Repository navigation
release: seed import uses the service data location; update journey starts from the release users run - #361
Merged
Merged
Conversation
…state before downloads
…tale pin alpha.14's `elastos update` refused alpha.15 on Apple Silicon and Linux ARM64 (component 'browser-vm-image' has a development or unsupported release strategy), and CI never ran that hop: its update journey started from the fixed pin 0.8.0-alpha.8. The pin moves to the current public release, 0.8.0-alpha.15 (head Qmeo1oq5QdGpHmB6qkeDURuXMYKpN2jDbSL832N6tV5z25, release QmUC1XLvsGrrwNKK6QCbNzZmTAdQ3AzqmfS8Q2vjCABDL5, SHA-256 e754d182...6d28), written by pin-previous-release from the signed head and release the origin serves. `release-publish.sh prepare` now reads update-hop-previous-release.json at the approved source commit and the origin's release-head.json before any download, and refuses unless the pin's head_cid is that head's CIDv0 (`release-provenance.py head-cid`, the signer's UnixFS CID): the candidate's update journey must have started from the release users run now.
…of a pair Review of #361: - seed printed prev_head_cid inside single quotes, so a head carrying x'$(...)' ran code on the seed before any verification. seed now refuses a signed head whose signer_did is not a did:key or whose prev_head_cid is not a canonical CID, before printing anything, and prints every value (seed host, stage, data dir, Runtime, unit, version, DID, files) as one shell word. - The seed's state check refused a first publication: no prev_head_cid and no publish-state.json made jq exit 2, though the Runtime reads absent state as empty. Absent state now passes only for a head without a predecessor. - prepare refused N+1 of a pair once N was public, because N+1's source still pins the head before N. release-provenance.py update-pin (replacing head-cid) also admits a public head that is byte for byte the head this Mac signed for N, prepared as input N from the same package run and source, when that head's prev_head_cid is the pin. Every other head is refused.
Contributor
Author
This was referenced Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two release-only gaps found while publishing alpha.15 (12 Oct), each now caught before any download:
publish-releasereads $XDG_DATA_HOME/elastos (the service's data location), so the import read an empty publish state and refused after a 23-minute download. The script now exports XDG_DATA_HOME, requires RELEASE_SEED_DATA to end in /elastos, and checks the saved publish state continues the signed head (or holds this version, for a rerun) before downloading.release-publish.sh preparerefuses when the pin is not the public head.Behaviour tests fail on the old code (74/74 pass). update-hop-linux passed from alpha.15 on a rented box. CI precheck PASS.
Part of #89.