cipd: enforce attestation check [infra/luci/luci-go : main]

[Chenlin Fan (Gerrit)]

Attention needed from Robbie Iannucci and Vadim Shtayura

Chenlin Fan voted

Auto-Submit	+1
Commit-Queue	+1

Open in Gerrit

Related details

Attention is currently required from:

• Robbie Iannucci
• Vadim Shtayura

Submit Requirements:

• Code-Owners
• Code-Review
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: infra/luci/luci-go

Gerrit-Branch: main

Gerrit-Change-Id: Iebcb4bbb9fb0987bbc2c5fdca548f3994ddf5740

Gerrit-Change-Number: 7960962

Gerrit-PatchSet: 2

Gerrit-Owner: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Robbie Iannucci <iann...@google.com>

Gerrit-Reviewer: Vadim Shtayura <vad...@chromium.org>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Vadim Shtayura <vad...@chromium.org>

Gerrit-Attention: Robbie Iannucci <iann...@google.com>

Gerrit-Comment-Date: Thu, 18 Jun 2026 04:51:04 +0000

Gerrit-HasComments: No

Gerrit-Has-Labels: Yes

[Chenlin Fan (Gerrit)]

Attention needed from Robbie Iannucci and Vadim Shtayura

Chenlin Fan voted Auto-Submit+0

Auto-Submit

+0

Open in Gerrit

Related details

Attention is currently required from:

• Robbie Iannucci
• Vadim Shtayura

Submit Requirements:

• Code-Owners
• Code-Review
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: infra/luci/luci-go

Gerrit-Branch: main

Gerrit-Change-Id: Iebcb4bbb9fb0987bbc2c5fdca548f3994ddf5740

Gerrit-Change-Number: 7960962

Gerrit-PatchSet: 2

Gerrit-Owner: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Robbie Iannucci <iann...@google.com>

Gerrit-Reviewer: Vadim Shtayura <vad...@chromium.org>

Gerrit-CC: LUCI CQ <infra-...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Vadim Shtayura <vad...@chromium.org>

Gerrit-Attention: Robbie Iannucci <iann...@google.com>

Gerrit-Comment-Date: Thu, 18 Jun 2026 06:56:19 +0000

Gerrit-HasComments: No

Gerrit-Has-Labels: Yes

[Chenlin Fan (Gerrit)]

Attention needed from Robbie Iannucci and Vadim Shtayura

Chenlin Fan voted Auto-Submit+1

Auto-Submit

+1

Gerrit-Comment-Date: Thu, 18 Jun 2026 06:56:26 +0000

Gerrit-HasComments: No

Gerrit-Has-Labels: Yes

[Robbie Iannucci (Gerrit)]

Attention needed from Chenlin Fan and Vadim Shtayura

Robbie Iannucci voted and added 1 comment

Votes added by Robbie Iannucci

Code-Review

+1

1 comment

Patchset-level comments

File-level comment, Patchset 2 (Latest):

Robbie Iannucci . resolved

good luck

Open in Gerrit

Related details

Attention is currently required from:

• Chenlin Fan
• Vadim Shtayura

Submit Requirements:

• Code-Owners
• Code-Review
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: infra/luci/luci-go

Gerrit-Branch: main

Gerrit-Change-Id: Iebcb4bbb9fb0987bbc2c5fdca548f3994ddf5740

Gerrit-Change-Number: 7960962

Gerrit-PatchSet: 2

Gerrit-Owner: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Robbie Iannucci <iann...@google.com>

Gerrit-Reviewer: Vadim Shtayura <vad...@chromium.org>

Gerrit-CC: LUCI CQ <infra-...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Chenlin Fan <fa...@chromium.org>

Gerrit-Attention: Vadim Shtayura <vad...@chromium.org>

Gerrit-Comment-Date: Fri, 19 Jun 2026 01:06:46 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: Yes

[Chenlin Fan (Gerrit)]

Attention needed from Robbie Iannucci and Vadim Shtayura

Chenlin Fan voted and added 1 comment

Votes added by Chenlin Fan

Auto-Submit	+1
Commit-Queue	+1

1 comment

Patchset-level comments

File-level comment, Patchset 2:

Robbie Iannucci . resolved

good luck

Chenlin Fan

:( no not good. need another stamp because I touched proto for VerificationPurpose.

