stacklok / toolhive / 34329896203

71%

Build Type

push

github

Committed by web-flow

Commit Message

Honour a pinned cosign key on plugin sync and upgrade (#6525)

* Honour a pinned cosign key on plugin sync/upgrade

Signed-off-by: Samuele Verzi <samu@stacklok.com>

* Split unsigned from keyless in keyed upgrades

A key-pinned entry whose candidate lost its signature was reported as a
signer change, whose remedy is --allow-signer-change. That override
bypasses the guard but not verification, and upgrade has no
unsigned-consent flag to pair with it, so the install failed
unsigned-rejected one step later. Report the rejection directly and name
the route that works.

A candidate that moved to keyless signing is still a signer change, but
it now carries the identity it moved to: the CLI infers "unsigned" from
an absent NewSignerIdentity, so an unnamed one was rendered as the one
thing it is not.

Signed-off-by: Samuele Verzi <samu@stacklok.com>

* Probe keyless before failing a keyed candidate

VerifyOCIWithKey reports ErrKeylessSigned only when every attached bundle
is keyless, so an artifact mid-migration — a valid keyless bundle beside a
stale key-pair one — arrived as ErrSignatureInvalid and was sent to
uninstall-and-reinstall. It is the supported key-to-keyless transition, so
verify the candidate keylessly before naming a diagnosis.

Restrict the signature-invalid verdict to ErrSignatureInvalid. Registry,
transport, and context failures say nothing about a signature, and advising
an uninstall over a network blip is destructive.

Narrow --allow-signer-change per entry. It is project-wide, so needing it
for one plugin dropped the pin on every key-pinned plugin beside it, and
resolveKeyAnchor then sent a still-key-signed candidate through keyless
verification, which fails ErrKeySigned. An entry whose candidate still
verifies against its pin keeps it.

Signed-off-by: Samuele Verzi <samu@stacklok.com>

* Refuse to drop a key pin on an unproven mismatch

A failed keyed verification was treated as evidence the candidate had moved
off its pinned key. Under ... (continued)

Coverage Stats

122 of 126 new or added lines in 2 files covered. (96.83%)

9 existing lines in 4 files now uncovered.

79908 of 113541 relevant lines covered (70.38%)

93.03 hits per line