{ "number": 36673, "input_hash": "fecefe81a6f0cfe9", "model": "ledger", "prompt_hash": null, "created": "2026-10-31T01:18:07+00:00", "result": { "summary": "Adds a scheduled GitHub Actions workflow that runs weekly to verify the validity and expiration date of the Windows code signing certificate. If the certificate is within 90 days of expiry or has already expired, the job opens an issue in the repository with certificate details and the checked commit. Duplicate issues are prevented by searching for existing open or closed issues matching the expiry title.", "problem": "There is no automated monitoring for code signing certificate expiration, forcing maintainers to rely on release candidate cycles to discover expired certificates. If a minor or bugfix release must be published on short notice, discovering an expired certificate at that moment can delay the release.", "card": "Adds a weekly GitHub Actions workflow to check the Windows code signing certificate and open an issue if it expires within 90 days. Bitcoin Core currently has no automated monitoring for certificate expiration, relying on release candidate cycles for codesigners to discover expired certificates. The author notes that relying on regular release cycles is prone to delaying urgent, short-notice bugfix releases. Duplicate issues are suppressed by checking for existing open or closed expiry reports.", "evidence": [ "PR description: 'Currently we have no automation in place to check that our code signing certificates are not expired or close to expiry. We have previously \"relied on Release Candidates\" as a dry-run for codesigners to realise that a certificate has expired and have time to fix it.'" ], "scope_notes": "", "changed_since_previous": "The core approach remains unchanged from the previous version.", "thread": { "last_event_at": "2026-10-30T11:55:45Z", "events": 15, "head_sha": "b7e371b634a0b971a9e012124431568fbcc6f194", "schema_floor": 2, "schema": 2 }, "waiting_on": [ { "at": "2026-10-30", "id": "c:6522077981", "on": "author", "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6522077981", "what": "response to maflcko's suggestion to make the script stand-alone" }, { "at": "2026-10-30", "id": "c:6520673273", "on": "reviewer", "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6520673273", "what": "fanquake to clarify availability of macOS cert in response to author's question" } ], "risk": { "level": "low", "touches": [ "tooling" ], "why": "A bug in the workflow could fail to alert developers to certificate expiration or create duplicate GitHub issues." }, "discussion": { "author_status": "last statement processed 2026-10-30", "open_concerns": [ "maflcko: Make the script stand-alone so that it can be run locally" ], "resolved_concerns": [ "hebasto: What is the rationale for the length period? (answered by willcl-ark 2026-10-27)", "hebasto: Amend the release process to track cert expiry instead of adding CI automation (answered by willcl-ark 2026-10-29)", "hebasto: Is anything enforcing the order of the certificates? (answered by willcl-ark 2026-10-29)", "fanquake: Add a similar check for macOS code-signing (answered by willcl-ark 2026-10-30)" ] }, "reviewability": { "state": "Ready", "label": "Ready", "reason": "Nothing known that would invalidate a review now." }, "agreement": { "state": "Strong", "summary": "Strong: substantive support, no open objection (fanquake, fanquake)", "reason": "Added fanquake's suggestion regarding macOS code-signing checks (answered by author) along with his supportive rationale, and recorded maflcko's suggestion to make the verification script standalone.", "evidence": [ "maflcko (suggestion, approach, must be answered, open): Make the script stand-alone so that it can be run locally", "fanquake: support \u2014 The certs are constantly used to produce (point) releases, not just major releases, so *always* need to work (particularly in the case of expedited releases, like this week).", "fanquake: support \u2014 Automating the check moves away from manual tasks that someone might forget, providing automated assurance that certificates are not expired or arbitrarily revoked." ], "objections": [ { "reviewer": "hebasto", "association": "MEMBER", "type": "question", "kind": "approach", "harm": "", "request": "", "question": "What is the rationale for the length period?", "text": "What is the rationale for the length period?", "clears_with": "answer", "blocking": false, "status": "answered", "status_note": "author explained it was a placeholder dependent on renewal lead time; achow101 provided renewal lead time data", "cleared": true, "author_replied": true, "others_replied": true, "fix_pushed": false, "replies": [ "c:6439926344", "c:6446779188", "c:6442935294" ], "evidence": "2026-10-27: 'What's the rationale for this length period?'", "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6439893489", "id": "c:6439893489", "at": "2026-10-27", "status_at": "2026-10-27", "status_by": "willcl-ark", "resolution_evidence": "2026-10-27: willcl-ark: 'There is no current rationale for this, it's a placeholder for now.'", "pin": null, "from_schema": 2 }, { "reviewer": "hebasto", "association": "MEMBER", "type": "suggestion", "kind": "approach", "harm": "", "request": "Amend the release process to track cert expiry instead of adding CI automation", "question": "", "text": "Amend the release process to track cert expiry instead of adding CI automation", "clears_with": "answer", "blocking": false, "status": "answered", "status_note": "author is open to either approach; fanquake argued automated CI is required for expedited and point releases", "cleared": true, "author_replied": true, "others_replied": true, "fix_pushed": false, "replies": [ "c:6505927336", "c:6508132613", "c:6508500612" ], "evidence": "2026-10-29: 'Alternatively, we could amend the release process as suggested in