fix(setup): verify Kitware archive key fingerprint

[wyli]

Summary

• verify the Kitware apt signing key primary fingerprint before dearmoring or writing it
• reject missing, mismatched, or bundled additional primary keys
• preserve the existing CMake setup behavior when the expected key is received

Security impact

The default holoscan setup path calls setup_cmake whenever CMake is absent or below the required version. Previously, bytes returned by the fixed HTTPS endpoint flowed directly through gpg --dearmor into a root-owned apt keyring. The URL is not user-controlled, but the network response is untrusted and the path is reachable, so a substituted key could become an apt trust anchor.

The expected full fingerprint, 4DBEBE3EEC96E7B8C6EC5BE99E92FDC6C5B9BA75, is published by the Kitware APT repository. The setup now reads GPG machine output and requires exactly one primary key with that fingerprint before writing the keyring or apt source. Legitimate subkeys remain supported, while an additional primary key causes setup to fail closed.

Testing

• PYTHONPATH=src pytest -q -o addopts="" tests/unit — 493 passed, 1 skipped
• PYTHONPATH=src python -m holoscan_cli lint — all pre-commit hooks passed
• confirmed the live Kitware key matches the fingerprint published on the official Kitware repository page

AI-assisted: Created with Codex/GPT at the user's request.

Summary by CodeRabbit

• Security

  • Strengthened host setup validation by checking that the repository signing key matches the expected fingerprint.
  • Prevents installation from continuing when the downloaded key is missing, invalid, unexpected, or ambiguous.

• Bug Fixes

  • Improved error handling and messaging for repository key download and validation failures.
  • Helps prevent incomplete or tampered setup steps from installing packages or using invalid signing keys.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 01089c09-1d29-48da-8f49-981884579009

📥 Commits

Reviewing files that changed from the base of the PR and between 46c11c1 and b9e498e.

📒 Files selected for processing (2)

• src/holoscan_cli/utils/host_setup.py
• tests/unit/test_host_setup.py

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

Walkthrough

The host setup now validates the downloaded Kitware archive key with exactly one matching primary fingerprint. Unit tests focus on this validator. The codespell ignore list includes fpr.

Changes

Kitware key validation

Layer / File(s)	Summary
Pinned key validation flow src/holoscan_cli/utils/host_setup.py	The setup inlines the Kitware key URL, validates one public-key record with the expected fingerprint, and simplifies download-related errors.
Focused validation coverage tests/unit/test_host_setup.py, .lint/codespell_ignore_words.txt	Tests cover matching, incorrect, and multiple primary fingerprints. The lint configuration ignores fpr.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to b9e49

The change adds verification of the Kitware signing key before installing it while preserving expected setup behavior; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: verification of the Kitware archive key fingerprint during setup.

---

_{Comment @coderabbitai help to get the list of available commands.}