[martynp]

No description provided.

[Copilot]

🟡 Changes recommended

Unresolved correctness issues affect Clevis compatibility, assurance evidence, and installer reruns.

1 open issue

• Attach subtest skips to the parent testcase · New

2 previously missed issues

In code that hasn't changed since last review

Prevent stale RPMs from overriding newly downloaded tools

scripts/​install-interop-tools.sh:36

On a reused prefix, packages/ retains RPMs from earlier downloads. The extraction loop then replays every version with --unconditional. Filename order is not RPM version order: release -10 sorts before -9, so the older cached package can overwrite the newly downloaded tools. Clear the package staging directory before downloading, or extract only packages selected for this run.

Clear recovery key use metadata during normalization

src/​key_store.rs:165

An accepted recovery key with use: "sig" still advertises verification capability because to_public_key() preserves use. JOSE's jose_jwk_prm accepts an operation allowed by either key_ops or use, and Clevis requires signatures from every key selected for verification. Enrollment therefore fails for this recovery key despite the normalized key_ops. Clear its advertised use metadata too, and cover this case in the Clevis regression.

3 resolved since last review

• Remove temporary file when permission setting fails
• Reject key operations incompatible with advertised verification roles
• Prevent use of attacker-controlled temporary directory

_{Review effort: Balanced}