Repository navigation
fix(release): verify current runtime manifest - #539
Conversation
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9c0d78b0a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| or runtime_manifest.get("runtime_uid") == "0" | ||
| or not isinstance(runtime_manifest.get("runtime_gid"), str) | ||
| or not runtime_manifest["runtime_gid"].isdigit() | ||
| or runtime_manifest.get("runtime_gid") == "0" |
There was a problem hiding this comment.
A v2 candidate manifest with runtime_uid: "00" (and likewise runtime_gid) satisfies isdigit() and is not string-equal to "0", even though Registryctl's canonical_runtime_binding_from_manifest parses it as numeric root and rejects it. This allows the independent release-form verifier to certify a non-canonical root identity if the candidate binary regresses; parse the IDs as bounded integers and require their canonical nonzero decimal representation.
AGENTS.md reference: AGENTS.md:L79-L81
Useful? React with 👍 / 👎.
| or not isinstance(runtime_manifest.get("runtime_files"), dict) | ||
| or not runtime_manifest["runtime_files"] |
There was a problem hiding this comment.
A manifest such as {"runtime_files":{"compose.yaml":"garbage"}} passes these predicates; the updated test fixture itself contains only that one entry, while Registryctl's validate_runtime_file_closure requires every topology-specific file, safe relative paths, exact digest bindings, and equality with the runtime tree. If the candidate binary regresses, this external release verifier can therefore certify a v2 closure without independently binding generated secrets and configuration files.
AGENTS.md reference: AGENTS.md:L79-L81
Useful? React with 👍 / 👎.
| raise ReleaseFormError("canonical runtime manifest fields are not closed") | ||
| if ( | ||
| runtime_manifest.get("schema_version") != "registryctl.local_runtime.v1" | ||
| runtime_manifest.get("schema_version") != "registryctl.local_runtime.v2" |
There was a problem hiding this comment.
The reviewed commit message has no Signed-off-by trailer, so it violates the repository requirement that every commit carry a DCO sign-off; recreate the commit with git commit -s before merging.
AGENTS.md reference: AGENTS.md:L70-L70
Useful? React with 👍 / 👎.
| or not isinstance(runtime_manifest.get("match_principal"), str) | ||
| or not runtime_manifest["match_principal"] |
There was a problem hiding this comment.
This accepts any non-empty string, so a candidate can emit match_principal: "other" while the maintained spreadsheet starter and successful authenticated request still use pw_001; the updated test fixture even uses the unrelated value district-7. Because this external check is the release proof, it would miss a candidate regression that detaches the manifest's authentication identity from the authored runtime, so require the exact starter principal rather than mere non-emptiness.
AGENTS.md reference: AGENTS.md:L79-L81
Useful? React with 👍 / 👎.
Summary
Why
Candidate run 30370628359 passed all three builds, advisory scans, payload assembly, and the Registryctl
init,doctor,start, andsmokecommands. The external evidence script then rejected Registryctl's current v2 runtime manifest because it still expected v1.Verification
python3 release/scripts/test_first_country_release_form.py(39 passed)python3 release/scripts/test_registry_release.py(92 passed)python3 release/scripts/check-gates-inventory.py(168 gates)python3 -m py_compile release/scripts/first-country-release-form.py release/scripts/test_first_country_release_form.pygit diff --check