feat: add signed marketplace feed config by giodl73-repo · Pull Request #98316 · openclaw/openclaw

giodl73-repo · 2026-07-01T01:29:29Z

Summary

extend marketplace feed verification config to support signed mode with local Ed25519 signing keys and an optional threshold
validate signed feed trust anchors in the OpenClaw config schema, including key shape, strict raw base64url public-key parsing, private-key rejection, unique key IDs, unique normalized public keys, and threshold bounds
document the new config fields in generated help and labels, and carry the verification shape into the official external catalog feed profile type
fail closed for signed feed profiles until refresh envelope enforcement is wired, without fetching, reading snapshots, or returning bundled public entries for that selected profile

Stack

Stacked after feat: add hosted feed envelope verifier #98299 (feeds-trust-envelope-verifier).
This PR intentionally targets main as a draft because the dependency branch is on the fork; review should focus on the top commit 09734e867b until feat: add hosted feed envelope verifier #98299 lands. This head is rebased onto feat: add hosted feed envelope verifier #98299 head 297003b252c, including the DSSE decoded-payload-byte verifier fix.

Scope boundaries

This is still a config-contract slice. It does not verify signed feed envelopes during marketplace refresh yet, does not persist snapshot trust state, does not add CLI/operator trust output, and does not change install eligibility. Signed profiles are accepted as local trust config but return zero marketplace entries until the later enforcement slice consumes signed envelopes.

Validation

> node scripts/run-vitest.mjs src/config/zod-schema.marketplaces.test.ts src/plugins/official-external-plugin-catalog.test.ts src/plugins/official-external-plugin-catalog-envelope.test.ts --reporter=dot
Test Files 3 passed (3)
Tests 78 passed (78)
[test] passed 3 Vitest shards

> npx oxfmt --check src/config/schema.help.ts src/config/schema.labels.ts src/config/types.marketplaces.ts src/config/zod-schema.marketplaces.test.ts src/config/zod-schema.ts src/infra/ed25519-signature.ts src/plugins/official-external-plugin-catalog-envelope.test.ts src/plugins/official-external-plugin-catalog-envelope.ts src/plugins/official-external-plugin-catalog.test.ts src/plugins/official-external-plugin-catalog.ts
All matched files use the correct format.

> npx oxlint src/config/schema.help.ts src/config/schema.labels.ts src/config/types.marketplaces.ts src/config/zod-schema.marketplaces.test.ts src/config/zod-schema.ts src/infra/ed25519-signature.ts src/plugins/official-external-plugin-catalog-envelope.test.ts src/plugins/official-external-plugin-catalog-envelope.ts src/plugins/official-external-plugin-catalog.test.ts src/plugins/official-external-plugin-catalog.ts
Found 0 warnings and 0 errors.

> git diff --check origin/main...HEAD && git diff --check
PASS

> pnpm tsgo:core
PASS

clawsweeper · 2026-07-01T01:30:22Z

Codex review: needs maintainer review before merge. Reviewed July 8, 2026, 11:27 PM ET / 03:27 UTC.

Summary
The PR adds signed marketplace feed profile configuration with Ed25519 trust anchors and threshold validation, updates help/labels/types, and carries the profile verification shape into the hosted catalog loader with a fail-closed signed mode.

PR surface: Source +131, Tests +139. Total +270 across 7 files.

Reproducibility: not applicable. as a feature/config PR. The staged behavior is source-verifiable, and the PR body/comments provide terminal proof for signed config validation and fail-closed selected-profile behavior.

Review metrics: 1 noteworthy metric.

Signed feed config surface: 1 mode added, 1 trust-key array added, 1 optional threshold added. These are public marketplace trust settings that affect upgrade compatibility and supply-chain review before merge.

Stored data model
Persistent data-model change detected: database schema: src/config/zod-schema.ts, unknown-data-model-change: src/config/zod-schema.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: canonical
Canonical: #98316
Summary: This PR is the signed marketplace feed config slice in an open feed-trust series; related PRs are prerequisite or follow-up consumers rather than duplicates.

Members:

adjacent_distinct: feat: add hosted feed envelope verifier #98299 - Merged prerequisite verifier-primitives PR that this branch now builds on, but it does not own the signed config contract.
partial_overlap: Verify signed marketplace feed refresh #98338 - Open follow-up that wires signed refresh enforcement and consumes the config shape added here.
adjacent_distinct: Show marketplace feed trust state #98350 - Open follow-up for CLI trust-state visibility after signed refresh state exists.
adjacent_distinct: feat: bind signed ClawHub default feed trust #101981 - Open follow-up for a signed ClawHub default feed slot after the signed feed trust stack exists.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Risk before merge

[P1] Merging this slice makes signed marketplace feed config valid while selected signed profiles intentionally throw until the follow-up refresh-enforcement PR lands.
[P1] The new local publisher public-key and threshold fields become part of OpenClaw's marketplace supply-chain trust contract before a release consumes signed envelopes end to end.
[P1] The PR is mergeable but behind current main, so final landing should use refreshed exact-head checks after the merge base is current.

