plan(v0.12.0): scope varve-driven interop + trust-hardening (REQ-26..30) - #261
Merged
Conversation
varve (downstream consumer of wsc) filed five issues while evaluating wsc::airgapped for offline manifest verification. Triaged into a v0.12.0 release scope in rivet (release: field is the source of truth; mirrored to the GitHub v0.12.0 milestone): - REQ-26 / #256 sign_digest — keyless sign over an arbitrary 32-byte digest, not only a WASM Module (verifier is already hash-based) - REQ-27 / #260 from_sigstore_bundle — ingest cosign bundles (legacy-JSON + protobuf v0.3 shapes) into KeylessSignature - REQ-28 / #231 SigstoreBundle::verify — in-library offline bundle verify (the verify half of #260; confirmed unimplemented on main); depends-on REQ-27, derives-from REQ-23 - REQ-29 / #259 refresh embedded Sigstore trusted root (1 Rekor log -> 2) + surface staleness (Rekor v2 tiled-log time-bomb) - REQ-30 / #258 no vacuous oracles — the airgapped e2e test never calls verify_signature; broadened to a suite-wide sweep + standing check (third instance of the shape this cycle) All draft; readiness is a live query (rivet release status v0.12.0). Scoped as one release rather than a patch+minor split because the publish pipeline was only just unblocked and #259's public-API ask makes a "patch" a minor anyway. Refs: #256 #260 #231 #259 #258 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH
…fresh Source read: RekorKeyring::from_trusted_root (rekor_verifier.rs:426) silently skips non-ECDSA_P256 keys and verify_set is P256-only, so the new Ed25519 log2025-1 key needs a real verification path, not a JSON edit. Removed the 'mechanical, patch-safe' framing; folded in the silent-skip finding and the open Rekor-v2 SET-envelope (checkpoint vs SignedEntryTimestamp) question. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH
This was referenced Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Triages the five issues varve filed while evaluating
wsc::airgappedfor offline manifest verification into a v0.12.0 release scope. Landed as rivet artifacts (therelease:field is the source of truth; mirrored to the GitHub v0.12.0 milestone), so readiness is a live query:rivet release status v0.12.0.sign_digest— keyless sign over an arbitrary 32-byte digest, not only aModulefrom_sigstore_bundle— ingest cosign bundles (legacy-JSON + protobuf v0.3)SigstoreBundle::verify— in-library offline bundle verify (the verify half of #260; confirmed unimplemented)verify_signature; broadened to a suite-wide sweep + CI gateExecution order: REQ-30 → REQ-26 → REQ-27 → REQ-28 → REQ-29 (30 first so later oracles are trustworthy; 29 last — it's the largest, a new crypto path). Each feature lands as its own PR off
main.This PR is the plan artifact only (rivet YAML). Implementation PRs follow per-feature.
🤖 Generated with Claude Code