Repository navigation
Install, update, release and CI remediation (9 October review) #311
Description
Part of #89.
A review on 9 October covered CI, release packaging, signing, publication, install and update on develop at 8941d478. This parent issue groups the fixes. It gives enough context to run them in the right order, alone or with several workers.
Owner: not assigned (Anders triages). Task base and PR target: develop. Related parents: #88 (install), #89 (signed update), #93 (release gates).
How the pipeline works today
- CI (
.github/workflows/ci.yml) runs on every PR and develop push.- It runs lint, Rust tests and capsule tests.
- It installs source-home on Linux x86-64, Linux ARM64 and macOS, and runs the installed model journey.
- It runs a custody smoke in Docker.
- On macOS, it installs the pinned previous release and runs a real signed update to N and N+1.
- Package.
release-package.yml, dispatched by hand, builds the N and N+1 inputs from one exactdevelopcommit. No signing key is involved. - Prepare and sign run on the operator's Mac.
scripts/release-publish.sh preparedownloads the packages and requires green develop CI for that commit.scripts/release-signer.pysigns the release head and release after the operator types the DID.
- Publish. The signed set is imported into the seed. The seed keeps every release pinned and only answers requests.
- Install.
scripts/install.sh:- fetches the signed head over HTTPS;
- verifies it against the DID stamped into the script;
- checks the binary's SHA-256 and version;
- installs in one journaled transaction;
- runs the principal-root upgrade and setup.
- Update. While System is open, Home asks the seed over Carrier for the latest signed head. It verifies both signatures, the release hash, the channel and the version order. After passkey approval, it swaps the binary by atomic rename under a journal, and it restores the previous release if the new one does not start.
The design is sound: verification is fail-closed, version order is enforced, and swaps are atomic and recoverable. The fixes below close gaps at the edges.
Fix groups
Group A. Security (private)
A draft repository security advisory holds four findings with their details, scenarios and Done means. Advisory: GHSA-wgx8-qf6g-cj4h (visible to maintainers only). The findings cover release-package provenance, local data retention after migration, a CI credential, and installer delivery values. Fix them through the advisory's private fork or private PRs, and publish the advisory after the fixes ship. This group goes first.
Group B. Installer and update fixes
- Installer acts only after the whole script has arrived #312 Installer acts only after the whole script has arrived (alpha.15, PR 0.8.0-alpha.15: install/update closure, Local AI fixes, Browser on Mac and Jetson #343)
- Installer keeps the user's TMPDIR #313 Installer keeps the user's
TMPDIR(alpha.15, PR 0.8.0-alpha.15: install/update closure, Local AI fixes, Browser on Mac and Jetson #343) - Uninstall, and the macOS paths in INSTALL.md #315 Uninstall, and the macOS paths in INSTALL.md (alpha.15, PR 0.8.0-alpha.15: install/update closure, Local AI fixes, Browser on Mac and Jetson #343)
Group C. Security hardening (public)
- Release fetches use HTTPS only, with loopback HTTP for fixtures #314 (closed) Release fetches use HTTPS only, with loopback HTTP for fixtures
- After 0.8.0: macOS: Developer ID signing and notarization #316 macOS: Developer ID signing and notarization (decision, then implementation)
Group D. CI consistency and coverage
Required checks run whenever their inputs change (path filters) #317 Required checks run whenever their inputs change (path filters)→ moved to After 0.8.0 (Required checks run whenever their inputs change (path filters) #317)- After 0.8.0: Every Rust workspace passes fmt, clippy and tests on its target platforms #318 Every Rust workspace passes fmt, clippy and tests on its target platforms
The local pre-push gate refuses what CI refuses #319 The local pre-push gate refuses what CI refuses→ moved to After 0.8.0 (The local pre-push gate refuses what CI refuses #319)CI proves install and update on Linux #320 CI proves install and update on Linux→ moved to After 0.8.0 (CI proves install and update on Linux #320)
Group E. Release process
A documented procedure to withdraw a bad release #321 A documented procedure to withdraw a bad release→ moved to After 0.8.0 (A documented procedure to withdraw a bad release #321)
CI speed work is a separate sub-issue of #194: #310.
