rasterstate/download-artifact-action
2
0
Fork 0
Code Issues 4 Pull requests Projects Releases Packages Wiki Activity Actions

Broker/store must mint signed repo-scoped artifact claims #17

New issue
Open
opened 2026-07-05 20:43:06 +00:00 by stephen · 0 comments
stephen commented 2026-07-05 20:43:06 +00:00
Owner
Copy link

Companion to #15 and PR #16's CHANGES review.

The action-side fix verifies RASTER_ARTIFACTS_SCOPE_CLAIM and derives the artifact prefix from the signed repository claim, but production still needs a trusted issuer outside the workflow job:

  • The Forgejo runner, broker, or store front-end must mint RASTER_ARTIFACTS_SCOPE_CLAIM for the actual run repository before job steps execute.
  • The private signing key must never be exposed to workflow-controlled env or repository secrets. Jobs receive only the claim and the public verification key.
  • The claim should include at least repository; include exp and run metadata if available.
  • Store credentials or policy should be narrowed to the same repository prefix where possible, so the signed claim and backend policy agree.

Without this issuer/store half, a deployment cannot provide the signed claim required by the action and should keep #15 open for production rollout tracking.

Companion to #15 and PR #16's CHANGES review. The action-side fix verifies `RASTER_ARTIFACTS_SCOPE_CLAIM` and derives the artifact prefix from the signed `repository` claim, but production still needs a trusted issuer outside the workflow job: - The Forgejo runner, broker, or store front-end must mint `RASTER_ARTIFACTS_SCOPE_CLAIM` for the actual run repository before job steps execute. - The private signing key must never be exposed to workflow-controlled env or repository secrets. Jobs receive only the claim and the public verification key. - The claim should include at least `repository`; include `exp` and run metadata if available. - Store credentials or policy should be narrowed to the same repository prefix where possible, so the signed claim and backend policy agree. Without this issuer/store half, a deployment cannot provide the signed claim required by the action and should keep #15 open for production rollout tracking.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
fix/server-bound-scope-15
fix/scope-isolation-15
ci/pr-test-gate
feat/artifact-integrity
harden-bounded-decompression
feat/2-safe-extract
feat/2-extraction-caps-setuid
wip/claude-3/rasterstate-download-artifact-action
feat/1-verify-digest
feat/2-safe-extraction
wip/claude-1/rasterstate-download-artifact-action
v1
v1.0.0
Labels
Clear labels   
backlog
Accepted but not scheduled

  
blocked
Blocked or stalled waiting on external progress

  
converted
Converted into tracked work

  
opportunity
Potential product or business opportunity

  
p1
Priority 1

  
p2
Priority 2

  
p3
Priority 3

  
parked
Paused intentionally until later

No labels
backlog
blocked
converted
opportunity
p1
p2
p3
parked
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
rasterstate/download-artifact-action#17
No description provided.