ochenstarik/server-monitor-manager
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases 17 Packages Wiki Activity Actions 2

fix: select cosign v3 detached signing mode

Browse source
This commit is contained in:
ochenstarik-ui 2026-08-18 00:25:23 +07:00
parent 307446915d
commit 26a11b77e7
5 changed files with 14 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
deploy/smm-setup.sh
View file

@ -3,7 +3,7 @@ set -Eeuo pipefail
IFS=$'\n\t' IFS=$'\n\t'
readonly PROGRAM_NAME="smm-setup" readonly PROGRAM_NAME="smm-setup"
readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.17" readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.18"
readonly DEFAULT_REPOSITORY="ochenstarik-ui/server-monitor-manager" readonly DEFAULT_REPOSITORY="ochenstarik-ui/server-monitor-manager"
readonly INNER_ASSET="ochenstarik-server-monitor-manager.sh" readonly INNER_ASSET="ochenstarik-server-monitor-manager.sh"
@ -27,7 +27,7 @@ force pass-through. Common bootstrap commands:
backup-create | backup-restore | version backup-create | backup-restore | version
Environment overrides: Environment overrides:
SMM_TAG Release tag (default: v0.1.0-alpha.17) SMM_TAG Release tag (default: v0.1.0-alpha.18)
SMM_REPOSITORY GitHub repository (default: ochenstarik-ui/server-monitor-manager) SMM_REPOSITORY GitHub repository (default: ochenstarik-ui/server-monitor-manager)
SMM_CACHE_DIR Verified-download cache directory SMM_CACHE_DIR Verified-download cache directory
USAGE USAGE

6
docs/linux-bootstrap.md
View file

@ -6,11 +6,11 @@ Server Monitor Manager устанавливает Control (Hub) и Agent (Node)
## Быстрая установка ## Быстрая установка
Скачайте и проверьте convenience installer из `v0.1.0-alpha.17`: Скачайте и проверьте convenience installer из `v0.1.0-alpha.18`:
```bash ```bash
curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.17/smm-setup.sh curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.18/smm-setup.sh
curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.17/smm-setup.sh.sha256 curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.18/smm-setup.sh.sha256
sha256sum -c smm-setup.sh.sha256 sha256sum -c smm-setup.sh.sha256
chmod 700 smm-setup.sh chmod 700 smm-setup.sh
``` ```

3
docs/release-policy.md
View file

@ -18,6 +18,7 @@ Known release history:
- `v0.1.0-alpha.14` is the first release with the complete manifest, keyless signature, and Fulcio certificate set, so its published assets can be verified. A clean host cannot install it because the release does not provision cosign. Preserve it for verification and historical evidence; do not use it for installation. - `v0.1.0-alpha.14` is the first release with the complete manifest, keyless signature, and Fulcio certificate set, so its published assets can be verified. A clean host cannot install it because the release does not provision cosign. Preserve it for verification and historical evidence; do not use it for installation.
- `v0.1.0-alpha.15` is the first release that provisions a pinned, checksum-verified cosign binary. Its automatically triggered Release Verification proved the clean-host Hub installation and manifest verification, then stopped before the clean-host Node installation because the acceptance script retained the deliberately removed cosign path in Bash's command hash. The immutable release and failed verification remain as evidence; the acceptance harness is corrected in the next version. - `v0.1.0-alpha.15` is the first release that provisions a pinned, checksum-verified cosign binary. Its automatically triggered Release Verification proved the clean-host Hub installation and manifest verification, then stopped before the clean-host Node installation because the acceptance script retained the deliberately removed cosign path in Bash's command hash. The immutable release and failed verification remain as evidence; the acceptance harness is corrected in the next version.
- `v0.1.0-alpha.16` clears the acceptance shell's command hash after removing its test-provisioned cosign. Its automatic verification proved clean-host Hub installation, but the convenience installer wrote the bootstrap checksum success line to stdout before the machine-readable `SMMNODE2` enrollment code. Node installation therefore rejected the contaminated value. The immutable release and failed verification remain as evidence; stdout isolation is corrected in the next version. - `v0.1.0-alpha.16` clears the acceptance shell's command hash after removing its test-provisioned cosign. Its automatic verification proved clean-host Hub installation, but the convenience installer wrote the bootstrap checksum success line to stdout before the machine-readable `SMMNODE2` enrollment code. Node installation therefore rejected the contaminated value. The immutable release and failed verification remain as evidence; stdout isolation is corrected in the next version.
- `v0.1.0-alpha.17` keeps checksum verification fail-closed while suppressing its success line, so pass-through commands such as `node-code` return only their machine-readable bootstrap output. It is the first release required to complete both automatic `workflow_run` verification and manual `workflow_dispatch` re-verification. - `v0.1.0-alpha.17` keeps checksum verification fail-closed while suppressing its success line, so pass-through commands such as `node-code` return only their machine-readable bootstrap output. Its automatic verification completed the clean-host Hub and Node installation, then the negative-test harness stopped while creating a wrong-identity signature because cosign v3 requires an explicit bundle or legacy detached-output mode. The immutable release and failed harness run remain as evidence; the negative test is corrected in the next version.
- `v0.1.0-alpha.18` makes the wrong-identity negative test select cosign v3's explicit detached-output mode, matching the production consumer's detached signature and certificate contract. It is the first release required to complete both automatic `workflow_run` verification and manual `workflow_dispatch` re-verification.
Every release candidate must pass a branch `workflow_dispatch` run of the Release pipeline before its immutable version tag is created. The release owner has sole write ownership of version sources, `deploy/**`, `tests/bootstrap/**`, release workflows, the root README release status, and translated README release statuses. Other contributors request changes to those paths in their report; they do not edit or bump them directly. One pull request covers one release topic and may merge only after required CI is green. Every release candidate must pass a branch `workflow_dispatch` run of the Release pipeline before its immutable version tag is created. The release owner has sole write ownership of version sources, `deploy/**`, `tests/bootstrap/**`, release workflows, the root README release status, and translated README release statuses. Other contributors request changes to those paths in their report; they do not edit or bump them directly. One pull request covers one release topic and may merge only after required CI is green.

