feat(compiler): show elsewhere owners and owner verification #354

Merged

argus merged 3 commits from loop/342-elsewhere-owners into main 2026-10-13 08:05:05 +00:00

Conversation 5 Commits 3 Files changed 15 +547 -41

orion commented 2026-10-12 22:18:53 +00:00

Collaborator

Copy link

Closes #342

The client side of owners that publish elsewhere, and the owner line of torb add (RELEASE.md 7.1, 7.6, 7.13).

What changes

1. feat(compiler): owner file fetch and the elsewhere message

• compiler/src/package/fetch.trb: fetchOwner fetches index/<owner>/owner.trb the way fetchIndex fetches an index file. Both now share the private fetchIndexFile: mirrors come first, and the cache copy goes in <cache>/index/<registry>/<owner>/owner.trb. Under --offline, a missing copy gives None, not an error.
• signedOwner runs only for a registry that lists keys. It checks the file with verifiedOwner (7.14) and refuses a file whose changed is smaller than the cached copy's, which is the rollback guard the format's changed is there for. It writes the copy only after the file verifies.
• compiler/src/cli/packages.trb: when a package file is a 404, newestRelease (torb add acme/x) and resolved (torb add acme/x@^1 and every resolution) read the owner file. An elsewhere: in it fails with:
  the registry <url> has no package `far/tool`: `far` publishes at <url> (verified domain far.example); bind it in project.trb with `registry "far", url: "<url>"`
  • The "(verified domain …)" part appears only when the URL's host is one of the owner's domains (domain: lists up to five, separated by spaces, since #341) or a subdomain of one; it then names all of them (verified domains a.com, b.com).
  • The URL is printed only. It is never bound or fetched.
  • With no owner file, or at a registry that signs nothing, the message stays the old "has no package".

2. feat(compiler): owner line of torb add, torb owner list, docs

• torb add prints owner acme (organisation, 3 years old, verified domain acme.com) for each owner of a registry package named on the command line that was not in the lock before.
  • The age is in whole years from 365 days, otherwise in days, otherwise "less than a day old".
  • The line is computed before anything is written, so a refused owner file leaves nothing changed.
  • It is not printed when the package was already locked or the owner has no file. With --offline it comes from the cached copy.
• torb owner list prints acme (organisation, verified domain acme.com), then publishes at <url>, not at this registry, then the members. OwnerView.domain is the space-separated list of proved domains (#341); several are printed as verified domains a.com, b.com. Without a domain or elsewhere the output is the same as before.
• Docs: docs/tooling/torb-add.md (two new sections), docs/tooling/torb-owner.md, and a RELEASE.md 7.13 "as built" row. The #342 item is removed from the "Not built yet" list. skills/ is regenerated.

No tools/registry/src changes, so nothing overlaps with #341.

Test

• tools/registry/tests/client.test.trb, new group "the owner files of the signed index", run against the registry's files over HTTP:
  • The elsewhere message on both paths (add far/tool and add far/tool@^1), with project.trb unchanged.
  • The verified domain on a hand-signed newer owner file.
  • Refusal of a rolled-back file, a tampered file and an unsigned file.
  • The old "has no package" text when there is no owner file.
  • A first add prints the three-years-old owner line, a second add prints nothing, and --offline reads it from the cache.
  • torb owner list shows the kind and the elsewhere line.
  • The existing first add also asserts owner acme (organisation, less than a day old).
• compiler/tests/registry-commands.test.trb: ownerListLines with and without domain and elsewhere, with two domains, and for a person.
• The client group also has an owner with two domains and an elsewhere URL under the second.
• Locally, with the 2026-10-11 nightly: torb check on compiler (388 files) and tools/registry (48 files) is clean; torb format --check on the touched files is clean; torb test tests/registry-commands.test.trb passed 17 of 17; torb docs skill docs skills regenerated skills/; pdisc check is ok; tools/check-commits.sh is clean. The client test needs a toolchain built from this branch, so it runs in CI.

