Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1180 +/- ##
==========================================
+ Coverage 92.16% 92.25% +0.08%
==========================================
Files 160 161 +1
Lines 7698 7863 +165
==========================================
+ Hits 7095 7254 +159
- Misses 603 609 +6
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
clement-tourriere
force-pushed
the
plugin-signing
branch
from
7e278ad to
f7b9705
Compare
| from dataclasses import dataclass, field | ||
| from pathlib import Path | ||
| from typing import Any, Dict, Optional | ||
| from typing import TYPE_CHECKING, Any, Dict, Optional |
There was a problem hiding this comment.
You can put this under the if TYPE_CHECKING: below and add from __future__ import annotations at the top of the file
| plugins[name] = PluginConfig(enabled=True) | ||
|
|
||
| return cls(plugins=plugins) | ||
| plugin_signature_mode = data.get("plugin_signature_mode", "strict") |
There was a problem hiding this comment.
"plugin_signature_mode" should probably be a const and "strict" part of an enum
|
|
||
| def get_signature_mode(self) -> "SignatureVerificationMode": | ||
| """Get the signature verification mode.""" | ||
| from ggshield.core.plugin.signature import SignatureVerificationMode |
| @@ -0,0 +1,7 @@ | |||
| ### Added | |||
|
|
|||
| - Add sigstore signature verification for plugin wheels, enforcing identity-based trust via OIDC. Plugins can be verified in STRICT, WARN, or DISABLED mode, configurable through enterprise settings or the `--allow-unsigned` flag. | |||
There was a problem hiding this comment.
--allow-unsigned is yet another option: did you look into merging it with the already existing --insecure option?
ggshield/__main__.py
Outdated
| # Suppress signature/loader loggers during startup to avoid noisy output | ||
| # before logging is configured |
There was a problem hiding this comment.
This looks like a workaround for sth that should be addressed at the source: configure properly the concerned loggers from the start
…re_mode Add keyless signature verification for plugin wheels using sigstore bundles with OIDC identity-based trust. Replace --force flag with --allow-unsigned and enterprise config signature mode support. Forward signature_mode through all download paths (GitHub release, GitHub artifact, URL, local wheel). Collapse repetitive install error tests into parametrized ones.
clement-tourriere
force-pushed
the
plugin-signing
branch
from
f7b9705 to
75bde61
Compare
2 participants
Context
The plugin system shipped in 1.48.0 used a --force flag to skip security warnings when installing from non-GitGuardian sources. This was a placeholder — it displayed a text warning but performed no actual
cryptographic verification.
This PR replaces that mechanism with real sigstore-based signature verification for plugin wheels, using OIDC identity-based trust (keyless). It also fixes a bug where the verification mode was not forwarded
through the GitHub release and artifact download paths.
What has been done
STRICT (block unsigned/invalid), WARN (log and continue), DISABLED (skip).
enterprise config.
writing the manifest (was missing entirely).
parameterized test.
Validation
pdm run pytest tests/unit/core/plugin/ tests/unit/cmd/plugin/ -x -q
All 246 tests pass. To manually test signature verification:
PR check list
label has been added to the PR.