Note required entitlement and pull permission for libraries commands - #3710
Merged
Conversation
Document that chainctl libraries update-hashes and verify each require an ecosystem entitlement and the matching libraries.<ecosystem>.pull permission, adding a note at each procedure step across the Python, JavaScript, and Java libraries guides. Auto-generated chainctl reference pages are excluded. Also fix a copy-paste error on the Python global-configuration page that referred to "JavaScript lockfile formats." Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for ornate-narwhal-088216 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Reword the update-hashes and verify permission notes to name only the pull permission or the Owner role, dropping the entitlement mention, and move each note to immediately after the command code block. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
matthewhelmke
approved these changes
Aug 6, 2026
Signed-off-by: s-stumbo <sally.stumbo@chainguard.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
chainctl libraries update-hashesandchainctl libraries verifyboth require an entitlement to the relevant ecosystem plus the matching pull permission (libraries.java.pull,libraries.javascript.pull, orlibraries.python.pull). That requirement wasn't stated where the docs tell readers to run these commands.This adds a short note at each procedure step across the Python, JavaScript, and Java libraries guides, and to the verification page's Requirements list. Ecosystem-specific pages name only that ecosystem's permission; the ecosystem-agnostic pages (quickstart, verification) list all three.
Auto-generated
chainctlreference pages (content/platform/chainctl/chainctl-docs/) and the docs bundle are intentionally excluded.Also fixes a copy-paste error on the Python global-configuration page that read "all supported JavaScript lockfile formats."
Files touched
quickstart.md— Step 4 (verify)verification.md— Requirements listpython/migration.md— Steps 2 (update-hashes) and 5 (verify)python/build-configuration.md,python/global-configuration.md— update-hashesjavascript/migration.md— Steps 3 (update-hashes) and 6 (verify)javascript/build-configuration.md,javascript/global-configuration.md— update-hashesjava/migration.md— Step 6 (verify)java/build-configuration.md— Maven and Gradle cache verify stepsOpen item for reviewers
The permission enforced by these commands is documented here as
libraries.<ecosystem>.pull, consistent withaccess.md. If anyone has confirmed hands-on whetherupdate-hashes/verifyenforce.pullspecifically (versus only requiring a valid pull token created via.pull_token_creator), please confirm on this PR.Testing plan
hugo server)./chainguard/libraries/quickstart/#step-4-verify-your-libraries/chainguard/libraries/verification/#requirements/chainguard/libraries/python/migration/(Steps 2 and 5)/chainguard/libraries/python/build-configuration/#updating-lockfile-hashes/chainguard/libraries/python/global-configuration/#updating-lockfile-hashes/chainguard/libraries/javascript/migration/(Steps 3 and 6)/chainguard/libraries/javascript/build-configuration/#authentication/chainguard/libraries/javascript/global-configuration/#updating-lockfile-hashes/chainguard/libraries/java/migration/#step-6-verify-artifacts/chainguard/libraries/java/build-configuration/(Maven and Gradle verify sections)/chainguard/libraries/access/#entitlement.content/platform/chainctl/chainctl-docs/page or the docs bundle was modified (git diff --stat mainshows only the 10 files above).🤖 Generated with Claude Code
Created in collaboration with Claude Code running Opus 4.8 (1M context) on 2026-08-05.