feat(cache): formalize caching config and add signing fields by dmadisetti · Pull Request #10523 · marimo-team/marimo

dmadisetti · 2026-08-12T19:46:05Z

📝 Summary

Formalizes the caching config entrypoints, and adds "signing" fields for cache verification.
This PR introduces the bones for signature verification that will come in a subsequent change.

Cache configuration moves out of experimental into a top-level [cache] table, and a [signing] table is added for trust and identity:

[cache]
verification = "on"          # off | on | strict

[cache.store]
type = "file"
args = { save_path = "~/.cache/marimo" }

# Or a tiered store:
# [[cache.store]]
# type = "file"
# [[cache.store]]
# type = "redis"

[signing]
private_key_path = "~/.marimo/key.pem"

[signing.trusted_signers]
"SHA256:kV9x2c...q8" = "CI cache key"
"SHA256:abc9f1...4d" = "Alice"

[cache].verification and [signing] are declared and merged here, with followup providing implementation.

Breaking

experimental.cache is removed for the explicit cache path.

Notes

signing.trusted_signers is a replace path in merge_config, not a deep merge. Deep-merging unions the fingerprints from every layer, and then no layer can remove a signer that a lower-priority one anchored.
signing.private_key_path joins the secrets mask, so this machine's signing identity is never serialized to the frontend.

Stack

this PR — config entrypoints + signing fields
refactor(cache): introduce SigningPolicy and rename mode to verification #10524 — SigningPolicy, mode -> verification
feat(cache): sanitize signing config from untrusted layers #10525 — config sanitization
docs(cache): document the cache signing trust model #10526 — docs

vercel · 2026-08-12T19:46:13Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
marimo-docs	Ready	Preview	Aug 12, 2026 9:37pm

github-actions · 2026-08-12T19:46:26Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

cubic-dev-ai

Review completed against the latest diff

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

Copilot

Pull request overview

Formalizes marimo’s caching configuration by promoting cache settings to a top-level [cache] table, adding a new [signing] table for future cache signature verification, and preserving backward compatibility with legacy experimental.cache configs.

Changes:

Add top-level cache and signing config schemas, including cache.verification and signing.{private_key_path,trusted_signers}.
Update cache store resolution to prefer [cache].store while falling back to experimental.cache, and accept legacy store vs type keys for store selection.
Extend config merge and secrets-masking behavior to support trust revocation (trusted_signers replace semantics) and prevent signing identity leakage (private_key_path masking), with accompanying tests.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/_save/stores/test_store_config.py	Adds regression coverage for legacy store key parsing and top-level cache store resolution precedence.
tests/_config/test_secrets_config.py	Verifies `signing.private_key_path` is masked and placeholder round-trips don’t overwrite real secrets.
tests/_config/test_config.py	Ensures `signing.trusted_signers` uses replace semantics to allow narrowing/revoking trust.
marimo/_save/stores/init.py	Switches store lookup to `[cache].store` with fallback to `experimental.cache` and supports legacy `store` key.
marimo/_config/secrets.py	Adds `signing.private_key_path` to the secrets mask list.
marimo/_config/config.py	Introduces new `CacheConfig`/`SigningConfig` types and updates merge behavior for `signing.trusted_signers`.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Promotes cache configuration out of `experimental` into a top-level `[cache]` table, and introduces the `[signing]` table that a later change uses to verify cache signatures. [cache] verification = "on" # off | on | strict [cache.store] type = "file" [signing] private_key_path = "~/.marimo/key.pem" [signing.trusted_signers] "SHA256:kV9x2c...q8" = "CI cache key" `[cache].verification` and `[signing]` are declared and merged here but nothing reads them yet; the `SigningPolicy` that consumes them lands next. BREAKING: `experimental.cache` is gone, not aliased. Move the store to `[cache].store` and spell its key `type`, which is what `StoreConfig` has always declared. The old reader looked up `store` instead, so that spelling worked by accident. `signing.trusted_signers` is a replace path in `merge_config` rather than a deep merge. Deep-merging would union the fingerprints from every layer, leaving no way for a higher-priority layer to narrow or revoke trust. `signing.private_key_path` joins the secrets mask, so this machine's signing identity is never serialized to the frontend.

codecov · 2026-08-12T21:39:43Z

Bundle Report

Changes will increase total bundle size by 90.71kB (0.35%) ⬆️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
marimo-esm	25.66MB	90.71kB (0.35%) ⬆️

