9
2
Fork
You've already forked platform
2

cli/README moderate trust workflow blocks #207

Closed
opened 2026年04月28日 11:06:46 +02:00 by modalala · 1 comment

Following quickstart docs:

(https://docs.caution.co/quickstart/ > https://docs.caution.co/quickstart/fully-managed/#install-the-cli > https://codeberg.org/caution/platform/src/branch/main/src/cli/README.md)

I was blocked trying to follow https://codeberg.org/caution/platform/src/branch/main/src/cli/README.md#moderate-trust

(削除) 2. Review and import signing keys (削除ここまで)

(削除) Once satisfied, import the keys you trust: (削除ここまで)
(削除) ~~ gpg --fetch-keys https://keyoxide.org/6B61ECD76088748C70590D55E90A401336C8AAA9 gpg --fetch-keys https://keyoxide.org/F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D gpg --fetch-keys https://keyoxide.org/88823A75ECAA786B0FF38B148E401478A3FBEF72 gpg --fetch-keys https://keyoxide.org/C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD ~~ (削除ここまで)

(削除) all returned gpg: no valid OpenPGP data found. This is because of how keyoxide is responding. (削除ここまで)
(削除) curl -L https://keyoxide.org/C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD (削除ここまで)
(削除) returns (削除ここまで)
(削除) <!DOCTYPE html> (削除ここまで)

(削除) I changed each command in a PR, which seems to work as is intended, see #205 (削除ここまで)
EDIT: PR merged! Section 2 is resolved.

3. Verify signatures

This section is currently not functioning.

After importing keys, I'm blocked trying to get manifest.txt and a signature for the manifest. Running make verify-cli returns:
make: *** No rule to make target 'dist/cli/manifest.txt', needed by 'verify-cli'. Stop.

I believe the end goal here is to allow caution cli users to confirm the integrity of their locally built binary. To do so they must have a reproducibly built binary with expectations anchored in the maintainers' keys.

Using make release-cli builds the binary and creates the manifest.txt derived from it, but in that case I still don't have one or more detached signature .asc files.

What we could do:
The 4 maintainers create an .asc file that is available to users via fetch or checked into the repo. In fact, checking in signatures seems to be encouraged later in the same README file being evaluated.

Then, create a new make target command for users to fetch the manifest, and verify with the signatures, or incorporate the proposed functionality into make verify-cli.

Finally, possibly create a canonical manifest.txt or eliminate ir. A signature for a blob can exist on its own.

(削除) I am not sure this is helpful, but I wrote a patch that uses make release-cli - which might be a partial solution. See #206 (削除ここまで)

Signers
Finally, a small related point: Daniel doesn't have any associated accounts linked on keyoxide, unlike the other signers - so a user has no way to simply follow the signers links, and confirm from there.)

### Following quickstart docs: (https://docs.caution.co/quickstart/ > https://docs.caution.co/quickstart/fully-managed/#install-the-cli > https://codeberg.org/caution/platform/src/branch/main/src/cli/README.md) I was blocked trying to follow https://codeberg.org/caution/platform/src/branch/main/src/cli/README.md#moderate-trust ~~**2. Review and import signing keys**~~ ~~Once satisfied, import the keys you trust:~~ ~~```~~ gpg --fetch-keys https://keyoxide.org/6B61ECD76088748C70590D55E90A401336C8AAA9 gpg --fetch-keys https://keyoxide.org/F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D gpg --fetch-keys https://keyoxide.org/88823A75ECAA786B0FF38B148E401478A3FBEF72 gpg --fetch-keys https://keyoxide.org/C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD ~~```~~ ~~all returned `gpg: no valid OpenPGP data found.` This is because of how keyoxide is responding.~~ ~~`curl -L https://keyoxide.org/C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD`~~ ~~returns~~ ~~`<!DOCTYPE html>`~~ ~~I changed each command in a PR, which seems to work as is intended, see #205~~ EDIT: PR merged! Section 2 is resolved. **3. Verify signatures** This section is currently not functioning. After importing keys, I'm blocked trying to get `manifest.txt` and a signature for the manifest. Running `make verify-cli` returns: `make: *** No rule to make target 'dist/cli/manifest.txt', needed by 'verify-cli'. Stop.` I believe the end goal here is to allow caution cli users to confirm the integrity of their locally built binary. To do so they must have a reproducibly built binary with expectations anchored in the maintainers' keys. Using `make release-cli` builds the binary and creates the `manifest.txt` derived from it, but in that case I still don't have one or more detached signature `.asc` files. What we could do: The 4 maintainers create an `.asc` file that is available to users via fetch or checked into the repo. In fact, [checking in signatures seems to be encouraged later in the same README file](https://codeberg.org/caution/platform/src/commit/9f43628a7d9c200f1c4a944d7803c7d5d962c520/src/cli/README.md?display=source#L157) being evaluated. Then, create a new `make` target command for users to fetch the manifest, and verify with the signatures, or incorporate the proposed functionality into `make verify-cli`. Finally, possibly create a canonical `manifest.txt` or eliminate ir. A signature for a blob can exist on its own. ~~I am not sure this is helpful, but I wrote a patch that uses `make release-cli` - which might be a partial solution. See #206~~ **Signers** Finally, a small related point: Daniel doesn't have any associated accounts linked on keyoxide, unlike the other signers - so a user has no way to simply follow the [signers links](https://codeberg.org/caution/platform/src/branch/main/src/cli/README.md#signers), and confirm from there.)
modalala changed title from (削除) cli/README moderate-trust workflow blocks (削除ここまで) to cli/README moderate trust workflow blocks 2026年04月29日 00:36:46 +02:00

