diff --git a/README.md b/README.md index 021c50f..69d5bfa 100644 --- a/README.md +++ b/README.md @@ -486,8 +486,13 @@ records which source actually served the converge. > credential-less `curl` succeeds. Forgejo with `REQUIRE_SIGNIN_VIEW=true` > answers **404 for a repo it reports as public**, which is exactly what a > wrong ref looks like; the refusal names this case rather than leaving you -> hunting for a typo. Set `FORGEJO__service__REQUIRE_SIGNIN_VIEW=false` on the -> instance before hosting a registry there. +> hunting for a typo. `FORGEJO__service__REQUIRE_SIGNIN_VIEW=false` is what +> makes an instance usable as a registry host. +> +> Verified on `forgejo.heavyduty.builders` (2026-07-27): a credential-less +> `templates_resolve` against `RIG_TEMPLATES_HOST=https://forgejo.heavyduty.builders` +> fetches and extracts a real repository archive. The mint-time path works +> there today. **The security trade — in bold, not a footnote.** **A main-tracked rig-templates repo means every merged PR there executes as root inside every @@ -1216,6 +1221,9 @@ FORGEJO__actions__DEFAULT_ACTIONS_URL=https://code.forgejo.org > > This affects only the *registry* fetch. `rig forgejo-runner` itself > authenticates with a token and works either way. +> +> On `forgejo.heavyduty.builders` this is **already set** — verified +> 2026-07-27 by resolving a registry from it with no credentials at all. ### `rig users apply --file ` diff --git a/docs/plans/2026-07-27-forgejo-ci-box.md b/docs/plans/2026-07-27-forgejo-ci-box.md index e28e770..7b3e629 100644 --- a/docs/plans/2026-07-27-forgejo-ci-box.md +++ b/docs/plans/2026-07-27-forgejo-ci-box.md @@ -59,7 +59,21 @@ means every existing caller behaves exactly as before. install-time cache. It gets the same knob, from the same environment variable, so the snapshot and the live fetch cannot disagree about where the registry is. -### The blocker this exposes +### The blocker this exposed — since cleared + +**Resolved 2026-07-27, after this was written.** The operator set +`REQUIRE_SIGNIN_VIEW=false`, and the mint-time path was then verified live: a +credential-less `templates_resolve` with +`RIG_TEMPLATES_HOST=https://forgejo.heavyduty.builders` fetches and extracts a +real archive. Piece 1 is proven end to end on the target instance, not merely +argued. + +The requirement below stands for *any* instance hosting a registry, and the +refusal text still names it — it is a property of the mint's creds-free +contract, not of one server's configuration. What follows is the original +analysis, kept because it is why the knob exists. + +### The blocker, as originally measured `templates_resolve` documents a hard contract: