add missing key for .module verification issue and remove debug step

Sparrow/Sparrow Wallet

08b36abb View source ↗

Public commit record

What the developer wrote

Authored by Craig Raw

60/100 · Adequate

add missing key for .module verification issue and remove debug step

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body

The short version

What changed, and why it matters

This commit fixes a build-time trust issue and cleans up temporary debugging. It adds the missing cryptographic key for the OpenTelemetry library so Gradle can verify its downloaded files, and removes a one-off debug step that was used to investigate why the build was failing. It does not change the wallet application itself or user funds handling.

Recommended action

No immediate action required. Reviewers may verify the added OpenTelemetry PGP key fingerprint (3F05DDA9F317301E927136D417A27CE7A60FF5F0) against official OpenTelemetry project key listings, and confirm the removed debug step did not expose secrets in CI logs.

Security signals we found

Dependency verification metadata updated to trust a previously untrusted signing key

Build pipeline debug instrumentation removed after incident investigation

No application code or cryptographic wallet logic changed

Technical analysis

Evidence from the diff

The commit adds trusted-key id 3F05DDA9F317301E927136D417A27CE7A60FF5F0 for group io.opentelemetry in gradle/verification-metadata.xml, resolving a Gradle dependency-verification failure for opentelemetry-bom-1.55.0.module. It also removes a temporary GitHub Actions debug job that searched for cached files, downloaded the module from Maven Central, and printed checksums and environment variables.

Changed components

gradle/verification-metadata.xml.github/workflows/package.yaml

Inspect captured patch +1 / −36

diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
index 8437463..43c72e3 100644
--- a/.github/workflows/package.yaml
+++ b/.github/workflows/package.yaml
@@ -25,42 +25,6 @@ jobs:
           java-version: '25.0.2'
       - name: Show Build Versions
         run: ./gradlew -v
-      - name: Debug opentelemetry-bom bytes seen by this runner
-        shell: bash
-        continue-on-error: true
-        run: |
-          set +e
-          echo "=== Runner: $RUNNER_OS $RUNNER_ARCH ==="
-          echo ""
-          echo "=== Any cached copy on the runner (before build downloads anything): ==="
-          for base in "$HOME" /opt /usr/local /Users /home 'C:/Users' 'D:/a'; do
-            [ -d "$base" ] || continue
-            find "$base" -name 'opentelemetry-bom-1.55.0.module' 2>/dev/null | while read f; do
-              echo "$f"
-              echo "  size=$(wc -c < "$f" 2>/dev/null | tr -d ' ')"
-              echo "  sha512=$(shasum -a 512 "$f" 2>/dev/null | cut -d' ' -f1)"
-            done
-          done
-          echo ""
-          echo "=== Fresh download from Maven Central (from this runner): ==="
-          curl -sL https://repo1.maven.org/maven2/io/opentelemetry/opentelemetry-bom/1.55.0/opentelemetry-bom-1.55.0.module -o /tmp/otel.module 2>/dev/null || echo "(curl failed)"
-          if [ -f /tmp/otel.module ]; then
-            echo "size=$(wc -c < /tmp/otel.module | tr -d ' ')"
-            echo "sha512=$(shasum -a 512 /tmp/otel.module | cut -d' ' -f1)"
-          fi
-          echo ""
-          echo "=== Pinned in verification-metadata.xml: ==="
-          grep -A2 'opentelemetry-bom-1.55.0.module' gradle/verification-metadata.xml | head -3
-          echo ""
-          echo "=== Gradle init scripts present: ==="
-          for base in "$HOME/.gradle" /opt /usr/local 'C:/Users' 'D:/a'; do
-            [ -d "$base" ] || continue
-            find "$base" -path '*init.d*' -type f 2>/dev/null | head -10
-          done
-          echo ""
-          echo "=== GRADLE_* / DEVELOCITY_* env: ==="
-          env | grep -iE '^(GRADLE|DEVELOCITY|BUILD_SCAN)' || echo "(none)"
-          exit 0
       - name: Build with Gradle
         run: ./gradlew jpackage
       - name: Codesign, package and notarize macOS distribution
diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml
index 2f5b8c4..ef7961e 100644
--- a/gradle/verification-metadata.xml
+++ b/gradle/verification-metadata.xml
@@ -30,6 +30,7 @@
          <trusted-key id="2E3A1AFFE42B5F53AF19F780BCF4173966770193" group="org.jetbrains" name="annotations" version="13.0"/>
          <trusted-key id="33FD4BFD33554634053D73C0C2148900BCD3C2AF" group="org.jetbrains" name="annotations"/>
          <trusted-key id="34D6FF19930ADF43AC127792A50569C7CA7FA1F0" group="com.jcraft" name="jzlib" version="1.1.3"/>
+         <trusted-key id="3F05DDA9F317301E927136D417A27CE7A60FF5F0" group="io.opentelemetry"/>
          <trusted-key id="41B962CF9AA2A26FF1F234D2A6144824624A3CBA" group="io.leangen.geantyref" name="geantyref" version="2.0.1"/>
          <trusted-key id="41CD49B4EF5876F9E9F691DABAC30622339994C4" group="org.jspecify" name="jspecify" version="1.0.0"/>
          <trusted-key id="5989BAF76217B843D66BE55B2D0E1FB8FE4B68B4" group="org.eclipse.jetty"/>

Risk score

Why this scored 18/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 2/15

Confidence 8/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 18/100

Community notes

Related watches

improve max cosigner ui handling in settings

resolve bip353 hrns over tcp via the socks proxy when one is configured

close remaining local dns resolution gaps when classifying hostnames and connecting via tor