Skip to content

testdata: refresh apko-discover lock for rotated chainguard key - #2601

Closed
tcnghia wants to merge 1 commit into
chainguard-dev:mainfrom
tcnghia:tcnghia/apko-discover-key-rotation
Closed

tcnghia wants to merge 1 commit into
chainguard-dev:mainfrom
tcnghia:tcnghia/apko-discover-key-rotation

Conversation

@tcnghia

@tcnghia tcnghia commented Oct 25, 2026

Copy link
Copy Markdown
Contributor

TestLock/apko-discover now fails on every apko PR, including #2600, which only changes APK cache files. Since #2322, the golden lock has embedded keyring content fetched live from apk.cgr.dev. The server now returns HTTP 404 for the embedded e3fb44… key and serves 717fef… instead. This is the same refresh as #2203 and #2350.

This PR addresses that by:

  • Removing the e3fb44… key from internal/cli/testdata/apko-discover.lock.json.
  • Adding the 717fef… key from the test's own LockCmd output. The diff is five lines added and five removed, with no other changes.

Evidence

I temporarily made TestLock write its output over the golden file, ran go test -run '^TestLock$/^apko-discover$' ./internal/cli/, then reverted the test change. At commit d849c4a, go test -count=1 -run '^TestLock$' ./internal/cli/ passes. The embedded 717fef… content has the same SHA-256 (fc774d8f…) as the key fetched with curl -s from apk.cgr.dev; the old key URL returns HTTP 404.

Note to reviewers: please feel free to independently validate our results.

Signed-off-by: Nghia Tran <tcnghia@gmail.com>
@tcnghia

tcnghia commented Oct 25, 2026

Copy link
Copy Markdown
Contributor Author

Closing as a duplicate of #2602, which makes the same key refresh.

@tcnghia tcnghia closed this Oct 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant