Repository navigation
Conversation
…bridge A new explore page after the walkthrough: build the config-session cnm, give it a community-administrator identity, install and set up vgi-bridge in VTA mode behind Nginx, point the VTC at it, register the GitHub App, bind the organization, give the cnm identity a passkey for single-administrator self-grants, adopt a repository, grant rights, and what members do in OpenVTC to link, clone and sign. Verified on the 2026-10-22 nightly with vgi-bridge 0.20.0. The Known Issues section records what bit during that run: the keyring cnm build, the step-up link carrying /v1 (fixed in verifiable-trust-infrastructure#2267), a did-git-sign credential missing from the VTA's ACL, an empty repository's first branch becoming the protected default, and a registry started before the VTA. Signed-off-by: Geoff Turk <geoff@ic3.dev>
The devops build pipeline now publishes the config-session build of cnm as cnm-server, next to pnm-server (ic3software/devops#150). Step 1 downloads it the way Server Setup downloads the rest of the stack, with the same no-checksum caveat, and keeps the source build only as the fallback for a box that asks before the next nightly has run. The Verified-with note says the run itself used a source build of the same nightly commit. Signed-off-by: Geoff Turk <geoff@ic3.dev>
Explore 01's Step 5 now installs cnm-server beside pnm-server, in both download channels and in the Option B source build, so the box has the config-session cnm whether it was built or downloaded. Explore 03's Step 1 drops its own download and source-build instructions and the 404 fallback, and only checks that the installed cnm is the server build; its Known Issues entry points back to Server Setup. Signed-off-by: Geoff Turk <geoff@ic3.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A third explore page: put a GitHub organization under the VTC with the VGI bridge, so a repository shows up in the admin console's Repos page and the member portal, and members hold rights to it. It was written from a run on an explore box set up by Explore 01 and 02 (the 2026-10-22 nightly), in the same shape as the walkthrough: a "Verified with" table, IDs to save, numbered steps with an expected result each, a members section, a verification list, and Known Issues.
cnmis the server build, thecnmidentity and its offline ACL grant, the bridge tarball with its checksum, the Nginx site and certificate,vgi-bridge setupwith thepnmhandoff and a systemd unit, the VTCbridgesentry, GitHub App registration and Device Flow, bind and install, a passkey for thecnmidentity, adopt, and grants.did-git-sign, clone, and what the Verified badge needs.cnm, the step-up link printed on the API base (fix(cnm): build the step-up and enrol links on the console's origin, not the API base verifiable-trust-infrastructure#2267), thedid-git-signcredential missing from the VTA ACL, an empty repository's first branch becoming the protected default, and a registry started before the VTA.cnm-serverbesidepnm-server, in both download channels and in the Option B source build, so Explore 03 finds the config-sessioncnmalready on the box.sysop/explore/README.mdlists the page as item 3, and Explore 02 gains a Next section pointing to it.One gap the page states openly: the mediator and Trust Registry versions are given only as the same day's nightly, since neither reports one on the box.
This PR waits for the build pipeline to publish
cnm-server(ic3software/devops#150); thecnm-server/nightly/cnmpath answers 404 until the next nightly has run.