papayo-oai 6cf2ff11b3 Bind executor plugin measurements to the trusted plugin version (#46528) ...

## Why

Identical script contents across plugin versions do not establish that the same measurement declaration applies. Resolving measurements through generic command attribution could use a different version's declaration, while shared helper paths could make attribution ambiguous.

## What changed

- Match canonical executor paths against trusted plugin identities before comparing script contents. Require an exact version match for measurements while retaining attribution across versions with matching contents.
- Keep measurement declarations bound to the selected trusted root, and allow distinct versions to coexist when extending trusted roots.
- Add `PluginMeasurementTarget` to extract an untrusted plugin/version hint from canonical remote cache paths, respecting Windows and POSIX path conventions.
- Skip executor lookups for unrelated scripts so attribution does not wait for executor provisioning.
- Increase the login unit test timeout in Bazel to `long`.

## Testing

Add regression coverage for multiple plugins and versions, canonical aliases, symlink escapes, path casing, and executor lookup avoidance. Add a remote execution integration test verifying that mismatched versions retain command attribution but receive no metrics sidecar, and matching versions use the trusted measurement declaration.

GitOrigin-RevId: d63430b37bf2de360c8d09af7f7453a5b5024d72

2026-09-19 00:14:07 +00:00

..

src

Bind executor plugin measurements to the trusted plugin version (#46528)

2026-09-19 00:14:07 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

Avoid executing PATH helpers before workspace trust (#42324)

2026-09-02 18:34:27 +00:00