Skip to content

fix(packages): honor APK signature key name - #46

Merged
jmgilman merged 1 commit into
mainfrom
fix/apk-signature-key-name
Aug 22, 2026
Merged

jmgilman merged 1 commit into
mainfrom
fix/apk-signature-key-name

Conversation

@jmgilman

Copy link
Copy Markdown
Contributor

Summary

  • read the RSA public-key basename declared by the APK signature stream
  • mount the reviewed repository key under that producer-declared name for apk verify
  • bound signature-stream decompression and reject unsafe key names

Production evidence

Run 32544821775 reached apk verify with all signing and R2 secrets, then failed because .config/keys/repository-apk.rsa.pub was mounted under its config filename instead of the package signature name.

Verification

  • go test ./internal/adapter/pkgverify

@jmgilman
jmgilman merged commit 9870697 into main Aug 22, 2026
3 checks passed
@jmgilman
jmgilman deleted the fix/apk-signature-key-name branch August 22, 2026 02:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant