stacklok / toolhive / 31801575950

70%

Build Type

push

github

Committed by web-flow

Commit Message

Enforce recorded ref and runner on skill verification (#6315)

* Enforce recorded ref and runner on skill verify

The certificate signing a skill artifact carries the git ref the signing
workflow ran on and the runner class it executed in, but both were
discarded: core's SAN policy deliberately matches any ref, so provenance
recorded for "this workflow in this repository" was satisfied by the same
workflow run from any branch, or on a self-hosted runner.

Read both Fulcio extensions off the verified certificate, record them in
the lock entry, and enforce the recorded values after the Sigstore policy
has passed — on the OCI, git, and stored-bundle paths alike. An empty
recorded value stays unconstrained, so entries written before the fields
existed, and certificates that carry no such extension, keep verifying.

Upgrade relaxes the ref alone and re-pins the observed one: a tag-based
release workflow signs every version on a new ref, and rejecting that
would demand --allow-signer-change on every routine upgrade, disabling
the guard entirely. Install and sync keep the exact match, and a runner
class change is blocked at every operation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Validate ref transitions on upgrade and fix multi-bundle diagnosis

Every upgrade cleared the pinned ref unconditionally before
re-verifying, so a candidate signed by the same identity, issuer, and
runner from a different branch passed and silently replaced the
locked ref — the exact substitution ref pinning exists to catch.
guardSignerChange now validates the transition itself: a recorded tag
ref may rotate to another tag (a release workflow signs each version
on its own tag), anything else must stay identical.

Separately, verifyKeylessBundles could lose a pinned-field mismatch
to a later bundle's plain policy failure by simple iteration order,
defeating classifyVerifyFailure's preference for the more specific
diagnosis. The per-bundle verification step is now ... (continued)

Coverage Stats

104 of 138 new or added lines in 6 files covered. (75.36%)

79 existing lines in 5 files now uncovered.

85162 of 121034 relevant lines covered (70.36%)

99.45 hits per line