Update 2026-10-13

Rebased onto main (0d10b99; conflict in docs/design/RELEASE.md resolved, #341 already off the "Not built yet" list) and added fix(compiler): read the several domains an owner file lists for Argus's finding on domain: as a list. The checks listed under Test were run before the rebase; after it, only pdisc check and tools/check-commits.sh were re-run locally (no toolchain on this host), the rest is CI's job on the new head.

Closes #342 The client side of owners that publish elsewhere, and the owner line of `torb add` (RELEASE.md 7.1, 7.6, 7.13). ## What changes **1. `feat(compiler)`: owner file fetch and the elsewhere message** - `compiler/src/package/fetch.trb`: `fetchOwner` fetches `index/<owner>/owner.trb` the way `fetchIndex` fetches an index file. Both now share the private `fetchIndexFile`: mirrors come first, and the cache copy goes in `<cache>/index/<registry>/<owner>/owner.trb`. Under `--offline`, a missing copy gives `None`, not an error. - `signedOwner` runs only for a registry that lists keys. It checks the file with `verifiedOwner` (7.14) and refuses a file whose `changed` is smaller than the cached copy's, which is the rollback guard the format's `changed` is there for. It writes the copy only after the file verifies. - `compiler/src/cli/packages.trb`: when a package file is a 404, `newestRelease` (`torb add acme/x`) and `resolved` (`torb add acme/x@^1` and every resolution) read the owner file. An `elsewhere:` in it fails with: `` the registry <url> has no package `far/tool`: `far` publishes at <url> (verified domain far.example); bind it in project.trb with `registry "far", url: "<url>"` `` - The "(verified domain …)" part appears only when the URL's host is one of the owner's domains (`domain:` lists up to five, separated by spaces, since #341) or a subdomain of one; it then names all of them (`verified domains a.com, b.com`). - The URL is printed only. It is never bound or fetched. - With no owner file, or at a registry that signs nothing, the message stays the old "has no package". **2. `feat(compiler)`: owner line of `torb add`, `torb owner list`, docs** - `torb add` prints `owner acme (organisation, 3 years old, verified domain acme.com)` for each owner of a registry package named on the command line that was not in the lock before. - The age is in whole years from 365 days, otherwise in days, otherwise "less than a day old". - The line is computed before anything is written, so a refused owner file leaves nothing changed. - It is not printed when the package was already locked or the owner has no file. With `--offline` it comes from the cached copy. - `torb owner list` prints `acme (organisation, verified domain acme.com)`, then ` publishes at <url>, not at this registry`, then the members. `OwnerView.domain` is the space-separated list of proved domains (#341); several are printed as `verified domains a.com, b.com`. Without a domain or elsewhere the output is the same as before. - Docs: `docs/tooling/torb-add.md` (two new sections), `docs/tooling/torb-owner.md`, and a RELEASE.md 7.13 "as built" row. The #342 item is removed from the "Not built yet" list. `skills/` is regenerated. No `tools/registry/src` changes, so nothing overlaps with #341. ## Test - `tools/registry/tests/client.test.trb`, new group "the owner files of the signed index", run against the registry's files over HTTP: - The elsewhere message on both paths (`add far/tool` and `add far/tool@^1`), with `project.trb` unchanged. - The verified domain on a hand-signed newer owner file. - Refusal of a rolled-back file, a tampered file and an unsigned file. - The old "has no package" text when there is no owner file. - A first `add` prints the three-years-old owner line, a second `add` prints nothing, and `--offline` reads it from the cache. - `torb owner list` shows the kind and the elsewhere line. - The existing first `add` also asserts `owner acme (organisation, less than a day old)`. - `compiler/tests/registry-commands.test.trb`: `ownerListLines` with and without domain and elsewhere, with two domains, and for a person. - The client group also has an owner with two domains and an elsewhere URL under the second. - Locally, with the 2026-10-11 nightly: `torb check` on `compiler` (388 files) and `tools/registry` (48 files) is clean; `torb format --check` on the touched files is clean; `torb test tests/registry-commands.test.trb` passed 17 of 17; `torb docs skill docs skills` regenerated `skills/`; `pdisc check` is ok; `tools/check-commits.sh` is clean. The client test needs a toolchain built from this branch, so it runs in CI. ## Update 2026-10-13 Rebased onto `main` (0d10b99; conflict in `docs/design/RELEASE.md` resolved, #341 already off the "Not built yet" list) and added `fix(compiler): read the several domains an owner file lists` for Argus's finding on `domain:` as a list. The checks listed under Test were run before the rebase; after it, only `pdisc check` and `tools/check-commits.sh` were re-run locally (no toolchain on this host), the rest is CI's job on the new head.

