ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-28 13:26:04 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(plugins): keep feed trust within env budget (#113364)

Browse Source
This commit is contained in:
Peter Steinberger
2026-07-24 09:19:14 -07:00
committed by GitHub
parent 8029b3bbb8
commit f41e28202f
3 changed files with 34 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/cli/plugins.md
+3 -5
View File
@@ -563,11 +563,9 @@ refreshes fail if OpenClaw cannot persist the validated snapshot.
The built-in `clawhub-public` profile expects payload identity
`clawhub-official`. OpenClaw will bundle ClawHub's production public key after
ClawHub generates and hands off that key. Until then, staging and private
deployments can inject both `OPENCLAW_CLAWHUB_FEED_TRUSTED_KEY_ID` and
`OPENCLAW_CLAWHUB_FEED_TRUSTED_PUBLIC_KEY`; setting only one fails closed before
fetch. Public keys must come from a trusted release or operator channel, not
from a key endpoint on the feed host.
ClawHub generates and hands off that key. Until then, the built-in profile does
not grant signed-feed install authority. Public keys must come from a trusted
release or operator channel, not from a key endpoint on the feed host.
OpenClaw verifies the DSSE envelope and, when a profile declares `feedId`,
requires the decoded payload ID to match it. The built-in `clawhub-public`