Hold sig-mismatched skills at sync; alert on failing integrity sweeps#350
Merged
Conversation
…er issue Two gaps let internally inconsistent skills publish and sit unnoticed: 1. The sync's drift detection only caught content changed WITHOUT a sig refresh. When content and signature changed together it trusted the pair blindly — and bot sync PRs run no CI, so nothing downstream verified them either. Seven skills published with content that fails signature verification this way. Defense #3 now digest-verifies every rsynced skill whose signature changed, and holds (revert/drop) any whose incoming content does not match its own incoming signature, with a 'sig mismatch' category in the PR body and tracker issue. 2. The daily full-catalog integrity sweep failed silently for a week — scheduled workflow failures alert no one. The sweep now maintains a rolling tracker issue (label: integrity-failure) with the finding list and owner recovery steps, and auto-closes it when a sweep passes. Signed-off-by: Moshe Abramovitch <moshea@nvidia.com>
sayalinvidia
approved these changes
Jul 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Onboarding type
components.d/<slug>.ymlfile)Context
The daily integrity sweep has been red since at least July 9 with nobody noticing, and 30 published files across 7 skills (amc x3, deepstream-dev, earth2studio x3) fail signature verification on main today. Root cause analysis showed the content/sig inconsistency exists at the source repos, and it entered the catalog because of two gaps this PR closes.
Change 1: Defense #3 in the sync (the ingestion gate)
The drift detection held content changed without a sig refresh, but blindly trusted content and signature that changed together — and bot sync PRs trigger no CI, so nothing else checked them. Now every rsynced skill whose signature changed gets digest-verified against that signature; mismatches are held (revert to last-signed, or drop if new) with a new
sig mismatchcategory in the sync PR body and the missing-compliance tracker.Change 2: The sweep maintains a tracker issue
Scheduled failures alert no one. The sweep now opens/updates a rolling issue (label
integrity-failure) with the finding list and owner recovery steps, and closes it automatically when a sweep passes — same pattern as the sync's missing-compliance tracker.Tested locally
bash -n.Team outreach for the existing 7 mismatched skills is already underway separately; this PR prevents recurrence and makes the cleanup visible.