Order and coordination
- Group A first. These findings share files with Groups B and D:
install.sh,.github/actions/rust-compile-cache/action.ymlandscripts/release-publish.sh. Check public candidates against the integrated advisory fixes. Preserve history; obtain approval before a rewrite. install.shhotspot. Installer acts only after the whole script has arrived #312, Installer keeps the user's TMPDIR #313 and Release fetches use HTTPS only, with loopback HTTP for fixtures #314 all editscripts/install.sh. Run them one after another, in that order, in one worker. Installer acts only after the whole script has arrived #312 restructures the file, so the other two rebase on it.release-signer.pyrequires every__STAMP__placeholder in the template, and the signature covers the installer bytes. Every installer change therefore ships only in a new signed release.ci.ymlhotspot. Required checks run whenever their inputs change (path filters) #317, Every Rust workspace passes fmt, clippy and tests on its target platforms #318, CI proves install and update on Linux #320 and CI speed: make the compiler cache store entries and shorten the macOS path #310 all editci.yml, as do CI and tests: warm caches, fail fast, keep only what catches real bugs #194's open batches (for example PR test: remove Rust duplication and timed settles (#194 Part 2) #225). Before you start, check open PRs that touchci.yml. Merge in this order: Required checks run whenever their inputs change (path filters) #317 → Every Rust workspace passes fmt, clippy and tests on its target platforms #318 → CI proves install and update on Linux #320. The nine required check names stay the same, unless Anders changes branch protection in the same step.- Independent items. Uninstall, and the macOS paths in INSTALL.md #315, The local pre-push gate refuses what CI refuses #319 and A documented procedure to withdraw a bad release #321 can run in parallel with everything else.
- Decisions first. macOS: Developer ID signing and notarization #316 needs an Apple Developer account decision from Anders. A documented procedure to withdraw a bad release #321 has an optional design part that depends on Design signed release-head freshness and explicit gateway freeze reporting #157 and Publisher key rotation without reinstalling: a root key delegates release signing keys #213.
- Builds.
AGENTS.mdallows one heavy local build at a time on the shared Mac, so prefer CI for proof. Every security-path change (installer, update, release scripts, workflows) gets independent model reviews (rule, 10 Oct, #89).
Work owned elsewhere (do not duplicate)
| Topic | Owner issue |
|---|---|
| Compiler cache, merge-queue choice, duplicate builds, test cleanup | #194 (and #310) |
| Maintainer key custody off the public server | #186 |
Publisher root key, rotation and revocation; head checks use only the first pinned DID (update.rs:1074) |
#213 (draft PR #221) |
| Signed release-head freshness | #157 |
| GitHub Release assets: tag-on-main check, Dependabot for Actions | #158 |
| Undo without a network (the user must save the previous head CID by hand today) | #297 |
| Invalid installed versions | #156 |
| Update/Undo before setup | #305 |
Decisions
Decided: D1 no code owners, model reviews instead (10 Oct). D2 yes (11 Oct): secret scanning and push protection on; cargo audit in CI is PR #351. D3 merge queue off (8 Oct).
Acceptance record
Group A and Groups B–E (except #319) shipped in 0.8.0-alpha.15 (PR #343, source aa3d61e). #319, #317, #320 and #321 moved to After 0.8.0; #314 is closed. The unwired Clipboard gate (#415) is fixed on the train (420d97682, 853938834). Candidate: see #93. Left for 0.8.0: publish the advisory after stable is live.
Remaining work for 0.8.0: #89 Remaining for 0.8.0.
How to work on this (any person or agent)
- Read
AGENTS.mdandSECURITY.mdfirst. FollowAGENTS.mdfor branches, reviews, push approval and the acceptance record. Keep exploit details of Group A out of public issues, PRs and commit messages. - Take one sub-issue at a time. Each sub-issue states its current behavior with file and line, the intended behavior, constraints and Done means with tests.
- Line numbers refer to
develop8941d478. If lines moved, find the code by the quoted function, step or job name. - Local checks:
just ci-local-prepush. Release-script changes also needpython3 scripts/release-platform-input-test.py,python3 scripts/ci-release-policy-test.pyandnode --test scripts/release-publish.test.mjs. - Close a sub-issue only when its Done means is proven and its PR has its reviews and is merged.
