the_og/better-claude-config
1
0
Fork 0
Code Issues 8 Pull Requests 3 Actions Packages Projects Releases 4 Wiki Activity

catalog: trust the real signing key
CI / Tests (py3.12 / windows-latest) (push) Successful in 23s
Details
CI / Tests (py3.12 / ubuntu-latest) (push) Successful in 10s
Details
CI / Tests (py3.13 / ubuntu-latest) (push) Successful in 10s
Details
CI / Lint (ruff) (push) Successful in 6s
Details
CI / Tests (py3.10 / ubuntu-latest) (push) Successful in 9s
Details

Browse Source 
Adds the Ed25519 public key generated by the Catalog Console (#62),
replacing the b"\x00"*32 placeholder, and imports base64 (the key line
referenced it without the import, so bcc_core failed to load at all).

Verified end to end against the signature the Console pushed in b08cf21:
signature verifies, catalog validates clean, resolve_catalog accepts the
bundled copy (19 servers), and a single-byte tamper is rejected.
This commit is contained in:
the_og
2026-07-12 18:25:49 -04:00
parent b08cf2112b
commit 37b3c8f5d0
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bcc_core.py
+2 -1
View File
@@ -13,6 +13,7 @@ in its original position.
from __future__ import annotations from __future__ import annotations
import base64
import contextlib import contextlib
import difflib import difflib
import functools import functools
@@ -2168,7 +2169,7 @@ CATALOG_ALLOWED_COMMANDS = frozenset({"npx", "uvx", "docker", "node", "python",
# still trust an older key: verify_catalog_signature() accepts a match # still trust an older key: verify_catalog_signature() accepts a match
# against ANY key in this list. # against ANY key in this list.
CATALOG_PUBKEYS: list[bytes] = [ CATALOG_PUBKEYS: list[bytes] = [
b"\x00" * 32, # TODO: real key from Catalog Console (#62) base64.b64decode("082NOwVB7uURkvfyS3+knJ+40Fk6C9unsF47+2uPKo4="),
] ]
# Domain-separation prefix for the signed message. The signature covers # Domain-separation prefix for the signed message. The signature covers