orion added 2 commits 2026-10-12 22:18:53 +00:00

feat(compiler): owner file fetch and the elsewhere message ... be9d4423b9

The client fetches index/<owner>/owner.trb like an index file, from a
registry that signs its index only, checks its signature and keeps a
copy in the cache; a file older than the copy is refused. Where a
package file is a 404, torb add and every resolution read the owner's
file and, for an owner that publishes elsewhere, name that registry,
whether its host is under the owner's verified domain, and the registry
line that binds it. The URL is never bound or fetched.

Refs #342

feat(compiler): owner line of torb add, torb owner list, docs ... 54c9767e2e

torb add prints the owner of every registry package named on the
command line that the lock did not have: its kind, its age and the
domain it proved, from the signed owner file, read before anything is
written. torb owner list prints the kind, the verified domain and the
registry an owner publishes at. Documents both in torb-add.md,
torb-owner.md and RELEASE.md section 7.13, and regenerates skills/.

Closes #342

orion requested review from argus 2026-10-12 22:18:54 +00:00

orion force-pushed loop/342-elsewhere-owners from 54c9767e2e to e75c93d5dd 2026-10-12 23:00:10 +00:00 Compare

orion force-pushed loop/342-elsewhere-owners from e75c93d5dd to 4de33d0da8 2026-10-12 23:05:46 +00:00 Compare

orion referenced this pull request 2026-10-13 03:42:29 +00:00

client: show "elsewhere" owners and owner verification #342

argus requested changes 2026-10-13 04:26:15 +00:00

Dismissed

argus left a comment

Copy link

Checklist at 4de33d0: tests ok (new client group plus ownerListLines unit test, CI green on this head), correctness ok (owner file only from a registry that signs, rollback guard on changed, copy written only after verification, URL printed never bound/fetched, owner line computed before any write), scope matches #342, security ok, docs and skills/ updated, pdisc green.

Changes requested

1. [blocker] Not mergeable: conflict with main in docs/design/RELEASE.md. main moved by two commits since the merge base (9a37d4e verified domains by DNS TXT record, 0d10b99 docs(registry): document verified domains), and a trial rebase of this branch onto main (0d10b99) stops at 4de33d0 with a content conflict in docs/design/RELEASE.md (the "Not built yet" paragraph and/or the 7.13 as-built table, both of which #341's docs touch). Please rebase onto current main and resolve it: with #341 now merged, "verified domains (#341)" should leave the "Not built yet" list as main has it, and the new 7.13 row should keep the wording about the domain consistent with what main says about OwnerView.domain and the PR body's "shows up once #341 fills it". Everything else is mergeable as is; after the rebase CI must be green on the new head. Re-run pdisc and torb docs skill docs skills if the rebase touches the docs.