Closing in favor of #339

Closing in favor of https://codeberg.org/caution/platform/issues/339
Sign in to join this conversation.
No Branch/Tag specified
main
feat/paddle-byoc-subscriptions
feat/legal-publish-doc
fix/issue-116-duplicate-ssh-key
fix/issue-307-remove-apps
fix/issue-265-http-port-private
fix/issue-330-remove-build-binary
feat/issue-164-account-id
fix/issue-119-logout-confirmation
feat/add-tofu-lockfile-cache
feat/webauthn-discoverable-login
docs/issue-339-install-instructions
fix/issue-336-split-qr-login-tokens
fix/verify-app-source-preflight
fix/many-git-push-deploy
fix/issue-334-email-verification-throttle
fix/issue-273-billing-url
fix/issue-333-final-usage-collection
fix/issue-270-low-credit-email
fix/issue-301-remove-auto-topup
fix/issue-320-byoc-auth-first
fix/issue-348-git-progress-checklist
fix/issue-321-byoc-caution-hcl
fix/issue-332-resource-id-suspension
fix/eif-app-mode-normalization
feat/cli-stagex-container
fix/eif-s3-layer-cache
fix/authz-role-checks
fix/paddle-customdata-credit-mint
fix/cli-hangs-unsupported-ssh-url
feat/print-platform-commit-dashboard
anton/feat/multi-user
fix/config-domain-validation
anton/support-ssh-destroy-get
fix/cli-config-dir
feat/publish-build-inputs
feat/locksmith-polishing
fix/procfile-run-command-no-split
anton/byoc-require-login
fix/hcl-init-template
feat/egress-default-deny
ryansquared/hcl
quotas
anton/feat/region-routing-resource-unavailable-alert
fix/attestation-502-dashboard
ryansquared/systemdize
fix/verify-git-credential-hang
anton/fix-low-credits-alert
xenushka/rename-byoc
ryansquared/add-download-eif
add-debug-flag
test/pr1-integration-harness
anton/fix/only-pass-required-env-vars
ryansquared/add-database-bucket
No results found.
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
Component/Enclave-Builder
This issue affects Enclave Builder (git-push and CLI)
Component/Infrastructure
This issue affects generic Caution hosted infra components
Deploy/BYOC
Relates to Caution Bring-your-own-compute
Deploy/Full-managed
Relates to Caution fully managed cloud
Deploy/Self-hosted
Relates to Caution deployed on self-hosted infra
Interface/API
This issue affects the API
Interface/CLI
This issue affects the command line interface
Interface/Git
This issue affects the Git `push` interface
Interface/Web
This issue affects the web dashboard
Kind/Bug
Something is not working
Kind/Documentation
Documentation changes
Kind/Enhancement
Improve existing functionality
Kind/Feature
New functionality
Kind/Security
This is security issue
Kind/Testing
Issue or pull request related to testing
Priority
Critical
The priority is critical
Priority
High
The priority is high
Priority
Low
The priority is low
Priority
Medium
The priority is medium
Reviewed
Confirmed
Issue has been confirmed
Reviewed
Duplicate
This issue or pull request already exists
Reviewed
Invalid
Invalid issue
Reviewed
Won't Fix
This issue won't be fixed
Status
Abandoned
Somebody has started to work on this but abandoned work
Status
Blocked
Something is blocking this issue or pull request
Status
Need More Info
Feedback is required to reproduce issue or to continue work
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
caution/platform#207
Reference in a new issue
caution/platform
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?