Repository navigation
fix(ci): verify served plugin checksums (D-1483) - #490
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Golden Path run 40261854806 fails installing licensed
ai:/registry.jsonadvertisesd2c8c734…, while/catalog.jsonadvertises03071f9d…, exactly the bytes CI downloaded.aiis not in this repository's free registry. The authenticated download returns 401 to public requests, so the licensed artifact and signature cannot be reconciled within this task. D-1483 remains BLOCKED on owner repair of licensed metadata; this PR adds the missing public free-download regression gate.The new verifier follows every installable free plugin's advertised download URL through the worker/CDN and hashes the served bytes. Registry sync verifies candidate checksums after refreshing versionless routes; a read-only dependent job checks live metadata even if sync fails. Offline fixtures cover mismatched/rebuilt bytes, conflicting checksum aliases, bad metadata, errors, tier exclusions and workflow ordering. Release checksum generation already reads published bytes, including assets uploaded to a draft release; corrected failure guidance removes the rebuild/upload workaround.
Investigation and validation:
git fetch origin main: branch starts at fresh99abe444.gh run view 40261854806 -R nself-org/cli --log-failed: step 9 confirms E124 and the two hashes above.https://plugins.nself.org/registry.json,/registry.json?nocache=1,/catalog.json,/plugins/aiand/plugins/ai/tarball; public GET ofhttps://ping.nself.org/plugins/ai/download: licensed metadata divergence confirmed; unauthenticated downloads refused (401).gh release view v1.2.10 -R nself-org/plugins --json assets --jq '[.assets[] | select(.name|startswith("ai-")) | .name]': no freeaiasset.PYTHONDONTWRITEBYTECODE=1 TMPDIR=/Volumes/D5/tmp/dw3-plugins-4.MF3XpV python3 -m unittest discover -s scripts/ci/tests -p 'test_verify_registry_downloads.py': PASS.PYTHONDONTWRITEBYTECODE=1 TMPDIR=/Volumes/D5/tmp/dw3-plugins-4.MF3XpV python3 -m unittest discover -s scripts/ci/tests -p 'test_registry_sync_triggers.py': PASS.PYTHONDONTWRITEBYTECODE=1 python3 scripts/ci/verify_registry_downloads.py: all 124 installable free downloads verified, errors=0; six explicitly noninstallable entries excluded (the separate audit checked all 130).actionlint .github/workflows/registry-sync.yml .github/workflows/tarball-checksum-gate.yml,jq empty registry.json,git diff --check: PASS.Owner action: reconcile private bundles
aimetadata/signature with its authenticated published bytes, then rungh workflow run registry-sync.yml -R nself-org/plugins --ref mainandgh run rerun 40261854806 -R nself-org/cli --failed. The investigation document records the complete hashes and evidence; no verified private-repository repair command is available from public evidence. No production write, credential access, release publishing, asset replacement, version bump, tag, merge, or repository setting change was performed.