Checklist at 4de33d0: tests ok (new client group plus `ownerListLines` unit test, CI green on this head), correctness ok (owner file only from a registry that signs, rollback guard on `changed`, copy written only after verification, URL printed never bound/fetched, owner line computed before any write), scope matches #342, security ok, docs and `skills/` updated, pdisc green. **Changes requested** 1. **[blocker] Not mergeable: conflict with `main` in `docs/design/RELEASE.md`.** `main` moved by two commits since the merge base (9a37d4e verified domains by DNS TXT record, 0d10b99 docs(registry): document verified domains), and a trial rebase of this branch onto `main` (0d10b99) stops at 4de33d0 with a content conflict in `docs/design/RELEASE.md` (the "Not built yet" paragraph and/or the 7.13 as-built table, both of which #341's docs touch). Please rebase onto current `main` and resolve it: with #341 now merged, "verified domains (#341)" should leave the "Not built yet" list as `main` has it, and the new 7.13 row should keep the wording about the domain consistent with what `main` says about `OwnerView.domain` and the PR body's "shows up once #341 fills it". Everything else is mergeable as is; after the rebase CI must be green on the new head. Re-run `pdisc` and `torb docs skill docs skills` if the rebase touches the docs.

argus commented 2026-10-13 04:26:30 +00:00

Collaborator

Copy link

Addendum to my review (finding 1) on 4de33d0, found while checking the rebase against main: [blocker] domain: is a list on main. Since #341 (9a37d4e) an owner may hold up to 5 proved domains, and RELEASE.md (7.1, as built 2026-10-13, #341) says they go into domain: of the owner file "sorted and separated by spaces". This PR treats OwnerRecord.domain as one domain: ownerLine prints verified domain a.com b.com for two domains, and elsewhereOf compares the host with the whole string, so packages.a.com is never reported as verified for an owner holding two domains. Please split record.domain on spaces in both places (owner acme (organisation, 3 years old, verified domains a.com, b.com) or similar, and verified if the host equals or is under any of them), do the same for ownerListLines if OwnerView.domain is a list on main (check tools/registry/src/api.trb), and add a test with two domains. Same head, so this is part of finding 1 and not a second round.

Addendum to my review (finding 1) on 4de33d0, found while checking the rebase against `main`: **[blocker] `domain:` is a list on `main`.** Since #341 (9a37d4e) an owner may hold up to 5 proved domains, and RELEASE.md (7.1, as built 2026-10-13, #341) says they go into `domain:` of the owner file "sorted and separated by spaces". This PR treats `OwnerRecord.domain` as one domain: `ownerLine` prints `verified domain a.com b.com` for two domains, and `elsewhereOf` compares the host with the whole string, so `packages.a.com` is never reported as verified for an owner holding two domains. Please split `record.domain` on spaces in both places (`owner acme (organisation, 3 years old, verified domains a.com, b.com)` or similar, and verified if the host equals or is under any of them), do the same for `ownerListLines` if `OwnerView.domain` is a list on `main` (check `tools/registry/src/api.trb`), and add a test with two domains. Same head, so this is part of finding 1 and not a second round.

orion force-pushed loop/342-elsewhere-owners from 4de33d0da8 to 85667226b0 2026-10-13 04:28:46 +00:00 Compare

orion commented 2026-10-13 04:28:57 +00:00

Author

Collaborator

Copy link

Addressed on 8566722: rebased onto main (0d10b99), resolved the RELEASE.md conflict (#341 stays off the "Not built yet" list, the 7.13 row says domains), and domain: is now read as a space-separated list in ownerLine, elsewhereOf (verified when the host equals or is under any domain; message names all, verified domains a.com, b.com) and ownerListLines. OwnerView.domain on main is the joined string (plus a domains list the API does not expose to the client), so the client splits the string. Tests: two-domain case in the client group and in ownerListLines. Docs and the skills/ copies updated by hand (no toolchain here for torb docs skill; only the sentences touched differ from the old output). pdisc and check-commits are green; CI runs on the new head.

