From b6a8f76306fe6814fde623176912692a4d5a4ba0 Mon Sep 17 00:00:00 2001 From: haim Date: Tue, 6 Oct 2026 13:12:23 +0300 Subject: [PATCH 1/2] [DOCS] partner guide: pass grant_write_access to verify/ while the write window is open --- PARTNER_GUIDE.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/PARTNER_GUIDE.md b/PARTNER_GUIDE.md index 5addb31..211847c 100644 --- a/PARTNER_GUIDE.md +++ b/PARTNER_GUIDE.md @@ -514,8 +514,9 @@ the output. Use this section when a release arrives between [step 8](#8-grant-write-access) and [step 11](#11-revoke-write-access). Your write access is granted, and the ceremony has not run yet. The steps are the same as in [Apply a later release](#apply-a-later-release), with -one difference: `plan` and `apply` keep `-var grant_write_access=true`. Without it, the -apply removes your two write bindings, and the keygen cannot write your share. +one difference: `plan`, `apply` and `verify/` keep `-var grant_write_access=true`. +Without it, the apply removes your two write bindings, and the keygen cannot write your +share. ```bash # Your GCP project ID, the same one you used in onboarding. Not the project number. @@ -539,9 +540,14 @@ terraform apply -var-file=../values.tfvars -var partner_project_id=$PROJECT \ terraform -chdir=verify init -backend=false -input=false terraform -chdir=verify plan -input=false \ - -var-file=../../values.tfvars -var partner_project_id=$PROJECT + -var-file=../../values.tfvars -var partner_project_id=$PROJECT \ + -var grant_write_access=true ``` +`verify/` takes the flag too. It checks that your write bindings match the flag, so +without it, it reports `CHECK FAILED: the share ... is still writable` for a window that +is correctly open. + **What to expect.** The per-pin table in [Apply a later release](#apply-a-later-release) applies, with the keygen row for an open window. When all three images change: From ca53c72d4e15b39636f65724df9b561111d99e0c Mon Sep 17 00:00:00 2001 From: haim Date: Tue, 6 Oct 2026 13:21:43 +0300 Subject: [PATCH 2/2] [DOCS] partner guide: drop the redundant verify/ note --- PARTNER_GUIDE.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/PARTNER_GUIDE.md b/PARTNER_GUIDE.md index 211847c..3816a43 100644 --- a/PARTNER_GUIDE.md +++ b/PARTNER_GUIDE.md @@ -544,10 +544,6 @@ terraform -chdir=verify plan -input=false \ -var grant_write_access=true ``` -`verify/` takes the flag too. It checks that your write bindings match the flag, so -without it, it reports `CHECK FAILED: the share ... is still writable` for a window that -is correctly open. - **What to expect.** The per-pin table in [Apply a later release](#apply-a-later-release) applies, with the keygen row for an open window. When all three images change: