fix: plugins explicit error matching

[yacosta738]

This pull request introduces several improvements to certificate chain validation for plugins, focusing on more robust handling of Fulcio keyless certificates and clarifying code semantics. The main enhancements include correcting the encoding of the code signing OID, embedding a fallback Fulcio intermediate certificate, and improving the handling of expired certificates during runtime verification.

Certificate validation robustness:

• Corrected the DER encoding for CODE_SIGNING_EKU_OID to match what webpki::KeyUsage::required_if_present expects, ensuring proper code signing verification.
• Added an embedded Fulcio intermediate certificate (FULCIO_INTERMEDIATE_CERT_1_PEM) and updated logic to use it as a fallback if no intermediates are found in the chain, improving reliability of certificate validation. [1] [2]

Runtime certificate verification logic:

• Refined runtime verification to explicitly allow expired Fulcio certificates, logging time-based errors at debug level and failing only on other verification errors, which improves installability of previously published artifacts. [1] [2] [3]
• Clarified comments and variable names to better explain the distinction between install-time and runtime certificate checks, improving code readability and maintainability.

Dependency update:

• Imported the Error type from webpki to enable more granular error handling during certificate verification.

Summary by CodeRabbit

• Bug Fixes
  • Enhanced certificate chain verification with automatic fallback to embedded intermediates, improving validation robustness
  • Refined runtime certificate validation error handling to gracefully process time-related errors without causing failures
  • Improved error logging for time-based certificate validation issues during runtime verification

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	corvus-plugins-edge	10c343a	Feb 25 2026, 10:21 PM

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between eaca946 and 10c343a.

📒 Files selected for processing (1)

• clients/agent-runtime/src/plugins/mod.rs

---

📝 Walkthrough

Walkthrough

Certificate verification logic in the agent-runtime is modified to convert the CODE_SIGNING_EKU_OID to DER-encoded bytes, add a Fulcio intermediate as a fallback in the chain, validate certificates against Fulcio trust anchors using expanded verification paths, and treat time-based validation errors as non-fatal during runtime re-verification.

Changes

Cohort / File(s)

Summary

Certificate Verification Logic clients/agent-runtime/src/plugins/mod.rs

Adds webpki Error import; converts CODE_SIGNING_EKU_OID from OID arc array to DER-encoded byte sequence; implements Fulcio intermediate fallback when parsed chain is empty; expands end-entity certificate verification to include intermediates and UnixTime validation against Fulcio trust anchors; treats time-related errors (expired/not-yet-valid) as non-fatal (debug-logged) during runtime verification while preserving install-time checks; updates validity flag handling and error context logging for new control flow.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• fix(plugins): update code signing EKU OID encoding and improve Fulciointermediate handling #86: Applies the same code-level changes to certificate verification (DER-encoded OID, Fulcio intermediate fallback, and non-fatal time error handling at runtime).
• fix: install preflight plugin signature #77: Modifies the same file to adjust certificate and signature handling logic in the verification flow.
• fix(plugins): harden install preflight and signature verification #76: Updates the same file with changes to plugin signature and certificate verification behavior.

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/plugins-explicit-error-matching-12980468180533261429

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}