Activity
andersalm commentedon Oct 9, 2026
Thanks Irzhy, a thorough review. The advisory goes first (OMP operator); for alpha.13 I verify the package run's branch, event and workflow file by hand before signing, and the code fix follows with your review. Then #312 → #313 → #314 in one worker, plus #315 (safe uninstall), #317, #319, #320 and #321 before 0.8.0; #316 and #318 after 0.8.0.
andersalm commentedon Oct 9, 2026
User-directed remediation has started from approved develop base
7184e0444079881e62ef99a6c3807547119a4534(tree5e05cebf3ae4ab3d75b220c17a3f2d176880ccc5). Group A remains the active task. The advisory now has a private repair fork; its implementation, detailed evidence and review will stay there. The current checkout and existing operator work remain preserved. No release, deployment or signing action is part of this step.The candidate will cover the four reviewed boundaries and include focused regression checks. CI cache correctness comes before speed changes in #310/#194. There is no candidate PR or new test result yet. Required independent review and human review remain part of acceptance.
andersalm commentedon Oct 9, 2026
The private candidate now includes local commit
57f6ab3dfor the cache startup repair. Twelve focused policy regressions passed. A separate smoke with pinned sccache 0.18.0 and Rust 1.91.0 also passed: credential-free clients reused compiled outputs, source and release-stamp edits invalidated the correct library, the read-only remote fixture received no writes, and all fixture processes/files were removed. Real GitHub cache persistence remains a required acceptance check after integration.The release and migration changes are in progress. Their focused tests and independent review will finish before one shared Rust verification batch. The public CI consistency work is recorded in #319 and the installed-journey diagnosis in #194; it carries separate source commits and acceptance.
andersalm commentedon Oct 9, 2026
Group A remains the sole active private security candidate. Its reviewed source changes are based on develop
7184e044; the committed source checkpoint is8ae07f8e. The release tooling has 60 passing signer fixtures and its new producer fixtures are reached by the ordinary release self-test loader. Independent review covers the candidate; one bounded-input repair from the final producer review is being completed before the final candidate is frozen.The full release policy and consumer suites are in progress. Rust verification is queued for the next free Mac heavy-build lease; the current owner keeps that lease. The local build plan reuses dependency intermediates, refreshes repository artifacts once, and retains its private verification cache only until the final gate completes. Public CI work is in ready PR #326 under #319.
GitHub's temporary advisory fork excludes Actions and status checks. Local source proof and an isolated, key-free real package/provenance integration proof therefore have separate acceptance records. Human review, accepted hosted provenance and installed release evidence remain required before Group A can be accepted. All production signing and live changes remain with their operator gates.
13 remaining items
andersalm commentedon Oct 9, 2026
GitHub’s temporary advisory repository rejects standard PR-comment APIs (
Not Foundover REST;This action is forbidden on workspace repositoriesover GraphQL). The private PR body is supported and already holds its development-review proof. The different-model verdict will be recorded there on the exact head, then linked safely from this issue. This keeps security evidence in the advisory workspace while satisfying the posted-review record.andersalm commentedon Oct 9, 2026
The different-model adversarial review returned one claimed tool-compatibility blocker based on an explicitly unverified recollection. I am checking the approved installed tool and its official source before changing the candidate. Two additional observations are under source review. Detailed findings and the exact review verdict are recorded in private advisory PR #1; the public PR #326 remains fully green.
andersalm commentedon Oct 9, 2026
The tool-compatibility blocker is confirmed against the installed pinned tool. The extra source review also found recovery edge cases worth fixing before handoff. I am adding bounded refusal tests and shared process ownership, then will run the complete affected gate once on the combined candidate. This keeps the fixes in private PR #1 and avoids separate expensive build batches.
andersalm commentedon Oct 9, 2026
The final pre-push gate stopped before any compiler work because develop advanced to 37e58ea (PR #327). Its changes overlap recovery/update and Carrier files in the private candidate. I will merge the current approved develop base into the task branch with normal history, inspect compatibility, and qualify the combined candidate. The earlier public PR #326 checks remain passed at head6d6330e4; its current-base compatibility will be stated separately.
andersalm commentedon Oct 9, 2026
Current develop is merged into the private task branch with normal history. Independent compatibility review caught a changed public API in one fixture, which was corrected before compiling. The installed recovery fences remain intact. The single combined source gate is now running on the clean updated candidate; earlier-base test results will be kept separate from its proof.
andersalm commentedon Oct 9, 2026
The combined source gate is still compiling. One nested installer fixture hit its local time limit, so I am checking its process state and exact cause before accepting a retry. The source review remains passed; final executable proof is still pending.
