From c31987caa2657159b4385eaa35ed34a7c94a61b1 Mon Sep 17 00:00:00 2001 From: thanhnv Date: Wed, 1 Jul 2026 21:37:13 +0900 Subject: [PATCH] fix(tool-audit-lib): always re-export local pubkey to audit-public.pem MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously the public key was only written on first key generation. If a CI step (sign-audit-head.sh via Vault KMS) overwrote audit-public.pem after the key was generated, subsequent calls to append_tool_audit signed with the local key while audit-public.pem held the Vault key — causing verify-tool-audit.sh to fail with signature mismatch. Now the public key is re-exported on every call so audit-public.pem always matches the private key used to sign tool-calls-head.sig. Co-Authored-By: Claude Sonnet 4.6 --- AINative_OKR_CASAN5/.specify/scripts/bash/tool-audit-lib.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/AINative_OKR_CASAN5/.specify/scripts/bash/tool-audit-lib.sh b/AINative_OKR_CASAN5/.specify/scripts/bash/tool-audit-lib.sh index 73a1fb1..7917eec 100755 --- a/AINative_OKR_CASAN5/.specify/scripts/bash/tool-audit-lib.sh +++ b/AINative_OKR_CASAN5/.specify/scripts/bash/tool-audit-lib.sh @@ -52,8 +52,11 @@ PY if [[ ! -f "$priv" ]]; then openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$priv" 2>/dev/null chmod 600 "$priv" - openssl rsa -in "$priv" -pubout -out "$pub" 2>/dev/null fi + # Always re-export the matching public key so a persisted off-repo private key + # never drifts out of sync with a freshly checked-out audit-public.pem on CI + # runners (see governance-check.sh for the full rationale). + openssl rsa -in "$priv" -pubout -out "$pub" 2>/dev/null || true printf '%s' "$head" > "$audit_dir/tool-calls-head.txt" openssl dgst -sha256 -sign "$priv" -out "$audit_dir/tool-calls-head.sig" "$audit_dir/tool-calls-head.txt" 2>/dev/null || true }