Add drop authorization signing evidence checks#185
Merged
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
Contributor
Author
|
@coderabbitai review Please review this no-secret drop authorization signing evidence schema/checker PR. Scope is documentation, Python validators/tests, CI/local gate wiring, and release artifact manifest/checksum coverage only; no Solidity behavior changes are intended. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (9)
✅ Files skipped from review due to trivial changes (3)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughWalkthroughThis PR implements drop-authorization signing evidence: a strict JSON Schema, a checked no-secret template and retained-artifact placeholder, a CLI checker with deterministic tests, manifest and checksum integration, CI/Make gating, policy/docs updates, and ops state changes. ChangesDrop Authorization Signing Evidence
Estimated code review effort: 🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Get PR details and file list
gh pr view 185 --repo 6529-Collections/6529Stream --json title,body,files,additions,deletions,changedFiles 2>/dev/null | head -200
echo "=== FILES CHANGED ==="
gh pr diff 185 --repo 6529-Collections/6529Stream --name-only 2>/dev/nullLength of output: 6877 🏁 Script executed: #!/bin/bash
# Get full diff of the PR
gh pr diff 185 --repo 6529-Collections/6529Stream 2>/dev/null | head -3000Length of output: 159941 🏁 Script executed: #!/bin/bash
# Get the rest of the diff
gh pr diff 185 --repo 6529-Collections/6529Stream 2>/dev/null | tail -n +3000Length of output: 23123 🏁 Script executed: #!/bin/bash
# Check the new scripts more carefully
cat scripts/check_drop_authorization_signing_evidence.py 2>/dev/null | grep -n "SECRET_KEY_RE\|SECRET_VALUE_RE\|scan_for_secret" | head -30
# Check the test file
cat scripts/test_drop_authorization_signing_evidence.py 2>/dev/null | grep -n "def test_" | head -50
# Check SHA256SUMS integrity - do the hashes in SHA256SUMS match actual files
echo "=== Checking SHA256SUMS alignment with release-checksums.json ==="
python3 -c "
import json, re
with open('release-artifacts/latest/SHA256SUMS') as f:
lines = [l.strip() for l in f if l.strip()]
sums = {}
for line in lines:
parts = line.split(' ', 1)
if len(parts) == 2:
sums[parts[1]] = parts[0]
with open('release-artifacts/latest/release-checksums.json') as f:
checksums = json.load(f)
for entry in checksums.get('files', []):
path = entry['path']
sha = entry['sha256'].replace('sha256:', '')
if path in sums:
if sums[path] != sha:
print(f'MISMATCH: {path}')
else:
print(f'MISSING from SHA256SUMS: {path}')
print('Cross-check done')
" 2>/dev/null || echo "Script failed"
# Look at the structure of the generate_release_manifest.py import to confirm it works
head -20 scripts/generate_release_manifest.py 2>/dev/nullLength of output: 3267 🏁 Script executed: #!/bin/bash
# Check if there's a stale hash risk - does the checker verify hashes at runtime?
grep -n "stale\|hash.*check\|check.*hash\|file_sha256\|sha256_bytes" scripts/check_drop_authorization_signing_evidence.py | head -40
# Check that SHA256SUMS self-hash entry is updated
grep "SHA256SUMS\|release-checksums" release-artifacts/latest/SHA256SUMS 2>/dev/null
# Examine the validate_file_ref to see if it actually reads + verifies hashes at check time
grep -n "validate_file_ref\|validate_retained" scripts/check_drop_authorization_signing_evidence.py | head -20
