rajames/LithosAnanke
1
1
Fork 0
Code Issues 76 Pull Requests 1 Actions Packages Projects 1 Releases 6 Activity

ci: the gate into master refuses an unsigned build (#174)

Browse Source 
Captain Bob, 2026-11-12: "Yes, reject unsigned builds". acceptance.yml's
"The capsule-signing key" step warned when CAPSULE_SIGN_KEY was missing and
the PR's acceptance went on, unsigned. Now it is an ::error:: and the step
fails, so the gate does too. A local or protocol build may still be unsigned
(kernel/Makefile, v4/Makefile): the refusal is the gate's. build.yml,
nightly.yml and release.yml still warn -- release.yml is Captain Bob's to rule.

scripts/test_acceptance_signing.sh takes the step from acceptance.yml as CI
runs it and runs it with and without a key. Against the workflow as it was:
the unsigned case passed, no error -- 2 failures. Now: no key fails with an
::error::, a key is handed to the build as SIGN_KEY. logs/20261112-185739/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RzZgrf7V7Zk2iczBXDRbm
This commit is contained in:
Claude
2026-11-12 18:57:39 +00:00
parent 947d044872
commit b0038376a7
3 changed files with 45 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/test_acceptance_signing.sh
Executable
+38
View File
@@ -0,0 +1,38 @@
#!/usr/bin/env bash
# SPDX-License-Identifier: LicenseRef-Starship-1.0
# Copyright (c) 2023-2026 Robert A. James
# test_acceptance_signing.sh -- #174: the PR gate into master refuses an unsigned build. The step
# ".gitea/workflows/acceptance.yml: The capsule-signing key" is taken from the workflow as CI runs
# it, and run here with and without CAPSULE_SIGN_KEY.
#
# Prints PASS:/FAIL: per check and RESULT:; exits 0 only if every check passes.
set -uo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
T=$(mktemp -d)
trap 'rm -rf "$T"' EXIT
ok=1
python3 - "$ROOT/.gitea/workflows/acceptance.yml" "$T/step.sh" <<'EOF' || { echo "FAIL: no 'The capsule-signing key' step in acceptance.yml"; exit 1; }
import sys, yaml
steps = yaml.safe_load(open(sys.argv[1]))["jobs"]["acceptance"]["steps"]
run = [s["run"] for s in steps if s.get("name") == "The capsule-signing key"]
assert len(run) == 1
open(sys.argv[2], "w").write(run[0])
EOF
run_step() { # run_step <key or empty>: the step's exit status; GITHUB_ENV and RUNNER_TEMP in $T
: > "$T/env"
KEY="$1" GITHUB_ENV="$T/env" RUNNER_TEMP="$T" bash -e "$T/step.sh" > "$T/out" 2>&1
}
if run_step ""; then echo "FAIL: #174 no CAPSULE_SIGN_KEY: the step passed -- an unsigned build would be accepted"; ok=0
else echo "PASS: #174 no CAPSULE_SIGN_KEY: the step fails, the gate refuses the unsigned build"; fi
grep -q "::error::" "$T/out" && echo "PASS: #174 and says so as an error" || { echo "FAIL: #174 no ::error:: line"; ok=0; }
if run_step "-----BEGIN PRIVATE KEY----- test -----END PRIVATE KEY-----" && grep -q "^SIGN_KEY=$T/capsule-signing.key$" "$T/env" &&
[ -s "$T/capsule-signing.key" ]; then
echo "PASS: with a key: the step passes and hands it to the build (SIGN_KEY)"
else echo "FAIL: with a key: the step did not pass, or did not set SIGN_KEY"; ok=0; fi
echo "RESULT: $([ $ok = 1 ] && echo PASS || echo FAIL)"
[ $ok = 1 ]