Repository navigation
fix(keys-sync): report GPG execution failures - #1634
Merged
potiuk merged 2 commits intoOct 16, 2026
Merged
Conversation
github-actions
Bot
added
capability:resolve
MakerFlyFly
marked this pull request as ready for review
October 15, 2026 04:39
Check import and listing return codes before assessing a fetched public key. Preserve missing-key results only for a confirmed no-data import followed by a successful empty listing. Include the GPG stage and diagnostics in the existing error response, and cover both operational failures and the compatible no-data cases. Generated-by: OpenAI Codex (GPT-6)
Read regular key files completely before considering an empty input, and import the same bytes through stdin. Reject failed imports of a public-key block even when GPG reports NODATA with zero import counts. Cover directories, truncated armor, readable binary keys and input changes with real-GPG regressions while preserving plain no-key text. Generated-by: OpenAI Codex (GPT-6)
potiuk
force-pushed
the
fix/keys-sync-gpg-errors-upstream
branch
from
October 16, 2026 01:46
4c0bae5 to
39e771d
Compare
Member
|
Rebased onto current #1635 added a Note for the author, not changed here: a roborev pass suggested that GnuPG 2.4.1+ may need an empty Still open for maintainers: ordering against #1625, which replaces this file. |
potiuk
approved these changes
Oct 16, 2026
potiuk
pushed a commit
to potiuk/magpie
that referenced
this pull request
Oct 16, 2026
* fix(keys-sync): report GPG execution failures Check import and listing return codes before assessing a fetched public key. Preserve missing-key results only for a confirmed no-data import followed by a successful empty listing. Include the GPG stage and diagnostics in the existing error response, and cover both operational failures and the compatible no-data cases. Generated-by: OpenAI Codex (GPT-6) * fix(keys-sync): reject malformed key input Read regular key files completely before considering an empty input, and import the same bytes through stdin. Reject failed imports of a public-key block even when GPG reports NODATA with zero import counts. Cover directories, truncated armor, readable binary keys and input changes with real-GPG regressions while preserving plain no-key text. Generated-by: OpenAI Codex (GPT-6)
potiuk
pushed a commit
to Kaap10/magpie
that referenced
this pull request
Oct 16, 2026
* fix(keys-sync): report GPG execution failures Check import and listing return codes before assessing a fetched public key. Preserve missing-key results only for a confirmed no-data import followed by a successful empty listing. Include the GPG stage and diagnostics in the existing error response, and cover both operational failures and the compatible no-data cases. Generated-by: OpenAI Codex (GPT-6) * fix(keys-sync): reject malformed key input Read regular key files completely before considering an empty input, and import the same bytes through stdin. Reject failed imports of a public-key block even when GPG reports NODATA with zero import counts. Cover directories, truncated armor, readable binary keys and input changes with real-GPG regressions while preserving plain no-key text. Generated-by: OpenAI Codex (GPT-6)
potiuk
added a commit
that referenced
this pull request
Oct 16, 2026
…er fixes into the tool and read S3 and version paths right Port of the key-checker fixes main landed on the script this series moves into tools/release-management (#1634, #1635, #1646): - A key passes only with a signing-capable primary or subkey that itself meets the strength floor and is not revoked, invalid, disabled or expired; a certify-only primary with no such subkey is blocked (`signers` in the check output). - GPG failures are reported, never read as "key not found": unreadable or non-file input, a failed import or listing, and gpg failing to start are errors naming the stage and exit code, with the "no key data" exception ported as is. release-verify list-keys, which runs gpg for keys-sync, now also reports each key's capabilities and subkeys. - Every test of main's test_check_key.py has a ported equivalent. Adversarial-review findings: - archive-sweep reads S3 URLs with promote's whole-host path-style rule, so a virtual-hosted bucket whose name starts with "s3" keeps its key. - A release_dist_url_template with a literal around <version> (v<version>, foo-<version>-bin) gives the right release directory and archive URLs. - keys-sync reads a GitHub KEYS URL as branch (the first segment after blob/) plus a path that may include subdirectories, so KEYS can live in e.g. dist/; a new optional keys_file_branch names a branch that contains '/' (release/1.x). Without it, a subdirectory reading is warned; a URL whose file is not KEYS is refused. - The keyserver's UIDs are compared with KEYS as a set, so a reordered keyserver listing is no longer reported as a rolled key. Generated-by: Claude Opus 5