# Check for self-referential SHA256 issue: does release-checksums.json hash itself?
grep "release-checksums.json" release-artifacts/latest/SHA256SUMS 2>/dev/null
# Check the drop-authorization-signing-evidence-template.json to understand retained artifact hashes
cat release-artifacts/drop-authorization-signing/drop-authorization-signing-evidence-template.json 2>/dev/nullLength of output: 5825 🏁 Script executed: #!/bin/bash
# Check test file completeness
cat scripts/test_drop_authorization_signing_evidence.py 2>/dev/null
echo "=== test_release_manifest.py changes ==="
git diff origin/main...HEAD -- scripts/test_release_manifest.py 2>/dev/null | head -300
echo "=== test_release_readiness.py changes ==="
git diff origin/main...HEAD -- scripts/test_release_readiness.py 2>/dev/null | head -100
echo "=== test_release_checksums.py changes ==="
git diff origin/main...HEAD -- scripts/test_release_checksums.py 2>/dev/null | head -100Length of output: 32248
Summary
Minor findings1.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/tooling.md (1)
357-365:⚠️ Potential issue | 🟡 MinorFix docs: checksum generator already hashes
release-artifacts/schema/drop-authorization-signing-evidence.schema.json
scripts/generate_release_checksums.pyincludes the wholerelease-artifacts/schemadirectory inDEFAULT_COVERED_PATHS, and for directories it hashes all files recursively (rglob("*")), so thedrop-authorization-signing-evidence.schema.jsonfile is covered in the generated checksums. Update thedocs/tooling.mdcoverage list (lines 357-365) to also mentionrelease-artifacts/schema/for consistency with the generator.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/tooling.md` around lines 357 - 365, Update the documentation list to reflect that scripts/generate_release_checksums.py (see DEFAULT_COVERED_PATHS and its use of rglob("*")) includes the entire release-artifacts/schema directory; specifically add "release-artifacts/schema/" to the coverage list in the tooling docs where release-artifacts/schema/drop-authorization-signing-evidence.schema.json is currently omitted so the docs match the generator's behavior.
🧹 Nitpick comments (1)
docs/incident-response.md (1)
268-270: ⚡ Quick winReference the schema and retained-artifact hash anchor here too.
The signer-compromise checklist currently points responders at the template and checker, but it skips the schema and retained-artifact file that the checker uses to validate the evidence chain. Adding those links keeps the runbook aligned with the actual contract and avoids treating the local example as the source of truth.
Per the PR objectives, retained signing evidence must validate retained artifact paths/hashes separately from the template.
♻️ Suggested edit
- Compare the payload and digest with [`docs/drop-authorization-signing.md`](drop-authorization-signing.md). +- Compare retained signing evidence with + [`release-artifacts/schema/drop-authorization-signing-evidence.schema.json`](../release-artifacts/schema/drop-authorization-signing-evidence.schema.json) + and + [`release-artifacts/drop-authorization-signing/drop-authorization-signing-retained-artifact.txt`](../release-artifacts/drop-authorization-signing/drop-authorization-signing-retained-artifact.txt). - Compare retained signing ceremony metadata with [`release-artifacts/drop-authorization-signing/drop-authorization-signing-evidence-template.json`](../release-artifacts/drop-authorization-signing/drop-authorization-signing-evidence-template.json) and `python scripts/check_drop_authorization_signing_evidence.py`.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/incident-response.md` around lines 268 - 270, Update the signer-compromise checklist to include direct links to the evidence schema and the retained-artifact hash anchor that the checker uses: add references alongside the existing template (`release-artifacts/drop-authorization-signing/drop-authorization-signing-evidence-template.json`) and the checker script (`python scripts/check_drop_authorization_signing_evidence.py`), explicitly linking the schema file used for validation and the retained-artifact hash/paths document (the retained-artifact anchor) so responders validate retained artifact paths/hashes against the canonical contract rather than only the local template.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ops/ROADMAP.md`:
- Around line 103-104: Update the ROADMAP entry that currently uses the phrase
"externally reviewed" to avoid implying a completed third-party audit; locate
the table row containing the Docs column text and the phrase "externally
reviewed" and either remove that phrase or replace it with "merged/local
evidence only" (or equivalent wording) so it matches docs/audit-package.md's
description of a pre-audit local baseline; ensure the change appears in the same
table cell that lists `docs/audit-package.md` and related docs so the wording is
consistent with the stated scope.
- Around line 85-90: Replace the vague, time-relative CI/status wording and the
unsupported “audit docs merged and externally reviewed” claim in the ROADMAP
entry: locate the exact phrases "GitHub Actions and CodeRabbit pending until PR
creation" / "Pending … until PR creation" and replace them with concrete status
or a dated artifact reference (e.g., latest GitHub Actions run ID, CodeRabbit
report link, or a timestamped statement), and either remove or substantiate the
"audit docs merged and externally reviewed" sentence by adding links/evidence or
rephrasing to accurately reflect it as a pre-audit local baseline; update the CI
run / verification fields (the lines mentioning CI run and status) to match the
chosen concrete artifacts so the ROADMAP.md entries are factual and timestamped.
