lfg2025/archy
1
0
Fork 0
Code Issues 24 Pull Requests 4 Actions Packages Projects Releases 71 Wiki Activity

docs(signing-runbook): Workstream B is complete — the anchor is pinned

Browse Source 
The runbook still opened with "the catalog is accepted unsigned (migration
window) and the anchor is unpinned (RELEASE_ROOT_PUBKEY_HEX = None)". Both have
been true-for-a-while false: `trust::anchor::RELEASE_ROOT_PUBKEY_HEX` is a
`Some(...)` with a verification note in its doc comment, and
`releases/app-catalog.json` carries both a `signature` and a `signed_by`
did:key.

This one matters more than a normal stale status: a reader taking the header at
face value would think the fleet still accepts unsigned catalogs and that the
one-way anchor-pinning door is still open. It isn't — pinning already happened,
so any future ceremony is a *rotation*, which is the case the doc's own warning
about mismatched-signature hard-rejection applies to most sharply.

Marked complete and kept the procedure verbatim below, since it's exactly what a
key rotation or publisher change needs. Also dropped a stale `:21` line number
from the anchor.rs citation.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
archipelago
2026-08-08 04:14:58 -04:00
co-authored by Claude Opus 5
parent a7992233ab
commit c3341fc680
1 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/workstream-b-signing-runbook.md
+18 -2
View File
@@ -1,12 +1,28 @@
# Workstream B — Signed app-catalog: completion runbook
**Status (2026-06-28):** The registry-distributed manifest pipeline is live — nodes fetch
**Status: ✅ COMPLETE** (runbook retained for re-running the ceremony — key
rotation, a new publisher, or a fresh release root).
The ceremony described below has been performed. Verified 2026-08-08:
- The anchor is **pinned** — `trust::anchor::RELEASE_ROOT_PUBKEY_HEX` is a
`Some(...)`, not `None`.
- `releases/app-catalog.json` carries a `signature` and a `signed_by` did:key.
Everything below therefore describes how to *do* the ceremony, not work that is
outstanding. The one-way-door warning in "Why this is gated on you" still
applies in full to any re-run: once a binary pins an anchor, a catalog signed by
a different key is hard-rejected fleet-wide.
---
**Original status (2026-06-28):** The registry-distributed manifest pipeline is live — nodes fetch
`releases/app-catalog.json` from the OTA mirror and embed manifests (origin-wins, disk
fallback). What remains for Workstream B is **authenticity**: pin the release-root anchor and
ship a *signed* catalog so nodes can cryptographically verify the publisher.
Today the catalog is **accepted unsigned** ("migration window") and the anchor is **unpinned**
(`core/archipelago/src/trust/anchor.rs:21` → `RELEASE_ROOT_PUBKEY_HEX = None`). Completing B is
(`core/archipelago/src/trust/anchor.rs` → `RELEASE_ROOT_PUBKEY_HEX = None`). Completing B is
a coordinated ceremony that **only the publisher can run** — it needs the offline
`RELEASE_MASTER_MNEMONIC`, which is not (and must not be) stored on any node or build host.