From c1af655076ad41d3db8c167a9c7b647eaef5cb1e Mon Sep 17 00:00:00 2001
From: Kenny Root <kenny@the-b.org>
Date: Fri, 16 Oct 2026 08:54:35 -0700
Subject: [PATCH] Require explicit trusted signing workflow identities

---
 .github/android-signer/123235.json     | 22 ++++++++--------------
 .github/android-signer/1421097317.json | 20 +++++++-------------
 .github/android-signer/README.md       |  8 ++++++--
 3 files changed, 21 insertions(+), 29 deletions(-)

diff --git a/.github/android-signer/123235.json b/.github/android-signer/123235.json
index 8e6a26e..c69fd75 100644
--- a/.github/android-signer/123235.json
+++ b/.github/android-signer/123235.json
@@ -1,31 +1,25 @@
 {
   "builder": {
-    "authorization": "workflow-identity",
-    "helpers": {},
     "refs": [
       "refs/heads/android-signer-v1"
     ],
     "repository": "connectbot/actions",
     "repository_id": 1369420724,
-    "sha256": [],
     "workflow": ".github/workflows/android-attest.yml"
   },
-  "callers": {
-    ".github/workflows/ci-tags.yml": [],
-    ".github/workflows/ci.yml": []
-  },
+  "callers": [
+    ".github/workflows/ci.yml",
+    ".github/workflows/ci-tags.yml"
+  ],
   "finalizer": {
-    "authorization": "workflow-identity",
-    "helpers": {},
     "refs": [
       "refs/heads/android-signer-v1"
     ],
     "repository": "connectbot/actions",
     "repository_id": 1369420724,
-    "sha256": [],
     "workflow": ".github/workflows/android-finalize.yml"
   },
-  "policy_hash": "52e5ee52950f2375caf6a6a958d09ca7b55d7cd90ca213aaffad15ee5c4a91ca",
+  "policy_hash": "2ed307fbe384c8755de7a2ef8da99ebf7984c70cdfbe36858702bb79bc12112d",
   "profiles": {
     "google": {
       "hybrid_min_sdk": null,
@@ -63,8 +57,8 @@
   ],
   "repository": "connectbot/connectbot",
   "repository_id": 123235,
-  "revision": 2,
-  "signer_revision": "39b8c5393a0e10285905f7ceb5aea73ffa54e870",
-  "version": 2,
+  "revision": 3,
+  "signer_revision": "fe6a2962b22e33deecb85cd0a738c1d6690fb7c1",
+  "version": 3,
   "visibility": "public"
 }
diff --git a/.github/android-signer/1421097317.json b/.github/android-signer/1421097317.json
index fb99f60..467122d 100644
--- a/.github/android-signer/1421097317.json
+++ b/.github/android-signer/1421097317.json
@@ -1,30 +1,24 @@
 {
   "builder": {
-    "authorization": "workflow-identity",
-    "helpers": {},
     "refs": [
       "refs/heads/android-signer-v1"
     ],
     "repository": "connectbot/actions",
     "repository_id": 1369420724,
-    "sha256": [],
     "workflow": ".github/workflows/android-attest.yml"
   },
-  "callers": {
-    ".github/workflows/ci.yml": []
-  },
+  "callers": [
+    ".github/workflows/ci.yml"
+  ],
   "finalizer": {
-    "authorization": "workflow-identity",
-    "helpers": {},
     "refs": [
       "refs/heads/android-signer-v1"
     ],
     "repository": "connectbot/actions",
     "repository_id": 1369420724,
-    "sha256": [],
     "workflow": ".github/workflows/android-finalize.yml"
   },
-  "policy_hash": "9fcc72e148625f3d26b299a5528b9d278382b7f18942ad81dc099852146bb968",
+  "policy_hash": "2ee9ce55c10ed8f971413592fc8b4c7f95be5f1ad0dfea3e8d4aa3ff05b5b36f",
   "profiles": {
     "google": {
       "hybrid_min_sdk": null,
@@ -61,8 +55,8 @@
   ],
   "repository": "connectbot/test-signer-1",
   "repository_id": 1421097317,
-  "revision": 9,
-  "signer_revision": "39b8c5393a0e10285905f7ceb5aea73ffa54e870",
-  "version": 2,
+  "revision": 10,
+  "signer_revision": "fe6a2962b22e33deecb85cd0a738c1d6690fb7c1",
+  "version": 3,
   "visibility": "public"
 }
diff --git a/.github/android-signer/README.md b/.github/android-signer/README.md
index 84fea3a..3ab8845 100644
--- a/.github/android-signer/README.md
+++ b/.github/android-signer/README.md
@@ -13,8 +13,7 @@ cannot replace this policy through workflow inputs or source checkout contents.
 The attestor (`android-attest.yml`) and finalizer run from protected
 `android-signer-v1` in
 `connectbot/actions` (immutable ID 1369420724). Caller workflow paths identify
-eligible CI entry points; empty digest lists intentionally mean identity-based
-authorization. Exact executed workflow commits remain recorded in certificates,
+eligible CI entry points as a path allowlist. Exact executed workflow commits remain recorded in certificates,
 receipts and provenance. Ordinary source/caller edits and reviewed builder branch
 updates do not require changes here or on the VM.
 
@@ -29,3 +28,8 @@ Application build instructions stay in each source repository. The shared
 attestor verifies a stable artifact handoff without executing application code.
 Changing Java, Gradle tasks, flavors, or output paths within that contract does
 not require an update to these policies.
+
+Only version 3 trusted-workflow policies are supported. Builder and finalizer
+identities are mandatory; authorization mode switches, caller-file digests, and
+workflow/helper content pins are not accepted. The native signer and shared
+helpers must be updated together with these policy exports.