In `@scripts/check_drop_authorization_signing_evidence.py`:
- Around line 422-434: The numeric checks currently call require_int (and
require_positive_int for sale_mode) but the schema requires non-negative values
for collection_id, signer_epoch, nonce, deadline and
signing_identity.signer_epoch; update the validation so the numeric_comparisons
loop uses require_non_negative_int for those keys (keep sale_mode using
require_positive_int if intended), replacing require_int calls with
require_non_negative_int, and also replace the separate check for
signing_identity.signer_epoch to call require_non_negative_int instead of
require_int; refer to numeric_comparisons, require_int,
require_non_negative_int, require_positive_int, and the
"signing_identity.signer_epoch" check to locate and change the calls.
---
Outside diff comments:
In `@docs/tooling.md`:
- Around line 357-365: Update the documentation list to reflect that
scripts/generate_release_checksums.py (see DEFAULT_COVERED_PATHS and its use of
rglob("*")) includes the entire release-artifacts/schema directory; specifically
add "release-artifacts/schema/" to the coverage list in the tooling docs where
release-artifacts/schema/drop-authorization-signing-evidence.schema.json is
currently omitted so the docs match the generator's behavior.
---
Nitpick comments:
In `@docs/incident-response.md`:
- Around line 268-270: Update the signer-compromise checklist to include direct
links to the evidence schema and the retained-artifact hash anchor that the
checker uses: add references alongside the existing template
(`release-artifacts/drop-authorization-signing/drop-authorization-signing-evidence-template.json`)
and the checker script (`python
scripts/check_drop_authorization_signing_evidence.py`), explicitly linking the
schema file used for validation and the retained-artifact hash/paths document
(the retained-artifact anchor) so responders validate retained artifact
paths/hashes against the canonical contract rather than only the local template.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fb06f0ca-f8dc-4a6e-add2-2867235787fe
📒 Files selected for processing (33)
.github/workflows/ci.ymlCHANGELOG.mdMakefiledocs/audit-package.mddocs/drop-authorization-signing.mddocs/incident-response.mddocs/known-blockers.mddocs/public-beta-evidence.mddocs/release-policy.mddocs/release-readiness.mddocs/status.mddocs/tooling.mdops/AUTONOMOUS_RUN.mdops/ROADMAP.mdrelease-artifacts/README.mdrelease-artifacts/drop-authorization-signing/drop-authorization-signing-evidence-template.jsonrelease-artifacts/drop-authorization-signing/drop-authorization-signing-retained-artifact.txtrelease-artifacts/latest/SHA256SUMSrelease-artifacts/latest/release-checksums.jsonrelease-artifacts/latest/release-manifest.jsonrelease-artifacts/schema/drop-authorization-signing-evidence.schema.jsonscripts/check.ps1scripts/check.shscripts/check_audit_package.pyscripts/check_drop_authorization_signing_evidence.pyscripts/check_incident_response.pyscripts/check_release_readiness.pyscripts/generate_release_checksums.pyscripts/generate_release_manifest.pyscripts/test_drop_authorization_signing_evidence.pyscripts/test_release_checksums.pyscripts/test_release_manifest.pyscripts/test_release_readiness.py
This was referenced Jun 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
python -m py_compile scripts\check_drop_authorization_signing_evidence.py scripts\test_drop_authorization_signing_evidence.py scripts\generate_release_manifest.py scripts\test_release_manifest.py scripts\generate_release_checksums.py scripts\test_release_readiness.pypython scripts\test_drop_authorization_signing_evidence.pypython scripts\check_drop_authorization_signing_evidence.pypython scripts\test_release_manifest.pypython scripts\generate_release_manifest.py --checkpython scripts\test_release_checksums.pypython scripts\generate_release_checksums.py --checkpython scripts\test_release_readiness.pypython scripts\check_release_readiness.pypython scripts\test_audit_package.pypython scripts\check_audit_package.pypython scripts\test_incident_response.pypython scripts\check_incident_response.pypython scripts\test_drop_authorization_payload_generator.pypython scripts\test_drop_authorization_fixtures.pypython scripts\check_drop_authorization_fixtures.pypython scripts\test_public_beta_evidence.pypython scripts\check_public_beta_evidence.pypython scripts\test_non_local_release_evidence.pypython scripts\check_non_local_release_evidence.pypython scripts\test_changelog_check.pypython scripts\check_changelog.pygit diff --checkmake checkpowershell -ExecutionPolicy Bypass -File scripts\check.ps1Closes #183
Summary by CodeRabbit
New Features
Chores
Documentation
Tests