Drop --key from plugin push

Key signing has no consume-time path: install verification is
keyless-only, and a key-signed artifact fails as ErrSignatureInvalid
rather than ErrUnsigned, so --allow-unsigned cannot override it. The flag
could only produce plugins nobody can install.

Rather than document that trap, remove it. The flag and the API's key
field are gone, and pluginsvc rejects a key set by an in-process caller
(PushOptions aliases skills.PushOptions, so the field still exists).
Plugin publishing is keyless or explicitly unsigned.

The flag returns in the change that makes install, sync, and the lock
carry a public key, tracked in #6442.

Part of #6300.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Signed-off-by: Samuele Verzi <samu@stacklok.com>

Author: samuv

cmd/thv/app/ai_plugin_push.go

@@ -11,7 +11,6 @@ import (
 )
 
 var (
-	aiPluginPushKey           string
 	aiPluginPushIdentityToken string
 	aiPluginPushNoSign        bool
 )
@@ -26,17 +25,13 @@ var aiPluginPushCmd = &cobra.Command{
 
 func init() {
 	aiPluginCmd.AddCommand(aiPluginPushCmd)
-	aiPluginPushCmd.Flags().StringVar(&aiPluginPushKey, "key", "",
-		"Path to a cosign private key to sign the pushed artifact. "+
-			"Encrypted keys are decrypted with COSIGN_PASSWORD read from the 'thv serve' process, "+
-			"which performs the signing. NOTE: ToolHive cannot yet verify key-signed artifacts at "+
-			"install time (only keyless/Fulcio signatures), so a project-scoped install of one is "+
-			"refused and --allow-unsigned does not override it; prefer keyless signing")
+	// No --key flag: plugin signing is keyless-only until install-time key
+	// verification exists (#6442). Pushing a key-signed plugin would produce
+	// an artifact no project-scoped install can accept.
 	aiPluginPushCmd.Flags().StringVar(&aiPluginPushIdentityToken, "identity-token", "",
 		"OIDC identity token (or a path to a file containing one) for keyless signing. "+
-			"Mutually exclusive with --key. If omitted, one is acquired automatically: from the "+
-			"ambient CI OIDC token when running with id-token: write permission, otherwise via an "+
-			"interactive browser sign-in")
+			"If omitted, one is acquired automatically: from the ambient CI OIDC token when "+
+			"running with id-token: write permission, otherwise via an interactive browser sign-in")
 	aiPluginPushCmd.Flags().BoolVar(&aiPluginPushNoSign, "no-sign", false,
 		"Push without signing (consumers will need an explicit unsigned exception to install project-scoped)")
 }
@@ -49,7 +44,6 @@ func aiPluginPushCmdFunc(cmd *cobra.Command, args []string) error {
 	// Sigstore keyless signing, not of the artifact kind being pushed.
 	token, err := identitytoken.Acquire(ctx, identitytoken.Options{
 		FlagValue: aiPluginPushIdentityToken,
-		Key:       aiPluginPushKey,
 		NoSign:    aiPluginPushNoSign,
 		Confirm:   confirmBrowserSignIn,
 	})
@@ -60,7 +54,6 @@ func aiPluginPushCmdFunc(cmd *cobra.Command, args []string) error {
 	c := newAIPluginClient(ctx)
 	err = c.Push(ctx, plugins.PushOptions{
 		Reference:     args[0],
-		Key:           aiPluginPushKey,
 		IdentityToken: token,
 		NoSign:        aiPluginPushNoSign,
 	})

cmd/thv/app/ai_plugin_trust_test.go

@@ -14,18 +14,22 @@ import (
 )
 
 // TestAIPluginPushSigningFlags pins the signed-by-default publish surface:
-// the three flags must exist, and neither signing method nor the opt-out may
-// be preset — a defaulted --no-sign would publish unsigned artifacts silently.
+// the keyless flags must exist, the opt-out must not be preset (a defaulted
+// --no-sign would publish unsigned artifacts silently), and --key must NOT be
+// offered — ToolHive cannot verify key-signed artifacts at install time, so
+// the flag would only produce uninstallable plugins (#6442). Re-add it in the
+// change that makes key verification work.
 func TestAIPluginPushSigningFlags(t *testing.T) {
 	t.Parallel()
 
-	for _, name := range []string{"key", "identity-token", "no-sign"} {
+	for _, name := range []string{"identity-token", "no-sign"} {
 		flag := aiPluginPushCmd.Flags().Lookup(name)
 		require.NotNil(t, flag, "thv ai-plugin push must expose --%s", name)
 	}
+	assert.Nil(t, aiPluginPushCmd.Flags().Lookup("key"),
+		"plugin signing is keyless-only; --key must not be advertised until install can verify it")
 	assert.Equal(t, "false", aiPluginPushCmd.Flags().Lookup("no-sign").DefValue,
 		"pushing unsigned must always be an explicit choice")
-	assert.Empty(t, aiPluginPushCmd.Flags().Lookup("key").DefValue)
 	assert.Empty(t, aiPluginPushCmd.Flags().Lookup("identity-token").DefValue)
 }
 

docs/arch/14-plugins-system.md

@@ -181,9 +181,9 @@ Project-scoped plugin installs are verified against Sigstore signatures, and the
 
 On first install of a signed plugin the observed signer identity is recorded (trust on first use) as the entry's `provenance:` block and **displayed to the user** — by `thv ai-plugin install` when it completes, and by `thv ai-plugin info` on every later read. Each subsequent install, sync, and upgrade enforces that identity *inside* the Sigstore verification policy: OCI artifacts through their attached signature bundles, git commits through gitsign signature-and-chain verification (recorded `provisional: true` — the transparency-log proof of signing time is not yet validated, so the replay window is unbounded until that lands, and the marker is rendered wherever the identity is). `thv ai-plugin sync` additionally re-verifies each entry's stored signature bundle offline — embedded trust root, no network — before counting it current, so a tampered-with stored bundle is caught in CI rather than at the next install. `thv ai-plugin upgrade` refuses to move to an artifact signed by a different identity, or to an unsigned one, without an explicit `--allow-signer-change`.
 
