[SLT.HOTFIX.001] Enforce trust threshold in pre-receive hook
Overview
Update the pre-receive hook to validate that pushes to trust refs are co-signed by the configured maintainer threshold, preventing under-signed trust changes from reaching protected repos.
References & Assets
User Story
As a repository administrator,
I want trust updates to be blocked unless the required maintainers have signed them,
so that Shiplog's trust graph cannot be altered by a single compromised actor.
Acceptance Criteria
Definition of Done
Hook enforcement shipped, documentation updated, and regression tests added across supported signature mechanisms.
Scope
In-Scope
- Pre-receive validation for trust ref
- SSH and PGP signature verification
- Error messaging and documentation updates
Out-of-Scope
- Journal/policy ref enforcement changes
- UI tooling for managing allowed signers
Deliverables
- Est. Lines of Code: ~180
- Est. Blast Radius: contrib/hooks/pre-receive.shiplog, TRUST docs, tests
Implementation Details
High-Level Approach
Parse trust.json from proposed update, verify signatures using existing verifier helpers, count distinct maintainers, and reject pushes below threshold with actionable errors.
Affected Areas
- contrib/hooks/pre-receive.shiplog
- lib/trust_verifier.sh
- docs/TRUST.md
- tests/26_trust_enforcement.bats
Implementation Steps
Test Plan
Happy Path
Edge Cases
Failure Cases
Monitoring & Success Metrics
QA Sign-off Matrix
| Environment |
Surface |
Owner |
Status |
Notes |
| Docker |
Git push |
TBD |
Pending |
Covered via make test |
Requirements
Hard Requirements
- Under-threshold trust updates must be rejected server-side
Soft Requirements
- Error guidance should point to trust docs for remediation
Runtime Requirements
- Hook must operate with default shell/ssh-keygen toolchain
Dependencies & Approvals
Production Notes
Priority: 5 / 5
Critical integrity fix (P0) for protecting trust updates.
Complexity: 3 / 5
Moderate shell scripting and integration work.
Estimate: 16 - 24 hours
Includes hook implementation, tests, and documentation.
Risk & Rollback
- Primary Risks: Hook false positives blocking legitimate pushes
- Mitigations: Thorough tests and dry-run validation
- Rollback / Kill Switch: Revert hook update or disable via env guard
Additional Notes
Coordinate with ops to roll out hook update across environments.
[SLT.HOTFIX.001] Enforce trust threshold in pre-receive hook
Overview
Update the pre-receive hook to validate that pushes to trust refs are co-signed by the configured maintainer threshold, preventing under-signed trust changes from reaching protected repos.
References & Assets
User Story
As a repository administrator,
I want trust updates to be blocked unless the required maintainers have signed them,
so that Shiplog's trust graph cannot be altered by a single compromised actor.
Acceptance Criteria
Definition of Done
Hook enforcement shipped, documentation updated, and regression tests added across supported signature mechanisms.
Scope
In-Scope
Out-of-Scope
Deliverables
Implementation Details
High-Level Approach
Parse trust.json from proposed update, verify signatures using existing verifier helpers, count distinct maintainers, and reject pushes below threshold with actionable errors.
Affected Areas
Implementation Steps
Test Plan
Happy Path
Edge Cases
Failure Cases
Monitoring & Success Metrics
QA Sign-off Matrix
Requirements
Hard Requirements
Soft Requirements
Runtime Requirements
Dependencies & Approvals
Production Notes
Priority: 5 / 5
Critical integrity fix (P0) for protecting trust updates.
Complexity: 3 / 5
Moderate shell scripting and integration work.
Estimate: 16 - 24 hours
Includes hook implementation, tests, and documentation.
Risk & Rollback
Additional Notes
Coordinate with ops to roll out hook update across environments.