Merge branch 'antigravity/signed-delivery-queue-a'

.github/workflows/linux-release.yml

@@ -1,4 +1,4 @@
-name: Linux release artifacts
+name: Release pipeline
 
 on:
   workflow_dispatch:
@@ -7,17 +7,19 @@ on:
       - 'v*'
 
 permissions:
-  contents: read
+  contents: write
+  id-token: write
 
 jobs:
   bootstrap:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
+      - name: Setup cosign
+        uses: sigstore/cosign-installer@v3.5.0
+
       - name: Validate bootstrap
         run: |
           bash -n deploy/ochenstarik-server-monitor-manager.sh
@@ -31,21 +33,20 @@ jobs:
           shellcheck --severity=error tests/bootstrap/run-native-systemd-smoke.sh
           shellcheck --severity=error tests/bootstrap/run-systemd-container-smoke.sh
           bash tests/bootstrap/test-bootstrap-contract.sh
+          bash tests/bootstrap/test-manifest-verification.sh
 
       - name: Package bootstrap
         shell: bash
         run: |
           set -Eeuo pipefail
           install -m 0755 deploy/ochenstarik-server-monitor-manager.sh ochenstarik-server-monitor-manager.sh
+          
+          # Substitute PROGRAM_VERSION from tag
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            sed -i "s/^PROGRAM_VERSION=.*$/PROGRAM_VERSION=\"${GITHUB_REF_NAME}\"/" ochenstarik-server-monitor-manager.sh
+          fi
+          
           sha256sum ochenstarik-server-monitor-manager.sh > ochenstarik-server-monitor-manager.sh.sha256
-          bootstrap_sha="$(sha256sum ochenstarik-server-monitor-manager.sh | awk '{print $1}')"
-          jq -n \
-            --arg schema "smm-bootstrap-manifest/v1" \
-            --arg version "${GITHUB_REF_NAME}" \
-            --arg bootstrap "ochenstarik-server-monitor-manager.sh" \
-            --arg bootstrap_sha256 "$bootstrap_sha" \
-            '{schema: $schema, version: $version, bootstrap: $bootstrap, bootstrap_sha256: $bootstrap_sha256, supported_runtimes: ["linux-x64", "linux-arm64"]}' \
-            > server-monitor-manager-bootstrap-manifest.json
 
       - name: Upload bootstrap artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -54,22 +55,9 @@ jobs:
           path: |
             ochenstarik-server-monitor-manager.sh
             ochenstarik-server-monitor-manager.sh.sha256
-            server-monitor-manager-bootstrap-manifest.json
 
-      - name: Attach bootstrap to GitHub Release
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
-        with:
-          prerelease: ${{ contains(github.ref_name, '-') }}
-          files: |
-            ochenstarik-server-monitor-manager.sh
-            ochenstarik-server-monitor-manager.sh.sha256
-            server-monitor-manager-bootstrap-manifest.json
-
-  publish:
+  publish-linux:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     strategy:
       matrix:
         runtime: [linux-x64, linux-arm64]
@@ -82,14 +70,25 @@ jobs:
         with:
           dotnet-version: 10.0.x
 
+      - name: Set Version
+        id: version
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            VERSION="${GITHUB_REF_NAME#v}"
+          else
+            VERSION="0.2.0-dev"
+          fi
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+
       - name: Publish agent
-        run: dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj --configuration Release --runtime ${{ matrix.runtime }} --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true -o out/agent
+        run: dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj --configuration Release --runtime ${{ matrix.runtime }} --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true -p:Version=${{ steps.version.outputs.version }} -o out/agent
 
       - name: Publish control
-        run: dotnet publish src/ServerMonitorManager.Control/ServerMonitorManager.Control.csproj --configuration Release --runtime ${{ matrix.runtime }} --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true -o out/control
+        run: dotnet publish src/ServerMonitorManager.Control/ServerMonitorManager.Control.csproj --configuration Release --runtime ${{ matrix.runtime }} --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true -p:Version=${{ steps.version.outputs.version }} -o out/control
 