-Publishing is signed by default. `thv ai-plugin push` requires `--key` (a cosign private key), an OIDC identity token for keyless signing (`--identity-token`, or acquired automatically from an ambient CI token or an interactive browser sign-in), or an explicit `--no-sign`. Either signing path attaches the signature manifest next to the pushed artifact, where install-time verification finds it. A failed signing fails the push: an artifact published as if it were signed — which consumers then have to install with `--allow-unsigned` — is worse than a push that visibly did not complete.
+Publishing is signed by default, and **keyless only**. `thv ai-plugin push` requires either an OIDC identity token (`--identity-token`, or acquired automatically from an ambient CI token or an interactive browser sign-in) or an explicit `--no-sign`. Signing attaches the signature manifest next to the pushed artifact, where install-time verification finds it. A failed signing fails the push: an artifact published as if it were signed — which consumers then have to install with `--allow-unsigned` — is worse than a push that visibly did not complete.
 
-Keyless signing is the only path ToolHive can currently verify end to end. Install-time verification is keyless-only (`verifier.VerifyOCI` checks a Fulcio certificate chain), and neither the lock schema nor the install API carries a public key, so a key-signed artifact fails verification as `ErrSignatureInvalid` — not `ErrUnsigned`, which means `--allow-unsigned` does not override it and a project-scoped install of one is refused outright. `--key` therefore publishes artifacts that are verifiable by cosign but not installable by ToolHive. This applies identically to `thv skill push --key`; closing it means threading a public key through the lock entry, the install options, and offline sync re-verification for both surfaces, tracked in [#6442](https://github.com/stacklok/toolhive/issues/6442).
+There is deliberately **no `--key` flag** and no `key` field on the push API, and `pluginsvc.Push` rejects a key set by an in-process caller with a 400. Install-time verification is keyless-only (`verifier.VerifyOCI` checks a Fulcio certificate chain), and neither the lock schema nor the install API carries a public key, so a key-signed artifact fails verification as `ErrSignatureInvalid` — not `ErrUnsigned`, which means `--allow-unsigned` cannot override it and a project-scoped install is refused outright. Offering key signing would therefore only let publishers produce plugins nobody can install. `thv skill push --key` still accepts one and has exactly this problem; the flag returns here once install, sync, and the lock can carry a public key, tracked in [#6442](https://github.com/stacklok/toolhive/issues/6442).
 
 What is still trusted on faith, deliberately and visibly:
 

docs/cli/thv_ai-plugin_push.md

@@ -327,7 +327,6 @@ func (s *PluginsRoutes) pushPlugin(w http.ResponseWriter, r *http.Request) error
 
 	if err := s.pluginService.Push(r.Context(), plugins.PushOptions{
 		Reference:     req.Reference,
-		Key:           req.Key,
 		IdentityToken: req.IdentityToken,
 		NoSign:        req.NoSign,
 	}); err != nil {

docs/server/docs.go

@@ -487,14 +487,18 @@ func TestPluginsRouter(t *testing.T) {
 			expectedStatus: http.StatusNoContent,
 		},
 		{
-			name:   "push plugin forwards key and no_sign",
+			// The request DTO has no key field, so a key sent by an older
+			// client is dropped rather than reaching the service: plugin
+			// signing is keyless-only (#6442). It must never arrive as a
+			// populated PushOptions.Key.
+			name:   "push plugin does not forward a key",
 			method: "POST",
 			path:   "/push",
-			body:   `{"reference":"ghcr.io/test/plugin:v1","key":"/tmp/cosign.key"}`,
+			body:   `{"reference":"ghcr.io/test/plugin:v1","key":"/tmp/cosign.key","no_sign":true}`,
 			setupMock: func(svc *plugmocks.MockPluginService, _ string) {
 				svc.EXPECT().Push(gomock.Any(), plugins.PushOptions{
 					Reference: "ghcr.io/test/plugin:v1",
-					Key:       "/tmp/cosign.key",
+					NoSign:    true,
 				}).Return(nil)
 			},
 			expectedStatus: http.StatusNoContent,

docs/server/swagger.json

@@ -77,11 +77,10 @@ type buildPluginRequest struct {
 type pushPluginRequest struct {
 	// OCI reference to push
 	Reference string `json:"reference"`
-	// Key is the path to a cosign private key used to sign the pushed
-	// artifact
-	Key string `json:"key,omitempty"`
 	// IdentityToken is a short-lived OIDC identity token used for keyless
-	// signing, mutually exclusive with Key
+	// signing. Plugin signing is keyless-only: there is deliberately no key
+	// field, because ToolHive cannot verify key-signed artifacts at install
+	// time and would publish an uninstallable plugin (#6442)
 	IdentityToken string `json:"identity_token,omitempty"`
 	// NoSign pushes without signing
 	NoSign bool `json:"no_sign,omitempty"`