ci(renovate): auto-update SHA256 checksums for tirith and cosign - #5851
Conversation
PR Summary by Qodoci(renovate): auto-update tirith SHA256 checksums after version bumps
AI Description
Diagram
High-Level Assessment
Files changed (4)
|
|
🤖 Finished Review · ✅ Success · Started 7:39 AM UTC · Completed 7:55 AM UTC |
Code Review by Qodo
1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
ReviewFindingsMedium
Low
Previous runReviewFindingsMedium
Low
Next steps:
Previous run (2)ReviewFindingsHigh
Medium
Low
Next steps:
Previous run (3)ReviewFindingsMedium
Low
Next steps:
Previous run (4)ReviewFindingsMedium
Low
Previous run (5)ReviewFindingsMedium
Low
Previous run (6)ReviewFindingsMedium
Low
Labels: PR modifies CI/Renovate configuration and sandbox image build Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
component/ci
7099360 to
61bb450
Compare
|
🤖 Finished Review · ✅ Success · Started 8:11 AM UTC · Completed 8:25 AM UTC |
Superseded by updated review
fullsend-ai-review
Bot
added
the
requires-manual-review
waynesun09
left a comment
waynesun09
left a comment
There was a problem hiding this comment.
Review-only pass (no approval/changes requested). Two inline findings above; one additional finding that isn't tied to a specific line:
[MEDIUM] PR's own linked dry-run evidence shows postUpgradeTasks failing, not succeeding
The PR test plan cites a Renovate dry-run (run 30794383857, job 91624555395) as proof postUpgradeTasks wiring works, but the actual log from that run shows an artifactError with Command failed: bash scripts/renovate/update-tirith-checksums.sh ... No such file or directory, and Renovate falling back to a dry-run lock-file-error comment — i.e. the postUpgradeTasks command never actually executed successfully in the cited evidence. This happens because the dry run checked out main, which doesn't yet have the new script (only this PR's branch does) — a chicken-and-egg gap. So the actual post-merge behavior of the new automation (does it correctly patch the Containerfile end-to-end against a real upstream release) has never been demonstrated to work; the cited "proof" actually demonstrates the opposite.
Suggestion: Re-run the dry-run pointed at a branch/config where the script already exists (e.g. RENOVATE_BASE_BRANCHES set to this PR's branch) and link a run showing the script executing successfully end-to-end, or explicitly caveat in the PR description that the wiring is unverified until the first real run against main post-merge, with a plan to check that run.
61bb450 to
904360d
Compare
|
🤖 Review · ❌ Terminated · Started 1:42 PM UTC · Ended 2:00 PM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 1:42 PM UTC · Completed 2:00 PM UTC |
waynesun09
left a comment
waynesun09
left a comment
There was a problem hiding this comment.
Review-only pass (no approval/changes requested). Two new inline findings below, not previously raised in the existing bot/human review threads on this PR.
904360d to
dd41b03
Compare
|
🤖 Review · |
dd41b03 to
81dfb61
Compare
|
🤖 Finished Review · ✅ Success · Started 5:48 AM UTC · Completed 6:05 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
removed
the
requires-manual-review
waynesun09
left a comment
waynesun09
left a comment
There was a problem hiding this comment.
Review-only sweep (no assignment, no approve/request-changes). Both findings below are independently verified and distinct from the existing discussion threads on this PR.
rh-hemartin
changed the title
81dfb61 to
96cdc3d
Compare
|
🤖 Finished Review · ✅ Success · Started 9:20 AM UTC · Completed 10:02 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
waynesun09
left a comment
waynesun09
left a comment
There was a problem hiding this comment.
Review-only pass (no approval/changes requested, no self-assignment). Two verified findings below.
96cdc3d to
9b63ee3
Compare
|
🤖 Review · |
9b63ee3 to
2347bb6
Compare
|
🤖 Finished Review · ✅ Success · Started 7:41 AM UTC · Completed 8:00 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Renovate bumps TIRITH_VERSION but left TIRITH_SHA256_{AMD64,ARM64}
stale, breaking the sandbox image build. Add a postUpgradeTasks script
that fetches checksums.txt from the new release and patches the
Containerfile ARGs automatically.
This process needed cosign, which is not installed on Renovate base
image. Add a Renovate rule to update the Cosign binary installed
within `scripts/renovate/update-tirith-checksums.sh`. To update
cosign itself another script is added which first downloads the previous
cosign version and then uses it to verify the next cosign version.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Hector Martinez <hemartin@redhat.com>
2347bb6 to
318c987
Compare
|
🤖 Finished Review · ✅ Success · Started 6:22 AM UTC · Completed 6:40 AM UTC |
Superseded by updated review
fullsend-ai-review
Bot
added
the
requires-manual-review
waynesun09
left a comment
waynesun09
left a comment
There was a problem hiding this comment.
