Repository navigation
feat: add signing trust flows - #536
Merged
Merged
Conversation
Collaborator
Jenkins BuildsClick to see older builds (19)
|
📊 basecamp doc-test reportsThis commit of basecamp, built once per OS and driven by each doc-test, rendered alongside the commands/actions actually run and their output (updated each run, commit
Pages can take a minute to update after the run finishes. |
Khushboo-dev-cpp
force-pushed
the
feat/install-trust
branch
6 times, most recently
from
November 3, 2026 13:43
41b4384 to
c418ed8
Compare
Khushboo-dev-cpp
marked this pull request as ready for review
November 3, 2026 13:43
Khushboo-dev-cpp
force-pushed
the
feat/install-trust
branch
from
November 3, 2026 15:36
c418ed8 to
26003cc
Compare
Each install dialog (Package Manager's install gate and upgrade, App Manager) says who signed every package the install would bring: the catalogue's signature for the planned root hash, or package_manager's verifyPackage of a local file. A damaged or wrongly signed package can't be installed. "Trust & install" trusts the publisher of the package the dialog is about, and nobody else, once its key is in the keyring, and says that what it signs will install without asking; anything else that isn't trusted installs "anyway". A publisher using a trusted name with another key, or a name with a word reading as Logos, is flagged and never offered. What was judged is what installs. The answer to package_manager_ui carries the plan, release by release, or a local file's root hash, signer and SHA-256, and package_manager_ui (bumped to ea0cdda) installs exactly that. App Manager's own installs are held to the same plan: every required package fetched and each file signed as approved, or nothing is installed. package_downloader is bumped to 6dee7e9 (logos-package-downloader#57): a release whose manifest names another package is never listed, planned or fetched, and a downloaded file must be the package asked for. Trust is bounded. A release installs only under the name it is listed as; a package named like one Basecamp ships, or like a caller the runtime trusts (core, core_service), installs only if Logos signed it; an update signed by another publisher than the installed copy asks, even when that publisher is trusted. Only Basecamp and the Package Manager's backend may call package_manager and package_downloader (a capability_module restriction registered before they load, and carried into an enforce-mode access policy), so no other module can add a key or install without a dialog; if the restriction can't be registered, neither module starts. Settings → Trusted Publishers lists package_manager's keyring (<baseDirectory>/keyring) with each key's fingerprint and date. Any publisher, Logos included, can be deleted; future installs from it then ask first. Only a new keyring gets Logos, so a deleted Logos stays deleted. Logos's keys are a list (current, older, revoked), checked before each release (README, "Cutting a release"). A keyring that can't be read trusts nobody. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Khushboo-dev-cpp
force-pushed
the
feat/install-trust
branch
from
November 3, 2026 16:05
26003cc to
75f4ba1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Linked issues
Screenshots / recordings
Test plan
nix build .#appsucceedsnix build .#smoke-test -Lpassesnix build .#integration-test -Lpasses (if UI-visible)nix build .#doctests -Lif touched)Release notes
Checklist
fix/,feat/,chore/,docs/,test/, orci/CLAUDE.md/README.md/docs/updated if behaviour or build steps changed.DS_Storefiles removed