potiuk
added a commit
that referenced
this pull request
Oct 16, 2026
…er fixes into the tool and read S3 and version paths right Port of the key-checker fixes main landed on the script this series moves into tools/release-management (#1634, #1635, #1646): - A key passes only with a signing-capable primary or subkey that itself meets the strength floor and is not revoked, invalid, disabled or expired; a certify-only primary with no such subkey is blocked (`signers` in the check output). - GPG failures are reported, never read as "key not found": unreadable or non-file input, a failed import or listing, and gpg failing to start are errors naming the stage and exit code, with the "no key data" exception ported as is. release-verify list-keys, which runs gpg for keys-sync, now also reports each key's capabilities and subkeys. - Every test of main's test_check_key.py has a ported equivalent. Adversarial-review findings: - archive-sweep reads S3 URLs with promote's whole-host path-style rule, so a virtual-hosted bucket whose name starts with "s3" keeps its key. - A release_dist_url_template with a literal around <version> (v<version>, foo-<version>-bin) gives the right release directory and archive URLs. - keys-sync reads a GitHub KEYS URL as branch (the first segment after blob/) plus a path that may include subdirectories, so KEYS can live in e.g. dist/; a new optional keys_file_branch names a branch that contains '/' (release/1.x). Without it, a subdirectory reading is warned; a URL whose file is not KEYS is refused. - The keyserver's UIDs are compared with KEYS as a set, so a reordered keyserver listing is no longer reported as a rolled key. Generated-by: Claude Opus 5
potiuk
added a commit
that referenced
this pull request
Oct 16, 2026
…er fixes into the tool and read S3 and version paths right Port of the key-checker fixes main landed on the script this series moves into tools/release-management (#1634, #1635, #1646): - A key passes only with a signing-capable primary or subkey that itself meets the strength floor and is not revoked, invalid, disabled or expired; a certify-only primary with no such subkey is blocked (`signers` in the check output). - GPG failures are reported, never read as "key not found": unreadable or non-file input, a failed import or listing, and gpg failing to start are errors naming the stage and exit code, with the "no key data" exception ported as is. release-verify list-keys, which runs gpg for keys-sync, now also reports each key's capabilities and subkeys. - Every test of main's test_check_key.py has a ported equivalent. Adversarial-review findings: - archive-sweep reads S3 URLs with promote's whole-host path-style rule, so a virtual-hosted bucket whose name starts with "s3" keeps its key. - A release_dist_url_template with a literal around <version> (v<version>, foo-<version>-bin) gives the right release directory and archive URLs. - keys-sync reads a GitHub KEYS URL as branch (the first segment after blob/) plus a path that may include subdirectories, so KEYS can live in e.g. dist/; a new optional keys_file_branch names a branch that contains '/' (release/1.x). Without it, a subdirectory reading is warned; a URL whose file is not KEYS is refused. - The keyserver's UIDs are compared with KEYS as a set, so a reordered keyserver listing is no longer reported as a rolled key. Generated-by: Claude Opus 5
potiuk
added a commit
that referenced
this pull request
Oct 16, 2026
…er fixes into the tool and read S3 and version paths right Port of the key-checker fixes main landed on the script this series moves into tools/release-management (#1634, #1635, #1646): - A key passes only with a signing-capable primary or subkey that itself meets the strength floor and is not revoked, invalid, disabled or expired; a certify-only primary with no such subkey is blocked (`signers` in the check output). - GPG failures are reported, never read as "key not found": unreadable or non-file input, a failed import or listing, and gpg failing to start are errors naming the stage and exit code, with the "no key data" exception ported as is. release-verify list-keys, which runs gpg for keys-sync, now also