Merge pull request #52 from ochenstarik-ui/codex/release-alpha16-cosign-verification

fix: complete clean-host release verification

deploy/smm-setup.sh

@@ -3,7 +3,7 @@ set -Eeuo pipefail
 IFS=$'\n\t'
 
 readonly PROGRAM_NAME="smm-setup"
-readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.15"
+readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.16"
 readonly DEFAULT_REPOSITORY="ochenstarik-ui/server-monitor-manager"
 readonly INNER_ASSET="ochenstarik-server-monitor-manager.sh"
 
@@ -27,7 +27,7 @@ force pass-through. Common bootstrap commands:
   backup-create | backup-restore | version
 
 Environment overrides:
-  SMM_TAG         Release tag (default: v0.1.0-alpha.15)
+  SMM_TAG         Release tag (default: v0.1.0-alpha.16)
   SMM_REPOSITORY  GitHub repository (default: ochenstarik-ui/server-monitor-manager)
   SMM_CACHE_DIR   Verified-download cache directory
 USAGE

docs/linux-bootstrap.md

@@ -6,11 +6,11 @@ Server Monitor Manager устанавливает Control (Hub) и Agent (Node)
 
 ## Быстрая установка
 
-Скачайте и проверьте convenience installer из `v0.1.0-alpha.15`:
+Скачайте и проверьте convenience installer из `v0.1.0-alpha.16`:
 
 ```bash
-curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.15/smm-setup.sh
+curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.16/smm-setup.sh
-curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.15/smm-setup.sh.sha256
+curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.16/smm-setup.sh.sha256
 sha256sum -c smm-setup.sh.sha256
 chmod 700 smm-setup.sh
 ```

docs/release-policy.md

@@ -16,6 +16,7 @@ Known release history:
 - `v0.1.0-alpha.12` was published with a keyless manifest signature but without the Fulcio signing certificate, so consumers cannot verify that signature. Its Windows `SHA256SUMS` asset also used CRLF and was not consumable by GNU `sha256sum -c`. The immutable release remains published as historical evidence; neither defect is repaired in place.
 - `v0.1.0-alpha.13` corrected the checksum portability defect, but it was also published with a keyless manifest signature and without the Fulcio signing certificate required by production consumers. The immutable release remains published as historical evidence; the producer/consumer certificate contract is corrected under a higher version.
 - `v0.1.0-alpha.14` is the first release with the complete manifest, keyless signature, and Fulcio certificate set, so its published assets can be verified. A clean host cannot install it because the release does not provision cosign. Preserve it for verification and historical evidence; do not use it for installation.
-- `v0.1.0-alpha.15` is the first release that provisions a pinned, checksum-verified cosign binary and can therefore be installed on a clean supported host without manual cosign setup.
+- `v0.1.0-alpha.15` is the first release that provisions a pinned, checksum-verified cosign binary. Its automatically triggered Release Verification proved the clean-host Hub installation and manifest verification, then stopped before the clean-host Node installation because the acceptance script retained the deliberately removed cosign path in Bash's command hash. The immutable release and failed verification remain as evidence; the acceptance harness is corrected in the next version.
+- `v0.1.0-alpha.16` clears the acceptance shell's command hash after removing its test-provisioned cosign, so both `install-hub` and `install-node` are exercised from a clean host. It is the first release required to complete both automatic `workflow_run` verification and manual `workflow_dispatch` re-verification.
 
 Every release candidate must pass a branch `workflow_dispatch` run of the Release pipeline before its immutable version tag is created. The release owner has sole write ownership of version sources, `deploy/**`, `tests/bootstrap/**`, release workflows, the root README release status, and translated README release statuses. Other contributors request changes to those paths in their report; they do not edit or bump them directly. One pull request covers one release topic and may merge only after required CI is green.

tests/bootstrap/test-cosign-provisioning.sh

@@ -106,4 +106,18 @@ chmod 0755 "$install_path"
 run_ensure_cosign x86_64 "$(printf '0%.0s' {1..64})" "$(printf '0%.0s' {1..64})" "$install_path"
 [[ ! -s "$work/urls" ]]
 
+# Bash caches successful command lookups. The release acceptance test removes
+# its own provisioned cosign to exercise install-node from a clean state, so it
+# must clear that cache before checking PATH again.
+(
+    PATH="$work/installed:$work/bin:/usr/bin:/bin"
+    cosign version >/dev/null
+    rm -f -- "$install_path"
+    hash -r
+    if command -v cosign >/dev/null 2>&1; then
+        printf '%s\n' 'cosign remained discoverable after hash reset' >&2
+        exit 1
+    fi
+)
+
 printf '%s\n' 'COSIGN_PROVISIONING=PASS'

tests/bootstrap/test-release-contract.sh

@@ -18,7 +18,7 @@ v1_fixture="$root/tests/fixtures/alpha8-v1-release"
     exit 1
 }
 bash -n "$setup"
-grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.15"' "$setup"
+grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.16"' "$setup"
 grep -Fq 'install-hub PUBLIC_HOST [HTTPS_PORT] [WG_PORT]' "$setup"
 grep -Fxq '  install-node' "$setup"
 if grep -Fq 'validate_control_url' "$setup" || grep -Fq '${CONTROL_URL%/}/control' "$setup"; then
@@ -60,6 +60,8 @@ grep -Fq 'server-monitor-manager-manifest.pem' "$workflow"
 grep -Fq 'v0.1.0-alpha.13' "$policy"
 grep -Fq 'v0.1.0-alpha.14' "$policy"
 grep -Fq 'v0.1.0-alpha.15' "$policy"
+grep -Fq 'v0.1.0-alpha.16' "$policy"
+grep -Fq 'hash -r' "$root/tests/release-verification/run-positive-installation.sh"
 grep -Fq 'readonly COSIGN_VERSION="v3.1.3"' "$bootstrap"
 grep -Fq 'readonly COSIGN_SHA256_AMD64="4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71"' "$bootstrap"
 grep -Fq 'readonly COSIGN_SHA256_ARM64="c5d324e091826b0d7a78eb16fef316450b4eb9aaec045611c08ba06f5e73220a"' "$bootstrap"
@@ -183,8 +185,8 @@ chmod +x "$work/bin/uname"
 
 HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" version >"$work/output"
 grep -Fq 'INNER_ARGS=version ' "$work/output"
-grep -Fq '/releases/download/v0.1.0-alpha.15/ochenstarik-server-monitor-manager.sh' "$work/urls"
+grep -Fq '/releases/download/v0.1.0-alpha.16/ochenstarik-server-monitor-manager.sh' "$work/urls"
-grep -Fq '/releases/download/v0.1.0-alpha.15/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls"
+grep -Fq '/releases/download/v0.1.0-alpha.16/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls"
 
 if HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" install-hub >"$work/invalid.out" 2>&1; then
     printf '%s\n' 'install-hub accepted a missing PUBLIC_HOST' >&2

tests/release-verification/run-positive-installation.sh

@@ -87,6 +87,7 @@ NODE_CODE="$(sudo bash smm-setup.sh --tag "$TAG" node-code test-node)"
 # Remove only that test-provisioned copy so install-node is also exercised from
 # a host without cosign.
 sudo rm -f -- /usr/local/bin/cosign
+hash -r
 if command -v cosign >/dev/null 2>&1; then
     echo "FAIL: cosign is still present before the clean-host install-node test" >&2
     exit 1