https://github.com/bitcoin/bitcoin/issues/36695#issuecomment-6505826743.'", "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6505885913", "id": "c:6505885913", "at": "2026-10-29", "status_at": "2026-10-29", "status_by": "willcl-ark", "resolution_evidence": "2026-10-29: willcl-ark: 'Yep! No skin off my back either way; happy with either approach.'", "pin": null, "from_schema": 2 }, { "reviewer": "hebasto", "association": "MEMBER", "type": "question", "kind": "correctness", "harm": "", "request": "", "question": "Is anything enforcing the order of the certificates?", "text": "Is anything enforcing the order of the certificates?", "clears_with": "answer", "blocking": false, "status": "answered", "status_note": "author confirmed nothing enforced it and pushed an amendment", "cleared": true, "author_replied": true, "others_replied": false, "fix_pushed": true, "replies": [ "rc:4416655464", "rc:4417812290" ], "evidence": "2026-10-29: 'Is anything enforcing that order?'", "url": "https://github.com/bitcoin/bitcoin/pull/36673#discussion_r4416591728", "id": "rc:4416591728", "at": "2026-10-29", "status_at": "2026-10-29", "status_by": "willcl-ark", "resolution_evidence": "2026-10-29: willcl-ark: 'There is not (nice question).'", "pin": null, "from_schema": 2 }, { "reviewer": "fanquake", "association": "MEMBER", "type": "suggestion", "kind": "scope", "harm": "", "request": "Add a similar check for macOS code-signing", "question": "", "text": "Add a similar check for macOS code-signing", "clears_with": "answer", "blocking": false, "status": "answered", "status_note": "author noted the macOS cert is not in the repo but offered to add the check if available", "cleared": true, "author_replied": true, "others_replied": false, "fix_pushed": false, "replies": [ "c:6520673273" ], "evidence": "2026-10-30: 'I think we should also add a similar check for macOS code-signing'", "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6520646183", "id": "c:6520646183", "at": "2026-10-30", "status_at": "2026-10-30", "status_by": "willcl-ark", "resolution_evidence": "2026-10-30: willcl-ark: 'To my knowledge the cert is not checked into this repo? but otherwise can trivially add the second check.'", "pin": null, "from_schema": 2 }, { "reviewer": "maflcko", "association": "MEMBER", "type": "suggestion", "kind": "approach", "harm": "", "request": "Make the script stand-alone so that it can be run locally", "question": "", "text": "Make the script stand-alone so that it can be run locally", "clears_with": "answer", "blocking": false, "status": "open", "status_note": "", "cleared": false, "author_replied": false, "others_replied": false, "fix_pushed": false, "replies": [], "evidence": "2026-10-30: 'the script should probably be stand-alone, so that it can be run locally?'", "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6522077981", "id": "c:6522077981", "at": "2026-10-30", "status_at": null, "status_by": null, "resolution_evidence": "", "pin": null, "from_schema": 2 } ], "support": [ { "reviewer": "fanquake", "reason": "The certs are constantly used to produce (point) releases, not just major releases, so *always* need to work (particularly in the case of expedited releases, like this week).", "substantive": true, "verdict": "", "id": "c:6508132613", "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6508132613", "at": "2026-10-29", "association": "MEMBER", "evidence": "none", "areas": [] }, { "reviewer": "fanquake", "reason": "Automating the check moves away from manual tasks that someone might forget, providing automated assurance that certificates are not expired or arbitrarily revoked.", "substantive": true, "verdict": "", "id": "c:6520646183", "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6520646183", "at": "2026-10-30", "association": "MEMBER", "evidence": "none", "areas": [] } ], "participants": [ { "login": "achow101", "stance": "neutral", "note": "provided information on certificate renewal lead times", "association": "MEMBER", "comments": 1, "first": "2026-10-27", "last": "2026-10-27" }, { "login": "hebasto", "stance": "question", "note": "asked about cert order enforcement and suggested amending the release process instead", "association": "MEMBER", "comments": 3, "first": "2026-10-27", "last": "2026-10-29" }, { "login": "fanquake", "stance": "support", "note": "supports automated monitoring over manual release process checks and suggested adding macOS cert monitoring", "association": "MEMBER", "comments": 2, "first": "2026-10-29", "last": "2026-10-30" }, { "login": "maflcko", "stance": "neutral", "note": "questioned CI reliability and suggested making the monitoring script stand-alone", "association": "MEMBER", "comments": 2, "first": "2026-10-29", "last": "2026-10-30" } ], "derivation": "substantive support, no open objection (fanquake, fanquake)", "model_state": null, "corrections": [], "notes": "Added fanquake's suggestion regarding macOS code-signing checks (answered by author) along with his supportive rationale, and recorded maflcko's suggestion to make the verification script standalone." }, "dependencies": { "depends_on": [], "enables": [] }, "categories": [ { "name": "build", "member": true, "evidence": "Adds a new GitHub Actions workflow file under .github/workflows/ to automate Windows code signing certificate checks.", "band": "P3", "reason_tag": "new feature", "score": 0.4, "factors": { "bug_severity": 0, "leverage": 1, "performance": 0, "security_stability": 1, "user_value": 0 }, "rationale": "Automates checking for certificate expiration so expedited and minor releases are not unexpectedly blocked by an expired signing key. As fanquake noted, automated checks replace manual tracking for certificates that 'always need to work (particularly in the case of expedited releases)', providing clear operational value while remaining reasonably deferrable." } ], "confidence": "high", "uncertainties": [], "needs": [] }, "cost_usd": 0.0, "source": { "record": "2026-10-31T01:18:07+00:00", "code": "2026-10-31T01:19:56+00:00", "judgments": 1 } }