stacklok / toolhive / 31693123182

70%

Build Type

push

github

Committed by web-flow

Commit Message

Sign pushes by default and remove the lock feature gate (#6139)

* Sign pushes by default and remove the lock feature gate

The final RFC THV-0080 piece: thv skill push signs the pushed artifact
with the provided cosign key (attaching the signature manifest next to
it, so installs can verify), and pushing unsigned requires an explicit
--no-sign — a failed signing fails the push rather than silently
publishing unsigned.

With signing on publish and verification on consume both in place, the
TOOLHIVE_SKILLS_LOCK_ENABLED gate comes out: the lock file, sync,
upgrade, dependency materialization, and signature verification are
now standard behavior for project-scoped skills. The architecture
document's trust-model section graduates from the drift-detection
honesty note to the verified model — TOFU semantics, the explicit
allow_unsigned / allow_signer_change escape hatches, the provisional
git marker, and what deliberately remains trusted on faith.

Closes #5899.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Push E2E artifacts with an explicit no-sign

Signed-by-default pushes turned every E2E push into a 400: the suite
has no signing infrastructure, so its pushes carry the explicit
no_sign decision — matching the allow_unsigned exceptions its
project-scoped installs already record.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Accept the key format cosign generate-key-pair writes

thv skill push --key could not read any key produced by the cosign CLI.
It failed with an opaque ASN.1 error, and no test caught it: the fixtures
built keys with cryptoutils, which writes PKCS#8 standard encryption
under the same "ENCRYPTED SIGSTORE PRIVATE KEY" label that cosign uses
for a payload sealed with scrypt and nacl/secretbox. Same label,
different bytes.

Decrypt the cosign sealing when the label says so, falling back to the
PKCS#8 form, and report a wrong password as such rather than as a parse
failure.

Also document where COSIGN_PASSWORD is ... (continued)

Coverage Stats

135 of 166 new or added lines in 13 files covered. (81.33%)

26 existing lines in 7 files now uncovered.

84578 of 120376 relevant lines covered (70.26%)

99.11 hits per line