feat: enforce CAC admissibility pipeline and signed CACert issuance#23618
feat: enforce CAC admissibility pipeline and signed CACert issuance#23618BrianCLong wants to merge 1 commit intomainfrom
Conversation
BrianCLong
added
the
codex
ChatGPT Codex Connector
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 17 minutes and 44 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (28)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 40dce4bbc3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Execute checks for CACert input | ||
| run: | | ||
| node ci/admissibility/admissibility_check.mjs examples/cac/valid_run schemas/cac |
There was a problem hiding this comment.
Each GitHub Actions job starts from a fresh checkout, but only admissibility_check installs ajv; the cacert job reruns admissibility_check.mjs (and later verify_cacert.mjs), both of which import ajv. In a clean runner this causes ERR_MODULE_NOT_FOUND and blocks CACert generation even for valid inputs, so the enforcement workflow cannot pass end-to-end.
Useful? React with 👍 / 👎.
| const outputSet = new Set(trace.outputs.map((o) => o.id)); | ||
| const stepSet = new Set(trace.steps.map((s) => s.id)); |
There was a problem hiding this comment.
The admissibility check only tracks decision_trace.outputs[*].id and never validates that each produced_by_step_id points to an existing step that actually emits that output. This allows a tampered trace to pass with incorrect provenance links (wrong producer attribution), which weakens the lineage guarantees this gate is supposed to enforce.
Useful? React with 👍 / 👎.
| const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8')); | ||
| if (!Array.isArray(manifest.artifacts) || manifest.artifacts.length === 0) { |
There was a problem hiding this comment.
The integrity check verifies manifest signatures and per-artifact hashes, but it never checks that the report’s required artifact_manifest_sha256 matches the manifest digest being verified. Because of this, a report can carry an arbitrary or stale manifest hash and still PASS, so the reported digest is not cryptographically bound to the validated evidence set.
Useful? React with 👍 / 👎.
BrianCLong
force-pushed
the
codex/implement-cacert-enforcement-and-issuance-pipeline
branch
from
40dce4b to
84c7eed
Compare
1 participant
Motivation
Description
.github/workflows/cac-enforcement.ymlthat runs the three checks and issues/verifies a signed CACert.ci/admissibility/:admissibility_check.mjs,reproducibility_check.mjs, andevidence_integrity_check.mjswhich validate lineage, replayability, and artifact signature/hash integrity respectively.scripts/cac/:generate_cacert.mjsto emit and signcacert.jsonandverify_cacert.mjsto validate schema, signatures, and artifact hashes.schemas/cac/(report.schema.json,metrics.schema.json,decision_trace.schema.json,failure_case.schema.json,cacert.schema.json) that require hashes, stable ordering, and forbid timestamps/volatile fields.examples/cac/valid_run/andexamples/cac/failing_run/including per-casefailure_case.jsonartifacts and manifest samples to exercise pass/fail behavior.docs/roadmap/STATUS.jsonto record progress and intent.Testing
node ci/admissibility/admissibility_check.mjs examples/cac/valid_run schemas/cacand it PASSed.node ci/admissibility/reproducibility_check.mjs examples/cac/valid_run 0and it PASSed.admissibility_check,reproducibility_check, andevidence_integrity_checkonexamples/cac/failing_runall failed as expected (missing trace link, replay drift, and hash mismatch respectively).evidence_integrity_checkand CACert signing/verification require thecosignbinary;cosignis installed in the workflow viasigstore/cosign-installer@v3.7.0, and the local sandbox did not includecosignfor a full local sign/verify run. All checks and signing are exercised end-to-end in CI.Codex Task