Add release signature evidence baseline#157
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (10)
✅ Files skipped from review due to trivial changes (2)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughWalkthroughAdds a release signature evidence JSON Schema, a CLI validator and unit tests, seeds a local evidence JSON, integrates signature evidence into manifest/checksum generation, updates release artifacts and docs, and wires checks into Makefile, local wrappers, and CI with a dedicated logging step. ChangesRelease Signature Evidence Infrastructure
Sequence DiagramsequenceDiagram
participant CI as CI workflow
participant Test as scripts/test_release_signatures.py
participant Check as scripts/check_release_signatures.py
participant Logs as ci-logs/
CI->>Test: run tests (capture stdout/stderr)
CI->>Check: run checker (capture stdout/stderr)
Test->>Logs: write release-signature-tests.log
Check->>Logs: write release-signature-check.log
CI-->>Logs: attach logs to job artifacts
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@coderabbitai review Follow-up pushed after the initial CI hygiene failure. Please review the latest head |
|
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
release-artifacts/latest/release-checksums.json (1)
5-25:⚠️ Potential issue | 🟠 Major | ⚡ Quick winInclude the new signature evidence artifacts in checksum coverage.
This regenerated checksum manifest still omits
release-artifacts/signatures/anvil-6529stream-v0.1.0-001-local.jsonandrelease-artifacts/schema/release-signature-evidence.schema.jsonfrom bothsource.covered_pathsand thefileslist. That leaves the committed evidence baseline outside the release checksum set, which contradicts the PR objective to include release signature evidence outputs in checksum generation.Also applies to: 30-160
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@release-artifacts/latest/release-checksums.json` around lines 5 - 25, Add the missing signature evidence artifacts to the checksum manifest by updating the JSON keys: add the two missing signature evidence artifact entries into source.covered_paths and append corresponding entries into the top-level files list (each with path, format and sha256 fields consistent with the existing text_checksum_file format), ensuring their sha256 values are computed and the path strings exactly match the committed artifacts so they are included in checksum coverage.docs/release-signatures.md (1)
32-32:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winRemove the extra blank line at EOF.
This trailing blank line is currently failing the repo’s lint/format gate, so CI will stay red until it’s removed.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/release-signatures.md` at line 32, Remove the extraneous blank line at the end of docs/release-signatures.md by editing the file so its last character is the final content character (no newline-only line after it); ensure the file ends with a single newline if your formatter requires one but not an extra empty line to satisfy the repo lint/format gate.Source: Pipeline failures
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ops/AUTONOMOUS_RUN.md`:
- Around line 142-147: The PR status block for "PR candidate: Add release
signature evidence baseline (Queue Item 81)" is stale: update the Status line in
AUTONOMOUS_RUN.md (the block containing "PR `#157` open; CodeRabbit review not yet
requested.") to reflect that CodeRabbit review has been requested (e.g., mention
"`@coderabbitai` review ping" or "CodeRabbit review requested/active") and adjust
any follow-up gating text so the next autonomous step will not wait on
CodeRabbit; locate the exact block by the heading text "PR candidate: Add
release signature evidence baseline (Queue Item 81)" and update the
Status/CodeRabbit request lines accordingly.
In `@scripts/check_release_signatures.py`:
- Around line 333-349: validate_evidence currently checks expected fields but
ignores extra properties; fix by validating the loaded JSON against the
canonical JSON Schema
(release-artifacts/schema/release-signature-evidence.schema.json) before the
per-field validators run: after evidence = require_dict(load_json(path), ...)
load the schema and run jsonschema.validate (or
Draft7Validator(schema).validate) so additionalProperties:false is enforced and
any unexpected top-level or nested keys cause an error; keep the existing
per-field calls (validate_network, validate_source, validate_artifacts,
validate_signing_identity, validate_signatures, validate_retained_artifacts,
validate_redaction_policy) but only after schema validation, and add a
regression test that injects an unknown field to ensure rejection.
