Repository navigation
feat: add registry assembly, signing, and verification tools - #256
Merged
Merged
Conversation
Extract the TUF signing primitives from test support into a production tuf_authoring module (canonical JSON, Ed25519 key ids, signed role documents) and expose the canonical expanded-package fingerprint. Build a3s-use-registry-tools on top: keygen with offline custody seeds, deterministic package packing, admission-driven catalog-v3 record and planning-bundle derivation, four-role TUF tree assembly, and a verifier that reloads the tree through the same tough loader a released client uses. The first published tree this tooling produced is verified end to end: source add with a pinned root, search, inspect, reviewed plan/apply, capability snapshot, and uninstall all pass against the bootstrapped Use-Registry dev-preview.
ZhiXiao-Lin
pushed a commit
to A3S-Lab/Use-Registry
that referenced
this pull request
Sep 7, 2026
The placeholder failed closed until the tooling had a pushed revision; A3S-Lab/Use#256 head is the current reviewed source. Update the pin to the Use main commit when that PR merges.
Assembly now clears the metadata/ and targets/ directories it owns before writing, so a superseded version can never linger beside a catalog that no longer advertises it. Two integration tests cover the ongoing publication workflow: metadata versions 1..3 assemble and verify in place, and a 0.1.0 -> 0.2.0 republication removes the stale target directory while the new identity verifies. The full client path was exercised end to end against a loopback server: install at metadata v1, republication at v2 with a package version bump, client metadata refresh, reviewed upgrade apply to capability generation 2, and clean uninstall.
main has been failing the test job since the gateway lease series: tokio's OpenOptions has inherent custom_flags/mode methods, so the shadowed std::os::unix::fs::OpenOptionsExt imports in the capability plane stores were never used, and has_generation_lease is exercised only by tests, so the lib target reported it as dead code. Drop the redundant imports and gate the test-only accessor with #[cfg(test)]. cargo clippy --workspace --all-targets --all-features --locked -- -D warnings passes and the full workspace suite is green (1421 passed).
rustc 1.98 reports the file-level 'use rusqlite::OptionalExtension as _' as unused in this module while 1.97 does not, which fails the CI clippy gate on current stable. Call the adapter fully qualified instead so the lint cannot disagree between toolchain versions; the exact CI command now passes under both 1.97.1 and 1.98.1.
Keep symlink metadata reads Unix-only in registry packing so Windows builds stay warning-clean, and surface the actual Control effect dispatch result when capability-plane fixture setup mismatches. Co-authored-by: Cursor <cursoragent@cursor.com>
ZhiXiao-Lin
marked this pull request as ready for review
September 8, 2026 11:17
ZhiXiao-Lin
pushed a commit
that referenced
this pull request
Sep 8, 2026
Record crates/registry-tools on main (#256) without claiming A5 EXIT; production custody and official bootstrap remain open. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bootstraps the A5 official-Registry tooling by extracting the TUF signing primitives from test support into a production module and adding an operator-facing crate:
tuf_authoringmodule (a3s-use-extension): canonical JSON, Ed25519 key ids, signed role documents — the same bytes the client verifies, now shared by test support and tooling. The existing golden fixture test proves byte-level equivalence after the refactor.a3s-use-registry-tools(crates/registry-tools, new workspace member):keygen(four independent role seeds, 0600, refuse-overwrite),pack(deterministic tar.gz),assemble(admission ACL + package manifest → catalog-v3 record + planning bundle + signed four-role tree),verify(reloads the tree through the same tough loader a released client uses, validates every record, planning binding, and on-disk target digest).package_fingerprintpromoted to a public API so registry assembly uses the exact admission-time content identity.Testing
cargo test -p a3s-use-registry-tools: 6/6 (roundtrip, planning-target, tamper detection, identity mismatch, missing-ceiling, keygen overwrite refusal)cargo test -p a3s-use-extension --lib: 281 passed including the plugin-v3 golden fixture (byte-identical after refactor)End-to-end evidence
The first tree this tooling produced was verified with the real CLI against a loopback server:
registry source addwith the pinned root →plugin search(full TUF chain) →inspect→plan-install→apply-plan(capability generation 1, skill-host prepared) →capability snapshot(expanded content lands at the catalog-declaredpackage.sha256) →uninstall(zero residue). Consumer side lives in A3S-Lab/Use-Registrybootstrap/dev-preview.🤖 Generated with Claude Code