       - name: Publish provisioning helper
-        run: dotnet publish src/ServerMonitorManager.Provisioning.Helper/ServerMonitorManager.Provisioning.Helper.csproj --configuration Release --runtime ${{ matrix.runtime }} --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true -o out/provisioning-helper
+        run: dotnet publish src/ServerMonitorManager.Provisioning.Helper/ServerMonitorManager.Provisioning.Helper.csproj --configuration Release --runtime ${{ matrix.runtime }} --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true -p:Version=${{ steps.version.outputs.version }} -o out/provisioning-helper
 
       - name: Package
         shell: bash
@@ -121,12 +120,167 @@ jobs:
             server-monitor-manager-${{ matrix.runtime }}.tar.gz.sha256
             server-monitor-manager-${{ matrix.runtime }}-sbom.json
 
-      - name: Attach to GitHub Release
+  package-windows:
+    runs-on: windows-latest
+    env:
+      SIGNING_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_BASE64 }}
+      SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Set up .NET 10
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68  # v6.0.0
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Prepare signing certificate
+        id: signing
+        shell: pwsh
+        run: |
+          $directory = Join-Path $env:RUNNER_TEMP 'smm-signing'
+          New-Item -ItemType Directory -Path $directory -Force | Out-Null
+          if ($env:SIGNING_CERTIFICATE_BASE64 -and $env:SIGNING_CERTIFICATE_PASSWORD) {
+            Write-Output "::add-mask::$env:SIGNING_CERTIFICATE_PASSWORD"
+            $pfx = Join-Path $directory 'trusted-signing.pfx'
+            [IO.File]::WriteAllBytes($pfx, [Convert]::FromBase64String($env:SIGNING_CERTIFICATE_BASE64))
+            "certificate=$pfx" >> $env:GITHUB_OUTPUT
+            "password=$env:SIGNING_CERTIFICATE_PASSWORD" >> $env:GITHUB_OUTPUT
+            "test_certificate=false" >> $env:GITHUB_OUTPUT
+          } else {
+            $password = [Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(24))
+            Write-Output "::add-mask::$password"
+            ./build/windows/New-TestSigningCertificate.ps1 -OutputDirectory $directory -Password $password
+            "certificate=$(Join-Path $directory 'server-monitor-manager-test-signing.pfx')" >> $env:GITHUB_OUTPUT
+            "public_certificate=$(Join-Path $directory 'server-monitor-manager-test-signing.cer')" >> $env:GITHUB_OUTPUT
+            "password=$password" >> $env:GITHUB_OUTPUT
+            "test_certificate=true" >> $env:GITHUB_OUTPUT
+          }
+
+      - name: Set Version
+        id: version
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            VERSION="${GITHUB_REF_NAME#v}"
+          else
+            VERSION="0.2.0-dev"
+          fi
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+
+      - name: Build signed MSIX
+        shell: pwsh
+        run: ./build/windows/Build-Installer.ps1 -CertificatePath '${{ steps.signing.outputs.certificate }}' -CertificatePassword '${{ steps.signing.outputs.password }}' -Version '${{ steps.version.outputs.version }}'
+
+      - name: Include test certificate
+        if: steps.signing.outputs.test_certificate == 'true'
+        shell: pwsh
+        run: Copy-Item -LiteralPath '${{ steps.signing.outputs.public_certificate }}' -Destination artifacts/windows-installer/ServerMonitorManager-test-signing.cer
+
+      - name: Verify checksum
+        shell: pwsh
+        run: |
+          $line = Get-Content artifacts/windows-installer/SHA256SUMS
+          $expected = ($line -split ' ')[0]
+          $actual = (Get-FileHash artifacts/windows-installer/ServerMonitorManager-win-x64.msix -Algorithm SHA256).Hash.ToLowerInvariant()
+          if ($actual -ne $expected) { throw 'Windows installer checksum mismatch.' }
+
+      - name: Generate SBOM
+        shell: bash
+        run: |
+          dotnet tool install --global CycloneDX
+          dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename server-monitor-manager-win-x64-sbom
+
+      - name: Upload installer artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: server-monitor-manager-win-x64
+          path: |
+            artifacts/windows-installer/ServerMonitorManager-win-x64.msix
+            artifacts/windows-installer/ServerMonitorManager-test-signing.cer
+            artifacts/windows-installer/SHA256SUMS
+            server-monitor-manager-win-x64-sbom.json
+          if-no-files-found: error
+
+  manifest:
+    runs-on: ubuntu-latest
+    needs: [bootstrap, publish-linux, package-windows]
+    steps:
+      - name: Setup cosign
+        uses: sigstore/cosign-installer@v3.5.0
+        
+      - name: Download all artifacts
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          path: artifacts
+
+      - name: Generate Manifest v2
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          
+          # Version fallback for non-tag runs
+          VERSION="${GITHUB_REF_NAME}"
+          if [[ ! "${GITHUB_REF}" == refs/tags/* ]]; then
+            VERSION="0.0.0-dev"
+          fi
+          
+          # Calculate hashes
+          BOOTSTRAP_SHA=$(sha256sum artifacts/server-monitor-manager-bootstrap/ochenstarik-server-monitor-manager.sh | awk '{print $1}')
+          LINUX_X64_SHA=$(sha256sum artifacts/server-monitor-manager-linux-x64/server-monitor-manager-linux-x64.tar.gz | awk '{print $1}')
+          LINUX_ARM64_SHA=$(sha256sum artifacts/server-monitor-manager-linux-arm64/server-monitor-manager-linux-arm64.tar.gz | awk '{print $1}')
+          MSIX_SHA=$(sha256sum artifacts/server-monitor-manager-win-x64/ServerMonitorManager-win-x64.msix | awk '{print $1}')
+          LINUX_X64_SBOM_SHA=$(sha256sum artifacts/server-monitor-manager-linux-x64/server-monitor-manager-linux-x64-sbom.json | awk '{print $1}')
+          LINUX_ARM64_SBOM_SHA=$(sha256sum artifacts/server-monitor-manager-linux-arm64/server-monitor-manager-linux-arm64-sbom.json | awk '{print $1}')
+          WIN_X64_SBOM_SHA=$(sha256sum artifacts/server-monitor-manager-win-x64/server-monitor-manager-win-x64-sbom.json | awk '{print $1}')
+          
+          jq -n \
+            --arg schema "smm-manifest/v2" \
+            --arg version "$VERSION" \
+            --arg bootstrap_sha256 "$BOOTSTRAP_SHA" \
+            --arg linux_x64_sha256 "$LINUX_X64_SHA" \
+            --arg linux_arm64_sha256 "$LINUX_ARM64_SHA" \
+            --arg msix_sha256 "$MSIX_SHA" \
+            --arg linux_x64_sbom_sha256 "$LINUX_X64_SBOM_SHA" \
+            --arg linux_arm64_sbom_sha256 "$LINUX_ARM64_SBOM_SHA" \
+            --arg win_x64_sbom_sha256 "$WIN_X64_SBOM_SHA" \
+            '{
+              schema: $schema,
+              version: $version,
+              components: {
+                control: $version,
+                agent: $version,
+                helper: $version,
+                desktop: $version
+              },
+              protocols: {
+                helper_protocol: "v1"
+              },
+              hashes: {
+                "ochenstarik-server-monitor-manager.sh": $bootstrap_sha256,
+                "server-monitor-manager-linux-x64.tar.gz": $linux_x64_sha256,
+                "server-monitor-manager-linux-arm64.tar.gz": $linux_arm64_sha256,
+                "ServerMonitorManager-win-x64.msix": $msix_sha256,
+                "server-monitor-manager-linux-x64-sbom.json": $linux_x64_sbom_sha256,
+                "server-monitor-manager-linux-arm64-sbom.json": $linux_arm64_sbom_sha256,
+                "server-monitor-manager-win-x64-sbom.json": $win_x64_sbom_sha256
+              }
+            }' > server-monitor-manager-manifest.json
+
+      - name: Sign Manifest
+        shell: bash
+        run: |
+          cosign sign-blob --yes --output-signature server-monitor-manager-manifest.sig server-monitor-manager-manifest.json
+
+      - name: Attach artifacts to GitHub Release
         if: startsWith(github.ref, 'refs/tags/')
         uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
         with:
           prerelease: ${{ contains(github.ref_name, '-') }}
           files: |
-            server-monitor-manager-${{ matrix.runtime }}.tar.gz
-            server-monitor-manager-${{ matrix.runtime }}.tar.gz.sha256
-            server-monitor-manager-${{ matrix.runtime }}-sbom.json
+            artifacts/server-monitor-manager-bootstrap/*
+            artifacts/server-monitor-manager-linux-x64/*
+            artifacts/server-monitor-manager-linux-arm64/*
+            artifacts/server-monitor-manager-win-x64/*
+            server-monitor-manager-manifest.json
+            server-monitor-manager-manifest.sig

