From a5a0731d20ce378b2f87ddb251b77ba5ea55a858 Mon Sep 17 00:00:00 2001 From: Albrecht Degering Date: Mon, 3 Aug 2026 17:09:50 +0200 Subject: [PATCH] Fix runtime distribution signing environment --- .gitea/workflows/runtime-distribution.yml | 2 +- docs/INSTALLATION_AND_DEPLOYMENT_ARCHITECTURE.md | 4 +++- tests/test_runtime_distribution_build.py | 14 ++++++++++++++ 3 files changed, 18 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/runtime-distribution.yml b/.gitea/workflows/runtime-distribution.yml index 13bad0a..0db84b3 100644 --- a/.gitea/workflows/runtime-distribution.yml +++ b/.gitea/workflows/runtime-distribution.yml @@ -202,7 +202,7 @@ jobs: --dependency "test_mail=$TEST_MAIL_IMAGE" \ --output-directory runtime-output/evidence \ --descriptor runtime-output/distribution-descriptor.json - python tools/release/generate-runtime-distribution.py \ + .runtime-build/bin/python tools/release/generate-runtime-distribution.py \ --descriptor runtime-output/distribution-descriptor.json \ --signing-key "$SIGNING_KEY_ID=runtime-output/signing-key.pem" \ --output runtime-output/distribution-manifest.json diff --git a/docs/INSTALLATION_AND_DEPLOYMENT_ARCHITECTURE.md b/docs/INSTALLATION_AND_DEPLOYMENT_ARCHITECTURE.md index c56736d..f4e8262 100644 --- a/docs/INSTALLATION_AND_DEPLOYMENT_ARCHITECTURE.md +++ b/docs/INSTALLATION_AND_DEPLOYMENT_ARCHITECTURE.md @@ -145,7 +145,9 @@ installation. Separate amd64/arm64 API and WebUI images are joined into OCI indexes and run as non-root identities. The release assets include CycloneDX application SBOMs, SLSA-style provenance, exact composition evidence, the single-file deployer, its detached Ed25519 signature, and a signed, expiring -distribution manifest. +distribution manifest. Evidence generation and signing run through the +workflow's isolated release Python environment so their cryptographic tooling +is explicit and independent of packages preinstalled in the Actions runner. The manifest contract is [`runtime-distribution-manifest.schema.json`](runtime-distribution-manifest.schema.json), diff --git a/tests/test_runtime_distribution_build.py b/tests/test_runtime_distribution_build.py index e7b4397..a00b2ec 100644 --- a/tests/test_runtime_distribution_build.py +++ b/tests/test_runtime_distribution_build.py @@ -29,6 +29,20 @@ FINALIZE = _load( class RuntimeDistributionBuildTests(unittest.TestCase): + def test_workflow_signs_with_the_release_environment(self) -> None: + workflow = (ROOT / ".gitea/workflows/runtime-distribution.yml").read_text( + encoding="utf-8" + ) + + self.assertIn( + ".runtime-build/bin/python tools/release/generate-runtime-distribution.py", + workflow, + ) + self.assertNotIn( + "\n python tools/release/generate-runtime-distribution.py", + workflow, + ) + def test_resolves_platforms_and_builds_evidence_descriptor(self) -> None: index = { "schemaVersion": 2,