reports each key's capabilities and subkeys. - Every test of main's test_check_key.py has a ported equivalent. Adversarial-review findings: - archive-sweep reads S3 URLs with promote's whole-host path-style rule, so a virtual-hosted bucket whose name starts with "s3" keeps its key. - A release_dist_url_template with a literal around <version> (v<version>, foo-<version>-bin) gives the right release directory and archive URLs. - keys-sync reads a GitHub KEYS URL as branch (the first segment after blob/) plus a path that may include subdirectories, so KEYS can live in e.g. dist/; a new optional keys_file_branch names a branch that contains '/' (release/1.x). Without it, a subdirectory reading is warned; a URL whose file is not KEYS is refused. - The keyserver's UIDs are compared with KEYS as a set, so a reordered keyserver listing is no longer reported as a rolled key. Generated-by: Claude Opus 5
potiuk
added a commit
that referenced
this pull request
Oct 16, 2026
…er fixes into the tool and read S3 and version paths right Port of the key-checker fixes main landed on the script this series moves into tools/release-management (#1634, #1635, #1646): - A key passes only with a signing-capable primary or subkey that itself meets the strength floor and is not revoked, invalid, disabled or expired; a certify-only primary with no such subkey is blocked (`signers` in the check output). - GPG failures are reported, never read as "key not found": unreadable or non-file input, a failed import or listing, and gpg failing to start are errors naming the stage and exit code, with the "no key data" exception ported as is. release-verify list-keys, which runs gpg for keys-sync, now also reports each key's capabilities and subkeys. - Every test of main's test_check_key.py has a ported equivalent. Adversarial-review findings: - archive-sweep reads S3 URLs with promote's whole-host path-style rule, so a virtual-hosted bucket whose name starts with "s3" keeps its key. - A release_dist_url_template with a literal around <version> (v<version>, foo-<version>-bin) gives the right release directory and archive URLs. - keys-sync reads a GitHub KEYS URL as branch (the first segment after blob/) plus a path that may include subdirectories, so KEYS can live in e.g. dist/; a new optional keys_file_branch names a branch that contains '/' (release/1.x). Without it, a subdirectory reading is warned; a URL whose file is not KEYS is refused. - The keyserver's UIDs are compared with KEYS as a set, so a reordered keyserver listing is no longer reported as a rolled key. Generated-by: Claude Opus 5
potiuk
added a commit
that referenced
this pull request
Oct 16, 2026
…er fixes into the tool and read S3 and version paths right Port of the key-checker fixes main landed on the script this series moves into tools/release-management (#1634, #1635, #1646): - A key passes only with a signing-capable primary or subkey that itself meets the strength floor and is not revoked, invalid, disabled or expired; a certify-only primary with no such subkey is blocked (`signers` in the check output). - GPG failures are reported, never read as "key not found": unreadable or non-file input, a failed import or listing, and gpg failing to start are errors naming the stage and exit code, with the "no key data" exception ported as is. release-verify list-keys, which runs gpg for keys-sync, now also reports each key's capabilities and subkeys. - Every test of main's test_check_key.py has a ported equivalent. Adversarial-review findings: - archive-sweep reads S3 URLs with promote's whole-host path-style rule, so a virtual-hosted bucket whose name starts with "s3" keeps its key. - A release_dist_url_template with a literal around <version> (v<version>, foo-<version>-bin) gives the right release directory and archive URLs. - keys-sync reads a GitHub KEYS URL as branch (the first segment after blob/) plus a path that may include subdirectories, so KEYS can live in e.g. dist/; a new optional keys_file_branch names a branch that contains '/' (release/1.x). Without it, a subdirectory reading is warned; a URL whose file is not KEYS is refused. - The keyserver's UIDs are compared with KEYS as a set, so a reordered keyserver listing is no longer reported as a rolled key. Generated-by: Claude Opus 5
potiuk
added a commit
that referenced
this pull request
Oct 16, 2026
