stacklok / toolhive / 30271716798

70%

Build Type

push

github

Committed by web-flow

Commit Message

Add provenance and unsigned fields to the skills lock schema (#6015)

First PR of the Sigstore stack (RFC THV-0080 Stack 2, tracked in
#5899): the lock file gains a typed provenance block recording the
verified signer identity — the trust-on-first-use anchor later
installs, syncs, and upgrades are checked against — and an unsigned
flag recording an explicit --allow-unsigned trust decision. The two
are mutually exclusive and validated with the same syntactic
constraints as resolvedReference (graphic characters, bounded
length), since the lock file is hand-editable and these values feed
the identity policy future verifications enforce.

The fields graduate from the Extra inline round-trip map into typed
schema under version 1, exactly the path the forward-compat design
reserved for them; that test's fixture moves to a still-unknown
field. InstallOptions gains the AllowUnsigned option and the internal
ProvenanceInfo/SigstoreBundle carriers the verification step (a later
PR) will populate. No behavior changes yet — nothing produces or
consumes these fields until the verifier lands.

Coverage Stats

33 of 35 new or added lines in 1 file covered. (94.29%)

9 existing lines in 3 files now uncovered.

80302 of 115374 relevant lines covered (69.6%)

84.14 hits per line