Repository navigation
Authorize auditor-backed TUF trust for the ConnectBot signer - #18
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace the production signer's manually pinned public Sigstore snapshot, which expires October 22, with image-anchored TUF trust held in signer RAM and persisted by the existing auditor. This enables policy v4/revision 8 and receipt v3. Key fingerprints, signing profiles, and APK rotation settings are unchanged.
Review pins:
1c233c69966e9ecaa58e29fa515600f71ceb5a3b6fdc42e9597a0ed92c400059e7eec8964175d55346206c3947b6d88260efaf235ce2f734d9dcd6ce74768c2c6e2c74f4155f338f77abf84e72e67ad7eece963573747011d0857ada15479a16c4cae0f3ed03aac698b523b97e1de314ac9d9ca81f0cdea66527502e6d73f338da7ffcbf661bd1a8b09cc2710d841f33cf12b1195135c94e96df1512c023a62fc92563f5351a85636018cb5b7d4478e17d4abaa5(root 16, effective expiry October 27 07:33:11 UTC)ghcr.io/connectbot/test-signer-1-audit:tuf-20261020-1c233c6@sha256:8b9eccaa4925634a40c19b87af95cb75d0c7a7276baa53621adbdaaac172e2d6558c61d2711e5772d382c06dc8166a6da9557d75.Validation: Rust suite, 63 shared-action tests and required helper CI pass. The exact committed Hermit image passed a disposable diskless/read-only guest test: uninitialized trust fails readiness while health stays up; explicit auditor initialization restores readiness; complete metrics and authenticated webhook checks pass; collector outage refuses signing. Rust and Python independently verified the fresh root-15-to-16 checkpoint. The host export was checked against revision 7's existing policy hash before generating this policy.
The matching image/configuration are staged outside the live export. Activate them only after this policy passes the required code-owner review and is merged. The signer keeps no writable storage; signed metadata expiry remains absolute across restarts.