Skip to content

Update github cli signing key #267

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gursewak1997 merged 1 commit into from
Sep 21, 2026
Merged

Update github cli signing key #267

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion devenv/Containerfile.c10s
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# These aren't packages, just low-dependency binaries dropped in /usr/local/bin
# so we can fetch them independently in a separate build.
ARG base=quay.io/centos/centos:stream10
FROM $base as base

Check warning on line 4 in devenv/Containerfile.c10s

View workflow job for this annotation

GitHub Actions / build (c10s, amd64)

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/

Check warning on line 4 in devenv/Containerfile.c10s

View workflow job for this annotation

GitHub Actions / build (c10s, arm64)

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/
# Life is too short to care about dash
RUN ln -sfr /bin/bash /bin/sh
RUN <<EORUN
Expand All @@ -18,28 +18,28 @@
baseurl=https://cli.github.com/packages/rpm
enabled=1
gpgcheck=1
gpgkey=https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x23F3D4EA75716059
gpgkey=https://cli.github.com/packages/githubcli-archive-keyring.asc

@cgwalters cgwalters Sep 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing to change here but in practice now this is basically just chaining security of TLS for what it's worth...like in the general case in theory what we should do here is have a set of keys in a trust root we manage.

But we already rely on TLS for many other things anyways.

An alternative actually is a much-reduced set of TLS trust roots than the default ca-certificates for the build process.

EOREPO

# Update after adding repositories
dnf -y makecache
EORUN

FROM base as tools

Check warning on line 28 in devenv/Containerfile.c10s

View workflow job for this annotation

GitHub Actions / build (c10s, amd64)

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/

Check warning on line 28 in devenv/Containerfile.c10s

View workflow job for this annotation

GitHub Actions / build (c10s, arm64)

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/
# renovate: datasource=github-releases depName=astral-sh/uv
ARG uvversion=0.12.13
COPY fetch-tools.py tool-versions.txt install-uv.sh /run/src/
RUN /run/src/fetch-tools.py
RUN uvversion=$uvversion /run/src/install-uv.sh

FROM base as rust

Check warning on line 35 in devenv/Containerfile.c10s

View workflow job for this annotation

GitHub Actions / build (c10s, amd64)

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/

Check warning on line 35 in devenv/Containerfile.c10s

View workflow job for this annotation

GitHub Actions / build (c10s, arm64)

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/
# renovate: datasource=custom.rust-nightly depName=rust-nightly versioning=rust-release-channel
ARG rust_nightly=nightly-2026-09-14
COPY install-rust.sh /run/src/
RUN rust_nightly=$rust_nightly /run/src/install-rust.sh

# Kani formal verification tool - requires rustup for toolchain management
FROM rust as kani

Check warning on line 42 in devenv/Containerfile.c10s

View workflow job for this annotation

GitHub Actions / build (c10s, amd64)

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/

Check warning on line 42 in devenv/Containerfile.c10s

View workflow job for this annotation

GitHub Actions / build (c10s, arm64)

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/
# renovate: datasource=crate depName=kani-verifier
ARG kaniversion=0.67.0
COPY install-kani.sh /run/src/
Expand Down
Loading