stacklok / toolhive / 32850699937

71%

Build Type

push

github

Committed by web-flow

Commit Message

Store plugin sigstore bundles, carry git signature (#6396)

Plugin install-time verification and offline re-verification in sync
--check need groundwork that has to land before the verifier does: OCI
installs must be able to persist the Sigstore bundle captured at install
time so sync can re-check it without contacting the registry, and git
installs must surface the resolved commit's gitsign signature and the
payload it covers so the verifier has something to check.

Adds migration 006 with an installed_plugins.sigstore_bundle BLOB column
(NULL for unsigned installs, so rows created by earlier schemas read back
as unsigned) and wires it through the SQLite plugin store and
InstalledPlugin. cloneAndCollectPlugin now returns the whole
git.HeadCommit instead of just the hash, so the signature and payload
travel with the commit they describe rather than being looked up again.

Nothing verifies yet — the values are carried, not consumed. Mirrors what
#6084 did for skills.

Part of #6300.

Signed-off-by: Samuele Verzi <samu@stacklok.com>

Coverage Stats

23 of 27 new or added lines in 2 files covered. (85.19%)

49 existing lines in 3 files now uncovered.

74814 of 107913 relevant lines covered (69.33%)

88.91 hits per line