oxidecomputer · karencfv · May 7, 2025 · Apr 22, 2025 · Apr 24, 2025 · Apr 24, 2025
diff --git a/dev-tools/omdb/src/bin/omdb/db.rs b/dev-tools/omdb/src/bin/omdb/db.rs
@@ -6767,6 +6767,8 @@ async fn cmd_db_inventory_cabooses(
         git_commit: String,
         name: String,
         version: String,
+        #[tabled(display_with = "option_impl_display")]
+        sign: Option<String>,
     }
 
     use nexus_db_schema::schema::sw_caboose::dsl;
@@ -6785,6 +6787,7 @@ async fn cmd_db_inventory_cabooses(
         name: caboose.name,
         version: caboose.version,
         git_commit: caboose.git_commit,
+        sign: caboose.sign,
     });
     let table = tabled::Table::new(rows)
         .with(tabled::settings::Style::empty())
@@ -7133,6 +7136,8 @@ async fn inv_collection_print_devices(
             name: &'a str,
             version: &'a str,
             git_commit: &'a str,
+            #[tabled(display_with = "option_impl_display")]
+            sign: &'a Option<String>,
         }
 
         println!("    cabooses:");
@@ -7146,6 +7151,7 @@ async fn inv_collection_print_devices(
                 name: &found_caboose.caboose.name,
                 version: &found_caboose.caboose.version,
                 git_commit: &found_caboose.caboose.git_commit,
+                sign: &found_caboose.caboose.sign,
             })
             .collect();
         let table = tabled::Table::new(caboose_rows)

diff --git a/nexus/db-model/src/inventory.rs b/nexus/db-model/src/inventory.rs
@@ -458,6 +458,7 @@ pub struct SwCaboose {
     pub git_commit: String,
     pub name: String,
     pub version: String,
+    pub sign: Option<String>,
 }
 
 impl From<Caboose> for SwCaboose {
@@ -468,6 +469,7 @@ impl From<Caboose> for SwCaboose {
             git_commit: c.git_commit,
             name: c.name,
             version: c.version,
+            sign: c.sign,
         }
     }
 }
@@ -479,6 +481,7 @@ impl From<SwCaboose> for Caboose {
             git_commit: row.git_commit,
             name: row.name,
             version: row.version,
+            sign: row.sign,
         }
     }
 }

diff --git a/nexus/db-model/src/schema_versions.rs b/nexus/db-model/src/schema_versions.rs
@@ -16,7 +16,7 @@ use std::{collections::BTreeMap, sync::LazyLock};
 ///
 /// This must be updated when you change the database schema.  Refer to
 /// schema/crdb/README.adoc in the root of this repository for details.
-pub const SCHEMA_VERSION: Version = Version::new(140, 0, 0);
+pub const SCHEMA_VERSION: Version = Version::new(141, 0, 0);
 
 /// List of all past database schema versions, in *reverse* order
 ///
@@ -28,6 +28,7 @@ static KNOWN_VERSIONS: LazyLock<Vec<KnownVersion>> = LazyLock::new(|| {
         // |  leaving the first copy as an example for the next person.
         // v
         // KnownVersion::new(next_int, "unique-dirname-with-the-sql-files"),
+        KnownVersion::new(141, "caboose-sign-value"),
         KnownVersion::new(140, "instance-intended-state"),
         KnownVersion::new(139, "webhooks"),
         KnownVersion::new(138, "saga-abandoned-state"),

