stacklok / toolhive / 32976581648

70%

Build Type

push

github

Committed by web-flow

Commit Message

Block plugin upgrades that change the signer identity (#6401)

Block plugin upgrades that change the signer

An upgrade re-resolves a mutable source, which is exactly when a
compromised or transferred publisher would slip a differently-signed
artifact into the pinned trust chain (RFC THV-0080). Upgrade planning
now probes the candidate's signer identity — chain-of-trust
verification only, no install — and blocks with a signer-change-blocked
status when it differs from the identity the lock file records, when a
pinned certificate field (repository ref or runner class) diverges, or
when the candidate is unsigned. Blocked plans carry no pinned
reference, exactly like ref changes: preview reports them,
fail-on-changes counts them as changes, and a plain upgrade exits with
the policy-rejection code pointing at --allow-signer-change.

The explicit override verifies the candidate chain-of-trust-only and
re-records the newly observed identity in the lock entry, so the
rotation is deliberate and diff-visible rather than silent. Entries
with no recorded provenance — including those marked unsigned — are
unaffected and skip the probe entirely.

Git candidates carry their commit signature material out of resolution
so the probe verifies the exact commit being planned without a second
clone. That material is bounded the same way verifyGitInstall bounds
it: the probe runs on every guarded upgrade, including the plan-only
modes that install nothing, so leaving it unbounded would let a hostile
repository spend our CPU without ever reaching an install.

Part of #6300.

Signed-off-by: Samuele Verzi <samu@stacklok.com>

Coverage Stats

74 of 86 new or added lines in 5 files covered. (86.05%)

3 existing lines in 1 file now uncovered.

75990 of 109259 relevant lines covered (69.55%)

91.26 hits per line