fix(installer): transitional artifact identity allowlist for org migration - #13
Draft
tnunamak wants to merge 1 commit into
Draft
fix(installer): transitional artifact identity allowlist for org migration#13tnunamak wants to merge 1 commit into
tnunamak wants to merge 1 commit into
Conversation
…ation The connectors-latest index is now signed by this repository's publish-connector-release-index.yml workflow, but the artifacts it references still carry Sigstore bundles from the pre-migration vana-com/data-connectors workflow. Verifying both against the single hardcoded identity deterministically fails for every consumer. - index verification stays strict: PDP-Connect identity only - artifact verification tries TRANSITIONAL_ARTIFACT_CERTIFICATE_IDENTITIES in order (PDP-Connect, then the historic vana-com identity) and fails only after all attempts, reporting every attempted identity - tests: vana-com fallback success, all-identity failure message, strict index verification Retirement: once every referenced artifact is re-published with PDP-Connect bundles, shrink the allowlist back to one entry. Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Schema Health Check — All ClearAll 50 scopes have consistent local schema files. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every consumer of the pinned installer currently fails verification deterministically: the
connectors-latestindex is signed by this repo's workflow (post-migration), but the artifacts it references still carry vana-com-signed Sigstore bundles (artifactUrls still point at vana-com releases). One hardcoded identity can't verify both.Change
TRANSITIONAL_ARTIFACT_CERTIFICATE_IDENTITIESallowlist — PDP-Connect first, historic vana-com fallback; failure only after all attempts, error lists every attempted identityVerified
Unit tests (fallback success / all-fail reporting / strict index) plus a live check against the published release: index verified PDP, vana-signed
github-playwright@1.2.0verified via fallback and unpacked. All repo check scripts pass.Retirement condition
Re-publish every referenced artifact from this repo's workflow; when the index references no vana-com-signed artifact, shrink the allowlist to one entry.
Context: unblocks vana-com/context-gateway#238 (
connectors:checkcannot pass with any consumer-side configuration today).