Repository navigation
The signature, provenance and zone tools' comments are shorter, with their reasons kept - #242
Merged
Merged
Conversation
…their reasons kept: cleanup-held's cut of tools/kryptik, tools/provenance-inventory.sh, tools/verify-signatures.sh and three of their tests, redone on main by hand, comments only Only comment regions are taken from 65a6fbb; its message, help-range and test-label changes are left out. Where the cut dropped a reason, a shorter one is kept: kryptik has no transfer, clipboard or mount command because from zone 0 those would bypass the chrome, --ask passes the passphrase never as an argument, a Wi-Fi passphrase goes on stdin; the inventory's || true and its passthrough of publisher-named classes; the GNU keyring vouches only for whoever it names until checked out of band, a pinned key is one its project publishes on its own origin, which CPython releases the python key signs, netfilter's confirmation of its current key, anchored_import's return codes and kernel.org's signed projects. tools/key-provenance.tsv is left as it is: its header says what each confirmation route establishes and where it stops, which a summary loses.
This was referenced Oct 7, 2026
This was referenced Oct 7, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The second part of the cleanup-held redo (#241 has the first). These are comments only, in
tools/kryptik,tools/provenance-inventory.sh,tools/verify-signatures.shand three tests:tools/tests/boot-success.sh,update-manifest-snapshot.shandverify-signatures.sh.How it was done. Cleanup-held's change was merged onto main. A changed region was kept only when every line on both sides is a comment or blank; a trailing comment counts only when the code before it is the same. Everything else went back to main: code, the user-facing messages and
--helpline ranges the held cut also rewrote, test labels, and every conflict. Then each kept cut was read by hand. Stripping comments from main's version and this one gives the same code in all six files;bash -npasses.Changed from the held cut, to keep a reason it dropped:
tools/kryptik: why there is no transfer, clipboard or mount command (from zone 0 they would bypass the chrome's approval); that--askpasses the passphrase never as an argument; and that a Wi-Fi passphrase always goes on stdin.tools/provenance-inventory.sh: why|| truefollows find and du (common.sh's ERR trap would abort); and why publisher-named classes are passed through (otherwise they would read as unverified).tools/verify-signatures.sh:anchored_import's return codes, 1 and 2, which callers use.Taken where the held cut corrects a comment: the stale-note rule in verify-signatures.sh now says what the code does (a note for a source outside the manifest is not flagged), and the test's summary says
nosigis unsigned, which its assertion checks.Dropped:
tools/key-provenance.tsv: its header says what each confirmation route (korg, wkd, savannah, github) establishes and where it stops. The held summary loses those distinctions, and merged onto main's text it would say the rest twice.tools/tests/provenance-inventory.sh: its only change conflicted.Proof: CI (shellcheck, syntax, the fixture suites, and the Source manifest job that runs verify-signatures.sh). Nothing the image does changes.