fix: preflight signed evidence inputs for release 0.9.4 - #147
Merged
Merged
Conversation
Signed-off-by: rldyourmnd <danil@nddev.it.com>
Signed-off-by: rldyourmnd <danil@nddev.it.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A release could spend the full validation budget before rejecting an independently pinned harness policy, and a plain hexadecimal SHA-256 value produced an opaque failure because the workflow expected
sha256:. Validate the encoded input and policy pin before the expensive gates, accept either exact SHA-256 notation, and give explicit diagnostics for missing or mismatched pins. Native archive-reader refusals are now printed in the job log.The independent pin remains mandatory; no supplied policy can authorize its own hash. Signature, freshness, build, attestation and publication checks remain unchanged. The full gate reuses the race suite already executed by Go-core instead of executing it a second time; the independent integrated-assurance scenario still runs. Advance the development version to 0.9.4 after the recorded failed 0.9.3 release.
Validation: 77 Python tests passed, including 11 cases executing the actual workflow step against the native bounded archive reader; context, projection and release-builder Go tests passed; regenerated fixtures, shellcheck and actionlint passed. Full release gates will run on the exact tagged source before publication.