In `@scripts/generate_release_manifest.py`:
- Around line 303-349: The release_signature_record function currently extracts
fields but never runs the release-signature validator, allowing invalid evidence
into the manifest; modify release_signature_record to validate the loaded JSON
with the same validator used by scripts/check_release_signatures.py (or call the
shared helper used by build_manifest) before serializing
release_signature_evidence: after loading data (and before building
record/update), call the validator (or shared validate_release_signature
function) on data, fail/raise on validation errors, and then include the
validated release_signature_evidence payload (not just a few fields) in the
record so build_manifest only emits validated evidence; reference
release_signature_record, file_record, release_signature_evidence, and the
validator in scripts/check_release_signatures.py when making the change.
---
Outside diff comments:
In `@docs/release-signatures.md`:
- Line 32: Remove the extraneous blank line at the end of
docs/release-signatures.md by editing the file so its last character is the
final content character (no newline-only line after it); ensure the file ends
with a single newline if your formatter requires one but not an extra empty line
to satisfy the repo lint/format gate.
In `@release-artifacts/latest/release-checksums.json`:
- Around line 5-25: Add the missing signature evidence artifacts to the checksum
manifest by updating the JSON keys: add the two missing signature evidence
artifact entries into source.covered_paths and append corresponding entries into
the top-level files list (each with path, format and sha256 fields consistent
with the existing text_checksum_file format), ensuring their sha256 values are
computed and the path strings exactly match the committed artifacts so they are
included in checksum coverage.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e6cf687f-854a-47df-9d3c-643434821dd0
📒 Files selected for processing (20)
.github/workflows/ci.ymlCHANGELOG.mdMakefiledocs/release-policy.mddocs/release-signatures.mddocs/status.mdops/AUTONOMOUS_RUN.mdops/ROADMAP.mdrelease-artifacts/README.mdrelease-artifacts/latest/SHA256SUMSrelease-artifacts/latest/release-checksums.jsonrelease-artifacts/latest/release-manifest.jsonrelease-artifacts/schema/release-signature-evidence.schema.jsonrelease-artifacts/signatures/anvil-6529stream-v0.1.0-001-local.jsonscripts/check.ps1scripts/check.shscripts/check_release_signatures.pyscripts/generate_release_manifest.pyscripts/test_release_manifest.pyscripts/test_release_signatures.py
|
@coderabbitai review Addressed the release-signature evidence review findings in latest head |
|
✅ Action performedReview finished.
|
1 participant
Summary
Closes #156.
Adds a no-secret, machine-checkable release signature evidence baseline for the release ceremony. This makes the missing detached checksum signature and signed Git tag work explicit without requiring production signing keys or claiming a real signature exists.
Changes
release-artifacts/schema/release-signature-evidence.schema.json.release-artifacts/signatures/anvil-6529stream-v0.1.0-001-local.json.scripts/check_release_signatures.pyandscripts/test_release_signatures.py.Makefile,scripts/check.sh,scripts/check.ps1, and CI.docs/release-signatures.mdand update release policy, status, release artifact docs, roadmap, changelog, and autonomous run state.Local Validation
python scripts\test_release_signatures.pypython scripts\check_release_signatures.pypython -m py_compile scripts\check_release_signatures.py scripts\test_release_signatures.py scripts\generate_release_manifest.py scripts\test_release_manifest.pypython scripts\test_release_manifest.pypython scripts\generate_release_manifest.py --checkpython scripts\test_release_checksums.pypython scripts\generate_release_checksums.py --checkpython scripts\test_changelog_check.pypython scripts\check_changelog.pybash -n scripts/check.shgit diff --check(passes with existing PowerShell line-ending warning forscripts/check.ps1)make checkNotes
No Solidity behavior changes. The committed evidence is intentionally local placeholder evidence only; real production detached signatures, signed tags, and signing-key custody remain future release ceremony work.
Summary by CodeRabbit
New Features
Documentation
Chores
Tests