feat(prs-556): make ABI trust posture an explicit policy - #457
Open
pepe-anchor wants to merge 1 commit into
Open
feat(prs-556): make ABI trust posture an explicit policy#457pepe-anchor wants to merge 1 commit into
pepe-anchor wants to merge 1 commit into
Conversation
Add MetadataTrustPolicy enum (AcceptUnsigned | RequireAllowlistedSigner) and SignerAllowlist to visualsign::signing. No Default impl — a deployment must state which posture it runs. Mark enum #[non_exhaustive].
Contributor
There was a problem hiding this comment.
Pull request overview
Introduces an explicit, deploy-time ABI metadata trust posture in visualsign::signing by making MetadataTrustPolicy explicitly non-default and preparing it for future expansion.
Changes:
- Updates
MetadataTrustPolicydocs to reflect a deploy-time (startup) trust posture decision. - Marks
MetadataTrustPolicyas#[non_exhaustive]to allow adding future posture variants.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+130
to
+133
| /// Because the choice lives on the parser's cmdline (for the enclave binary, in | ||
| /// the `pivotArgs` of the signed TVC manifest), a signer can verify out of band | ||
| /// which posture the deployment they are signing against actually runs, instead | ||
| /// of trusting a per-request signal or a log line that no one sees. |
Comment on lines
+153
to
+155
| /// Marked `#[non_exhaustive]` so a third posture can be added without breaking | ||
| /// downstream crates that match on this enum. Every match today lives in this | ||
| /// module; consumers only construct variants. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why am I making this PR?
The parser currently makes ABI trust decisions per-request, meaning a caller can opt into leniency by omitting a signature. The trust posture should be a deploy-time choice, fixed at startup and auditable in the TVC manifest.
What am I changing?
Add
MetadataTrustPolicyenum (AcceptUnsigned | RequireAllowlistedSigner) andSignerAllowlisttovisualsign::signing. No Default impl, a deployment must explicitly state which posture it runs. Marked#[non_exhaustive]so future posture variants are safe.What is the Linear ticket?
PRS-556
What are the rollback steps?
Revert the commit. No wire-format or API changes at this layer.
Is this change backwards compatible?
Yes. No existing callers are broken,
MetadataTrustPolicyhas no Default impl so every construction site is explicit.Does this require cross-team/service coordination?
No.
How do I know it works as designed? Which tests exercise this code?
Existing signing.rs unit tests cover SignerAllowlist construction and policy accessors.
Verified at this commit:
cargo clippy --all-targets -- -D warningsclean,cargo fmt --checkclean. TheubuntuCI job passed on this exact commit under #440 (run 31109841752).