stacklok / toolhive / 33764673379

70%

Build Type

push

github

Committed by web-flow

Commit Message

Sign plugin pushes and remove the lock feature gate (#6438)

* Sign plugin pushes and remove the lock gate

The last RFC THV-0080 piece for plugins: thv ai-plugin push signs the
pushed artifact through toolhive-core's signer — with a cosign key, or
keylessly via an OIDC identity token acquired the same way skill push
acquires one — and attaches the signature next to the artifact so
install-time verification finds it. Pushing unsigned now requires an
explicit --no-sign, and a failed signing fails the push rather than
silently publishing an artifact consumers must then install with
--allow-unsigned.

The signing fields are threaded through the plugins push DTO and the Go
HTTP client, which carried only a reference: without that, every flag
died at the transport boundary. The install response gains the recorded
provenance for the same reason — the CLI is a pure HTTP client, so a
dropped provenance block would print every signed install as untracked.
thv ai-plugin info and install now render the trust state the lock file
records, provisional marker included.

With signing on publish and verification on consume both in place, the
TOOLHIVE_PLUGINS_LOCK_ENABLED gate comes out: the lock file, sync,
upgrade, and signature verification are standard behavior for
project-scoped plugins.

E2E pushes carry an explicit no_sign — the suite has no signing
infrastructure, matching the allow_unsigned exceptions its installs
already record.

Part of #6300.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Signed-off-by: Samuele Verzi <samu@stacklok.com>

* Document the plugins trust model

The plugins architecture document described signature verification as "a
separate concern" — true when written, wrong now that TOFU recording,
offline sync re-verification, the signer-change guard, and signed-by-
default publishing have all landed. Add the trust-model section it was
missing: what is verified, what the escape hatches are, and what remains
trusted on f... (continued)

Coverage Stats

239 of 284 new or added lines in 21 files covered. (84.15%)

54 existing lines in 5 files now uncovered.

77637 of 111035 relevant lines covered (69.92%)

91.54 hits per line