cipd: add ExemptFromVerifySoftwareArtifacts [infra/luci/luci-go : main]

[Chenlin Fan (Gerrit)]

Attention needed from Robbie Iannucci and Vadim Shtayura

Chenlin Fan voted Commit-Queue+1

Commit-Queue

+1

Open in Gerrit

Related details

Attention is currently required from:

• Robbie Iannucci
• Vadim Shtayura

Submit Requirements:

• Code-Owners
• Code-Review
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: infra/luci/luci-go

Gerrit-Branch: main

Gerrit-Change-Id: I31e6ee9e60f888beeab3fd7cd321f17cb86cb50c

Gerrit-Change-Number: 7610909

Gerrit-PatchSet: 2

Gerrit-Owner: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Robbie Iannucci <iann...@google.com>

Gerrit-Reviewer: Vadim Shtayura <vad...@chromium.org>

Gerrit-CC: LUCI CQ <infra-...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Vadim Shtayura <vad...@chromium.org>

Gerrit-Attention: Robbie Iannucci <iann...@google.com>

Gerrit-Comment-Date: Wed, 04 Mar 2026 11:32:32 +0000

Gerrit-HasComments: No

Gerrit-Has-Labels: Yes

[Vadim Shtayura (Gerrit)]

Attention needed from Chenlin Fan and Robbie Iannucci

Vadim Shtayura added 2 comments

File cipd/appengine/impl/repo/repo.go

Line 678, Patchset 2 (Latest): vsaResp = &api.VerifySoftwareArtifactResponse{Allowed: true}

Vadim Shtayura . unresolved

is it too late to convert this to an enum with variants `ALLOWED, REJECTED, EXEMPTED`? (Or somehow else identify that a package was exemption for VSA).

Alternatively, can we NOT call setVerificationSummary if the package was exempted? (that the lack of verification summary will serve as a signal it was exempted).

I just this storing "Allowed: true" for packages we haven't actually verified is wrong.

Edit: looks like setVerificationSummary does nothing if `resp.VerificationSummary == ""`. I think it will be clearer if this check was done here instead.

Line 688, Patchset 2 (Latest): if !vsaResp.Allowed {

Vadim Shtayura . unresolved

we should probably log packages exempted from the check

Open in Gerrit

Related details

Attention is currently required from:

• Chenlin Fan
• Robbie Iannucci

Submit Requirements:

• Code-Owners
• Code-Review

• No-Unresolved-Comments

• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: infra/luci/luci-go

Gerrit-Branch: main

Gerrit-Change-Id: I31e6ee9e60f888beeab3fd7cd321f17cb86cb50c

Gerrit-Change-Number: 7610909

Gerrit-PatchSet: 2

Gerrit-Owner: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Robbie Iannucci <iann...@google.com>

Gerrit-Reviewer: Vadim Shtayura <vad...@chromium.org>

Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>

Gerrit-CC: LUCI CQ <infra-...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Chenlin Fan <fa...@chromium.org>

Gerrit-Attention: Robbie Iannucci <iann...@google.com>

Gerrit-Comment-Date: Mon, 23 Mar 2026 23:50:59 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: No

[Chenlin Fan (Gerrit)]

Attention needed from Robbie Iannucci and Vadim Shtayura

Chenlin Fan added 2 comments

File cipd/appengine/impl/repo/repo.go

Line 678, Patchset 2: vsaResp = &api.VerifySoftwareArtifactResponse{Allowed: true}

Vadim Shtayura . resolved

is it too late to convert this to an enum with variants `ALLOWED, REJECTED, EXEMPTED`? (Or somehow else identify that a package was exemption for VSA).

Alternatively, can we NOT call setVerificationSummary if the package was exempted? (that the lack of verification summary will serve as a signal it was exempted).

I just this storing "Allowed: true" for packages we haven't actually verified is wrong.

Edit: looks like setVerificationSummary does nothing if `resp.VerificationSummary == ""`. I think it will be clearer if this check was done here instead.

Chenlin Fan

The proto is copied from https://source.corp.google.com/piper///depot/google3/google/internal/bcid/softwareverifier/v1/software_verifier_service.proto;l=255 so we probably don't want to change its fields.

Updated to only call `setVerificationSummary` when `resp.VerificationSummary != ""`. I will keep the checks in setVerificationSummary until we remove the backfill logic.

Line 688, Patchset 2: if !vsaResp.Allowed {

Vadim Shtayura . resolved

we should probably log packages exempted from the check

Chenlin Fan

Done

Open in Gerrit

Related details

Attention is currently required from:

• Robbie Iannucci
• Vadim Shtayura

Submit Requirements:

• Code-Owners
• Code-Review

• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: infra/luci/luci-go

Gerrit-Branch: main

Gerrit-Change-Id: I31e6ee9e60f888beeab3fd7cd321f17cb86cb50c

Gerrit-Change-Number: 7610909

Gerrit-PatchSet: 3

Gerrit-Owner: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Robbie Iannucci <iann...@google.com>

Gerrit-Reviewer: Vadim Shtayura <vad...@chromium.org>

Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>

Gerrit-CC: LUCI CQ <infra-...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Vadim Shtayura <vad...@chromium.org>

Gerrit-Attention: Robbie Iannucci <iann...@google.com>

Gerrit-Comment-Date: Tue, 24 Mar 2026 02:51:02 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: No

Comment-In-Reply-To: Vadim Shtayura <vad...@chromium.org>

[Vadim Shtayura (Gerrit)]

Attention needed from Chenlin Fan and Robbie Iannucci

Vadim Shtayura voted Code-Review+1

Code-Review

+1

Open in Gerrit

Related details

Attention is currently required from:

• Chenlin Fan
• Robbie Iannucci

Submit Requirements:

• Code-Owners
• Code-Review
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: infra/luci/luci-go

Gerrit-Branch: main

Gerrit-Change-Id: I31e6ee9e60f888beeab3fd7cd321f17cb86cb50c

Gerrit-Change-Number: 7610909

Gerrit-PatchSet: 3

Gerrit-Owner: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Robbie Iannucci <iann...@google.com>

Gerrit-Reviewer: Vadim Shtayura <vad...@chromium.org>

Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>

Gerrit-CC: LUCI CQ <infra-...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Chenlin Fan <fa...@chromium.org>

Gerrit-Attention: Robbie Iannucci <iann...@google.com>

Gerrit-Comment-Date: Tue, 24 Mar 2026 15:25:02 +0000

Gerrit-HasComments: No

Gerrit-Has-Labels: Yes