Affected Assets, Files, and Routes:

view changes for bundle: marimo-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
`assets/react-*.js`	89.06kB	814.16kB	12.28% ⚠️
`assets/index-*.css`	268 bytes	366.22kB	0.07%
`assets/dist-*.js`	89 bytes	341.65kB	0.03%
`assets/ai-*.js`	512 bytes	295.51kB	0.17%
`assets/cell-*.js`	27 bytes	185.64kB	0.01%
`assets/tooltip-*.js`	-1 bytes	26.91kB	-0.0%
*`assets/vega-.browser-CAfmqKEc.js`** (New)	25.14kB	25.14kB	100.0% 🚀
`assets/command-*.js`	552 bytes	10.13kB	5.76% ⚠️
`assets/defaultLocale-*.js`	139 bytes	4.65kB	3.08%
`assets/cells-*.css`	62 bytes	9.16kB	0.68%
`assets/utils-*.js`	27 bytes	6.39kB	0.42%
~~*`assets/vega-.browser-Dun7Qe4B.js`*~~ (Deleted)*	-25.17kB	0 bytes	-100.0% 🗑️

github-actions · 2026-08-12T21:45:44Z

Coverage Report for ./frontend

Status	Category	Percentage	Covered / Total
🔵	Lines	78.73%	81725 / 103802
🔵	Statements	78.73%	81725 / 103802
🔵	Functions	71.42%	695 / 973
🔵	Branches	79.28%	4884 / 6160

File Coverage

No changed files found.

Generated in workflow #20418 for commit c814b4b by the Vitest Coverage Report Action

kirangadhave

🚀

mscolnick · 2026-08-14T14:43:33Z

        ("ai", "bedrock", "aws_secret_access_key"),
        ("runtime", "dotenv"),
+        # This machine's signing identity — never serialized to the frontend.
+        ("signing", "private_key_path"),


should we include cache here as well? in case there is anything sensitive in it?

Cache itself is not sensitive, but the private key is. That's in the stack, so just getting this in

…ion (#10524) ## 📝 Summary Builds on #10523, which added the config fields. Introduces `SigningPolicy` and refactors the signing logic to use the term "verification" over `mode`. `marimo/_save/signing_policy.py` resolves the config into a frozen policy at context creation (before untrusted code can run). `LazyLoader` reads the frozen policy as its default trust and identity source; (with explicit kwargs still allowed). Recap of `verification` types: | Entry at load | `off` | `on` (default) | `strict` | |---|---|---|---| | trusted fingerprint + valid signature | serve (unchecked) | serve | serve | | foreign / bad signature / unsigned | serve (unchecked) | **miss** (recompute) | **raise** | | on write (private key available) | not signed | signed | signed | `off` is the only posture that serves unverified bytes. `on` is fail-safe, `strict` is fail-closed. ### Stack 1. #10523 — config entrypoints + signing fields 2. **this PR** — `SigningPolicy`, `mode` → `verification` 3. — config sanitization (untrusted layers) 4. — docs

## 📝 Summary Adds config sanitization. marimo merges configuration from several layers, and two of them travel with the code. Trusting a signing key is a grant of arbitrary code execution, because a cache restore is `pickle.loads`. So a layer that could name its own key as trusted, or turn verification off, could ship a poisoned cache entry that runs on `git clone`. ``` user config ─┐ environment ─┼─→ merged effective config → SigningPolicy (frozen) │ pyproject ───┤ PEP 723 ─────┼─→ strip [signing] + [cache].verification workspace ───┘ .marimo.toml ``` ### Stack 1. #10523 — config entrypoints + signing fields 2. #10524 — `SigningPolicy`, `mode` → `verification` 3. **this PR** — config sanitization (untrusted layers) 4. — docs --------- Signed-off-by: Dylan Madisetti <dylan@madisetti.me> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

…team#10523) ## 📝 Summary Formalizes the caching config entrypoints, and adds "signing" fields for cache verification. This PR introduces the bones for signature verification that will come in a subsequent change. Cache configuration moves out of `experimental` into a top-level `[cache]` table, and a `[signing]` table is added for trust and identity: ```toml [cache] verification = "on" # off | on | strict [cache.store] type = "file" args = { save_path = "~/.cache/marimo" } # Or a tiered store: # [[cache.store]] # type = "file" # [[cache.store]] # type = "redis" [signing] private_key_path = "~/.marimo/key.pem" [signing.trusted_signers] "SHA256:kV9x2c...q8" = "CI cache key" "SHA256:abc9f1...4d" = "Alice" ``` `[cache].verification` and `[signing]` are declared and merged here, with followup providing implementation. ### Breaking `experimental.cache` is removed for the explicit cache path. ### Notes - `signing.trusted_signers` is a **replace** path in `merge_config`, not a deep merge. Deep-merging unions the fingerprints from every layer, and then no layer can remove a signer that a lower-priority one anchored. - `signing.private_key_path` joins the secrets mask, so this machine's signing identity is never serialized to the frontend. ### Stack 1. **this PR** — config entrypoints + signing fields 2. marimo-team#10524 — `SigningPolicy`, `mode` -> `verification` 3. marimo-team#10525 — config sanitization 4. marimo-team#10526 — docs