Maintainer options:

Accept staged signed-feed config (recommended)
Maintainers can merge after exact-head checks while explicitly accepting that selected signed profiles throw until the follow-up enforcement PR lands.
Require enforcement in the same landing window
Hold this PR until signed refresh enforcement is ready so the newly valid config has a runtime consumer immediately.
Pause the feed-trust series
Keep the PR open or close the stack if the staged security contract is not worth the temporary operator impact.

Next step before merge

[P2] The remaining action is maintainer acceptance of the staged compatibility and security-boundary risk plus exact-head landing checks, not an automated repair.

Maintainer decision needed

Question: Should OpenClaw accept this staged signed marketplace feed config before signed refresh enforcement is merged?
Rationale: The patch is coherent and proven, but it intentionally exposes new supply-chain trust configuration and a selected runtime path that fails closed until a follow-up PR consumes signed envelopes.
Likely owner: Patrick-Erichsen — He is assigned, authored the latest head cleanup, and already made the clearest review decision on the staged signed-config risk.
Options:
- Accept staged config slice (recommended): Merge after exact-head checks if maintainers are comfortable owning the temporary fail-closed signed-profile behavior until enforcement follows.
- Land with refresh enforcement: Hold this PR until Verify signed marketplace feed refresh #98338 can land with it so accepted signed config has a working consumer immediately.
- Pause the trust stack: Keep the stack open but unmerged if the broader marketplace feed trust direction needs more product or security review first.

Security
Cleared: No concrete secret-handling, dependency, workflow, or code-execution regression was found; the trust-root config remains a maintainer-owned security-boundary merge risk.

Review details

Best possible solution:

Land this only as an accepted trust-stack slice, then continue with signed refresh enforcement in #98338 so signed profiles become usable rather than permanently fail-closed.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a feature/config PR. The staged behavior is source-verifiable, and the PR body/comments provide terminal proof for signed config validation and fail-closed selected-profile behavior.

Is this the best way to solve the issue?

Yes as an acceptable staged stack slice after maintainer approval, but not as the complete signed-feed solution. The complete end state still needs signed refresh enforcement in #98338 and later trust-state visibility.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 1252a3da59a8.

Label changes

Label justifications:

P2: This is a normal-priority marketplace trust feature with limited immediate blast radius but real compatibility and security-boundary review needs.
merge-risk: 🚨 compatibility: The PR adds a new config shape whose selected runtime path intentionally throws until signed refresh enforcement lands.
merge-risk: 🚨 security-boundary: The PR defines locally trusted publisher key and threshold semantics for signed marketplace feed supply-chain data.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body/comments include terminal/source-harness proof for signed config acceptance, malformed-key and duplicate-anchor rejection, and selected signed-profile no-fetch fail-closed behavior.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body/comments include terminal/source-harness proof for signed config acceptance, malformed-key and duplicate-anchor rejection, and selected signed-profile no-fetch fail-closed behavior.

Evidence reviewed

PR surface:

Source +131, Tests +139. Total +270 across 7 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	5	140	9	+131
Tests	2	146	7	+139
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	7	286	16	+270

What I checked:

Repository policy applied: Root policy treats config additions, fail-closed paths, and security-boundary trust decisions as compatibility-sensitive, and the plugin-scoped guide places marketplace discovery/config in the plugin control plane. (AGENTS.md:31, 1252a3da59a8)
Current main is unsigned-only: Current main only accepts marketplace feed verification with mode "unsigned", so this PR adds new signed-feed config surface rather than fixing an already-supported signed mode. (src/config/zod-schema.ts:496, 1252a3da59a8)
PR signed config schema: PR head accepts signed verification, requires at least one trusted key, validates raw/PEM Ed25519 public keys, rejects duplicate key IDs/material, and bounds threshold to configured key count. (src/config/zod-schema.ts:526, f4eca07b6788)
PR fail-closed loader path: PR head threads feed-profile verification through source resolution and throws before snapshot/fetch when the selected profile uses signed verification. (src/plugins/official-external-plugin-catalog.ts:846, f4eca07b6788)
Regression coverage: PR head adds schema coverage for signed config acceptance and invalid trust anchors plus catalog coverage proving selected signed profiles reject before fetch. (src/plugins/official-external-plugin-catalog.test.ts:555, f4eca07b6788)
Maintainer review context: Patrick-Erichsen first requested changes for the accepted-but-unusable signed config path, later approved a prior head while explicitly accepting the staged config decision, and authored the latest type cleanup commit on the current head. (src/config/types.marketplaces.ts:1, f4eca07b6788)