diff --git a/nexus/db-queries/src/db/datastore/inventory.rs b/nexus/db-queries/src/db/datastore/inventory.rs
@@ -18,6 +18,7 @@ use diesel::IntoSql;
 use diesel::JoinOnDsl;
 use diesel::NullableExpressionMethods;
 use diesel::OptionalExtension;
+use diesel::PgExpressionMethods;
 use diesel::QueryDsl;
 use diesel::Table;
 use diesel::expression::SelectableHelper;
@@ -554,7 +555,7 @@ impl DataStore {
             // - `hw_baseboard` with an "id" primary key and lookup columns
             //   "part_number" and "serial_number"
             // - `sw_caboose` with an "id" primary key and lookup columns
-            //   "board", "git_commit", "name", and "version"
+            //   "board", "git_commit", "name", "version", and "sign"
             // - `inv_caboose` with foreign keys "hw_baseboard_id",
             //   "sw_caboose_id", and various other columns
             //
@@ -596,7 +597,8 @@ impl DataStore {
             //         AND sw_caboose.board = ...
             //         AND sw_caboose.git_commit = ...
             //         AND sw_caboose.name = ...
-            //         AND sw_caboose.version = ...;
+            //         AND sw_caboose.version = ...
+            //         AND sw_caboose.sign IS NOT DISTINCT FROM ...;
             //
             // Again, the whole point is to avoid back-and-forth between the
             // client and the database.  Those back-and-forth interactions can
@@ -642,6 +644,9 @@ impl DataStore {
                                     )
                                     .and(dsl_sw_caboose::version.eq(
                                         found_caboose.caboose.version.clone(),
+                                    ))
+                                    .and(dsl_sw_caboose::sign.is_not_distinct_from(
+                                        found_caboose.caboose.sign.clone(),
                                     )),
                             ),
                         )

diff --git a/nexus/db-schema/src/schema.rs b/nexus/db-schema/src/schema.rs
@@ -1476,6 +1476,7 @@ table! {
         git_commit -> Text,
         name -> Text,
         version -> Text,
+        sign -> Nullable<Text>,
     }
 }
 

diff --git a/nexus/inventory/src/builder.rs b/nexus/inventory/src/builder.rs
@@ -717,6 +717,7 @@ mod test {
             git_commit: String::from("git_commit_1"),
             name: String::from("name_1"),
             version: String::from("version_1"),
+            sign: Some(String::from("sign_1")),
         };
         for bb in &common_caboose_baseboards {
             let _ = collection.sps.get(*bb).unwrap();
@@ -1105,7 +1106,7 @@ mod test {
             git_commit: String::from("git_commit1"),
             name: String::from("name1"),
             version: String::from("version1"),
-            sign: None,
+            sign: Some(String::from("sign1")),
             epoch: None,
         };
         assert!(
@@ -1125,7 +1126,7 @@ mod test {
             "reporting caboose for unknown baseboard: \
             BaseboardId { part_number: \"p1\", serial_number: \"bogus\" } \
             (Caboose { board: \"board1\", git_commit: \"git_commit1\", \
-            name: \"name1\", version: \"version1\" })"
+            name: \"name1\", version: \"version1\", sign: Some(\"sign1\") })"
         );
         assert!(
             !builder
@@ -1177,7 +1178,7 @@ mod test {
                     git_commit: String::from("git_commit2"),
                     name: String::from("name2"),
                     version: String::from("version2"),
-                    sign: None,
+                    sign: Some(String::from("sign2")),
                     epoch: None,
                 },
             )

diff --git a/nexus/inventory/src/collector.rs b/nexus/inventory/src/collector.rs
@@ -449,8 +449,8 @@ mod test {
         for c in &collection.cabooses {
             write!(
                 &mut s,
-                "    board {:?} name {:?} version {:?} git_commit {:?}\n",
-                c.board, c.name, c.version, c.git_commit,
+                "    board {:?} name {:?} version {:?} git_commit {:?} sign {:?}\n",
+                c.board, c.name, c.version, c.git_commit, c.sign,
             )
             .unwrap();
         }

diff --git a/nexus/inventory/src/examples.rs b/nexus/inventory/src/examples.rs
@@ -540,7 +540,7 @@ pub fn caboose(unique: &str) -> SpComponentCaboose {
         git_commit: format!("git_commit_{}", unique),
         name: format!("name_{}", unique),
         version: format!("version_{}", unique),
-        sign: None,
+        sign: Some(format!("sign_{}", unique)),
         epoch: None,
     }
 }

diff --git a/nexus/inventory/tests/output/collector_basic.txt b/nexus/inventory/tests/output/collector_basic.txt
@@ -7,18 +7,18 @@ baseboards:
     part "sim-gimlet" serial "sim-9cb9b78f-5614-440c-b66d-e8e81fab69b0"
 
