DNM

Author: TheButlah

.github/workflows/ta-ci.yaml

@@ -16,11 +16,15 @@ permissions:
 jobs:
   build:
     name: Rust CI
-    uses: worldcoin/orb-rustzone/.github/workflows/ta.yaml@main
+    uses: worldcoin/orb-rustzone/.github/workflows/ta.yaml@ryanbutler-orbs-1219-ta-signing-in-ci
     with:
       target_env: stage
       source: ${{ github.sha }}
       cargo_profile: artifact
-    secrets:
-      GIT_HUB_TOKEN: ${{ secrets.ORB_GIT_HUB_TOKEN }}
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+    secrets: inherit
+    #   GIT_HUB_TOKEN: ${{ secrets.ORB_GIT_HUB_TOKEN }}
+    #   CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+    permissions: write-all
+    #   contents: read
+    #   id-token: write
+    #   deployments: write

.gitignore

@@ -8,6 +8,9 @@ result
 result-devkit
 .envrc
 
+# Python stuff
+__pycache__
+
 # Used by build.rs
 /git_version
 

xtask/optee/src/lib.rs

@@ -121,7 +121,7 @@ impl SignArgs {
             format!("failed to read requried arg: {ENV_OPTEE_OS_PATH}")
         })?;
 
-        run_cmd!(AWS_PROFILE=$aws_profile uv run $optee_os_path/scripts/sign_encrypt.py sign-enc --uuid $inspected_uuid --in $file_to_sign --out $out_dir/$inspected_uuid.ta --key $key_id)?;
+        run_cmd!(AWS_PROFILE=$aws_profile uv run --all-packages $optee_os_path/scripts/sign_encrypt.py sign-enc --uuid $inspected_uuid --in $file_to_sign --out $out_dir/$inspected_uuid.ta --key $key_id)?;
 
         Ok(())
     }