Harden registry release preflight

2026-07-21 12:53:38 -03:00
parent 9bedf70371
commit 64fc7339ef
4 changed files with 67 additions and 1 deletions
@@ -522,6 +522,17 @@ def _cmd_registry_publish(args):
        if not name or not version:
            print("Error: config.yaml must have 'name' and 'version' fields", file=sys.stderr)
            return 1
+        # Registry fields are local installation/status metadata. Including a
+        # previous release's hash or owner in a new payload makes content
+        # identity depend on stale registry state.
+        for key in (
+            "registry_hash",
+            "registry_status",
+            "registry_owner",
+            "registry_feedback",
+        ):
+            data.pop(key, None)
+        config_yaml = yaml.dump(data, default_flow_style=False, sort_keys=False)
    except yaml.YAMLError as e:
        print(f"Error: Invalid YAML in config.yaml: {e}", file=sys.stderr)
        return 1