build/windows/Build-Installer.ps1

@@ -5,6 +5,9 @@ param(
     [Parameter(Mandatory = $true)]
     [string]$CertificatePassword,
 
+    [Parameter(Mandatory = $false)]
+    [string]$Version,
+
     [string]$OutputDirectory = 'artifacts/windows-installer'
 )
 
@@ -38,19 +41,38 @@ try {
     dotnet restore $project -p:Platform=x64 -p:PublishReadyToRun=false -p:RestoreLockedMode=true
     if ($LASTEXITCODE -ne 0) { throw 'dotnet restore failed' }
 
-    dotnet publish $project `
-        --configuration Release `
-        --runtime win-x64 `
-        --no-restore `
-        -p:Platform=x64 `
-        -p:PublishReadyToRun=false `
-        -p:GenerateAppxPackageOnBuild=true `
-        -p:AppxPackageSigningEnabled=true `
-        -p:PackageCertificateThumbprint=$($signingCertificate.Thumbprint) `
-        -p:AppxBundle=Never `
-        -p:AppxSymbolPackageEnabled=false `
-        -p:UapAppxPackageBuildMode=SideloadOnly `
-        -p:AppxPackageDir="$appPackages\"
+    if ($Version) {
+        $dotnetArgs += "-p:Version=$Version"
+        $dotnetArgs += "-p:AppxPackageVersion=$Version.0"
+        dotnet publish $project `
+            --configuration Release `
+            --runtime win-x64 `
+            --no-restore `
+            -p:Platform=x64 `
+            -p:PublishReadyToRun=false `
+            -p:GenerateAppxPackageOnBuild=true `
+            -p:AppxPackageSigningEnabled=true `
+            -p:PackageCertificateThumbprint=$($signingCertificate.Thumbprint) `
+            -p:AppxBundle=Never `
+            -p:AppxSymbolPackageEnabled=false `
+            -p:UapAppxPackageBuildMode=SideloadOnly `
+            -p:AppxPackageDir="$appPackages\" `
+            -p:Version=$Version
+    } else {
+        dotnet publish $project `
+            --configuration Release `
+            --runtime win-x64 `
+            --no-restore `
+            -p:Platform=x64 `
+            -p:PublishReadyToRun=false `
+            -p:GenerateAppxPackageOnBuild=true `
+            -p:AppxPackageSigningEnabled=true `
+            -p:PackageCertificateThumbprint=$($signingCertificate.Thumbprint) `
+            -p:AppxBundle=Never `
+            -p:AppxSymbolPackageEnabled=false `
+            -p:UapAppxPackageBuildMode=SideloadOnly `
+            -p:AppxPackageDir="$appPackages\"
+    }
     if ($LASTEXITCODE -ne 0) { throw 'dotnet publish failed' }
 
     $package = Get-ChildItem -LiteralPath $appPackages -Recurse -File |

tests/bootstrap/test-manifest-verification.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+echo "Running negative tests for manifest verification..."
+
+if ! command -v cosign &> /dev/null; then
+    echo "cosign could not be found. Please install it to run these tests."
+    exit 1
+fi
+
+# Generate test keypair
+export COSIGN_PASSWORD=""
+cosign generate-key-pair
+export SMM_TEST_PUBKEY="cosign.pub"
+
+ARCHIVE_NAME="test-archive.tar.gz"
+echo "archive content" > "$ARCHIVE_NAME"
+ARCHIVE_HASH=$(sha256sum "$ARCHIVE_NAME" | awk '{print $1}')
+
+cat <<EOF > manifest.json
+{
+  "hashes": {
+    "$ARCHIVE_NAME": "$ARCHIVE_HASH"
+  }
+}
+EOF
+
+cosign sign-blob --yes --key cosign.key --output-signature manifest.sig manifest.json
+
+echo "Test 1: Valid signature and hash"
+if ! bash tests/bootstrap/verify-manifest.sh "$ARCHIVE_NAME" manifest.json manifest.sig; then
+    echo "FAIL: Valid payload rejected"
+    exit 1
+fi
+echo "PASS: Valid payload accepted"
+
+echo "Test 2: Altered byte in archive"
+echo "altered content" > "$ARCHIVE_NAME"
+if bash tests/bootstrap/verify-manifest.sh "$ARCHIVE_NAME" manifest.json manifest.sig >/dev/null 2>&1; then
+    echo "FAIL: Altered archive accepted"
+    exit 1
+fi
+echo "PASS: Altered archive rejected"
+
+echo "Test 3: Substituted hash in manifest without resigning"
+# Restore archive
+echo "archive content" > "$ARCHIVE_NAME"
+# Corrupt manifest
+cat <<EOF > manifest.json
+{
+  "hashes": {
+    "$ARCHIVE_NAME": "0000000000000000000000000000000000000000000000000000000000000000"
+  }
+}
+EOF
+if bash tests/bootstrap/verify-manifest.sh "$ARCHIVE_NAME" manifest.json manifest.sig >/dev/null 2>&1; then
+    echo "FAIL: Substituted hash accepted"
+    exit 1
+fi
+echo "PASS: Substituted hash rejected"
+
+echo "Test 4: Manifest without signature"
+if bash tests/bootstrap/verify-manifest.sh "$ARCHIVE_NAME" manifest.json "" >/dev/null 2>&1; then
+    echo "FAIL: Missing signature accepted"
+    exit 1
+fi
+echo "PASS: Missing signature rejected"
+
+echo "All tests passed."
+
+rm -f cosign.key cosign.pub manifest.json manifest.sig "$ARCHIVE_NAME"

tests/bootstrap/verify-manifest.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+ARCHIVE=$1
+MANIFEST=$2
+SIGNATURE=${3:-}
+
+if [ -z "$SIGNATURE" ]; then
+    echo "Signature is required."
+    exit 1
+fi
+
+if ! command -v cosign &> /dev/null; then
+    echo "cosign could not be found."
+    exit 1
+fi
+
+if ! command -v jq &> /dev/null; then
+    echo "jq could not be found."
+    exit 1
+fi
+
+# Verify signature
+if [ -n "${SMM_TEST_PUBKEY:-}" ]; then
+    cosign verify-blob "$MANIFEST" --signature "$SIGNATURE" --key "$SMM_TEST_PUBKEY" >/dev/null 2>&1
+else
+    cosign verify-blob "$MANIFEST" \
+        --signature "$SIGNATURE" \
+        --certificate-identity-regexp "^https://github.com/ochenstarik-ui/server-monitor-manager/" \
+        --certificate-oidc-issuer "https://token.actions.githubusercontent.com" >/dev/null 2>&1
+fi
+
+# Parse expected hash from manifest based on archive name (assuming archive name ends with .tar.gz or .msix)
+ARCHIVE_BASENAME=$(basename "$ARCHIVE")
+# The manifest schema isn't fully defined yet, but we expect it to contain hashes. 
+# We can store them as { "hashes": { "server-monitor-manager-linux-x64.tar.gz": "sha256..." } }
+EXPECTED_HASH=$(jq -r ".hashes[\"$ARCHIVE_BASENAME\"]" "$MANIFEST")
+
+if [ "$EXPECTED_HASH" == "null" ] || [ -z "$EXPECTED_HASH" ]; then
+    echo "Hash for $ARCHIVE_BASENAME not found in manifest."
+    exit 1
+fi
+
+ACTUAL_HASH=$(sha256sum "$ARCHIVE" | awk '{print $1}')
+
+if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then
+    echo "Hash mismatch for $ARCHIVE_BASENAME! Expected $EXPECTED_HASH, got $ACTUAL_HASH."
+    exit 1
+fi
+
+echo "Verification successful."
+exit 0