From 1451df32feac0b3ef263bcdbc88ff173db063443 Mon Sep 17 00:00:00 2001 From: Sulthan Nauval Abdillah Date: Sat, 8 Aug 2026 17:03:44 +0000 Subject: [PATCH] fix(ci): actually verify the claw-ui signature in the weekly drift run MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first real drift run failed on `claw-ui signature verified` against rantaiclaw v0.18.2-alpha. Nothing was wrong with the bundle — it built and installed cleanly, 17 of 18 assertions passed. The check itself was the defect. - rantaiclaw treats a missing cosign as a soft degrade: it warns and installs the console anyway. drift.yml never installed cosign, so the assertion could not pass there — and would have been meaningless if it had, since nothing was verified - the failure was also unreadable: pack-airgapped.sh's output is captured to a temp file, so CI showed `FAIL` with the reason nowhere on screen - install cosign in drift.yml so the signature is really checked; that verification is the point of the weekly run - require cosign in tests/airgapped-bundle.sh the way bun is required (exit 2 with a reason), so the check can neither pass without verifying nor fail for a cause that isn't the artifact - print what pack-airgapped.sh reported when the assertion does fail --- .github/workflows/drift.yml | 5 ++++- tests/airgapped-bundle.sh | 11 +++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/workflows/drift.yml b/.github/workflows/drift.yml index 0390763..1b99f75 100644 --- a/.github/workflows/drift.yml +++ b/.github/workflows/drift.yml @@ -20,7 +20,10 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: oven-sh/setup-bun@v2 # pack-airgapped.sh builds the console with it + - uses: oven-sh/setup-bun@v2 # pack-airgapped.sh builds the console with it + # rantaiclaw degrades to an unverified install when cosign is absent, so without + # this the weekly run would check the claw-ui signature by not checking it. + - uses: sigstore/cosign-installer@v3 - name: Fetch latest rantaiclaw (x86_64 linux gnu) env: diff --git a/tests/airgapped-bundle.sh b/tests/airgapped-bundle.sh index 0a14e88..125a47e 100755 --- a/tests/airgapped-bundle.sh +++ b/tests/airgapped-bundle.sh @@ -17,6 +17,11 @@ RC="${1:-${RC_BIN:-$(command -v rantaiclaw 2>/dev/null || true)}}" [ -x "$RC" ] || { echo "✗ need a rantaiclaw binary: tests/airgapped-bundle.sh "; exit 2; } RC="$(cd "$(dirname "$RC")" && pwd)/$(basename "$RC")" command -v bun >/dev/null 2>&1 || { echo "✗ bun is required to build the airgapped bundle"; exit 2; } +# rantaiclaw treats a missing cosign as a soft degrade — it warns and installs anyway. +# So without cosign the signature assertion below cannot pass and cannot mean anything +# either; demand it up front rather than reporting a failure whose real cause is +# "this host has no cosign". +command -v cosign >/dev/null 2>&1 || { echo "✗ cosign is required — this check exists to prove the claw-ui artifact was signed"; exit 2; } W="$(mktemp -d)"; trap 'rm -rf "$W"' EXIT TAG=v0.0.0-test @@ -30,6 +35,12 @@ ck "claw-ui checksum verified" "grep -q 'SHA256 verified' '$W/pack.log'" # Fails closed upstream when the signature bundle is missing, so a pass here means # the artifact really was signed — not that verification was skipped. ck "claw-ui signature verified" "grep -q 'cosign signature verified' '$W/pack.log'" +if ! grep -q 'cosign signature verified' "$W/pack.log"; then + # pack-airgapped.sh's output is captured, so without this the log says only "FAIL" + # and the reason stays in a temp file nobody sees. + echo " ↳ what pack-airgapped.sh reported instead:" + grep -iE 'cosign|signature|verif' "$W/pack.log" | head -5 | sed 's/^/ /' +fi tar xzf "$REPO/dist/rantai-copilot-airgapped-$TAG-x86_64-linux.tar.gz" -C "$W" BD="$W/rantai-copilot-airgapped-$TAG-x86_64-linux"