Merge branch 'main' into dependabot/nix/nixpkgs-nixos-26.05

hyperpolymath · web-flow · commit cfe98092d357 · 2026-05-26T01:58:53.000+01:00
diff --git a/.github/workflows/lockdown.yml b/.github/workflows/lockdown.yml
@@ -27,43 +27,90 @@ jobs:
   verify-signatures:
     name: Verify Commit Signatures
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
         with:
           fetch-depth: 0
 
-      - name: Verify All Commits Signed
+      - name: Verify All Commits Signed (via GitHub API)
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
         run: |
-          echo "Checking commit signatures..."
-          # Trusted bot accounts that don't require signatures
+          # The previous implementation used `git verify-commit` locally
+          # on the runner. That ALWAYS fails for signed commits because
+          # CI runners have no GPG keyring with the signer's public
+          # key, so verify-commit can't validate the signature and
+          # exits 1 — flagging every signed human commit as "unsigned"
+          # (saw on PR #89, 2026-05-25 — commits with local `%G?: G`
+          # rejected in CI).
+          #
+          # GitHub already verifies signatures server-side and exposes
+          # the result via the REST API. We query each commit's
+          # verification status directly. This also implicitly handles
+          # the auto-merge-commit case: the API only knows about real
+          # commits, not the ephemeral `refs/pull/N/merge`.
+          echo "Checking commit signatures via GitHub API..."
+
+          # Trusted bot accounts that don't require signatures.
           TRUSTED_BOTS="noreply@anthropic.com github-actions[bot] dependabot[bot]"
 
-          for commit in $(git log --format=%H origin/main..HEAD 2>/dev/null || git log --format=%H -10); do
+          # Range: PR head vs base (PRs) or current branch tip vs main (pushes).
+          if [[ -n "${GITHUB_BASE_REF:-}" ]]; then
+            RANGE="origin/${GITHUB_BASE_REF}..HEAD"
+            git fetch --no-tags --depth=50 origin "${GITHUB_BASE_REF}" || true
+          else
+            RANGE="origin/main..HEAD"
+          fi
+
+          failed=0
+          for commit in $(git log --no-merges --format=%H "$RANGE" 2>/dev/null || git log --no-merges --format=%H -10); do
             AUTHOR_EMAIL=$(git log -1 --format='%ae' "$commit")
             AUTHOR_NAME=$(git log -1 --format='%an' "$commit")
 
-            # Check if commit is from a trusted bot
-            IS_BOT=false
+            # Trusted bot allowlist (still useful for dependabot etc.).
+            is_bot=false
             for bot in $TRUSTED_BOTS; do
               if [[ "$AUTHOR_EMAIL" == "$bot" ]] || [[ "$AUTHOR_NAME" == "$bot" ]]; then
-                IS_BOT=true
+                is_bot=true
                 echo "✓ Trusted bot commit: $commit ($AUTHOR_EMAIL)"
                 break
               fi
             done
-
-            # Require signature only for non-bot commits
-            if [[ "$IS_BOT" == "false" ]]; then
-              if ! git verify-commit "$commit" 2>/dev/null; then
-                echo "ERROR: Unsigned commit detected: $commit"
-                echo "All human commits MUST be GPG or SSH signed."
-                exit 1
-              fi
-              echo "✓ Signed commit verified: $commit"
+            [[ "$is_bot" == "true" ]] && continue
+
+            verified=$(gh api "repos/${REPO}/commits/${commit}" --jq '.commit.verification.verified' 2>/dev/null || echo "")
+            reason=$(gh api "repos/${REPO}/commits/${commit}" --jq '.commit.verification.reason' 2>/dev/null || echo "unknown")
+
+            # `bad_email` means the SIGNATURE itself is valid (GPG checks
+            # out) but the signing key's UID set on the GitHub-registered
+            # key doesn't include this commit's author email. Soft-pass
+            # with a warning: the commit IS cryptographically signed by a
+            # key the user controls; only the GitHub-side UID binding is
+            # incomplete. Hard policy enforcement would require the user
+            # to add the noreply email as a UID on the key and re-upload.
+            if [[ "$verified" == "true" ]]; then
+              echo "✓ Signed and verified by GitHub: $commit"
+            elif [[ "$reason" == "bad_email" ]]; then
+              echo "⚠ Signed but GitHub UID mismatch (bad_email): $commit"
+              echo "  Signature valid; key's GitHub-registered UIDs don't include $AUTHOR_EMAIL."
+              echo "  Fix: add the email as a UID on the signing key, re-upload to GitHub."
+            else
+              echo "ERROR: Unsigned or unverifiable commit: $commit"
+              echo "  Author: $AUTHOR_NAME <$AUTHOR_EMAIL>"
+              echo "  GitHub verification: verified=$verified reason=$reason"
+              echo "  All human commits MUST be GPG- or SSH-signed."
+              failed=1
             fi
           done
-          echo "All commits verified."
+
+          if [[ $failed -eq 1 ]]; then
+            exit 1
+          fi
+          echo "All non-bot commits verified."
 
