Development record
commands/update.md network inventory (adr-38) says GitHub attestations API and the Sigstore TUF repository are reached by update, to verify build provenance, reading as exhaustive; ahoy install now makes the same check (internal/core/ahoy/apply.go), and both verbs also reach the GitHub git API to resolve the tag commit (internal/core/update/provenance.go), which the inventory omits.
issueopenminoriss-2610141706058429
commands/update.md network inventory (adr-38) says GitHub attestations API and the Sigstore TUF repository are reached by update, to verify build provenance, reading as exhaustive; ahoy install now makes the same check (internal/core/ahoy/apply.go), and both verbs also reach the GitHub git API to resolve the tag commit (internal/core/update/provenance.go), which the inventory omits.
Frontmatter
| id | iss-2610141706058429 |
|---|---|
| type | issue |
| lifecycle | open |
| severity | minor |
.abcd/work/issues/open/iss-2610141706058429-commands-update-md-network-inventory.md
open on GitHub ↗ · commit history ↗
mentions1
- adr-38Implicit checks are disk-only — the network answers only an explicit ask