 cabooses:
-    board "SimGimletSp" name "SimGimlet" version "0.0.1" git_commit "fefefefe"
-    board "SimGimletSp" name "SimGimlet" version "0.0.2" git_commit "ffffffff"
-    board "SimRot" name "SimGimletRot" version "0.0.3" git_commit "edededed"
-    board "SimRot" name "SimSidecarRot" version "0.0.3" git_commit "edededed"
-    board "SimRot" name "SimGimletRot" version "0.0.4" git_commit "eeeeeeee"
-    board "SimRot" name "SimSidecarRot" version "0.0.4" git_commit "eeeeeeee"
-    board "SimRotStage0" name "SimGimletRot" version "0.0.200" git_commit "dadadadad"
-    board "SimRotStage0" name "SimSidecarRot" version "0.0.200" git_commit "dadadadad"
-    board "SimRotStage0" name "SimGimletRot" version "0.0.200" git_commit "ddddddddd"
-    board "SimRotStage0" name "SimSidecarRot" version "0.0.200" git_commit "ddddddddd"
-    board "SimSidecarSp" name "SimSidecar" version "0.0.1" git_commit "fefefefe"
-    board "SimSidecarSp" name "SimSidecar" version "0.0.2" git_commit "ffffffff"
+    board "SimGimletSp" name "SimGimlet" version "0.0.1" git_commit "fefefefe" sign None
+    board "SimGimletSp" name "SimGimlet" version "0.0.2" git_commit "ffffffff" sign None
+    board "SimRot" name "SimGimletRot" version "0.0.3" git_commit "edededed" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRot" name "SimSidecarRot" version "0.0.3" git_commit "edededed" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRot" name "SimGimletRot" version "0.0.4" git_commit "eeeeeeee" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRot" name "SimSidecarRot" version "0.0.4" git_commit "eeeeeeee" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRotStage0" name "SimGimletRot" version "0.0.200" git_commit "dadadadad" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRotStage0" name "SimSidecarRot" version "0.0.200" git_commit "dadadadad" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRotStage0" name "SimGimletRot" version "0.0.200" git_commit "ddddddddd" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRotStage0" name "SimSidecarRot" version "0.0.200" git_commit "ddddddddd" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimSidecarSp" name "SimSidecar" version "0.0.1" git_commit "fefefefe" sign None
+    board "SimSidecarSp" name "SimSidecar" version "0.0.2" git_commit "ffffffff" sign None
 
 rot pages:
     data_base64 "Z2ltbGV0LWNmcGEtYWN0aXZlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="

diff --git a/nexus/inventory/tests/output/collector_errors.txt b/nexus/inventory/tests/output/collector_errors.txt
@@ -5,18 +5,18 @@ baseboards:
     part "i86pc" serial "SimGimlet01"
 
 cabooses:
-    board "SimGimletSp" name "SimGimlet" version "0.0.1" git_commit "fefefefe"
-    board "SimGimletSp" name "SimGimlet" version "0.0.2" git_commit "ffffffff"
-    board "SimRot" name "SimGimletRot" version "0.0.3" git_commit "edededed"
-    board "SimRot" name "SimSidecarRot" version "0.0.3" git_commit "edededed"
-    board "SimRot" name "SimGimletRot" version "0.0.4" git_commit "eeeeeeee"
-    board "SimRot" name "SimSidecarRot" version "0.0.4" git_commit "eeeeeeee"
-    board "SimRotStage0" name "SimGimletRot" version "0.0.200" git_commit "dadadadad"
-    board "SimRotStage0" name "SimSidecarRot" version "0.0.200" git_commit "dadadadad"
-    board "SimRotStage0" name "SimGimletRot" version "0.0.200" git_commit "ddddddddd"
-    board "SimRotStage0" name "SimSidecarRot" version "0.0.200" git_commit "ddddddddd"
-    board "SimSidecarSp" name "SimSidecar" version "0.0.1" git_commit "fefefefe"
-    board "SimSidecarSp" name "SimSidecar" version "0.0.2" git_commit "ffffffff"
+    board "SimGimletSp" name "SimGimlet" version "0.0.1" git_commit "fefefefe" sign None
+    board "SimGimletSp" name "SimGimlet" version "0.0.2" git_commit "ffffffff" sign None
+    board "SimRot" name "SimGimletRot" version "0.0.3" git_commit "edededed" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRot" name "SimSidecarRot" version "0.0.3" git_commit "edededed" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRot" name "SimGimletRot" version "0.0.4" git_commit "eeeeeeee" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRot" name "SimSidecarRot" version "0.0.4" git_commit "eeeeeeee" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRotStage0" name "SimGimletRot" version "0.0.200" git_commit "dadadadad" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRotStage0" name "SimSidecarRot" version "0.0.200" git_commit "dadadadad" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRotStage0" name "SimGimletRot" version "0.0.200" git_commit "ddddddddd" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRotStage0" name "SimSidecarRot" version "0.0.200" git_commit "ddddddddd" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimSidecarSp" name "SimSidecar" version "0.0.1" git_commit "fefefefe" sign None
+    board "SimSidecarSp" name "SimSidecar" version "0.0.2" git_commit "ffffffff" sign None
 
