feat(plugin): record installed-plugin provenance on the instance#422
Merged
Conversation
…re-plugins#8) Increment 4 of the registry supply-chain RFC. A successful plugin install now records its resolved provenance in two places on the instance (beyond the existing controller-side local record), so an audit can answer 'which plugin bytes are on this box, and how were they verified' from both the AWS control plane and the instance itself: - EC2 tag: spore:plugin:<name> = version + content-digest/commit prefixes + verification tier (signature/manifest/none). Compact, well under EC2's 256-char limit. Written via UpdateInstanceTags after a successful install. - spored state: Provenance threaded through the install request → InstallWithProvenance → persisted in PluginState. 'spawn plugin status' shows a Source: line. Both writes are best-effort — a tagging/state failure never fails an already-completed install. InstallWithPushed now delegates to the new InstallWithProvenance (nil prov = today's behavior); the install request gained an optional provenance field (older controllers omit it). Also documents the already-shipped legacy-bundle error fix (#421) in the CHANGELOG. Tests: provenance persisted to state; tag-value builder (all tiers, length bound).
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Increment 4 of the registry supply-chain RFC (spore-plugins#8, decision #5: EC2 tag + spored state).
What
A successful
spawn plugin installnow records the resolved provenance in two places on the instance (in addition to the existing controller-side local record), so an audit can answer "which plugin bytes are on this box, and how were they verified" from both the AWS control plane and the instance itself:spore:plugin:<name>— compact value:version=…;sha256=…;commit=…;verify=signature|manifest|none. Well under EC2's 256-char limit. Written viaUpdateInstanceTags.InstallWithProvenance→ persisted inPluginState.Provenance.spawn plugin status <name>shows aSource:line.Both are recorded once the install request is accepted (the bytes are on the box and their provenance is known), independent of whether the plugin's service later reaches Running — matching spored's state, which persists on failure too. Both writes are best-effort; a failure never fails the install.
InstallWithPushednow delegates toInstallWithProvenance(nil prov = today's behavior); the install request'sprovenancefield is optional (older controllers omit it).Tests
InstallWithProvenancepersists provenance to state.Real-AWS smoke ✅ (gated: TTL 30m, spore-host-dev)
Launched t3.small, hot-swapped branch spored (verified sha == local build), installed the signed official
rstudio-server@v1.0.1(signature verified (official release)):spore:plugin:rstudio-server = version=v1.0.1;sha256=0bffc628dd64;commit=2dda4ab8dc6f;verify=signaturespawn plugin statusshowsSource: commit 2dda4ab8dc6f · sha256 0bffc628dd64 · signature-verified ✓startstep failed (pre-existing plugin bug spore-plugins#12) — confirming provenance is captured regardless of the plugin's runtime outcome.Instance terminated; leak-check clean; S3 staging cleaned.
Also documents the already-merged legacy-bundle error fix (#421) in the CHANGELOG.
Refs #8.