Release v5.0.0 — re-signed pre-tag receipt (rebind after CI fix #156) - #157
Merged
Conversation
The first release run (33074248363) failed at build-and-attest: the pre-tag gate ran before `cryptography` was installed (ModuleNotFoundError, fail-closed). PR #156 fixed that (install cryptography before the gate), which changed `.github/` and thus the subject_tree_digest (bb1fbba3 -> 4212087). The old receipt no longer binds this tree. This REPLACES the receipt with one re-signed (Mac, ed25519 private half — never leaves the Mac) over the new tree: subject_tree_digest 4212087273dc..., gate_source_digest fa6a019b6dee..., audit_exit_code 0, verdict WITHSTANDS_DEEPGATE, signer iJipntJA8N//... (pinned in pre_tag_trusted_pubkeys.txt). pre_tag_audit_gate.py --version 5.0.0 --strict is green locally (1 verified receipt, 0 rejected). Nothing shipped under the old tag; the tag will be re-created at the merged head of this fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first release run (33074248363) failed at build-and-attest:
pre_tag_audit_gate --strictran beforecryptographywas installed (ModuleNotFoundError, fail-closed). PR #156 fixed that, which changed.github/and thussubject_tree_digest(bb1fbba3 → 4212087). The old receipt no longer binds this tree.This replaces the receipt with one re-signed (Mac, ed25519 private half — never leaves the Mac) over the new tree:
4212087273dc…, gate_source_digestfa6a019b6dee…, audit_exit_code 0, verdict WITHSTANDS_DEEPGATEiJipntJA8N//…(pinned inaudit_artifacts/pre_tag_trusted_pubkeys.txt)pre_tag_audit_gate.py --version 5.0.0 --strictgreen locally (1 verified, 0 rejected)Nothing shipped under the old tag (
gh release view v5.0.0= not found). After merge, tag v5.0.0 is re-created at this head so the fixed release.yml runs green.