stacklok / toolhive / 33373399293

70%

Build Type

push

github

Committed by web-flow

Commit Message

Report key-signed artifacts as such at install (#6443)

* Report key-signed artifacts as such at install

A cosign key-pair signature is a real signature referrer, so bundle
retrieval finds it and the unsigned verdict never fires. The keyless
policy then rejects every bundle for want of a Fulcio certificate, and
that failure was classified as an invalid signature — blaming the
signature for what is actually a missing trust anchor, and leaving no
remedy, since the unsigned exception only overrides the unsigned
verdict. The result was a hard 403 that no flag could resolve.

Key-signed artifacts now classify as their own condition, so install
names the key-pair layout, states that keyless signing is the remedy,
and says plainly that the unsigned exception does not apply. Sync and
upgrade get a matching failure reason, distinct from signature-invalid
because nothing is wrong with the signature.

The new sentinel deliberately does not wrap the invalid-signature one:
reporting a valid signature as a verification failure is the
misclassification being removed here, and the narrowing cannot fail
open, as no caller treats that sentinel as permission to proceed.

Mixed artifacts keep the keyless diagnosis — a bundle that does carry a
certificate genuinely failed the policy.

Also documents the gap on `thv skill push --key`, which advertised key
signing with no caveat while the equivalent plugin warning shipped
separately.

Refs #6442

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Signed-off-by: Samuele Verzi <samu@stacklok.com>

* Report key-signed catalog installs consistently

A first install resolved from a catalog entry that declares provenance
is classified by its own route, which reported every failure other than
unsigned as a mismatch against the catalog-declared provenance. For a
key-signed artifact that is wrong twice over: nothing was compared,
because the keyless policy cannot check a key-pair signature at all,
and the report ca... (continued)

Coverage Stats

30 of 34 new or added lines in 4 files covered. (88.24%)

6 existing lines in 3 files now uncovered.

76345 of 109583 relevant lines covered (69.67%)

91.69 hits per line