Skip to content

fix(release): verify current runtime manifest #539

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jeremi merged 1 commit into from
Jul 28, 2026
Merged

fix(release): verify current runtime manifest #539

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion release/scripts/first-country-release-form.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -670,18 +670,32 @@ def read_runtime_inspection(
"workbook_classification",
"workbook_project_file",
"workbook_runtime_path",
"match_principal",
"runtime_uid",
"runtime_gid",
"runtime_files",
"topology",
}
if expected_notary_image is not None:
expected_keys.add("notary")
if not isinstance(runtime_manifest, dict) or set(runtime_manifest) != expected_keys:
raise ReleaseFormError("canonical runtime manifest fields are not closed")
if (
runtime_manifest.get("schema_version") != "registryctl.local_runtime.v1"
runtime_manifest.get("schema_version") != "registryctl.local_runtime.v2"

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add the required DCO sign-off

The reviewed commit message has no Signed-off-by trailer, so it violates the repository requirement that every commit carry a DCO sign-off; recreate the commit with git commit -s before merging.

AGENTS.md reference: AGENTS.md:L70-L70

Useful? React with 👍 / 👎.

or runtime_manifest.get("environment") != "local"
or runtime_manifest.get("relay_image") != expected_relay_image
or runtime_manifest.get("workbook_classification")
!= "operator_owned_source_data"
or not isinstance(runtime_manifest.get("match_principal"), str)
or not runtime_manifest["match_principal"]
Comment on lines +689 to +690

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Bind the manifest principal to the maintained starter

This accepts any non-empty string, so a candidate can emit match_principal: "other" while the maintained spreadsheet starter and successful authenticated request still use pw_001; the updated test fixture even uses the unrelated value district-7. Because this external check is the release proof, it would miss a candidate regression that detaches the manifest's authentication identity from the authored runtime, so require the exact starter principal rather than mere non-emptiness.

AGENTS.md reference: AGENTS.md:L79-L81

Useful? React with 👍 / 👎.

or not isinstance(runtime_manifest.get("runtime_uid"), str)
or not runtime_manifest["runtime_uid"].isdigit()
or runtime_manifest.get("runtime_uid") == "0"
or not isinstance(runtime_manifest.get("runtime_gid"), str)
or not runtime_manifest["runtime_gid"].isdigit()
or runtime_manifest.get("runtime_gid") == "0"
Comment on lines +693 to +696

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Reject every numeric representation of the root identity

A v2 candidate manifest with runtime_uid: "00" (and likewise runtime_gid) satisfies isdigit() and is not string-equal to "0", even though Registryctl's canonical_runtime_binding_from_manifest parses it as numeric root and rejects it. This allows the independent release-form verifier to certify a non-canonical root identity if the candidate binary regresses; parse the IDs as bounded integers and require their canonical nonzero decimal representation.

AGENTS.md reference: AGENTS.md:L79-L81

Useful? React with 👍 / 👎.

or not isinstance(runtime_manifest.get("runtime_files"), dict)
or not runtime_manifest["runtime_files"]
Comment on lines +697 to +698

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Validate the complete runtime-files closure

A manifest such as {"runtime_files":{"compose.yaml":"garbage"}} passes these predicates; the updated test fixture itself contains only that one entry, while Registryctl's validate_runtime_file_closure requires every topology-specific file, safe relative paths, exact digest bindings, and equality with the runtime tree. If the candidate binary regresses, this external release verifier can therefore certify a v2 closure without independently binding generated secrets and configuration files.

AGENTS.md reference: AGENTS.md:L79-L81

Useful? React with 👍 / 👎.

or runtime_manifest.get("topology") != expected_topology
):
raise ReleaseFormError(
Expand Down
10 changes: 9 additions & 1 deletion release/scripts/test_first_country_release_form.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,7 @@ def write_combined_runtime(self) -> Path:
path.parent.mkdir(parents=True, exist_ok=True)
path.write_text(contents, encoding="utf-8")
manifest = {
"schema_version": "registryctl.local_runtime.v1",
"schema_version": "registryctl.local_runtime.v2",
"environment": "local",
"relay_image": self.relay,
"compose_digest": self.module.digest_uri(
Expand All @@ -210,6 +210,14 @@ def write_combined_runtime(self) -> Path:
"workbook_classification": "operator_owned_source_data",
"workbook_project_file": "data/public_works_projects.xlsx",
"workbook_runtime_path": "/data/public_works_projects.xlsx",
"match_principal": "district-7",
"runtime_uid": "1000",
"runtime_gid": "1000",
"runtime_files": {
"compose.yaml": self.module.digest_uri(
self.root / ".registry-stack/runtime/local/compose.yaml"
)
},
"topology": "combined_notary",
"notary": {
"notary_image": self.notary,
Expand Down
Loading