Repository navigation
fix(ci): bring verify-published-checksums tests to the publish-manifest contract (D-1105) - #488
Merged
Merged
Conversation
…st contract (D-1105) Signed runs now pass --published-sha256 with a manifest of every served tarball. Adds tests that --signatures without --published-sha256 is refused and that a tarball differing from the manifest stops the write.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
PR #473 (D-1105) made
scripts/verify-published-checksums.sh --signaturesrequire--published-sha256(the publish job's approved manifest).scripts/ci/tests/test_verify_published_checksums.pystill called it with--signaturesalone, so 13 tests failed and the Hygienetracked-binariesstep has been red on main since.Changes (tests only, script enforcement untouched)
verify()now builds apublished-sha256.txt(sha256sum lines of every served tarball) and passes--published-sha256on every signed run.published=Noneomits it and aPathsupplies a custom manifest.test_signatures_without_published_manifest_is_refused:--signatureswithout--published-sha256exits 1, names the flag, and leaves releases.json untouched.test_tarball_changed_since_the_manifest_stops_the_write: a platform or source tarball that differs from the manifest isUNAPPROVED, exits 1, and writes nothing.No script bug turned up, so the script is unchanged.
Verification
python3 -m unittest discover -s scripts/ci/tests: 88 tests OK (13 failures before).python3 scripts/ci/check-tracked-binaries.py: pass.bash scripts/release/verify-published-checksums-test.sh: all cases passed.--all): all pass.Not fixed here
The Hygiene
file-sizestep also fails on main, independent of this change:free/ci/internal/nodes/registry/registry.go(342 lines),free/github-runner/internal/trust.go(416) andscripts/verify-published-checksums.sh(347) exceed the 300-line limit. Fixing that means splitting source files, so it is out of scope for this PR. The Hygiene gate stays red until it is handled.