stacklok / toolhive / 33605177354

70%

Build Type

push

github

Committed by web-flow

Commit Message

Honour a pinned cosign key on sync and upgrade (#6478)

* Classify a key-signed stored bundle

Back-filling provenance from a stored bundle assumed the bundle carried a
certificate. A key-signed one does not: the trust anchor lives outside the
artifact, which is the whole shape of the key-pair flow. Handed one, the
keyless verification underneath failed on the absent certificate and reported
a broken signature — for a bundle that is perfectly intact and verifies fine
against its key.

Report it as ErrKeySigned instead, decided from the bundle's own shape rather
than from a failed attempt to read an identity out of it. Callers that need to
treat "there is nothing here to observe" differently from "this signature is
damaged" can now tell the two apart, which the next change needs to explain
itself to the user.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Samuele Verzi <samu@stacklok.com>

* Verify key-pinned entries on sync and adopt

Sync re-verified every stored bundle through the keyless path, which refuses a
key-pinned entry outright. Sync reads that refusal as drift it can heal by
reinstalling, so a key-pinned skill reported as modified on every run and never
settled, and `--check` failed permanently on a project that was in fact intact.
The trust anchor was recorded correctly and simply never consulted.

Re-verify against the pinned key instead, reconstructing the signed payload
from the lock's reference rather than the install record's: the lock is the
authority on what the project is pinned to, and the install record is the thing
being checked against it. A missing bundle now names the key as the anchor it
could not satisfy — the keyless wording named an empty signer identity, since
a key entry records none.

Adoption refuses a key-signed install rather than attempting it. Adoption
back-fills trust from what the bundle reveals, and a key-pair bundle reveals no
identity and does not carry the key, so there is... (continued)

Coverage Stats

63 of 65 new or added lines in 3 files covered. (96.92%)

4 existing lines in 1 file now uncovered.

76788 of 110043 relevant lines covered (69.78%)

92.05 hits per line