fix(kernel): the durable pkg MANIFEST copy runs under the promote identity #2060

Merged

pipeline-bot merged 1 commit from fix/kernel-manifest-promote-identity into trunk

2026-08-16 10:01:17 +00:00

sean commented

2026-08-16 10:00:28 +00:00

Owner

linux opts into the promote keyset; the gating pkg copy moves to pkg/linux/snapshots/ under linuxpromote-s3; build key stays off pkg; the interim olly-platform grant is reverted. Root cause of the three seanfarm34 release failures.

sean added 1 commit

2026-08-16 10:00:28 +00:00

fix(kernel): the durable pkg MANIFEST copy runs under the promote identity

pipeline/ci CI green @ 46fbfccf9e55

Details

46fbfccf9e

1d3670ee made the pkg copy gate the release but shipped it with the
BUILD key against a pkg/linux-snapshots prefix no policy grants —
seanfarm34 failed the gate on its first exercise, three times.

The fix aligns with the provisioner's existing design instead of
widening any policy: linux opts into the promote keyset (the promote
class already grants pkg/$PROJECT/* rw), the copy targets
pkg/linux/snapshots/ under a dedicated promote alias, and the build
key stays off the pkg bucket entirely (untrusted-compile vs
trusted-publish). The interim olly-platform pkg/linux-snapshots grant
(2058/2059) is reverted — wrong identity, now unneeded.

Found along the way, tracked separately: the MinioPolicy operator's
update reconcile is a silent no-op (Ready=True, generation observed,
MinIO body unchanged — only the create path applies), and the
obsbucket ArgoCD app reports Synced under SSA while its apply was
webhook-denied.

pipeline-bot merged commit 46fbfccf9e into trunk

2026-08-16 10:01:17 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/pipelines!2060

No description provided.

Rows
Columns