Open in Gerrit

Related details

Attention is currently required from:

• Robbie Iannucci
• Vadim Shtayura

Submit Requirements:

• Code-Owners
• Code-Review

• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: infra/luci/luci-go

Gerrit-Branch: main

Gerrit-Change-Id: Iebcb4bbb9fb0987bbc2c5fdca548f3994ddf5740

Gerrit-Change-Number: 7960962

Gerrit-PatchSet: 5

Gerrit-Owner: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Robbie Iannucci <iann...@google.com>

Gerrit-Reviewer: Vadim Shtayura <vad...@chromium.org>

Gerrit-CC: LUCI CQ <infra-...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Vadim Shtayura <vad...@chromium.org>

Gerrit-Attention: Robbie Iannucci <iann...@google.com>

Gerrit-Comment-Date: Fri, 19 Jun 2026 02:21:12 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: Yes

Comment-In-Reply-To: Robbie Iannucci <iann...@google.com>

[Robbie Iannucci (Gerrit)]

Attention needed from Chenlin Fan and Vadim Shtayura

Robbie Iannucci voted and added 1 comment

Votes added by Robbie Iannucci

Code-Review

+1

1 comment

Patchset-level comments

File-level comment, Patchset 6 (Latest):

Robbie Iannucci . resolved

good luck x2

Open in Gerrit

Related details

Attention is currently required from:

• Chenlin Fan
• Vadim Shtayura

Submit Requirements:

• Code-Owners
• Code-Review

• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: infra/luci/luci-go

Gerrit-Branch: main

Gerrit-Change-Id: Iebcb4bbb9fb0987bbc2c5fdca548f3994ddf5740

Gerrit-Change-Number: 7960962

Gerrit-PatchSet: 6

Gerrit-Owner: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Robbie Iannucci <iann...@google.com>

Gerrit-Reviewer: Vadim Shtayura <vad...@chromium.org>

Gerrit-CC: LUCI CQ <infra-...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Chenlin Fan <fa...@chromium.org>

Gerrit-Attention: Vadim Shtayura <vad...@chromium.org>

Gerrit-Comment-Date: Fri, 19 Jun 2026 02:39:36 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: Yes

[Chenlin Fan (Gerrit)]

Attention needed from Vadim Shtayura

Chenlin Fan voted Commit-Queue+2

Commit-Queue

+2

Open in Gerrit

Related details

Attention is currently required from:

• Vadim Shtayura

Submit Requirements:

• Code-Owners
• Code-Review
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: infra/luci/luci-go

Gerrit-Branch: main

Gerrit-Change-Id: Iebcb4bbb9fb0987bbc2c5fdca548f3994ddf5740

Gerrit-Change-Number: 7960962

Gerrit-PatchSet: 6

Gerrit-Owner: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Robbie Iannucci <iann...@google.com>

Gerrit-Reviewer: Vadim Shtayura <vad...@chromium.org>

Gerrit-CC: LUCI CQ <infra-...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Vadim Shtayura <vad...@chromium.org>

Gerrit-Comment-Date: Fri, 19 Jun 2026 04:05:12 +0000

Gerrit-HasComments: No

Gerrit-Has-Labels: Yes

[LUCI CQ (Gerrit)]

LUCI CQ submitted the change

Change information

Commit message:

cipd: enforce attestation check

- Reject registration request when attestation check failed.
- Remove obsolete attach metadata workflow.

This won't block package uploads UNLESS it's under an L1 policy.
Currently almost all prefix are exempt to L0 except some infra/chromium
3pp related prefixes.

Bug: 393121542

Change-Id: Iebcb4bbb9fb0987bbc2c5fdca548f3994ddf5740

Reviewed-on: https://chromium-review.googlesource.com/c/infra/luci/luci-go/+/7960962

Auto-Submit: Chenlin Fan <fa...@chromium.org>

Reviewed-by: Robbie Iannucci <iann...@google.com>

Commit-Queue: Chenlin Fan <fa...@chromium.org>

Files:

• M cipd/appengine/impl/repo/repo.go
• M cipd/appengine/impl/repo/repo_test.go
• M cipd/appengine/impl/vsa/api/software_verifier_service.pb.go
• M cipd/appengine/impl/vsa/api/software_verifier_service.proto
• M cipd/appengine/impl/vsa/api/vsa_log_entry.pb.go
• M cipd/appengine/impl/vsa/vsa.go

Change size: M

Delta: 6 files changed, 40 insertions(+), 104 deletions(-)

Branch: refs/heads/main

Submit Requirements:

• Code-Review: +1 by Robbie Iannucci

Open in Gerrit

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: merged

Gerrit-Project: infra/luci/luci-go

Gerrit-Branch: main

Gerrit-Change-Id: Iebcb4bbb9fb0987bbc2c5fdca548f3994ddf5740

Gerrit-Change-Number: 7960962

Gerrit-PatchSet: 7

Gerrit-Owner: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: Chenlin Fan <fa...@chromium.org>

Gerrit-Reviewer: LUCI CQ <infra-...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-Reviewer: Robbie Iannucci <iann...@google.com>

Gerrit-Reviewer: Vadim Shtayura <vad...@chromium.org>

Gerrit-CC: chromium...@chromium.org