 rot pages:
     data_base64 "Z2ltbGV0LWNmcGEtYWN0aXZlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="

diff --git a/nexus/inventory/tests/output/collector_sled_agent_errors.txt b/nexus/inventory/tests/output/collector_sled_agent_errors.txt
@@ -6,18 +6,18 @@ baseboards:
     part "sim-gimlet" serial "sim-9cb9b78f-5614-440c-b66d-e8e81fab69b0"
 
 cabooses:
-    board "SimGimletSp" name "SimGimlet" version "0.0.1" git_commit "fefefefe"
-    board "SimGimletSp" name "SimGimlet" version "0.0.2" git_commit "ffffffff"
-    board "SimRot" name "SimGimletRot" version "0.0.3" git_commit "edededed"
-    board "SimRot" name "SimSidecarRot" version "0.0.3" git_commit "edededed"
-    board "SimRot" name "SimGimletRot" version "0.0.4" git_commit "eeeeeeee"
-    board "SimRot" name "SimSidecarRot" version "0.0.4" git_commit "eeeeeeee"
-    board "SimRotStage0" name "SimGimletRot" version "0.0.200" git_commit "dadadadad"
-    board "SimRotStage0" name "SimSidecarRot" version "0.0.200" git_commit "dadadadad"
-    board "SimRotStage0" name "SimGimletRot" version "0.0.200" git_commit "ddddddddd"
-    board "SimRotStage0" name "SimSidecarRot" version "0.0.200" git_commit "ddddddddd"
-    board "SimSidecarSp" name "SimSidecar" version "0.0.1" git_commit "fefefefe"
-    board "SimSidecarSp" name "SimSidecar" version "0.0.2" git_commit "ffffffff"
+    board "SimGimletSp" name "SimGimlet" version "0.0.1" git_commit "fefefefe" sign None
+    board "SimGimletSp" name "SimGimlet" version "0.0.2" git_commit "ffffffff" sign None
+    board "SimRot" name "SimGimletRot" version "0.0.3" git_commit "edededed" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRot" name "SimSidecarRot" version "0.0.3" git_commit "edededed" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRot" name "SimGimletRot" version "0.0.4" git_commit "eeeeeeee" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRot" name "SimSidecarRot" version "0.0.4" git_commit "eeeeeeee" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRotStage0" name "SimGimletRot" version "0.0.200" git_commit "dadadadad" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRotStage0" name "SimSidecarRot" version "0.0.200" git_commit "dadadadad" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRotStage0" name "SimGimletRot" version "0.0.200" git_commit "ddddddddd" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimRotStage0" name "SimSidecarRot" version "0.0.200" git_commit "ddddddddd" sign Some("11594bb5548a757e918e6fe056e2ad9e084297c9555417a025d8788eacf55daf")
+    board "SimSidecarSp" name "SimSidecar" version "0.0.1" git_commit "fefefefe" sign None
+    board "SimSidecarSp" name "SimSidecar" version "0.0.2" git_commit "ffffffff" sign None
 