   # ==========================================================================
   # Enforce Branch Protection
diff --git a/rgtv-cli/Cargo.toml b/rgtv-cli/Cargo.toml
@@ -14,7 +14,7 @@ path = "src/main.rs"
 
 [dependencies]
 # Synchronous HTTP client — no async overhead needed for a CLI.
-ureq = { version = "3", features = ["json"] }  # TODO: migrate to ureq 3.x API (AgentBuilder/Error/RequestBuilder all renamed)
+ureq = { version = "3", features = ["json"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 # Zeroize heap allocations holding raw credential values after use.
diff --git a/rgtv-cli/src/main.rs b/rgtv-cli/src/main.rs
@@ -109,64 +109,78 @@ impl Config {
 // ---------------------------------------------------------------------------
 
 /// A short-timeout ureq agent appropriate for interactive CLI calls.
+///
+/// `http_status_as_error(false)` keeps 4xx/5xx as `Ok` responses so the
+/// broker's structured error body can still be surfaced (see `parse_response`).
 fn http_agent() -> ureq::Agent {
-    ureq::AgentBuilder::new()
-        .timeout_read(Duration::from_secs(10))
-        .timeout_write(Duration::from_secs(5))
+    ureq::Agent::config_builder()
+        .timeout_recv_body(Some(Duration::from_secs(10)))
+        .timeout_send_body(Some(Duration::from_secs(5)))
+        .http_status_as_error(false)
         .build()
+        .into()
 }
 
 fn bearer(token: &str) -> String {
     format!("Bearer {token}")
 }
 
-/// Convert a ureq error into a human-readable string, surfacing the broker's
-/// own error message when it returns a structured error body.
+/// Convert a transport-level ureq error into a human-readable string.
+///
+/// HTTP-status errors don't reach this path (see `http_agent`) — they come
+/// back as `Ok` responses whose status code is checked by `parse_response`.
 fn ureq_err(e: ureq::Error) -> String {
-    match e {
-        ureq::Error::Status(code, resp) => {
-            let body = resp.into_string().unwrap_or_default();
-            if let Ok(b) = serde_json::from_str::<BrokerError>(&body) {
-                format!("broker {code}: {}", b.error)
-            } else {
-                format!("broker {code}: {body}")
-            }
+    format!("transport: {e}")
+}
+
+/// Parse a response, surfacing the broker's structured error body on non-2xx.
+fn parse_response<T: serde::de::DeserializeOwned>(
+    mut resp: ureq::http::Response<ureq::Body>,
+    what: &str,
+) -> Result<T, String> {
+    let status = resp.status().as_u16();
+    let body = resp
+        .body_mut()
+        .read_to_string()
+        .map_err(|e| format!("read {what} body: {e}"))?;
+    if !(200..300).contains(&status) {
+        if let Ok(b) = serde_json::from_str::<BrokerError>(&body) {
+            return Err(format!("broker {status}: {}", b.error));
         }
-        ureq::Error::Transport(t) => format!("transport: {t}"),
+        return Err(format!("broker {status}: {body}"));
     }
+    serde_json::from_str(&body).map_err(|e| format!("parse {what}: {e}"))
 }
 
 fn get_health(cfg: &Config) -> Result<HealthResponse, String> {
     let url = format!("{}/health", cfg.base_url);
     let resp = http_agent()
         .get(&url)
-        .set("Authorization", &bearer(&cfg.agent_token))
+        .header("Authorization", bearer(&cfg.agent_token))
         .call()
         .map_err(ureq_err)?;
-    resp.into_json().map_err(|e| format!("parse health: {e}"))
+    parse_response(resp, "health")
 }
 
 fn get_credentials(cfg: &Config) -> Result<CredentialsResponse, String> {
     let url = format!("{}/v1/credentials", cfg.base_url);
     let resp = http_agent()
         .get(&url)
-        .set("Authorization", &bearer(&cfg.agent_token))
+        .header("Authorization", bearer(&cfg.agent_token))
         .call()
         .map_err(ureq_err)?;
-    resp.into_json()
-        .map_err(|e| format!("parse credentials: {e}"))
+    parse_response(resp, "credentials")
 }
 
 fn post_grant(cfg: &Config, hint: &str) -> Result<GrantResponse, String> {
     let url = format!("{}/v1/grants", cfg.base_url);
     let body = serde_json::json!({ "hint": hint });
     let resp = http_agent()
         .post(&url)
-        .set("Authorization", &bearer(&cfg.agent_token))
-        .set("Content-Type", "application/json")
+        .header("Authorization", bearer(&cfg.agent_token))
         .send_json(body)
         .map_err(ureq_err)?;
-    resp.into_json().map_err(|e| format!("parse grant: {e}"))
+    parse_response(resp, "grant")
 }
 
 /// Redeem a grant and return the credential value wrapped in Zeroizing<String>
@@ -175,10 +189,10 @@ fn post_redeem(cfg: &Config, grant_id: &str) -> Result<Zeroizing<String>, String
     let url = format!("{}/v1/grants/{grant_id}/redeem", cfg.base_url);
     let resp = http_agent()
         .post(&url)
-        .set("Authorization", &bearer(&cfg.agent_token))
-        .call()
+        .header("Authorization", bearer(&cfg.agent_token))
+        .send_empty()
         .map_err(ureq_err)?;
-    let body: RedeemBody = resp.into_json().map_err(|e| format!("parse redeem: {e}"))?;
+    let body: RedeemBody = parse_response(resp, "redeem")?;
     Ok(Zeroizing::new(body.value))
 }
 
