Conversation
sinkog
commented
Jul 19, 2026
sinkog
commented
Member
- relay_integration_test.go: drives execute through a cic-flow that does REAL RSA-SHA256 signing against a fake OCI server that VERIFIES the draft-cavage signature the way OCI does (reconstructs the signing string from the wire headers, RSA-verifies). Proves the guest's canonical string is consistent with what it sends. Negative: bad signature → 401 → execute failed. Stdlib + wazero only (no relay dependency).
- mk/wasm.mk: wasm.test now runs the module's whole go test suite (was -run TestHostLoad), so all 35 assertions — host-load, domain unit (validate/plan/observe/execute/destroy/invoke/poll), integration — are CI-guarded. Confirmed green on the runner.
Adds a cryptographically real end-to-end proof of the sign+send path, and closes a CI gap where the host-side/integration tests only ran locally. - relay_integration_test.go: drives the guest's execute through a cic-flow host that does REAL RSA-SHA256 (pkcs1v15) signing against a fake OCI server which VERIFIES the draft-cavage signature the way OCI does — reconstructing the signing string from the wire headers and RSA-verifying it. Proves the guest's canonical string is consistent with the headers it sends. A negative test confirms a non-verifying signature → 401 → execute reports the step failed. Imports only stdlib + wazero; never the relay's Go packages (RO from here). - mk/wasm.mk: wasm.test now runs the module's whole go test suite (was -run TestHostLoad only), so all 35 assertions — host-load, domain unit (validate/plan/observe/execute/destroy/invoke/poll), and the integration tests — are guarded in CI, not just the host-load smoke tests. Full local CI green (golang.quality, wasm.build/integrity/test full suite, check, verify-release, manifest, pytest). --- [signing-metadata] key = cic-my-sign-key signature = vault:v1:MEUCIQCs5dWyqncnp8c2WsJqWOjsDaF/kNVAH7zy1t0GIIVEWAIgTAywour1ztkW5NCZQAqlxZhMGKWU6sCwMEE0h1UKZGc= hash-algorithm = sha256 digest = h/d8Cde6poZ08zaszT5x/Ba2kmWy7qh3jO9SHDzBZJ4= [certificate] -----BEGIN CERTIFICATE----- MIICBjCCAaygAwIBAgIUSnRMR6RPnEbg296XWPOqq/u5PCwwCgYIKoZIzj0EAwIw QzELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxGTAXBgNV BAMMEENJQyBEZXZlbG9wZXIgQ0EwHhcNMjYwMzIwMTMyMjU5WhcNMjYxMjMxMTMy MjU5WjBFMQswCQYDVQQGEwJIVTEZMBcGA1UECgwQQ2VudHJhbEluZnJhQ29yZTEb MBkGA1UEAwwSR2Fib3IgWm9sdGFuIFNpbmtvMFkwEwYHKoZIzj0CAQYIKoZIzj0D AQcDQgAEIG2CVmTfmLB9pLLclj7YmP2eedAjklpy4LGrU2ijoiy6Xqpuybv7OgJe i+ez31s65NEV8+X/ByeX1cstR988z6N8MHowCQYDVR0TBAIwADAdBgNVHQ4EFgQU yZN6AIX/TNnIJ9GwAa/NRN3ujHAwHwYDVR0jBBgwFoAUXn6CHYzPUqU4JVP8g+OS WeDYjhcwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEF BQcDBDAKBggqhkjOPQQDAgNIADBFAiEA+bFzXRoJ4PCQbhAAtpkcMjt0vNj5rEW0 lOMBGDNyaWkCIB1vmM7PcZzv/c9bIrxF5kqv6QXomouhByUfeNUTbpKW -----END CERTIFICATE-----
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.