 rot pages:
     data_base64 "Z2ltbGV0LWNmcGEtYWN0aXZlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="

diff --git a/nexus/types/src/inventory.rs b/nexus/types/src/inventory.rs
@@ -260,6 +260,9 @@ pub struct Caboose {
     pub git_commit: String,
     pub name: String,
     pub version: String,
+    // The sign will generally be present for production RoT and RoT bootloader images.
+    // It's currently absent from SP images and could be absent from RoT images as well.
+    pub sign: Option<String>,
 }
 
 impl From<gateway_client::types::SpComponentCaboose> for Caboose {
@@ -269,6 +272,7 @@ impl From<gateway_client::types::SpComponentCaboose> for Caboose {
             git_commit: c.git_commit,
             name: c.name,
             version: c.version,
+            sign: c.sign,
         }
     }
 }

diff --git a/schema/crdb/caboose-sign-value/up01.sql b/schema/crdb/caboose-sign-value/up01.sql
@@ -0,0 +1,2 @@
+ALTER TABLE omicron.public.sw_caboose
+    ADD COLUMN IF NOT EXISTS sign TEXT; -- nullable
diff --git a/schema/crdb/caboose-sign-value/up02.sql b/schema/crdb/caboose-sign-value/up02.sql
@@ -0,0 +1 @@
+DROP INDEX IF EXISTS omicron.public.sw_caboose@caboose_properties;
diff --git a/schema/crdb/caboose-sign-value/up03.sql b/schema/crdb/caboose-sign-value/up03.sql
@@ -0,0 +1,2 @@
+CREATE UNIQUE INDEX IF NOT EXISTS caboose_properties
+    on omicron.public.sw_caboose (board, git_commit, name, version, sign);
diff --git a/schema/crdb/caboose-sign-value/up04.sql b/schema/crdb/caboose-sign-value/up04.sql
@@ -0,0 +1,3 @@
+CREATE UNIQUE INDEX IF NOT EXISTS caboose_properties_no_sign
+    on omicron.public.sw_caboose (board, git_commit, name, version)
+    WHERE sign IS NULL;
diff --git a/schema/crdb/dbinit.sql b/schema/crdb/dbinit.sql
@@ -3375,10 +3375,22 @@ CREATE TABLE IF NOT EXISTS omicron.public.sw_caboose (
     board TEXT NOT NULL,
     git_commit TEXT NOT NULL,
     name TEXT NOT NULL,
-    version TEXT NOT NULL
+    version TEXT NOT NULL,
+    sign TEXT -- nullable
 );
+
+/*
+ * We use a complete and a partial index to ensure uniqueness. 
+ * This is necessary because the sign column is NULLable, but in SQL, NULL values
+ * are considered distinct. That means that a single complete index on all of these
+ * columns would allow duplicate rows where sign is NULL, which we don't want.
+ */
 CREATE UNIQUE INDEX IF NOT EXISTS caboose_properties
-    on omicron.public.sw_caboose (board, git_commit, name, version);
+    on omicron.public.sw_caboose (board, git_commit, name, version, sign);
+
+CREATE UNIQUE INDEX IF NOT EXISTS caboose_properties_no_sign
+    on omicron.public.sw_caboose (board, git_commit, name, version)
+    WHERE sign IS NULL;
 
 /* root of trust pages: this table assigns unique ids to distinct RoT CMPA
    and CFPA page contents, each of which is a 512-byte blob */
@@ -5504,7 +5516,7 @@ INSERT INTO omicron.public.db_metadata (
     version,
     target_version
 ) VALUES
-    (TRUE, NOW(), NOW(), '140.0.0', NULL)
+    (TRUE, NOW(), NOW(), '141.0.0', NULL)
 ON CONFLICT DO NOTHING;
 
 COMMIT;
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		ALTER TABLE omicron.public.sw_caboose
		ADD COLUMN IF NOT EXISTS sign TEXT; -- nullable
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		DROP INDEX IF EXISTS omicron.public.sw_caboose@caboose_properties;
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		CREATE UNIQUE INDEX IF NOT EXISTS caboose_properties
		on omicron.public.sw_caboose (board, git_commit, name, version, sign);