Registry supply-chain: signed releases, checksums, source pinning, permission inspection

[scttfrdmn]

Problem

spawn plugin install github:org/repo/tool and registry installs execute third-party code locally and as root on the instance. There is currently no signing, checksumming, or pinning story documented, and questions the review raised are unanswered: does a version resolve to a git tag/release/branch/manifest? are files checksummed? can a tag be moved? are transitive downloads verified? is the resolved source recorded on the instance?

Proposed shape

• Signed registry releases + checksums for plugin artifacts
• Source pinning (resolve + record the exact commit on the instance)
• Permission inspection surfaced pre-install (pairs with spawn#387 plugin inspect and spawn#388 permissions: block)

Also: strategic registry expansion

The current four plugins (tailscale, rstudio-server, globus-personal-endpoint, spore-sync) prove the model across four shapes. Strong next candidates that demonstrate reusable strengths: JupyterLab, code-server, Docker/Podman, NVIDIA container toolkit, DCV, SSM setup, CloudWatch agent, Mountpoint-for-S3 / rclone, VS Code tunnel, Slurm client, GitHub Actions runner.

Raised by an external security/architecture review. See spawn#387/#388.

[scttfrdmn]

Design RFC drafted in PR #9 (docs/registry-supply-chain-rfc.md) — signing, immutable pinning, checksums (incl. fetch-step sha256), and trust tiers, complementing the shipped inspect/permissions work. This issue stays open to track the decision + implementation.

[scttfrdmn]

Reopened: PR #9 landed the design RFC (docs/registry-supply-chain-rfc.md), not the implementation. This issue stays open to track the signing/pinning/checksum decisions and their rollout.

[scttfrdmn]

Increment 1 landed in spore-host/spawn PR #398: the plugin resolver now records provenance — the exact plugin.yaml sha256 plus a best-effort immutable commit SHA — surfaced in spawn plugin inspect (a Resolved: line) and stored in the local install record. Still open for later increments: signed official releases, a checksum manifest, fetch-step sha256:, and on-instance/EC2-tag recording.