cmd-sign: make staging location stream-specific #4317
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Create a new variable for the staging location instead of pushing the staging path on the prefix, only to then peel it off later to get back to its original value.
We want to store all the signatures in the same location rather than stream-specific. But ideally we still want the staging location for signing to be stream-specific so that we can safely garbage collect stale files there without worrying about stepping on concurrent runs. Just pick up the stream from the metadata and use that to build the staging location. See also coreos/fedora-coreos-pipeline#1218.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the OCI signing process to use a stream-specific staging location in S3. This is a valuable change that enhances safety by isolating concurrent signing runs for different streams, preventing them from interfering with each other. The implementation correctly determines the stream from build metadata and applies it to the staging path, while keeping the final signature destination unchanged, as described. The code is clear and the changes are consistent with the stated goal. I have one minor suggestion to improve the robustness of how the stream name is parsed.
jbtrystram
approved these changes
Sep 11, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We want to store all the signatures in the same location rather than
stream-specific. But ideally we still want the staging location for
signing to be stream-specific so that we can safely garbage collect
stale files there without worrying about stepping on concurrent runs.
Just pick up the stream from the metadata and use that to build the
staging location.
See also coreos/fedora-coreos-pipeline#1218.