Repository navigation
Check pgstencil's npm signature and provenance attestation before a Hosted production deploy - #1245
Merged
Merged
Conversation
Deploying mouseterm with
|
| Latest commit: |
bf57ff9
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://c0e8da9a.mouseterm.pages.dev |
| Branch Preview URL: | https://hosted-deploy-provenance.mouseterm.pages.dev |
nedtwigg
had a problem deploying
to
hosted-preview
October 20, 2026 15:46 — with 
GitHub Actions
Error
GitHub Actions
Error
dormouse-bot
left a comment
dormouse-bot
left a comment
Collaborator
There was a problem hiding this comment.
The diff looks correct and I have no findings. I'm holding the approval only because Workflow Lint is red at this head. The failure isn't from this PR: zizmor flags ref-version-mismatch on the swatinem/rust-cache pin at .github/workflows/ci.yml:403, and main's latest CI run (39445113310) fails Workflow Lint with the same annotation.
…d production deploy The production verify job now runs hosted/scripts/pgstencil-provenance.mjs, which verifies each installed pgstencil package's npm SLSA attestation (the Fulcio signer and source digest, the statement's subject against the locked integrity, its workflow and commit) and that the commit is on pgstencil main with a passing security-audit. These checks previously ran only nightly. The specs make the deploy-time check the audited property, the hosted audit prompt runs the same script, and the Relay guarantee row now states that an open socket closes by the room's sweep. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nedtwigg
force-pushed
the
hosted-deploy-provenance
branch
from
October 20, 2026 15:53
80d4524 to
a52bb1e
Compare
dormouse-bot
approved these changes
Oct 20, 2026
…spec text Move verifyPackages into hosted/scripts/pgstencil-provenance.mjs, which production.mjs now imports for its preflight and deploy call, so the provenance script no longer loads the deploy orchestration. Drop a test the subject cases already cover, and point the audit prompt, hosted.md, and the rationale at S119/S120 and the code instead of restating them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dormouse-bot
approved these changes
Oct 20, 2026
…duction verify job Replace the provenance script with one workflow step: `npm audit signatures --include-attestations` in `hosted/`, failing the job unless both pgstencil packages have a valid registry signature and a verified provenance attestation. The nightly audit keeps the deeper check that the attestation names pgstencil's release workflow at the provenance commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nedtwigg
changed the title
dormouse-bot
approved these changes
Oct 20, 2026
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dormouse-bot
approved these changes
Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hosted's production
verifyjob, whichdeployneeds, now asks npm whether each installed pgstencil package has a valid registry signature and a verified SLSA provenance attestation before anything ships.Until now the production workflow checked pgstencil only through
verifyPackages, which reads each package's owndist/provenance.json. The attestation checks indocs/specs/security-hosted.md-> "Deployment boundary" ran only in the nightly security audit, so a pgstencil bump deployed between two nightly runs went out on the self-reported file alone.What changed
.github/workflows/hosted-production.yml: after the existingverifyPackagesstep, one step runsnpm audit signatures --json --include-attestationsinhosted/and usesjqto fail the job unless neitherpgstencilnor@pgstencil/authis listed as invalid or missing, and both appear as verified with a provenance attestation. npm's own exit code covers every package in Hosted's tree, so it is ignored and only pgstencil's packages gate the deploy. Permissions, pins, and actions are unchanged; no token is needed.docs/specs/security-hosted.mdnow has theverifyjob's check as its first clause. The deeper check, that the attestation's certificate names pgstencil's release workflow onmainat thedist/provenance.jsoncommit, stays with the nightly audit, as does S120 (the commit is on pgstencilmainand passed its audit). The reasoning is insecurity-hosted.rationale.md..github/audit/hosted.md: the attestation instructions now run the same npm command inhosted/as the job does, and judge S119's new clause against that step.security-hosted.md: it now says entitlement is rechecked whenever a request or socket is admitted, and that a socket already open for a removed or de-entitled computer is closed no later than the room's sweep. That is the bound S115 already sets; the old wording implied every request is rechecked.Tests
jqfilter edited copies of that output: dropping either package fromverified, removing its provenance attestation, or listing it as invalid or missing each fails; an invalid unrelated package passes; npm's error output fails.pnpm lint:workflows,node --test hosted/scripts/*.test.mjs,node scripts/spec-lint.mjs,node scripts/md-unwrap.mjs.This touches
.github/, so the owner merges it.🤖 Generated with Claude Code