Visitar URL original
Comparing main...fix/spec-sign-packaged-payload · owncloud/developer-certificates · GitHub
Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: owncloud/developer-certificates
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: owncloud/developer-certificates
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: fix/spec-sign-packaged-payload
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 1 commit
  • 4 files changed
  • 2 contributors

Commits on Aug 21, 2026

  1. docs: sign the packaged payload, not the checkout 

    The reference developer signing workflow in attestation/CRL spec §2 ran
`ocsign --path .`, which in a GitHub Actions job is the actions/checkout
tree. In app mode the manifest hashes everything under --path bar
appinfo/signature.json and OS cruft, so that command signs .git, tests/
and .github/ as part of the app -- and the result verifies, because the
manifest genuinely describes the tree that was signed.

files_antivirus v1.3.1 shipped exactly this: a ~1 MB archive carrying the
whole checkout, manifest over 537 paths including .git/config. ocsign now
refuses such a --path (owncloud/ocsign#21), so §2 as written exits 1.

§2 now packages first (staging dir, e.g. build/artifacts/appstore/<app>),
signs that directory, and rolls the tarball from the signed tree, with the
payload rule stated normatively: the signed tree and the shipped tree must
be the same tree, and --allow-vcs must never appear in a release pipeline.

The "full YAML" §2 pointed at did not exist -- the same reference workflow
was promised in developer-documentation spec §9 and design §16 as well. It
is now written, as §4.1 of both the developer-documentation spec and the
published developer guide, in the correct package -> sign -> tar order.
Verified against ocsign v0.3.0: the documented invocation exits 0 and the
old `--path .` form exits 1; the resulting archive holds only the payload.

Closes #77

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
    @DeepDiver1975 @claude
    DeepDiver1975 and claude committed Aug 21, 2026
    Configuration menu
    Copy the full SHA
    0e14ea1 View commit details
    Browse the repository at this point in the history
Loading