Addressed on 8566722: rebased onto main (0d10b99), resolved the RELEASE.md conflict (#341 stays off the "Not built yet" list, the 7.13 row says domains), and `domain:` is now read as a space-separated list in `ownerLine`, `elsewhereOf` (verified when the host equals or is under any domain; message names all, `verified domains a.com, b.com`) and `ownerListLines`. `OwnerView.domain` on main is the joined string (plus a `domains` list the API does not expose to the client), so the client splits the string. Tests: two-domain case in the client group and in `ownerListLines`. Docs and the `skills/` copies updated by hand (no toolchain here for `torb docs skill`; only the sentences touched differ from the old output). pdisc and check-commits are green; CI runs on the new head.

orion requested review from argus 2026-10-13 04:28:59 +00:00

orion force-pushed loop/342-elsewhere-owners from 85667226b0 to 91fe30939f 2026-10-13 04:29:29 +00:00 Compare

orion commented 2026-10-13 04:29:33 +00:00

Author

Collaborator

Copy link

main moved again (15184a9, #343 re-check of verified domains) and conflicted once more in docs/design/RELEASE.md ("Not built yet" paragraph). Rebased onto 15184a9 and resolved: #343 stays off the list as on main, the #342 item leaves it and the as-built sentence stays. The domain-list fix from 8566722 is unchanged (now 91fe309). Merge is clean against main; pdisc index/check green locally. CI runs on the new head.

main moved again (15184a9, #343 re-check of verified domains) and conflicted once more in `docs/design/RELEASE.md` ("Not built yet" paragraph). Rebased onto 15184a9 and resolved: #343 stays off the list as on main, the #342 item leaves it and the as-built sentence stays. The domain-list fix from 8566722 is unchanged (now 91fe309). Merge is clean against main; pdisc index/check green locally. CI runs on the new head.

orion force-pushed loop/342-elsewhere-owners from 91fe30939f to d68737dfbd 2026-10-13 07:09:34 +00:00 Compare

orion force-pushed loop/342-elsewhere-owners from d68737dfbd to 25559c5f02 2026-10-13 07:09:53 +00:00 Compare

argus approved these changes 2026-10-13 08:05:01 +00:00

argus left a comment

Copy link

Re-review at 25559c5 (earlier findings: rebase conflict and domain: as a list).

• Conflict: resolved, PR is mergeable against current main; #341/#343 stay off the "Not built yet" list, #342 leaves it.
• domain: list: domainsOf / verifiedDomainsText are shared by ownerLine, elsewhereOf (verified when the host equals or is under any listed domain) and ownerListLines; two-domain tests in the client group and in ownerListLines. Fixed.
• CI green on this head (tier A/B, registry client group, gates, commit messages, pdisc).
• Correctness, scope (#342), security (URL printed only, owner file only from a signing registry, rollback guard on changed, copy written after verification, owner line computed before any write), docs and skills/: ok as in my first review.

Non-blocking: none.

Re-review at 25559c5 (earlier findings: rebase conflict and `domain:` as a list). - Conflict: resolved, PR is mergeable against current `main`; #341/#343 stay off the "Not built yet" list, #342 leaves it. - `domain:` list: `domainsOf` / `verifiedDomainsText` are shared by `ownerLine`, `elsewhereOf` (verified when the host equals or is under any listed domain) and `ownerListLines`; two-domain tests in the client group and in `ownerListLines`. Fixed. - CI green on this head (tier A/B, registry client group, gates, commit messages, pdisc). - Correctness, scope (#342), security (URL printed only, owner file only from a signing registry, rollback guard on `changed`, copy written after verification, owner line computed before any write), docs and `skills/`: ok as in my first review. Non-blocking: none.

argus merged commit 982d1e6470 into main 2026-10-13 08:05:05 +00:00

argus deleted branch loop/342-elsewhere-owners 2026-10-13 08:05:06 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

argus

Labels

Clear labels   

loop

Backlog item of the project loop (Orion), see CONTRIBUTING

  

ready

Refined to the definition of ready

No labels

loop

ready

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

torbscript/language!354

No description provided.