stacklok / toolhive / 30826608202

70%

Build Type

push

github

Committed by web-flow

Commit Message

Re-verify stored signatures offline during sync (#6131)

Sync now re-verifies each managed entry's stored Sigstore bundle
against the identity recorded in the lock file — entirely offline, via
the embedded trust root — before an entry can count as current
(RFC THV-0080). A failed re-verification is drift: check mode reports
it (the CI gate covers signatures like it covers content drift), and
apply mode reinstalls from the pinned reference, where install-time
verification enforces the locked identity and heals the stored state.
An OCI entry recording a signer identity without a stored bundle fails
closed; git entries store no bundle by design — their signatures are
re-verified when content is re-resolved.

Adoption back-fills provenance from the stored bundle when one exists;
otherwise adopting is the same trust decision as an unsigned install
and now requires the explicit --allow-unsigned exception (new flag on
sync, threaded through the API), recorded as unsigned in the entry.

Part of #5899.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Coverage Stats

53 of 64 new or added lines in 4 files covered. (82.81%)

2 existing lines in 1 file now uncovered.

82838 of 118469 relevant lines covered (69.92%)

98.0 hits per line