Approving. I validated the tirith version-lock and install chain end to end by actually executing both scripts, not just reading them.
What I ran
update-tirith-checksums.shin the real Renovate runtime —ghcr.io/renovatebot/renovate:43(the default image for the pinnedrenovatebot/github-actionv46.1.21), linux/amd64, with the Containerfile pre-bumped toTIRITH_VERSION=0.3.3and a deliberately wrongTIRITH_SHA256_AMD64. Result: cosign bootstrapsha256sum -c→ OK,verify-blobonchecksums.txt→Verified OK, both ARGs rewritten, exit 0.- Toolchain check on that same image —
curl,git,sha256sum,mktemp,sed -i, GNUgrep 3.11(sogrep -oPworks), and outbound HTTPS to GitHub releases all present/working. Worth confirming explicitly since the whole design rests on the Renovate image being able to fetch and hash. update-cosign-checksum.shagainst a real pending bump — cosign v3.1.3 shipped 2026-08-06, so I simulated exactly the bump Renovate will produce (3.1.2 → 3.1.3) in a throwaway git repo: old binary bootstrapped and checksum-verified, new binary's sigstore bundle verified with the old binary (Verified OK),COSIGN_SHA256rewritten. Thekeyless@projectsigstore.iam.gserviceaccount.com/accounts.google.comidentity pin is correct for current cosign releases.
Cross-checks against upstream (independent of the scripts)
- Written amd64/arm64 SHAs match tirith v0.3.3's signed
checksums.txtexactly (6cdbe35e…,c784233…). - Downloading
tirith-x86_64-unknown-linux-gnu.tar.gzv0.3.3 hashes to the amd64 value the script wrote, and the tarball hastirithas a top-level member — so the Containerfile'ssha256sum -c -+tar xzf -C /usr/local/bin tirithinstall step succeeds with what the script produces. Theamd64→x86_64/arm64→aarch64mapping matches the release asset names. - Computed cosign SHA
4629c757…matches sigstore's owncosign_checksums.txtfor v3.1.3. checksums.txtuses the two-spacesha256␣␣filenameformat the anchored greps require, and only one line matches each pattern.RENOVATE_ALLOWED_COMMANDSis the correct (non-deprecated) name for Renovate 43, and the anchored^bash scripts/renovate/[a-zA-Z0-9_-]+\.sh$regex admits both scripts.
Failure modes are all fail-closed: a bad cosign bootstrap hash, a missing/invalid signature, a non-semver version, or a malformed digest each abort before any sed, leaving the pinned checksums untouched and the bump PR blocked. automerge: false on both rules keeps a human in the loop either way.
Non-blocking notes (nothing here needs a change in this PR)
- cosign 3.x prints deprecation warnings for
--certificate/--signature(please use --bundle with --trusted-root). Works today; a future cosign major that removes them would break tirith bumps — fail-closed, but worth a follow-up when it lands. - The
command -v cosignfallback trusting a PATH cosign is a deliberate, already-discussed trade-off; fine as a follow-up if the base image ever ships one. - The remaining open thread is the 4-space vs 2-space indentation nit — cosmetic.
|
🤖 Finished Retro · ✅ Success · Started 1:08 PM UTC · Completed 1:24 PM UTC Commit: |
Retro: PR #5851 — ci(renovate): auto-update SHA256 checksums for tirith and cosignWorkflow OverviewHuman-authored PR by rh-hemartin (co-authored with Claude Code) adding Renovate post-upgrade scripts to auto-update SHA256 checksums for tirith and cosign. The PR went through 7 review agent iterations over 4 days (Aug 3–7), with extensive human review from waynesun09. Merged after thorough validation. Agents repo: Review Quality DeltaThe human reviewer (waynesun09) consistently found higher-impact issues than the review agent. Key findings by source: Human found, agent never found (7 issues):
Human found first, agent found 1 day later (1 issue):
Agent found first (3 issues):
What made the human review superior: domain-specific Renovate expertise (deprecated env vars, executionMode bugs), live state verification (checking PR #5618 via API, running scripts in the Renovate container), and systemic thinking (detecting the irony of hardcoding cosign while automating tirith). What Went Well
Evidence Supporting Existing Issues
Proposals filed
|
waynesun09
left a comment
waynesun09
left a comment
There was a problem hiding this comment.
