diff --git a/deploy/smm-setup.sh b/deploy/smm-setup.sh index ca5cd09..bdfa785 100644 --- a/deploy/smm-setup.sh +++ b/deploy/smm-setup.sh @@ -3,7 +3,7 @@ set -Eeuo pipefail IFS=$'\n\t' readonly PROGRAM_NAME="smm-setup" -readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.15" +readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.16" readonly DEFAULT_REPOSITORY="ochenstarik-ui/server-monitor-manager" readonly INNER_ASSET="ochenstarik-server-monitor-manager.sh" @@ -27,7 +27,7 @@ force pass-through. Common bootstrap commands: backup-create | backup-restore | version Environment overrides: - SMM_TAG Release tag (default: v0.1.0-alpha.15) + SMM_TAG Release tag (default: v0.1.0-alpha.16) SMM_REPOSITORY GitHub repository (default: ochenstarik-ui/server-monitor-manager) SMM_CACHE_DIR Verified-download cache directory USAGE diff --git a/docs/linux-bootstrap.md b/docs/linux-bootstrap.md index 55f8ee7..54317a6 100644 --- a/docs/linux-bootstrap.md +++ b/docs/linux-bootstrap.md @@ -6,11 +6,11 @@ Server Monitor Manager устанавливает Control (Hub) и Agent (Node) ## Быстрая установка -Скачайте и проверьте convenience installer из `v0.1.0-alpha.15`: +Скачайте и проверьте convenience installer из `v0.1.0-alpha.16`: ```bash -curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.15/smm-setup.sh -curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.15/smm-setup.sh.sha256 +curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.16/smm-setup.sh +curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.16/smm-setup.sh.sha256 sha256sum -c smm-setup.sh.sha256 chmod 700 smm-setup.sh ``` diff --git a/docs/release-policy.md b/docs/release-policy.md index b86264a..2d6e1ef 100644 --- a/docs/release-policy.md +++ b/docs/release-policy.md @@ -16,6 +16,7 @@ Known release history: - `v0.1.0-alpha.12` was published with a keyless manifest signature but without the Fulcio signing certificate, so consumers cannot verify that signature. Its Windows `SHA256SUMS` asset also used CRLF and was not consumable by GNU `sha256sum -c`. The immutable release remains published as historical evidence; neither defect is repaired in place. - `v0.1.0-alpha.13` corrected the checksum portability defect, but it was also published with a keyless manifest signature and without the Fulcio signing certificate required by production consumers. The immutable release remains published as historical evidence; the producer/consumer certificate contract is corrected under a higher version. - `v0.1.0-alpha.14` is the first release with the complete manifest, keyless signature, and Fulcio certificate set, so its published assets can be verified. A clean host cannot install it because the release does not provision cosign. Preserve it for verification and historical evidence; do not use it for installation. -- `v0.1.0-alpha.15` is the first release that provisions a pinned, checksum-verified cosign binary and can therefore be installed on a clean supported host without manual cosign setup. +- `v0.1.0-alpha.15` is the first release that provisions a pinned, checksum-verified cosign binary. Its automatically triggered Release Verification proved the clean-host Hub installation and manifest verification, then stopped before the clean-host Node installation because the acceptance script retained the deliberately removed cosign path in Bash's command hash. The immutable release and failed verification remain as evidence; the acceptance harness is corrected in the next version. +- `v0.1.0-alpha.16` clears the acceptance shell's command hash after removing its test-provisioned cosign, so both `install-hub` and `install-node` are exercised from a clean host. It is the first release required to complete both automatic `workflow_run` verification and manual `workflow_dispatch` re-verification. Every release candidate must pass a branch `workflow_dispatch` run of the Release pipeline before its immutable version tag is created. The