feat: verified bootstrap engine and release signature contract - #12
Merged
Conversation
Publish a detached minisign signature for install-sfetch.sh, require it at the release gate, and ship a dual-route verified bootstrap engine with a thin composite action wrapper. Tag CI creates draft releases until maintainer sign/upload/publish. Self-bootstrap uses the verified engine against the N-1 pin. VERSION 0.4.11. Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of @3leapsdave Co-Authored-By: Grok 4.5 <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Colocate the bootstrap engine under the action path (no workspace fallback). Always download hash-pinned minisign 0.12; scrub test-only env in the action. Exact version token matching and required route logging. Remove best-effort self-close. Replace floating latest CI examples; pin Windows dogfood minisign via official archives. Expand bootstrap and signature harnesses (positive minisig/sha256sums fixtures, hostile workspace resolve, goneat fail-closed, PGP manifests-only). Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of @3leapsdave Co-Authored-By: Grok 4.5 <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of @3leapsdave Co-Authored-By: Grok 4.5 <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Emit one stdout route= field for the action wrapper; human logs use verify-route=. Resolve the shared engine from the action repository root scripts/ path only (remove colocated copy). Acquire-minisign is a thin wrapper over --acquire-minisign-only. Match versions by exact whitespace tokens (reject -rc1 suffixes). Drop production || true on minisign -v. Expand harness for action parse simulation and negatives. Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of @3leapsdave Co-Authored-By: Grok 4.5 <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Drop SFETCH_BOOTSTRAP_BASE_URL and SKIP_MINISIGN_INSTALL from the production engine (fixtures patch temporary copies). Action uses awk route counts without || true and trusts engine post-install asserts. Remove version-matches-pin helper; engine matcher is the sole SSOT. Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of @3leapsdave Co-Authored-By: Grok 4.5 <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Assert SFETCH_MINISIGN_PUB equals the canonical consumer trust anchor (scripts/sfetch-minisign-anchor.pub SSOT, go:embed in main) before verify-signatures proceeds. Reject leading-zero semver components and fail semver_cmp loudly. Harden PowerShell path env, prefix-strip action outputs, and defer install-dir mkdir until after validation. Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of @3leapsdave Co-Authored-By: Grok 4.5 <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
minisign -V always uses scripts/sfetch-minisign-anchor.pub (SSOT). SFETCH_MINISIGN_PUB remains a required advisory that must match the operative key line (comment+key format), so operator/key divergence cannot reintroduce a green gate with a non-consumer verifier key. Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of @3leapsdave Co-Authored-By: Grok 4.5 <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Replace Bash $((10#$n)) arithmetic in semver_cmp with length-then C-locale lexical decimal comparison so oversized components cannot wrap and pass the supported-range gate. Add huge-component harness negative. Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of @3leapsdave Co-Authored-By: Grok 4.5 <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Harness asserts early reject for huge-major wrap-to-zero and huge-patch wrap-into-range (nonzero exit, no verify-route=, no fetch log, install dir absent). Document arithmetic-free comparator rationale; suppress SC2016 on intentional PowerShell $env: single-quoted command. Generated by Grok (https://x.ai) running Grok Build under supervision of [@3leapsdave](https://github.com/3leapsdave) Co-Authored-By: Grok <noreply@3leaps.net> Committer-of-Record: Dave Thompson <dave@3leaps.net> [@3leapsdave] Role: devlead
Add release-checklist steps to advance SFETCH_BOOTSTRAP_MAX/MINISIG_SINCE, assert MAX equals v(VERSION) from committed constants (not engine runtime), document action-SHA / sfetch-version pin coupling, and smoke-test post-release install via the verified engine instead of pipe-to-bash. Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of @3leapsdave Co-Authored-By: Grok 4.5 <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of @3leapsdave Co-Authored-By: Grok 4.5 <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
The bootstrap engine acquired minisign into a private temp dir for verification, then invoked install-sfetch.sh which requires minisign on PATH and failed on clean runners without ambient minisign. Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of @3leapsdave Co-Authored-By: Grok 4.5 <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of @3leapsdave Co-Authored-By: Grok 4.5 <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
sfetch --version writes to stderr, so the setup-sfetch PATH assert grepped an empty tee file. Fixture engines no longer inject ambient minisign (CI distro packages are often 0.11); they use the engine's pinned 0.12 download. Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of @3leapsdave Co-Authored-By: Grok 4.5 <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a fail-closed verified bootstrap path for sfetch installers and hardens the release/signature contract around published assets.
Bootstrap
bootstrap-sfetch-verifiedengine with dual verification routes (minisig vs SHA256SUMS) selected by version pinRelease process
VERSION(committed constants only; not self-advancing at engine runtime)Test plan
./scripts/test-bootstrap-sfetch-verified.sh./scripts/assert-bootstrap-range-release.sh./scripts/test-release-verify-signatures.sh(as applicable)go test ./...Tip:
804ff2e41d9a388955969aa16c70c6970b5f5095