Automated review sweep: 2 additional findings below.
| "${COSIGN}" verify-blob \ | ||
| --certificate "${WORKDIR}/checksums.txt.pem" \ | ||
| --signature "${WORKDIR}/checksums.txt.sig" \ | ||
| --certificate-identity-regexp "^https://github\\.com/sheeki03/tirith/\\.github/workflows/" \ |
There was a problem hiding this comment.
[MEDIUM] cosign certificate-identity-regexp for tirith accepts any .github/workflows/ file, not just release.yml
Independently verified by decoding the real checksums.txt.pem for tirith v0.3.1: the certificate SAN is exactly https://github.com/sheeki03/tirith/.github/workflows/release.yml@refs/tags/v0.3.1. The --certificate-identity-regexp here is anchored only at the start (^https://github\.com/sheeki03/tirith/\.github/workflows/), so it would accept a Fulcio cert minted by ANY workflow under that path, not just release.yml — confirmed via the GitHub API that sheeki03/tirith also has ci.yml, bench.yml, fuzz.yml, and threatdb.yml. None of those currently declare id-token: write (also confirmed), so this isn't exploitable today, but the trust boundary is looser than it needs to be: if any workflow in that upstream, third-party repo is ever granted OIDC signing permission for any reason, it could mint a signature this script would accept as a valid tirith "release". This is distinct from the earlier resolved thread on this line (which made the regex match upstream install.sh's .github/workflows/ prefix) — that fix matched upstream's scope, but upstream's scope itself doesn't pin to the specific release workflow.
Suggestion: anchor the regex to the exact release workflow and version being fetched, e.g. --certificate-identity-regexp "^https://github\\.com/sheeki03/tirith/\\.github/workflows/release\\.yml@refs/tags/v${VERSION}$", so a compromised or newly-added non-release workflow with id-token: write can't forge a valid signature.
| SCRIPT="scripts/renovate/update-tirith-checksums.sh" | ||
|
|
||
| # --- Read old and new versions --- | ||
| OLD_VERSION=$(git show HEAD:"${SCRIPT}" | grep -oP '^COSIGN_VERSION=\K\S+' || true) |
There was a problem hiding this comment.
[MEDIUM] OLD_VERSION extraction via git show HEAD assumes an unconfirmed Renovate commit ordering for executionMode: branch
OLD_VERSION/OLD_SHA256 are read via git show HEAD:"${SCRIPT}" while NEW_VERSION is read from the working tree. This only produces a correct diff if Renovate applies the COSIGN_VERSION bump to the working tree but has NOT yet committed it to HEAD by the time postUpgradeTasks runs. The cosign packageRule in renovate.json now uses executionMode: "branch" (changed in this same PR specifically to work around the previously-flagged 'update'-mode same-file collision, renovatebot/renovate#42263). I could not confirm from Renovate's public docs whether 'branch' mode commits the manager's version bump before or after invoking postUpgradeTasks. If the bump is committed first, git show HEAD would already return the NEW version, OLD_VERSION would equal NEW_VERSION, and the script would print "cosign version unchanged (...)" and exit 0 without verifying the new binary or refreshing COSIGN_SHA256 — a silent no-op that looks successful in CI logs.
Suggestion: confirm Renovate's actual commit ordering for executionMode: branch against a real cosign version bump before relying on this, or make the script resilient to either ordering (e.g. derive OLD_VERSION from the parent commit git show HEAD~1:... or add an explicit log/guard that treats an unexpected 'unchanged' result as suspicious when the Renovate PR title indicates a bump).
2 participants
Summary
scripts/renovate/update-tirith-checksums.shthat fetcheschecksums.txtfrom the tirith GitHub release, verifies its cosign signature against the Sigstore transparency log, and patchesTIRITH_SHA256_AMD64/ARM64in the sandbox Containerfile. Cosign is not installed on the Renovate base image, so the script bootstraps it from a pinned version and SHA256.scripts/renovate/update-cosign-checksum.shthat downloads the new cosign binary, verifies its sigstore bundle using the old pinned binary, and updatesCOSIGN_SHA256inupdate-tirith-checksums.sh.postUpgradeTasksto the tirith and cosign package rules inrenovate.jsonso both scripts run after Renovate bumps their respective versions.customManagerso Renovate tracks the cosign version pin inupdate-tirith-checksums.sh.RENOVATE_ALLOWED_POST_UPGRADE_COMMANDSin.github/workflows/renovate.yml.automerge: falsefor tirith so a human still reviews each version bump before merge.Fixes: #5618
Test plan
verify-blobpasses against live v0.3.1 release artifacts with identity pinned tosheeki03/tirithand GitHub Actions OIDC issuer🤖 Generated with Claude Code