release owner has sole write ownership of version sources, `deploy/**`, `tests/bootstrap/**`, release workflows, the root README release status, and translated README release statuses. Other contributors request changes to those paths in their report; they do not edit or bump them directly. One pull request covers one release topic and may merge only after required CI is green. diff --git a/tests/bootstrap/test-cosign-provisioning.sh b/tests/bootstrap/test-cosign-provisioning.sh index b3655fe..fdfeb60 100644 --- a/tests/bootstrap/test-cosign-provisioning.sh +++ b/tests/bootstrap/test-cosign-provisioning.sh @@ -106,4 +106,18 @@ chmod 0755 "$install_path" run_ensure_cosign x86_64 "$(printf '0%.0s' {1..64})" "$(printf '0%.0s' {1..64})" "$install_path" [[ ! -s "$work/urls" ]] +# Bash caches successful command lookups. The release acceptance test removes +# its own provisioned cosign to exercise install-node from a clean state, so it +# must clear that cache before checking PATH again. +( + PATH="$work/installed:$work/bin:/usr/bin:/bin" + cosign version >/dev/null + rm -f -- "$install_path" + hash -r + if command -v cosign >/dev/null 2>&1; then + printf '%s\n' 'cosign remained discoverable after hash reset' >&2 + exit 1 + fi +) + printf '%s\n' 'COSIGN_PROVISIONING=PASS' diff --git a/tests/bootstrap/test-release-contract.sh b/tests/bootstrap/test-release-contract.sh index 37c24de..1dfab22 100644 --- a/tests/bootstrap/test-release-contract.sh +++ b/tests/bootstrap/test-release-contract.sh @@ -18,7 +18,7 @@ v1_fixture="$root/tests/fixtures/alpha8-v1-release" exit 1 } bash -n "$setup" -grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.15"' "$setup" +grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.16"' "$setup" grep -Fq 'install-hub PUBLIC_HOST [HTTPS_PORT] [WG_PORT]' "$setup" grep -Fxq ' install-node' "$setup" if grep -Fq 'validate_control_url' "$setup" || grep -Fq '${CONTROL_URL%/}/control' "$setup"; then @@ -60,6 +60,8 @@ grep -Fq 'server-monitor-manager-manifest.pem' "$workflow" grep -Fq 'v0.1.0-alpha.13' "$policy" grep -Fq 'v0.1.0-alpha.14' "$policy" grep -Fq 'v0.1.0-alpha.15' "$policy" +grep -Fq 'v0.1.0-alpha.16' "$policy" +grep -Fq 'hash -r' "$root/tests/release-verification/run-positive-installation.sh" grep -Fq 'readonly COSIGN_VERSION="v3.1.3"' "$bootstrap" grep -Fq 'readonly COSIGN_SHA256_AMD64="4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71"' "$bootstrap" grep -Fq 'readonly COSIGN_SHA256_ARM64="c5d324e091826b0d7a78eb16fef316450b4eb9aaec045611c08ba06f5e73220a"' "$bootstrap" @@ -183,8 +185,8 @@ chmod +x "$work/bin/uname" HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" version >"$work/output" grep -Fq 'INNER_ARGS=version ' "$work/output" -grep -Fq '/releases/download/v0.1.0-alpha.15/ochenstarik-server-monitor-manager.sh' "$work/urls" -grep -Fq '/releases/download/v0.1.0-alpha.15/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls" +grep -Fq '/releases/download/v0.1.0-alpha.16/ochenstarik-server-monitor-manager.sh' "$work/urls" +grep -Fq '/releases/download/v0.1.0-alpha.16/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls" if HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" install-hub >"$work/invalid.out" 2>&1; then printf '%s\n' 'install-hub accepted a missing PUBLIC_HOST' >&2 diff --git a/tests/release-verification/run-positive-installation.sh b/tests/release-verification/run-positive-installation.sh index 7bc2072..c1e83af 100644 --- a/tests/release-verification/run-positive-installation.sh +++ b/tests/release-verification/run-positive-installation.sh @@ -87,6 +87,7 @@ NODE_CODE="$(sudo bash smm-setup.sh --tag "$TAG" node-code test-node)" # Remove only that test-provisioned copy so install-node is also exercised from # a host without cosign. sudo rm -f -- /usr/local/bin/cosign +hash -r if command -v cosign >/dev/null 2>&1; then echo "FAIL: cosign is still present before the clean-host install-node test" >&2 exit 1