Update dev and prod PCR approvals for ad5a389d - #909
Merged
Conversation
Record EIF measurements built from ad5a389 and append their PCR0 approvals using the existing SDK-matching signing key. Preserve all 145 previous entries in each history. This does not publish the legacy mirror or deploy. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Allow approval-edit PRs from this repository to use the trusted EIF cache job while retaining GitHub-only caching for forks and other manual refs. Extend routing coverage and update the cache trust guidance. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Allow trusted dev/prod EIF builds 180 minutes on the organization ARM64 8-core runner while preserving the standard unprivileged runner and timeout. Register the custom label with actionlint and retain cache trust boundaries. Remove the standalone signed-PCR dev-shell job and its unused selector output while keeping lightweight root and manual compatibility validation. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Contributor
|
Maple development preview: https://f34ec719.maple-ca8.pages.dev Commit: Uses development API, billing, flags and PCR configuration. Cloudflare Access applies. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update only the four canonical PCR files for EIFs built from master commit
ad5a389d175543abe103201bd1345ae9a647fb96, including the backend changes merged in #908.The fresh legacy baseline is
OpenSecretCloud/opensecret@70bc7f8826f55be18431eaf0038ddcbc98bca99a. Its four approval files matched the canonical pre-update bundle exactly; the offline validator confirms both updated histories preserve that baseline.Reviewed artifact evidence
Built on Linux ARM64 using the pinned component flake and normal Nix cache semantics. Credentials and dotenv loading were excluded from both builds.
aa8826a86f044f61fb6623896fe06c2a08be2d244e544a99f9812f1734ff582aa1f98ee51d59e1dc609bfc4c4dc2e5e2da55f7809f4866193c62b8b9b8852567Dev PCR0:
Prod PCR0:
Both PCR0s are new. PCR1 is unchanged; PCR2 changes with the new userspace and remains environment-specific. The existing format signs lowercase PCR0 text only with ECDSA P-384/SHA-384 and a 96-byte IEEE-P1363 signature, not PCR1/PCR2 or history metadata.
Validation
check_opensecret_eif.shcomparisons passed after the update and again on the committed tree.aarch64-linuxNix checks passed, including workflow lint and signed-PCR regression tests. Other systems were omitted.CI and remaining operator checkpoints
Unlike #905/#906, this PR explicitly changes approval JSON, so both hosted dev/prod EIF comparisons should run. Those PR jobs use the unprivileged GitHub cache path. FlakeHub OIDC authentication and its cache access must be verified separately by a trusted-master run; local cache hits do not prove hosted timing or cache access.
This PR does not merge anything, publish the legacy mirror, transfer an EIF, or deploy. After separate approval, publish the canonical update and its exact four-file legacy mirror and verify both public locations before deployment. The generated measurement files are build evidence, not proof of a running enclave or a forced independent rebuild.