…er fixes into the tool and read S3 and version paths right Port of the key-checker fixes main landed on the script this series moves into tools/release-management (#1634, #1635, #1646): - A key passes only with a signing-capable primary or subkey that itself meets the strength floor and is not revoked, invalid, disabled or expired; a certify-only primary with no such subkey is blocked (`signers` in the check output). - GPG failures are reported, never read as "key not found": unreadable or non-file input, a failed import or listing, and gpg failing to start are errors naming the stage and exit code, with the "no key data" exception ported as is. release-verify list-keys, which runs gpg for keys-sync, now also reports each key's capabilities and subkeys. - Every test of main's test_check_key.py has a ported equivalent. Adversarial-review findings: - archive-sweep reads S3 URLs with promote's whole-host path-style rule, so a virtual-hosted bucket whose name starts with "s3" keeps its key. - A release_dist_url_template with a literal around <version> (v<version>, foo-<version>-bin) gives the right release directory and archive URLs. - keys-sync reads a GitHub KEYS URL as branch (the first segment after blob/) plus a path that may include subdirectories, so KEYS can live in e.g. dist/; a new optional keys_file_branch names a branch that contains '/' (release/1.x). Without it, a subdirectory reading is warned; a URL whose file is not KEYS is refused. - The keyserver's UIDs are compared with KEYS as a set, so a reordered keyserver listing is no longer reported as a rolled key. Generated-by: Claude Opus 5
potiuk
added a commit
that referenced
this pull request
Oct 16, 2026
… decide and render as code (#1625) * perf(release-audit-report, release-archive-sweep, release-keys-sync): decide and render as code The last three release skills each had one rule in a skill-local script and the rest in prose. The scripts move unchanged into tools/release-management (render_record → audit_report.record, retention → archive_sweep, check_key → keys_sync), and new commands do what the agent did by hand, printing JSON and running nothing: - audit-report: `verdict` (planning issue found, `org/repo#n` normalised to the canonical URL), `gather` (PonyMail subjects and queries, the `svn info` revision command, the required fields; the search itself stays with the agent), `voters` (the [RESULT] voters mapped to roster handles with vote-tally's binding resolution, unresolved ones listed, never cited), `check` (Step 1 missing / redacted fields, schema violations, the thread-permalink shape), `record`, and `pr`. - archive-sweep: `verdict`, `listing`, `trains` (strict `N.x` lines become patterns; a free-text retention rule leaves `keep` to the agent), `retention`, and `render` for svn mv, gh release delete (with the permanent-deletion warning), aws s3 mv, self-hosted, and atr (no command). - keys-sync: whether the fingerprint is in KEYS and its UID matches the keyserver's is no longer a text scan. A new read-only `release-verify list-keys` lists fingerprints and UIDs in the existing throwaway GNUPGHOME (no agent, no keyring, no network, private-key material refused), and `keys-sync verdict` classifies it as proceed / noop / blocked, failing closed when it cannot compare. `render` draws the `# <uid>` KEYS block, the svn / git / generic sequence and the upload reminder with the expiry advisory. Every rendered command quotes its values with the shared shell helpers. Each backend and outcome gets its own file; audit-report's PR step moves, byte-identical with its generated adversarial block, to audit-log-pr.md at the skill root. Golden rules, Hard rules and the eval headings are unchanged. audit-report 6,657 → 5,136 tokens, archive-sweep 4,573 → 4,165, keys-sync 4,871 → 4,584. Evals: the scripted cases become pytest cases named after each former case (expected records byte-identical); the judgement and injection cases stay, their fixtures now carrying the real tool output. Generated-by: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01GTPsZ5aEE5bUVYqp47Dpvv * fix(release-archive-sweep, release-keys-sync, release-audit-report): refuse what the rules forbid instead of defaulting Review findings on the three tools: - archive-sweep: `retention` refuses a trains file whose retention rule was not decided (keep_decided false) unless every train names its keep, so a free-text rule no longer falls back to keep=1 and archives what the rule keeps. - archive-sweep: `render` refuses a retention output without mapping_complete, and any latest-of-line, orphan or pre-release in past_retention (Golden rule 2). - archive-sweep: a trailing -incubating qualifier is a release, not a pre-release, so podlings