9
tests/bootstrap/test-release-contract.sh
View file

@ -18,7 +18,7 @@ v1_fixture="$root/tests/fixtures/alpha8-v1-release"
exit 1 exit 1
} }
bash -n "$setup" bash -n "$setup"
grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.17"' "$setup" grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.18"' "$setup"
grep -Fq 'install-hub PUBLIC_HOST [HTTPS_PORT] [WG_PORT]' "$setup" grep -Fq 'install-hub PUBLIC_HOST [HTTPS_PORT] [WG_PORT]' "$setup"
grep -Fxq ' install-node' "$setup" grep -Fxq ' install-node' "$setup"
if grep -Fq 'validate_control_url' "$setup" || grep -Fq '${CONTROL_URL%/}/control' "$setup"; then if grep -Fq 'validate_control_url' "$setup" || grep -Fq '${CONTROL_URL%/}/control' "$setup"; then
@ -62,7 +62,10 @@ grep -Fq 'v0.1.0-alpha.14' "$policy"
grep -Fq 'v0.1.0-alpha.15' "$policy" grep -Fq 'v0.1.0-alpha.15' "$policy"
grep -Fq 'v0.1.0-alpha.16' "$policy" grep -Fq 'v0.1.0-alpha.16' "$policy"
grep -Fq 'v0.1.0-alpha.17' "$policy" grep -Fq 'v0.1.0-alpha.17' "$policy"
grep -Fq 'v0.1.0-alpha.18' "$policy"
grep -Fq 'hash -r' "$root/tests/release-verification/run-positive-installation.sh" grep -Fq 'hash -r' "$root/tests/release-verification/run-positive-installation.sh"
grep -Fq -- '--use-signing-config=false --new-bundle-format=false' \
"$root/tests/release-verification/run-negative-tests.sh"
grep -Fq 'readonly COSIGN_VERSION="v3.1.3"' "$bootstrap" grep -Fq 'readonly COSIGN_VERSION="v3.1.3"' "$bootstrap"
grep -Fq 'readonly COSIGN_SHA256_AMD64="4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71"' "$bootstrap" grep -Fq 'readonly COSIGN_SHA256_AMD64="4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71"' "$bootstrap"
grep -Fq 'readonly COSIGN_SHA256_ARM64="c5d324e091826b0d7a78eb16fef316450b4eb9aaec045611c08ba06f5e73220a"' "$bootstrap" grep -Fq 'readonly COSIGN_SHA256_ARM64="c5d324e091826b0d7a78eb16fef316450b4eb9aaec045611c08ba06f5e73220a"' "$bootstrap"
@ -190,8 +193,8 @@ chmod +x "$work/bin/uname"
HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" version >"$work/output" HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" version >"$work/output"
grep -Fq 'INNER_ARGS=version ' "$work/output" grep -Fq 'INNER_ARGS=version ' "$work/output"
grep -Fq '/releases/download/v0.1.0-alpha.17/ochenstarik-server-monitor-manager.sh' "$work/urls" grep -Fq '/releases/download/v0.1.0-alpha.18/ochenstarik-server-monitor-manager.sh' "$work/urls"
grep -Fq '/releases/download/v0.1.0-alpha.17/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls" grep -Fq '/releases/download/v0.1.0-alpha.18/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls"
node_code="$(HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" node-code fixture-node)" node_code="$(HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" node-code fixture-node)"
[[ "$node_code" == 'SMMNODE1.fixture' ]] || { [[ "$node_code" == 'SMMNODE1.fixture' ]] || {

1
tests/release-verification/run-negative-tests.sh
View file

@ -72,6 +72,7 @@ echo "Test 4: Signature made by another identity"
export COSIGN_PASSWORD="" export COSIGN_PASSWORD=""
cosign generate-key-pair >/dev/null cosign generate-key-pair >/dev/null
cosign sign-blob --yes --key cosign.key \ cosign sign-blob --yes --key cosign.key \
--use-signing-config=false --new-bundle-format=false \
--output-signature fake.sig server-monitor-manager-manifest.json >/dev/null --output-signature fake.sig server-monitor-manager-manifest.json >/dev/null
if ./ochenstarik-server-monitor-manager.sh verify-manifest server-monitor-manager-manifest.json \ if ./ochenstarik-server-monitor-manager.sh verify-manifest server-monitor-manager-manifest.json \
fake.sig server-monitor-manager-manifest.pem >/dev/null 2>&1; then fake.sig server-monitor-manager-manifest.pem >/dev/null 2>&1; then