fix(release-ci): install cryptography before the pre-tag gate - #156
Merged
Conversation
The v5.0.0 release run failed: build-and-attest runs `pre_tag_audit_gate --strict` BEFORE any pip install, so verify_receipt (ed25519) raised `ModuleNotFoundError: No module named 'cryptography'` and fail-closed rejected the (valid) signed receipt — publish-pypi/publish-release were skipped, nothing shipped. The makellose-500 F6 signed-receipt change made the gate need cryptography at this step, but release.yml never installed it. Adds `pip install cryptography>=42` (the pyproject floor) before the gate. This changes `.github/` and therefore `subject_tree_digest`, so the v5.0.0 pre-tag receipt is re-signed over the new tree via a fresh keyless handshake. Owner-GO Phase C (release-CI fix).
b7n0de
added a commit
that referenced
this pull request
Aug 27, 2026
…0260827 Release v5.0.0 — re-signed pre-tag receipt (rebind after CI fix #156)
b7n0de
pushed a commit
that referenced
this pull request
Aug 27, 2026
The first release run (33074248363) failed at build-and-attest: the pre-tag gate ran before `cryptography` was installed (ModuleNotFoundError, fail-closed). PR #156 fixed that (install cryptography before the gate), which changed `.github/` and thus the subject_tree_digest (bb1fbba3 -> 4212087). The old receipt no longer binds this tree. This REPLACES the receipt with one re-signed (Mac, ed25519 private half — never leaves the Mac) over the new tree: subject_tree_digest 4212087273dc..., gate_source_digest fa6a019b6dee..., audit_exit_code 0, verdict WITHSTANDS_DEEPGATE, signer iJipntJA8N//... (pinned in pre_tag_trusted_pubkeys.txt). pre_tag_audit_gate.py --version 5.0.0 --strict is green locally (1 verified receipt, 0 rejected). Nothing shipped under the old tag; the tag will be re-created at the merged head of this fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v5.0.0 release run failed at build-and-attest: the pre-tag gate ran before any pip install, so verify_receipt (ed25519) hit ModuleNotFoundError and fail-closed rejected the valid receipt. Adds pip install cryptography>=42 before the gate. Nothing shipped. Re-sign follows (subject changes). Owner-GO.