archive their older releases. - keys-sync: the Step 0 verdict normalises the fingerprint as Step 1 does (a 0x prefix no longer turns the no-op into a duplicate append). - keys-sync: Step 2 requires --key-listing and appends only an armour holding exactly the key Step 1 checked. - audit-report: `pr --base` defaults to <default-branch>, not main. Generated-by: Claude Opus 5 * fix(release-keys-sync, release-archive-sweep): carry main's key-checker fixes into the tool and read S3 and version paths right Port of the key-checker fixes main landed on the script this series moves into tools/release-management (#1634, #1635, #1646): - A key passes only with a signing-capable primary or subkey that itself meets the strength floor and is not revoked, invalid, disabled or expired; a certify-only primary with no such subkey is blocked (`signers` in the check output). - GPG failures are reported, never read as "key not found": unreadable or non-file input, a failed import or listing, and gpg failing to start are errors naming the stage and exit code, with the "no key data" exception ported as is. release-verify list-keys, which runs gpg for keys-sync, now also reports each key's capabilities and subkeys. - Every test of main's test_check_key.py has a ported equivalent. Adversarial-review findings: - archive-sweep reads S3 URLs with promote's whole-host path-style rule, so a virtual-hosted bucket whose name starts with "s3" keeps its key. - A release_dist_url_template with a literal around <version> (v<version>, foo-<version>-bin) gives the right release directory and archive URLs. - keys-sync reads a GitHub KEYS URL as branch (the first segment after blob/) plus a path that may include subdirectories, so KEYS can live in e.g. dist/; a new optional keys_file_branch names a branch that contains '/' (release/1.x). Without it, a subdirectory reading is warned; a URL whose file is not KEYS is refused. - The keyserver's UIDs are compared with KEYS as a set, so a reordered keyserver listing is no longer reported as a rolled key. Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
key_found: false.Type of change
keys-sync.Test plan
0a1f044eand pass with the repair. The old-helper replay honours itstext=Truesubprocess interface.e1c2e10a) and pass with the reviewed follow-up.prek run --all-files, including lychee, passes on this HEAD in the Linux checkout; both changed source files match the Windows checkout byte for byte. No tracked files were changed by the checks.pre-first-pr-checkagainst upstream main: all five categories pass, ready with zero blocking or advisory items.4c0bae57: requiredprek,zizmorandtests-okpass, including the Ready-event reruns. CodeQL and RAT also pass. No old-head success is reused.RFC-AI-0004 compliance
The helper continues to handle public information in a disposable keyring. It adds no signing operation, network operation or outbound message. Release signing remains with the RM.
Linked issues
Fixes #1633
Notes for reviewers
This branch is based on upstream main
0a1f044eand contains only the two reviewed helper/test changes from fork Draft PR #12. The source files match reviewed fork HEAD06056d2cbyte for byte. The fork issue and PR remain audit references.Suggested labels:
bug,family:release-management,capability:fix.Coordination with #1625: that pending PR removes both files changed here and replaces the GPG entry point with
release-verify list-keys. Its proposed reader still ignores import/listing return codes. This PR fixes current main; it does not claim conflict-free integration with that migration. If this repair merges first, #1625 must retain/migrate the error handling and regressions. If #1625 merges first, this PR must be adapted to its replacement entry point. No changes to the migration or shared signature-verification functions are bundled here.No key-strength, signing-subkey admission, signer-selection, signing or signature-verification policy changes. This remains independent of issue #1628, including Option 2.
Windows/MSYS homedir compatibility is still unresolved; production acceptance is correct error reporting with exit 2. Native Windows GPG was unavailable for separate verification.
No skill prompt or eval fixture changes. Existing Step 1 model fixtures have no helper-error case, so model-layer error forwarding has not been independently evaluated. Fork PR #12's last HEAD had no reported remote CI; this PR requires checks on its new HEAD.
Was generative AI tooling used to co-author this PR?
Generated-by:. Upstream maintainer review is pending.