andersalm commentedon Oct 11, 2026
D2 decided (Anders, 11 Oct): yes. Secret scanning and push protection are now enabled. A CI
cargo auditstep usingelastos/.cargo/audit.tomland--lockedrelease tag builds come on branch ci/supply-chain. D1 stays as decided on 10 Oct (model reviews); D3 stays off (8 Oct).andersalm commentedon Oct 13, 2026
Status: Group B is done in alpha.15 via #343. #317, #319 and #320 moved to 0.8.1. #321 stays for Tuesday (the withdraw section). The advisory mapping is reported to Anders privately.
andersalm commentedon Oct 16, 2026
Remaining for 0.8.0 (15 Oct 22:45 COT; final candidate alpha.21 = alpha.20 + automatic Community recovery; plan #93 6207232773): publish advisory GHSA-wgx8 with 0.8.0, then close (every other sub-issue is in After 0.8.0).
andersalm commentedon Oct 16, 2026
Body reconciled: #314 ticked (closed). #317, #319, #320, #321 struck → moved to After 0.8.0 (milestone already set on each). The publish-advisory item stays for publication.
andersalm commentedon Oct 19, 2026
Unwired check failing since 8 Oct (found during alpha.24 integration):
node scripts/home-clipboard-source-gate.mjs(injust verify,justfile:174) fails with "capsules/chat-room/browser/chat-room.js must use the canonical Home Clipboard client and its fixed target binding".chat-room.jslast changed ind57f5a96b(8 Oct). The gate last changed in0ead0bcc6(1 Oct). The file is unchanged in alpha.23 (bfefe92f6) and in the alpha.24 train.ci.yml) nor the pre-push gate runsjust verify, so the failure went unseen. It is not caused by alpha.24.andersalm commentedon Oct 22, 2026
The 22 October #93 audit refreshed the advisory DB to
640bf5a9f06e66d8721e8772766531fe77c8630dand audited all 34 tracked Cargo.lock files under the candidate's existing policy. Each exited 0; informational unsound/unmaintained warnings and a yanked package remain. Keep a reachability/upgrade disposition with this issue/#318 and the private dependency review. This is a successful configured gate, not a blanket dependency-safety claim. Candidate460b1888dretains the reviewed webpki shim exception with its review date: re-review by 20 November 2026 at the latest (elastos/.cargo/audit.toml:5-11). That date does not end the exception automatically. The exact source-gate/behaviour/layout results are in #93's verification record.andersalm commentedon Oct 22, 2026
The completed draft-register CI run failed cargo-audit on existing dependency inputs (RUSTSEC-2026-0379 through RUSTSEC-2026-0383); remaining jobs were cancelled.
The register changes no lockfiles, and fetched develop has the same inputs. Please retain dependency remediation as a release gate; exact evidence is in #194.
andersalm commentedon Oct 22, 2026
Dependency gate result for the 0.8.0 candidate, in reply to 6352529865.
The freeze candidate
7192a34efalready has the update for RUSTSEC-2026-0379 to -0383. Commit2b1dba958(20 Oct, reviewed as3e52c4d84) moves wasmtime to 36.0.19, rustls-webpki to 0.103.16, webpki-roots to 1.0.10 and webpki-root-certs to 1.0.10 in the eight Cargo.lock files that the failed run flagged:elastosand the availability, chain, content-block-graph, exit, ipfs, model and object providers. The 34 tracked Cargo.lock files andelastos/.cargo/audit.tomlat7192a34efare the same bytes as at460b1888d, which passed the audit in 6343277089 with the same RustSec database640bf5a9. A new local run of cargo-audit 0.22.2 on7192a34efwith that database (upstream HEAD when checked) also passes all 34.Required check: the
cargo-auditjob of the train's CI run 39866505004 on7192a34efpassed at 22:39:53Z. It scanned 34 Cargo.lock files against 1,349 loaded advisories and found no vulnerability.Run 39854146042 tested PR #487 (head
ceca1d3b1) merged with develop3beb81643. Develop receives2b1dba958with the freeze promotion. Until then, runs based on develop report these advisories. The cargo-audit gate stays in force, and #487 takes the fix from develop after the promotion.Follow-up right after the promotion:
elastos/.cargo/audit.tomlignores RUSTSEC-2026-0381 so that webpki-roots 0.26.11 passes. Since 21 Oct the RustSec entry marks 0.26.11 unaffected (advisory-db8c254009), and the audit of7192a34efalso passes without the file. Removing the file on develop keeps the check watching every webpki-roots version.