Repository navigation
Conversation
wallet-rs is archived. tempo-sign now lives in tempo's tempo-ext, next to the installer that verifies its manifests (tempoxyz/tempo#8236). Resolving the tempo workspace clones reth, so cache ~/.cargo/git/db, which Cargo.lock pins by commit hash. test.yml builds the signer from the same pinned ref and signs a fixture, since the publish job is the only other place it runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Build the release signer in
tempo-extension.ymlfromtempoxyz/tempo(tempo-ext,signfeature) instead of the archivedtempoxyz/wallet-rs.Motivation
wallet-rswas archived on 2026-09-06;tempo-signwas its last live code. tempoxyz/tempo#8236 moves it intocrates/ext, next to the installer that verifies its manifests, with a test covering both sides.Draft until tempo#8236 merges. The pin currently points at that PR's head (
a54f3730). Before marking ready, repin to the merge commit on tempomain.Changes
tempo-extension.yml: check outtempoxyz/tempoat a pinned commit and build withcargo build --locked --release -p tempo-ext --features sign --bin tempo-sign. Same CLI and flags, so the sign step only changes the binary path.~/.cargo/git/db(keyed onCargo.lock). Resolving the tempo workspace clonesretheven though the signer never builds it. Only git sources are cached:Cargo.lockpins them by commit hash, so a tampered entry can't change what builds in a job that holdsRELEASE_SIGNING_KEY. Registry crates download fresh.test.yml: newtempo-signjob. It reads the pinned ref fromtempo-extension.yml(single source), builds the signer, and signs the existingtempo-extensionfixture with a throwaway key. It also checks thatgenerate-keycreates a 0600 key and won't overwrite one, then checks the manifest URLs and thefile:/version:/skill:trusted comments the installer requires. Until now the signer only ran in real publishes.tempo-extensiondocs at tempo.Testing
Ran the new job's pin lookup and signing script locally against the signer built from tempo at
a54f3730:Changing the expected skill comment makes the script exit 1.
zizmor --persona regularon both workflows: no findings. Auditor persona adds oneundocumented-permissionshelp, matching the other test jobs.Build time (macOS, 14 cores), clean everything vs cached git deps:
Real releases are infrequent, so the cold path mostly hits the first publish per caller repo and after a tempo repin.
🤖 Generated with Claude Code