Likely related people:

giodl73-repo: Authored the hosted catalog feed loader/config series on current main, the merged verifier prerequisite, and most commits in this signed-config PR. (role: feature owner and recent area contributor; confidence: high; commits: 4010b81a77f4, c29e1fe764f3, 70e0fd4d8b91; files: src/plugins/official-external-plugin-catalog.ts, src/config/zod-schema.ts, src/config/types.marketplaces.ts)
Patrick-Erichsen: Assigned on the PR, provided the key changes-requested and approval context for the staged signed-config decision, and authored the current-head type cleanup commit. (role: reviewer and current-head contributor; confidence: high; commits: f4eca07b6788, 9bd70cb34665; files: src/config/types.marketplaces.ts, src/plugins/official-external-plugin-catalog-envelope.ts)
vincentkoc: Current-main blame for the unsigned marketplace schema and hosted catalog loader lines runs through a recent broad refactor, making him a secondary context owner rather than the signed-feed feature owner. (role: recent area contributor; confidence: low; commits: fc4626c1221d; files: src/config/zod-schema.ts, src/plugins/official-external-plugin-catalog.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (13 earlier review cycles; latest 8 shown)

reviewed 2026-07-07T22:04:48.796Z sha ea66dcf :: needs real behavior proof before merge. :: none
reviewed 2026-07-07T23:46:33.002Z sha 19e3a0d :: needs real behavior proof before merge. :: [P2] Keep signed config invalid until refresh consumes it
reviewed 2026-07-08T02:14:21.188Z sha 756be49 :: needs real behavior proof before merge. :: none
reviewed 2026-07-08T17:50:58.522Z sha 187a48f :: needs maintainer review before merge. :: none
reviewed 2026-07-08T17:59:03.318Z sha 187a48f :: needs maintainer review before merge. :: none
reviewed 2026-07-08T22:27:51.242Z sha 09734e8 :: needs maintainer review before merge. :: none
reviewed 2026-07-08T22:35:50.355Z sha 09734e8 :: needs maintainer review before merge. :: none
reviewed 2026-07-09T03:21:24.853Z sha f4eca07 :: needs maintainer review before merge. :: none

giodl73-repo · 2026-07-01T04:01:40Z

@clawsweeper re-review

Applied the trust-anchor hardening for this config slice: signed feed key IDs must be unique, normalized Ed25519 public keys must be unique, and focused schema/catalog validation has been rerun. PR body is updated with the new head and validation.

clawsweeper · 2026-07-01T04:01:43Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-07-01T04:20:38Z

@clawsweeper re-review

Final head is 16cbe67. In addition to duplicate key-id/material rejection, this now strictly rejects malformed raw base64url Ed25519 public keys before decoding. Focused schema/catalog validation and Codex review are clean; PR body updated.

clawsweeper · 2026-07-01T04:20:41Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-07-02T00:33:55Z

@clawsweeper re-review

Added source-harness proof at head 16cbe67 showing valid signed config acceptance, malformed raw-key rejection, duplicate trust-anchor rejection, and selected signed-profile no-fetch fail-closed behavior.

giodl73-repo · 2026-07-06T18:02:30Z

@clawsweeper re-review

Proof and implementation have been refreshed since the current stale verdict: head 16cbe678ce includes strict raw-key validation, duplicate key-id/material rejection, and source-harness proof for valid signed config, invalid config, and selected signed-profile no-fetch fail-closed behavior.

Patrick-Erichsen

Approved at the current live head after the scoped CI repairs and full exact-head validation passed. The staged signed-feed configuration decision is explicitly accepted. This approval does not merge the PR.

giodl73-repo · 2026-07-08T17:45:44Z

@clawsweeper re-review

Rebased onto #98299 head c6525aa and refreshed current-head proof at 187a48f. PR body now shows signed config acceptance, malformed raw-key rejection, duplicate trust-anchor rejection, and selected signed-profile rejection before fetch. Local format and git diff checks passed.

clawsweeper · 2026-07-08T17:45:47Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-07-08T22:22:58Z

@clawsweeper re-review

Rebased onto #98299 head 297003b252c with the DSSE decoded-payload-byte verifier fix. New head is 09734e867b.

Validation passed: focused marketplace schema/catalog/envelope Vitest (3 files / 78 tests), targeted oxfmt, targeted oxlint, git diff --check origin/main...HEAD && git diff --check, and pnpm tsgo:core. PR body has been refreshed with the current stack head and validation.

clawsweeper · 2026-07-08T22:23:01Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-07-09T03:16:42Z

@clawsweeper re-review

Restacked #98316 onto main after #98299 landed. Current head: f4eca07b6788d775fda3586a7f7ab6dfe47950e8.

