OpenSecret PCR approvals (dev and prod) for 1cd4c683 - #920
Closed
AnthonyRonning wants to merge 2 commits into
Closed
AnthonyRonning wants to merge 2 commits into
AnthonyRonning wants to merge 2 commits into
Conversation
Source commit: 1cd4c68 PCR0: 1092211c6a982fcc74da98b9dcb854d5fbb193fcfb58ac93a18c63de0542bf403863ce00083c648abdc35bfff325632d EIF SHA-256: 21420d54c94ac35d61883a6c3168e48b5cee0f8b4fc9d43f8ef4d40075816685 Signed by the OpenSecret EIF release workflow run 34872032464.
Source commit: 1cd4c68 PCR0: 21bef9d3f216409a31f95e602b0f1a7de349782d325d8e4e46266ae48a578a9dff8bd8e31c991487e873bb726dcbc7e0 EIF SHA-256: e05945c951ef56973a7b73b46e1d242f6cb590705dabcd31cc979ef14f6d7e57 Signed by the OpenSecret EIF release workflow run 34872034708.
This was referenced Sep 14, 2026
Contributor
Author
|
Superseded: master moved (#917 bumps services/opensecret/Cargo.lock) before these approvals could be deployed, so a fresh signing round runs on the current master instead. |
AnthonyRonning
deleted the
opensecret/pcr-approval-both-1cd4c68399d3
branch
September 15, 2026 00:45
w3irdrobot
pushed a commit
to w3irdrobot/Maple
that referenced
this pull request
Sep 15, 2026
Each OpenSecret EIF release run pushed its own opensecret/pcr-approval-<env>-<commit> branch, so when one commit changed both measurement sets the two single-environment pull requests each failed the other environment's approval comparison (MaplePrivacyLabs#918 and MaplePrivacyLabs#919), and the approvals had to be combined by hand (MaplePrivacyLabs#920). The publisher now targets opensecret/pcr-approval-<commit>: if the branch already exists it must descend from the source commit and change only approval files, the run refuses to repeat an environment that is already on it, and its commit is rebased onto the branch tip. A push rejected by the other environment's concurrent run is refetched, replayed and retried up to five times. Fixtures cover the sequential second environment, the repeated environment refusal, and a lost push race driven through a git shim; the runbook describes the shared branch. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both signed approvals from master
1cd4c68399d3(health-check liveness #913, DeepSeek V4 Flash retirement #915), combined so the approval checks compare each environment's build against its updated file:1092211c6a982fcc74da98b9dcb854d5fbb193fcfb58ac93a18c63de0542bf403863ce00083c648abdc35bfff325632d21bef9d3f216409a31f95e602b0f1a7de349782d325d8e4e46266ae48a578a9dff8bd8e31c991487e873bb726dcbc7e0Only the four approval files change. Supersedes #918 and #919, whose single-environment branches each failed the other environment's comparison by design. After merging, the four files are mirrored to the legacy repository before deployment.
🤖 Generated with Claude Code