feat(platform): Add live USK catalog publishing#1334
Conversation
Add live USK catalog publication for signed first-party catalogs, including localhost Platform API insertion, retained staging, public/private source correlation, sanitized summaries, release-certification evidence, docs, and focused tests.
Bypass inherited proxy selectors for the localhost live publication client and preflight summary output before staging or queueing live USK inserts.
Rename the live catalog refresh scheduler redaction check so sanitized release evidence preserves its boolean result, and assert self-test checks remain boolean.
Convert ValidatedPublicationInputs from a record to an immutable regular class with named builder construction and defensive sidecar byte copies.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 97a727dde8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Clean staged catalog sidecars when live publication fails before queue acceptance, while retaining staging after queued inserts fail later verification.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dba63c5088
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Reject publish-usk output paths that would overwrite signed catalog sidecars, including existing filesystem aliases, and cover catalog/signature collision cases.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 194c1d6a64
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Write a sanitized incomplete marker during live publication output preflight so failed attempts cannot leave prior success summaries readable.
|
1 participant
Summary
crypta-app publish-usk --livesupport for signed first-party catalog publication to a live Crypta USK while preserving deterministic--dry-runpublication plans.cryptad-app-catalog.signaturethrough the localhost Platform API queue path with secure env/file secret inputs, public/private USK source correlation, no-proxy HTTP client behavior, retained staging sidecars, output preflight, and sanitized JSON/Markdown summaries.Test Plan
./gradlew spotlessApply./gradlew :platform-devtools:test --tests '*PlatformApiLiveUskPublisherTest' --tests '*LiveUskPublicationServiceTest'./gradlew :platform-devtools:testpython3 tools/release-certification/app_platform_smoke.py --self-testpython3 tools/release-certification/release_certification.py --self-testAdditional Verification
python3 tools/release-certification/app_platform_smoke.py --mode release-candidate --out-dir build/app-platform-smoke-review-fixwas run to inspect the generated live catalog refresh evidence. The live refresh evidence passed and preserved boolean check values; the overall local release-candidate smoke failed because signing/reviewer inputs were not configured (app-platform.signed-bundles,catalog.smoke, andapp-review.first-party-catalog).Notes