Repository navigation
Adopt Registry Stack v0.13.0 - #13
Conversation
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 59881a6b1f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| https://github.com/registrystack/registry-stack.git "$source_dir" | ||
| fi |
There was a problem hiding this comment.
On a clean checkout, every just up and just up-esignet now unconditionally reaches this clone and then compiles Registry Stack from source, so normal startup fails without GitHub access and requires a local registry-stack working tree plus a Rust build instead of consuming the digest-pinned image. Publish the feature-enabled Relay image by digest or move this source build behind an explicit development recipe so the documented normal path remains standalone.
AGENTS.md reference: AGENTS.md:L3-L5
Useful? React with 👍 / 👎.
| source_commit = versions.get("REGISTRY_STACK_SOURCE_COMMIT") | ||
| if not source_commit or not COMMIT_RE.fullmatch(source_commit): | ||
| failures.append( | ||
| "REGISTRY_STACK_SOURCE_COMMIT must be exactly 40 lowercase hex characters" |
There was a problem hiding this comment.
For local just review-release or just release-pins runs, this only checks that REGISTRY_STACK_SOURCE_COMMIT looks like a SHA; any arbitrary 40-character hash passes and the command reports that all release inputs match the tag. The release-candidate workflow has a separate checkout comparison, but these public recipes do not, so resolve the requested tag and compare its commit before declaring success.
Useful? React with 👍 / 👎.
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 572d772fce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Build and push feature-enabled Relay runtime | ||
| id: relay-runtime | ||
| uses: docker/build-push-action@v6 |
There was a problem hiding this comment.
In this workflow, the stack smoke and both E2E suites run at lines 95–102 before this build, and just up currently forces REGISTRY_RELAY_IMAGE="$SOLMARA_RELAY_RUNTIME_IMAGE", so those gates exercise the previously committed runtime digest. This step then builds a different Relay binary and uses its digest as the hosted Relay wrapper base without running any test against it; a Dockerfile, compiler, or feature-build regression can therefore produce publishable images despite every gate passing. Build and select this artifact before starting the stack, or rerun the live gates against its resulting digest.
Useful? React with 👍 / 👎.
| are the Registry Stack `v0.13.0` release assets. The published Relay image is | ||
| the immutable runtime base, while `just up` builds and caches a replacement | ||
| Relay binary from the pinned source with the explicitly declared | ||
| `attribute-release` feature. That opt-in is required by the NIA eSignet | ||
| profile because the release Relay intentionally excludes beta API features. |
There was a problem hiding this comment.
For normal startup, the current just up recipe selects the published SOLMARA_RELAY_RUNTIME_IMAGE, while source compilation occurs only in the *-dev recipes. This paragraph instead says just up builds and caches a replacement binary, and the following paragraph tells users that it prepares that source build, contradicting both the immediately preceding startup documentation and the actual standalone acquisition path. Update this section to describe pulling the digest-pinned runtime and reserve the build instructions for the development recipes.
AGENTS.md reference: AGENTS.md:L3-L5
Useful? React with 👍 / 👎.
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aaeee3f3db
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if claims.get("individual_id") != SUBJECT or claims.get("name") != "Elena Dela Cruz": | ||
| return "response claims did not match the synthetic eSignet subject" |
There was a problem hiding this comment.
When the Relay omits required eSignet attributes such as given_name, family_name, or birthdate, or adds an unintended field such as legacy_nid, this check still returns success because it validates only individual_id and name. The authored solmara-nia-userinfo profile requires five claims and eSignet requests six, so the new live gate can pass while hosted login is unusable or the response over-discloses source data; validate the expected claim set and required values rather than only these two entries.
Useful? React with 👍 / 👎.
| relay_runtime = versions.get("SOLMARA_RELAY_RUNTIME_IMAGE") | ||
| relay_runtime_match = PIN_RE.match(relay_runtime or "") | ||
| if ( | ||
| not relay_runtime_match | ||
| or relay_runtime_match.group("image") | ||
| != SOLMARA_RELAY_RUNTIME_REPOSITORY | ||
| ): |
There was a problem hiding this comment.
