torbscript/language
Watch
1
0
Fork
You've already forked language
 0
Code Issues 139 Pull requests 2 Projects Releases 18 Packages 3 Wiki Activity Actions

registry: the production signing key and its line in torb #21

New issue
Closed
opened 2026-10-05 21:07:11 +00:00 by orion · 4 comments
orion commented 2026-10-05 21:07:11 +00:00
Collaborator
Copy link

Context

The index is signed and checked since 2026-09-27 (std/signature); the production key and the line in torb that trusts it are missing.

Source

Acceptance criteria

  • torb carries the production public key and checks the index against it
  • Key rotation as RELEASE.md section 7.14 describes
  • The private key is never in the repository

Dependencies

None known.

Notes

Generating the production key is the owner's step; the code that trusts it is the loop's.

Moved from the planning lists of the docs; the design record stays the specification.

## Context The index is signed and checked since 2026-09-27 (`std/signature`); the production key and the line in `torb` that trusts it are missing. ## Source - [ROADMAP.md, the package manager](https://git.torb.dev/torbscript/language/src/commit/393ef2608e4a60b8ff76d8b6b408951b822d887d/docs/ROADMAP.md#L96) - [RELEASE.md section 7.14](https://git.torb.dev/torbscript/language/src/commit/393ef2608e4a60b8ff76d8b6b408951b822d887d/docs/design/RELEASE.md#L1433) ## Acceptance criteria - [ ] `torb` carries the production public key and checks the index against it - [ ] Key rotation as RELEASE.md section 7.14 describes - [ ] The private key is never in the repository ## Dependencies None known. ## Notes Generating the production key is the owner's step; the code that trusts it is the loop's. _Moved from the planning lists of the docs; the design record stays the specification._
orion commented 2026-10-06 16:28:12 +00:00
Author
Collaborator
Copy link

[loop:torbscript] intake: in scope as an issue (author orion, label loop), with an owner question: the production signing key must be generated and held by the owner, and the key line in torb is a trust decision; the loop never creates or touches a production key. Repo-side work (trust line mechanism, rotation) only after the owner provides the public key, to settle in refine. Release freeze for 0.1.0 (2026-10-06) holds new PRs, next: refine (owner decision expected)

[loop:torbscript] intake: in scope as an issue (author orion, label loop), with an owner question: the production signing key must be generated and held by the owner, and the key line in `torb` is a trust decision; the loop never creates or touches a production key. Repo-side work (trust line mechanism, rotation) only after the owner provides the public key, to settle in refine. Release freeze for 0.1.0 (2026-10-06) holds new PRs, next: refine (owner decision expected)
orion commented 2026-10-09 05:13:42 +00:00
Author
Collaborator
Copy link

[loop:torbscript] refine: still queued behind the intake order. next: waiting (ready buffer full: #4, #163, #164, #223 are ready) until 2026-10-10T04:00:00Z

[loop:torbscript] refine: still queued behind the intake order. next: waiting (ready buffer full: #4, #163, #164, #223 are ready) until 2026-10-10T04:00:00Z
orion commented 2026-10-13 10:36:54 +00:00
Author
Collaborator
Copy link

[loop:torbscript] claim refine by session:loop-torbscript-20261013 until 2026-10-13T12:36Z

[loop:torbscript] claim refine by session:loop-torbscript-20261013 until 2026-10-13T12:36Z
orion commented 2026-10-13 10:38:34 +00:00
Author
Collaborator
Copy link

[loop:torbscript] refine: nothing left to build, the item was already done before it was filed. Checked on current main (read-only) and against the live registry:

  • torb carries the production public key: shippedKeys in compiler/src/package/registry.trb lists ed25519:d0f14d66...04d7c4 for https://packages.torb.dev/ (commit 9d73902, 2026-09-28, "feat(package): ship the production signing key of packages.torb.dev"). The index is checked against it: std/signature and compiler/src/package/signing.trb, RELEASE.md section 7.14 ("Built (2026-09-28)"), tested in compiler/tests/packages.test.trb (the shipped key trusted offline without being pinned).
  • Key rotation as section 7.14 describes: the successor is announced endorsed by the current key and trust runs forward along endorsements (trusted keys test in packages.test.trb, a successor is announced endorsed by the signing key, and only one at a time in tools/registry/tests/server.test.trb); the operator steps are docs/contributing/releasing.md step 11.
  • The private key is not in the repository: it lives only in the deployment's .env as REGISTRY_SIGNING_KEY (section 7.11).
  • https://packages.torb.dev/index/config.trb currently lists exactly the shipped key, so the live registry and torb agree.

The issue text was stale when filed (the planning-list line it was moved from predates 9d73902). No production key is needed from the owner. Closing as already landed. A rotation to a successor key stays an owner step when it is wanted, with its own issue then.

next: closed (already landed in 9d73902). Worker usage: ~70k tokens (sonnet).

[loop:torbscript] refine: nothing left to build, the item was already done before it was filed. Checked on current `main` (read-only) and against the live registry: - `torb` carries the production public key: `shippedKeys` in `compiler/src/package/registry.trb` lists `ed25519:d0f14d66...04d7c4` for `https://packages.torb.dev/` (commit 9d73902, 2026-09-28, "feat(package): ship the production signing key of packages.torb.dev"). The index is checked against it: `std/signature` and `compiler/src/package/signing.trb`, RELEASE.md section 7.14 ("Built (2026-09-28)"), tested in `compiler/tests/packages.test.trb` (the shipped key trusted offline without being pinned). - Key rotation as section 7.14 describes: the successor is announced endorsed by the current key and trust runs forward along endorsements (`trusted keys` test in `packages.test.trb`, `a successor is announced endorsed by the signing key, and only one at a time` in `tools/registry/tests/server.test.trb`); the operator steps are `docs/contributing/releasing.md` step 11. - The private key is not in the repository: it lives only in the deployment's `.env` as `REGISTRY_SIGNING_KEY` (section 7.11). - `https://packages.torb.dev/index/config.trb` currently lists exactly the shipped key, so the live registry and `torb` agree. The issue text was stale when filed (the planning-list line it was moved from predates 9d73902). No production key is needed from the owner. Closing as already landed. A rotation to a successor key stays an owner step when it is wanted, with its own issue then. next: closed (already landed in 9d73902). Worker usage: ~70k tokens (sonnet).
orion closed this issue 2026-10-13 10:38:34 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
loop/705-default-shadow
loop/691-tensor-core
loop/705-fix-candidate
orion/456-tierb-probe
loop/164-measure2
loop/207-measure
loop/164-prototype
probe/207-count
loop/205-measure
loop/140-hide-staged
nightly-20261103
nightly-20261031
nightly-20261029
nightly-20261027
nightly-20261026
nightly-20261025
nightly-20261024
nightly-20261023
nightly-20261021
nightly-20261020
nightly-20261015
nightly-20261014
nightly-20261013
nightly-20261011
nightly-20261010
nightly-20261009
nightly-20261008
seeds
Labels
Clear labels   
loop
Backlog item of the project loop (Orion), see CONTRIBUTING

  
ready
Refined to the definition of ready

No labels
loop
ready
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
torbscript/language#21
No description provided.