stacklok / toolhive / 33420391085

70%

Build Type

push

github

Committed by web-flow

Commit Message

Record a pinned cosign key in the lock schema (#6444)

* Record a pinned cosign key in the lock schema

Verifying a key-signed artifact needs a trust anchor, and a lock entry
could previously express only a keyless certificate identity. Entries
may now pin a cosign public key instead.

The full key is stored rather than a digest of it, because the key is
recoverable from neither the artifact nor the stored bundle: cosign's
signature manifest defines no annotation carrying it, so a digest would
have nothing to hash at verification time. It is held as base64 DER
SPKI because a lock value may not contain whitespace, which rules out
PEM armor.

The two anchors are mutually exclusive. They are checked by different
policies against different trust roots, so an entry carrying both would
not say which applies, and one carrying neither pins nothing.
Certificate-derived fields are refused on a key-pinned entry as well:
read from a certificate a key-pair signature does not have, they would
pin constraints no verification could check.

That exclusivity is also why no schema version bump is needed. A build
predating this field sees an entry with no signer identity, reports it
as required, and fails the lock file closed rather than treating the
entry as unpinned. Bumping instead would be actively harmful, since the
version check is an equality comparison and would reject every existing
lock file.

Nothing writes a key-pinned entry yet. Until the install path lands,
handing one to a keyless verification path is refused up front: its
certificate fields are empty by construction, which Sigstore rejects
for want of subject alternative name criteria — closed already, but
with a message that names neither the entry nor the mismatch.

Skill info and install output render a key-pinned entry distinctly,
since an empty signer identity would otherwise read as an untracked
install.

Refs #6442

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Signed-off-by: ... (continued)

Coverage Stats

74 of 77 new or added lines in 8 files covered. (96.1%)

12 existing lines in 5 files now uncovered.

76505 of 109704 relevant lines covered (69.74%)

92.0 hits per line