When SOLMARA_RELAY_RUNTIME_IMAGE points to any digest in the expected repository, review-release accepts it without inspecting the image labels that bind the runtime to REGISTRY_STACK_SOURCE_COMMIT, REGISTRY_RELAY_FEATURES, and the pinned base image. Since normal just up forcibly selects this runtime, a stale or incorrectly built digest can be declared consistent with the requested release even though the Registry Stack tag, source commit, and official image pins all validate; inspect the published runtime and compare its provenance labels before reporting success.
Useful? React with 👍 / 👎.
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f1fc780104
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| runtime base. The release-candidate workflow publishes that source-bound | ||
| runtime before the hosted wrapper. PostgreSQL health checks now probe the TCP |
There was a problem hiding this comment.
When release operators rely on this changelog, it incorrectly implies that every release-candidate run publishes a freshly source-built runtime before the hosted wrapper. In the checked .github/workflows/release-candidate.yml, the workflow only verifies the source checkout and then builds the wrapper with the already-pinned SOLMARA_RELAY_RUNTIME_IMAGE; the runtime is published separately, as the README and hosted deployment guide correctly state. This claim can therefore hide the separate runtime publication prerequisite during a Registry Stack upgrade.
Useful? React with 👍 / 👎.
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: abfda66651
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| unsigned_projection = copy.deepcopy(bundled) | ||
| unsigned_projection.pop("config_trust", None) | ||
| if unsigned_projection != source: | ||
| fail(f"{project} signed config differs from compiler output") |
There was a problem hiding this comment.
When a generated Relay artifact is removed, changed, or left stale while relay.yaml remains unchanged, this gate still passes because it compares only the YAML projection and never compares bundle/config/artifacts with runtime/registry-projects/hosted/<project>/relay/artifacts. Signature verification proves only that the stale or incomplete bundle was signed, so the release checks can accept a hosted wrapper whose contracts or private bindings differ from the compiler output; compare the complete artifact trees as part of this closure check.
AGENTS.md reference: AGENTS.md:L12-L13
Useful? React with 👍 / 👎.
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 87d8ead852
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| --bundle-dir "/etc/solmara/hosted-relay-bundles/$project/bundle" \ | ||
| --anchor-path "/etc/solmara/hosted-relay-bundles/$project/trust-anchor.json" \ | ||
| --state-path "/etc/solmara/hosted-relay-bundles/$project/antirollback-seed.json" \ | ||
| | jq -e '.result == "verified" and .bundle_sequence == 1' >/dev/null |
There was a problem hiding this comment.
When the documented bundle-rotation process regenerates the bundles with --sequence 2 or higher, this release-candidate gate rejects the valid, successfully verified bundle solely because it requires bundle_sequence == 1. Compare the reported sequence with the committed manifest for each project, or at least accept any positive verified sequence, so the workflow can publish routine configuration rotations.
Useful? React with 👍 / 👎.
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Summary
registryctlto the Registry Stack v0.13.0 release.registryctl check --explainreview output.v013state epoch for the v0.13 retained-result contract boundary.attribute-releaseRelay runtime bridge for Solmara's NIA/eSignet profile, including exact tag and commit verification, OCI capability labels, local caching, and release-candidate publication.Why
Registry Stack v0.13.0 improves the project authoring and reporting flow, but its published default Relay image intentionally excludes the beta
attribute-releaseCargo feature required by Solmara's NIA/eSignet configuration. Without an explicit bridge, the official image rejects the NIA configuration at startup.This change keeps Solmara on the exact v0.13.0 release source and official runtime base while preserving the required capability. The intended 1.0 end state is an official, narrowly named released Relay variant that Solmara can consume directly by immutable digest. That work is tracked in registry-stack#487.
Developer and operator impact
just upandjust up-esignetverify or build the feature-enabled Relay runtime before starting the stack.just registry-projects-reviewexposes the complete redacted acquisition and disclosure explanation for every local and hosted project.registryctl.project_command.v1build report bound to the requested environment, a real project-owned output directory, and a complete Relay/Notary configuration closure.Validation
just lintjust test: 40 scenario-runner, 175 portal, 72 home, and 106 script tests passedjust composejust review-release v0.13.0just registry-projects-check: all 12 local/hosted profiles and 240 fixture executions passedjust registry-projects-test: all 120 unique fixtures passedjust registry-projects-runtime-checkjust registry-projects-reviewjust upandjust smoke: six authorities and 18 scenarios passedgit diff --checkVerification gaps and follow-up