Scope is back to the source-profile config slice only: seven config/catalog files, no verifier-foundation commits duplicated from #98299.

Fresh local proof on this head:

node scripts/run-vitest.mjs src/config/schema.help.quality.test.ts src/config/zod-schema.marketplaces.test.ts src/plugins/official-external-plugin-catalog.test.ts src/plugins/official-external-plugin-catalog-envelope.test.ts --reporter=dot
npx oxfmt --check on all seven changed files
npx oxlint on all seven changed files
git diff --check origin/main...HEAD and git diff --check
pnpm build passed under scripts/pr-prepare gates

Local pnpm check stopped only on npm-shrinkwrap guard, which reproduces on latest origin/main in this WSL Node/npm setup; hosted CI should be treated as the exact-head source of truth for that guard.

clawsweeper · 2026-07-09T03:16:44Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-07-09T03:32:42Z

Merged via squash.

Prepared head SHA: f4eca07b6788d775fda3586a7f7ab6dfe47950e8
Landed commit: 735dbd2f951943eee069b8837ca8a3f1b55ac2c1

* feat: add signed marketplace feed config * Clarify marketplace feed trust keys * Preserve marketplace feed signing key type alias * Fail closed for unwired signed marketplace feeds * refactor: inline marketplace trust key config --------- Co-authored-by: Gio Della-Libera <[email protected]> Co-authored-by: Patrick Erichsen <[email protected]>

openclaw-barnacle Bot added size: L maintainer Maintainer-authored PR labels Jul 1, 2026

giodl73-repo force-pushed the feeds-trust-source-profiles branch from a419080 to a54b57d Compare July 1, 2026 01:50

This was referenced Jul 1, 2026

Verify signed marketplace feed refresh #98338

Merged

Show marketplace feed trust state #98350

Merged

giodl73-repo force-pushed the feeds-trust-source-profiles branch from a54b57d to 321dff3 Compare July 1, 2026 03:50

giodl73-repo force-pushed the feeds-trust-source-profiles branch from 321dff3 to 16cbe67 Compare July 1, 2026 04:07

clawsweeper Bot mentioned this pull request Jul 6, 2026

feat: add hosted feed envelope verifier #98299

Merged

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jul 6, 2026

Patrick-Erichsen approved these changes Jul 8, 2026

View reviewed changes

giodl73-repo force-pushed the feeds-trust-source-profiles branch 2 times, most recently from 756be49 to 187a48f Compare July 8, 2026 17:45

clawsweeper Bot mentioned this pull request Jul 8, 2026

feat: bind signed ClawHub default feed trust #101981

Merged

giodl73-repo force-pushed the feeds-trust-source-profiles branch from 187a48f to 09734e8 Compare July 8, 2026 22:22

openclaw-barnacle Bot added size: XL and removed size: L labels Jul 8, 2026

giodl73-repo and others added 5 commits July 8, 2026 20:05

feat: add signed marketplace feed config

f81de85

Clarify marketplace feed trust keys

1fe94a5

Preserve marketplace feed signing key type alias

614ca09

Fail closed for unwired signed marketplace feeds

e07861c

refactor: inline marketplace trust key config

f4eca07

giodl73-repo force-pushed the feeds-trust-source-profiles branch from 09734e8 to f4eca07 Compare July 9, 2026 03:16

openclaw-barnacle Bot added size: M and removed size: XL labels Jul 9, 2026

giodl73-repo merged commit 735dbd2 into openclaw:main Jul 9, 2026
108 of 110 checks passed

giodl73-repo deleted the feeds-trust-source-profiles branch July 9, 2026 03:32

Uh oh!

Uh oh!

Conversation

giodl73-repo commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Stack

Scope boundaries

Validation

Uh oh!

clawsweeper Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jul 1, 2026

Uh oh!

clawsweeper Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jul 1, 2026

Uh oh!

clawsweeper Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jul 2, 2026

Uh oh!

giodl73-repo commented Jul 6, 2026

Uh oh!

Patrick-Erichsen left a comment

Choose a reason for hiding this comment

Uh oh!

giodl73-repo commented Jul 8, 2026

Uh oh!

clawsweeper Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jul 8, 2026

Uh oh!

clawsweeper Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jul 9, 2026

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

giodl73-repo commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

giodl73-repo commented Jul 1, 2026 •

edited

Loading

clawsweeper Bot commented Jul 1, 2026 •

edited

Loading

clawsweeper Bot commented Jul 1, 2026 •

edited

Loading

clawsweeper Bot commented Jul 1, 2026 •

edited

Loading

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading