Skip to content

ci: harden Cloud Agent apt keyrings (signed-by) and document .cursor - #265

Open
seonghobae wants to merge 4 commits into
masterfrom
cursor/cloud-env-apt-hardening-fbec
Open

ci: harden Cloud Agent apt keyrings (signed-by) and document .cursor#265
seonghobae wants to merge 4 commits into
masterfrom
cursor/cloud-env-apt-hardening-fbec

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 17, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Collaborator

Pull Request

Summary

  • Follow-up to ci: keep Cloud Agent install revision-agnostic #258 (merged), applying the CodeRabbit hardening suggestions from the ci: add versioned Cloud Agent dev environment (.cursor) #257/ci: keep Cloud Agent install revision-agnostic #258 review to the now-merged .cursor/install.sh.
  • Store the CRAN and r2u repository keys under /etc/apt/keyrings and bind each deb entry with signed-by, replacing the global-trust /etc/apt/trusted.gpg.d approach so a key can only vouch for its own source.
  • Print the resolved R + mirt/testthat/roxygen2/rcmdcheck versions after provisioning. Cross-agent reproducibility is pinned by the environment-build snapshot; the apt block only reprovisions a bare image.
  • Add .cursor/README.md documenting the Cloud Agent environment for maintainers.
  • Why: aligns the first-boot provisioning path with modern APT security practice (per-repo keyrings) and the repo's security-first posture, and improves post-install observability. Only affects .cursor/ tooling; no package code changes.

Validation

  • R CMD check (or equivalent CI) succeeded — no package code touched (.cursor/ is in .Rbuildignore).
  • Markdown/YAML/workflow lint checks succeeded — new .cursor/README.md is outside the linted globs; no workflow/YAML changes.
  • No secrets or credentials were added.
  • shellcheck .cursor/install.sh clean; the signed-by keyrings were exercised with apt update (both CRAN and r2u repos trusted, r-cran-mirt resolves from r2u).

Risk and Rollback

  • Risk level: low
  • Rollback plan: revert this commit. Only the bare-image reprovision path in .cursor/install.sh changes; the snapshot-based boot path is unaffected.

Behavioral Impact

  • R/aFIPC.R unchanged
  • If changed, regression evidence is attached

Checklist

  • Docs updated as needed — adds .cursor/README.md.
  • New/updated GitHub Actions use full commit SHA pinning — none changed.
  • Security policy / contribution policy alignment verified — no new deps; no secrets.
Open in Web Open in Cursor 

Summary by CodeRabbit

  • 문서

    • Cloud Agent 환경의 구성 및 설치 동작을 문서화했습니다.
    • R 검증 명령, 단일 테스트 실행 방법, 아키텍처 문서 참조를 추가했습니다.
    • 설치 과정에서 CRAN R과 지정 패키지가 설치되며 현재 소스 트리는 설치하지 않는다는 점을 명확히 했습니다.

  • 개선 사항

    • 저장소별 키링과 signed-by 설정을 적용해 패키지 저장소 인증 보안을 강화했습니다.
    • 설치 완료 후 R 및 주요 패키지 버전을 확인할 수 있습니다.

@cursoragent @seonghobae
ci: harden Cloud Agent apt keyrings and document .cursor
3128506 
Follow-up to #258 (merged):
- Store CRAN and r2u keys under /etc/apt/keyrings and bind each repo with
  signed-by, replacing global /etc/apt/trusted.gpg.d trust (CodeRabbit).
- Print resolved R + mirt/testthat/roxygen2/rcmdcheck versions after
  provisioning; cross-agent reproducibility is pinned by the environment
  build snapshot (this block only reprovisions a bare image).
- Add .cursor/README.md documenting the environment.

Validated: shellcheck clean; signed-by repos trusted by apt update; r-cran-mirt
resolves from r2u.

Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
@coderabbitai

coderabbitai Bot commented Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 80d5e7a8-c31e-4cd0-a3d7-e6e8b056c149

📥 Commits

Reviewing files that changed from the base of the PR and between f87c232 and 6e75865.

📒 Files selected for processing (2)
  • .cursor/README.md
  • .cursor/install.sh

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

Cloud Agent의 R 환경 설치가 저장소별 keyring과 signed-by를 사용하도록 변경되었습니다. 설치 문서는 재현성, 테스트, 검증 명령을 설명합니다. 설치 완료 출력은 R과 주요 R 패키지 버전을 표시합니다.

Changes

Cloud Agent R 환경

Layer / File(s) Summary
R 환경 설치 및 검증
.cursor/install.sh, .cursor/README.md		 APT 저장소별 keyring과 signed-by 설정을 적용했습니다. R 의존성 설치, 테스트 실행, rcmdcheck, 환경 재현성 정보를 문서화했습니다. 설치 완료 시 R 및 주요 패키지 버전을 출력합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 6e758

This PR limits its behavior change to Cloud Agent APT keyring handling, version reporting, and maintainer documentation; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

  • ContextualWisdomLab/aFIPC#257: 동일한 Cloud Agent R 환경 설치 스크립트를 도입했으며, 이번 변경은 해당 스크립트의 설치 방식을 보완합니다.

Suggested reviewers: cursoragent

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed PR 제목은 APT 키링 보안 강화와 .cursor 문서 추가라는 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/cloud-env-apt-hardening-fbec

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@seonghobae
seonghobae marked this pull request as ready for review August 17, 2026 17:03
@cursor

cursor Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

seonghobae and others added 3 commits August 18, 2026 02:26
@seonghobae
docs(cursor): note signed-by keyring security posture
be0e22a 
Document the per-repo signed-by APT keyrings added in this PR (and refresh
the head so the transient-503 Strix check re-runs on a healthy API).
@cursoragent @seonghobae
ci: re-run checks after transient GitHub 503 incident
952bfd5 
The prior noema-review/strix failures were transient: their internal gh API
calls returned HTTP 503 during a GitHub platform incident (repo is public;
the same calls succeed now). No code change is needed; this empty commit
re-runs the required review workflows on a healthy API.

Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
@seonghobae
docs(cursor): document single-test-file runs; re-run checks
6e75865 
Adds a filter example for testthat::test_local(). Also re-runs the required
review workflows via a user-token commit; the prior noema-review/strix reds
were transient GitHub HTTP 503s inside those workflows' gh calls, and an
installation-token push does not re-trigger pull_request_target workflows.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@seonghobae @cursoragent