External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

ci(ocr): verify the baked trust file, not unset image env vars (#666)

Browse Source 
Fourth latent bug in the OCR publish chain (#649/#519 added it, never ran).
verify-ocr's trust-identity step read OCR_RUNTIME_INDEX_KEY_ID from the image env,
which the official image leaves unset by design (operator-override path;
runtime-index.ts reads the baked file when env is unset). It compared "" to
snapotter-ocr-2026-07 and failed a correct image. Now verifies the baked
/app/docker/ocr-runtime-trust.json, proven against the built release image.

A full audit of the remaining chain (verify, sign, verify-signed, publish)
reproduced the sign+verify path end-to-end inside the image and confirmed nothing
else breaks for v2.2.0. One latent non-ASCII canonicalization mismatch filed as
#667 (cannot fire on v2.2.0). Non-releasable type so the re-dispatch re-runs 2.2.0.
This commit is contained in:
SnapOtter
2026-07-29 20:21:16 +08:00
committed by GitHub
parent c2903872bb
commit 44081e6a3f
2 changed files with 22 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/infra/ocr-release-workflow.test.ts
+8 -2
View File
@@ -203,8 +203,14 @@ describe("OCR v3 bundle release workflow", () => {
expect(verifyJob).toContain("timeout-minutes: 90");
expect(verifyJob).toContain("docker/verify-ocr-runtime.sh");
expect(verifyJob).toContain("Verify image has the release trust identity");
expect(verifyJob).toContain("Verification image OCR key ID does not match");
expect(verifyJob).toContain("Verification image OCR public key does not match");
// The identity is verified against the baked trust FILE, which the runtime
// reads, not the OCR_RUNTIME_INDEX_* env vars, which the official image leaves
// unset by design. Reading the env compared "" and failed a correct image.
expect(verifyJob).toContain("cat /app/docker/ocr-runtime-trust.json");
expect(verifyJob).toContain(".keys[0].keyId");
expect(verifyJob).toContain("Baked OCR trust key ID");
expect(verifyJob).toContain("Baked OCR trust public key does not match");
expect(verifyJob).not.toContain('printf %s "$OCR_RUNTIME_INDEX_KEY_ID"');
expect(verifyJob).toContain(
'actual_official_container="$(docker run --rm --entrypoint sh "${SNAPOTTER_BUNDLE_IMAGE}"',
);