A clone fails on tags made before a key rotation issue #114 closed: completed andymccall opened this 18 days ago · 1 comment

A fresh oxy clone https://oxygenhub.io/andymccall/oxygen fails with oxy 0.4.3:

error: origin v0.1.0: key [f1add7844d37](/andymccall/oxygen/change/f1add7844d37) may not create tags/v0.1.0 under this repository's policy

Found when a new runner (mars-1) had no cached copy of the oxygen subrepo and oxygenhub run 332's fmt job failed while cloning it.

Cause: a tag's attestation is checked against the current policy with Policy::authorizes, which knows nothing of rotation. v0.1.0 was signed by a key that has since been rotated to one the policy names, so every tag made before a rotation is refused, and one refused tag fails the whole clone. Changes already handle this (Policy::succeeds walks previous links); tags did not.

Fix: a tag signed by a predecessor of a key the rule lists is authorized when it is dated before that predecessor's successor was made, so old tags stay valid and a superseded key makes nothing new. Revoked keys never qualify.

After the fix: oxygen, then the pins in oxygenflow (runners) and oxygenhub, then the runners redeployed.