Fail early when caution verify is too old for the remote attestation #346

New issue

Open

opened 2026-06-30 13:07:54 +00:00 by vkobel · 0 comments

vkobel commented

2026-06-30 13:07:54 +00:00

(Migrated from codeberg.org)

We should add an explicit verifier compatibility field to the attestation manifest, e.g. verify_protocol or min_cli_version, and have caution verify check it immediately after fetching/parsing the remote attestation, before any local rebuild work.

If the local CLI is too old, fail with a clear message like:

This deployment requires a newer Caution CLI to verify correctly.
Please update/reinstall Caution or rebuild the CLI from the latest source.

Right now an old caution CLI can try to verify a newer deployment and only fail late, often as a generic build/PCR/parse failure. That is confusing, and in the worst case it means the local verifier might not understand the attestation/build format it is trying to validate. We should add an explicit verifier compatibility field to the attestation manifest, e.g. verify_protocol or min_cli_version, and have caution verify check it immediately after fetching/parsing the remote attestation, before any local rebuild work. If the local CLI is too old, fail with a clear message like: ``` This deployment requires a newer Caution CLI to verify correctly. Please update/reinstall Caution or rebuild the CLI from the latest source. ```

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

public/platform#346

No description provided.

Rows
Columns