Report key-signed artifacts as such at install - #6471
lorenzozanee wants to merge 1 commit into
Conversation
A skill or plugin pushed with --key produces a validly key-signed artifact, but install verification is keyless-only. The artifact was therefore refusing with a generic signature failure and --allow-unsigned could not override it because the error was ErrSignatureInvalid rather than ErrUnsigned. Classify the layout via Bundle.HasCertificate and surface ErrKeySigned with an actionable message stating that key-pair signatures cannot be verified at install time, that --allow-unsigned does not apply, and that the artifact should be re-published with keyless signing. Add the same handling for catalog-constrained and sync/upgrade paths and document the limitation on thv skill push --key. Closes #6442 Signed-off-by: lorenzozanee <wyz0707@proton.me>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #6471 +/- ##
=======================================
Coverage 78.02% 78.03%
=======================================
Files 767 767
Lines 74273 74298 +25
=======================================
+ Hits 57955 57975 +20
- Misses 16313 16318 +5
Partials 5 5 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Thanks for picking this up. The same change landed on Since then the scope of #6442 has moved on: the skills half is complete (#6444, #6447, #6478) and what remains is bringing the plugins surface to parity — install-time key verification, sync/upgrade re-verify against a pinned key, and then restoring Closing this as superseded. |
Summary
A skill or plugin pushed with
thv skill push --keyproduces a validly key-signed artifact, but install-time verification is keyless-only. The install previously failed with a generic signature error that--allow-unsignedcould not override. This change classifies the key-signed layout distinctly and reports an actionable refusal.Fixes #6442
Type of change
Test plan
task test)task test-e2e)task lint-fix)API Compatibility
v1beta1API, OR theapi-break-allowedlabel is applied and the migration guidance is described above.