…ion (marimo-team#10524) ## 📝 Summary Builds on marimo-team#10523, which added the config fields. Introduces `SigningPolicy` and refactors the signing logic to use the term "verification" over `mode`. `marimo/_save/signing_policy.py` resolves the config into a frozen policy at context creation (before untrusted code can run). `LazyLoader` reads the frozen policy as its default trust and identity source; (with explicit kwargs still allowed). Recap of `verification` types: | Entry at load | `off` | `on` (default) | `strict` | |---|---|---|---| | trusted fingerprint + valid signature | serve (unchecked) | serve | serve | | foreign / bad signature / unsigned | serve (unchecked) | **miss** (recompute) | **raise** | | on write (private key available) | not signed | signed | signed | `off` is the only posture that serves unverified bytes. `on` is fail-safe, `strict` is fail-closed. ### Stack 1. marimo-team#10523 — config entrypoints + signing fields 2. **this PR** — `SigningPolicy`, `mode` → `verification` 3. — config sanitization (untrusted layers) 4. — docs

…am#10525) ## 📝 Summary Adds config sanitization. marimo merges configuration from several layers, and two of them travel with the code. Trusting a signing key is a grant of arbitrary code execution, because a cache restore is `pickle.loads`. So a layer that could name its own key as trusted, or turn verification off, could ship a poisoned cache entry that runs on `git clone`. ``` user config ─┐ environment ─┼─→ merged effective config → SigningPolicy (frozen) │ pyproject ───┤ PEP 723 ─────┼─→ strip [signing] + [cache].verification workspace ───┘ .marimo.toml ``` ### Stack 1. marimo-team#10523 — config entrypoints + signing fields 2. marimo-team#10524 — `SigningPolicy`, `mode` → `verification` 3. **this PR** — config sanitization (untrusted layers) 4. — docs --------- Signed-off-by: Dylan Madisetti <dylan@madisetti.me> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

dmadisetti mentioned this pull request Aug 12, 2026

refactor(cache): introduce SigningPolicy and rename mode to verification #10524

Merged

vercel Bot deployed to Preview August 12, 2026 19:46

View deployment

This was referenced Aug 12, 2026

feat(cache): sanitize signing config from untrusted layers #10525

Merged

docs(cache): document the cache signing trust model #10526

Open

dmadisetti force-pushed the dm/cache-config branch from 7bf7e55 to 2656fea Compare August 12, 2026 19:53

vercel Bot deployed to Preview August 12, 2026 19:54

View deployment

cubic-dev-ai Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread marimo/_save/stores/__init__.py Outdated

Comment thread marimo/_save/stores/__init__.py Outdated

dmadisetti added the enhancement New feature or request label Aug 12, 2026

dmadisetti requested a lite review from Copilot August 12, 2026 20:03

Copilot started reviewing on behalf of dmadisetti August 12, 2026 20:03

View session

Copilot AI reviewed Aug 12, 2026

View reviewed changes

Comment thread marimo/_save/stores/__init__.py Outdated

dmadisetti force-pushed the dm/cache-config branch from 2656fea to 918b703 Compare August 12, 2026 21:02

vercel Bot deployed to Preview August 12, 2026 21:03

View deployment

dmadisetti requested a lite review from Copilot August 12, 2026 21:18

Copilot started reviewing on behalf of dmadisetti August 12, 2026 21:19

View session

Copilot AI reviewed Aug 12, 2026

View reviewed changes

dmadisetti force-pushed the dm/cache-config branch from 918b703 to c814b4b Compare August 12, 2026 21:36

github-actions Bot added the bash-focus Area to focus on during release bug bash label Aug 12, 2026

vercel Bot deployed to Preview August 12, 2026 21:37

View deployment

dmadisetti requested a review from kirangadhave August 12, 2026 22:18

dmadisetti marked this pull request as ready for review August 12, 2026 22:18

dmadisetti requested a review from mscolnick August 13, 2026 18:50

kirangadhave approved these changes Aug 13, 2026

View reviewed changes

Comment thread marimo/_save/stores/__init__.py

mscolnick reviewed Aug 14, 2026

View reviewed changes

Comment thread marimo/_config/config.py

mscolnick reviewed Aug 14, 2026

View reviewed changes

dmadisetti merged commit 7ff2b4d into main Aug 17, 2026
49 checks passed

dmadisetti deleted the dm/cache-config branch August 17, 2026 23:15

Conversation

dmadisetti commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Summary

Breaking

Notes

Stack

Uh oh!

vercel Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

codecov Bot commented Aug 12, 2026

Bundle Report

Affected Assets, Files, and Routes:

Assets Changed:

Uh oh!

github-actions Bot commented Aug 12, 2026

Coverage Report for ./frontend

Uh oh!

kirangadhave left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mscolnick Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

dmadisetti Aug 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dmadisetti commented Aug 12, 2026 •

edited

Loading

vercel Bot commented Aug 12, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading