Merge branch 'main' into antigravity/node-enrollment-endpoint

deploy/smm-setup.sh

@@ -3,7 +3,7 @@ set -Eeuo pipefail
 IFS=$'\n\t'
 
 readonly PROGRAM_NAME="smm-setup"
-readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.15"
+readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.18"
 readonly DEFAULT_REPOSITORY="ochenstarik-ui/server-monitor-manager"
 readonly INNER_ASSET="ochenstarik-server-monitor-manager.sh"
 
@@ -27,7 +27,7 @@ force pass-through. Common bootstrap commands:
   backup-create | backup-restore | version
 
 Environment overrides:
-  SMM_TAG         Release tag (default: v0.1.0-alpha.15)
+  SMM_TAG         Release tag (default: v0.1.0-alpha.18)
   SMM_REPOSITORY  GitHub repository (default: ochenstarik-ui/server-monitor-manager)
   SMM_CACHE_DIR   Verified-download cache directory
 USAGE
@@ -114,7 +114,7 @@ curl -fsSL "$release_base/$INNER_ASSET.sha256" -o "$temporary_directory/$INNER_A
 
 (
     cd "$temporary_directory"
-    sha256sum -c "$INNER_ASSET.sha256"
+    sha256sum -c "$INNER_ASSET.sha256" >/dev/null
 ) || die "checksum verification failed for $RELEASE_TAG/$INNER_ASSET"
 
 install -m 0755 "$temporary_directory/$INNER_ASSET" "$cached_script"

docs/linux-bootstrap.md

@@ -6,11 +6,11 @@ Server Monitor Manager устанавливает Control (Hub) и Agent (Node)
 
 ## Быстрая установка
 
-Скачайте и проверьте convenience installer из `v0.1.0-alpha.15`:
+Скачайте и проверьте convenience installer из `v0.1.0-alpha.18`:
 
 ```bash
-curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.15/smm-setup.sh
-curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.15/smm-setup.sh.sha256
+curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.18/smm-setup.sh
+curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.18/smm-setup.sh.sha256
 sha256sum -c smm-setup.sh.sha256
 chmod 700 smm-setup.sh
 ```

docs/release-policy.md

@@ -16,6 +16,9 @@ Known release history:
 - `v0.1.0-alpha.12` was published with a keyless manifest signature but without the Fulcio signing certificate, so consumers cannot verify that signature. Its Windows `SHA256SUMS` asset also used CRLF and was not consumable by GNU `sha256sum -c`. The immutable release remains published as historical evidence; neither defect is repaired in place.
 - `v0.1.0-alpha.13` corrected the checksum portability defect, but it was also published with a keyless manifest signature and without the Fulcio signing certificate required by production consumers. The immutable release remains published as historical evidence; the producer/consumer certificate contract is corrected under a higher version.
 - `v0.1.0-alpha.14` is the first release with the complete manifest, keyless signature, and Fulcio certificate set, so its published assets can be verified. A clean host cannot install it because the release does not provision cosign. Preserve it for verification and historical evidence; do not use it for installation.
-- `v0.1.0-alpha.15` is the first release that provisions a pinned, checksum-verified cosign binary and can therefore be installed on a clean supported host without manual cosign setup.
+- `v0.1.0-alpha.15` is the first release that provisions a pinned, checksum-verified cosign binary. Its automatically triggered Release Verification proved the clean-host Hub installation and manifest verification, then stopped before the clean-host Node installation because the acceptance script retained the deliberately removed cosign path in Bash's command hash. The immutable release and failed verification remain as evidence; the acceptance harness is corrected in the next version.
+- `v0.1.0-alpha.16` clears the acceptance shell's command hash after removing its test-provisioned cosign. Its automatic verification proved clean-host Hub installation, but the convenience installer wrote the bootstrap checksum success line to stdout before the machine-readable `SMMNODE2` enrollment code. Node installation therefore rejected the contaminated value. The immutable release and failed verification remain as evidence; stdout isolation is corrected in the next version.
+- `v0.1.0-alpha.17` keeps checksum verification fail-closed while suppressing its success line, so pass-through commands such as `node-code` return only their machine-readable bootstrap output. Its automatic verification completed the clean-host Hub and Node installation, then the negative-test harness stopped while creating a wrong-identity signature because cosign v3 requires an explicit bundle or legacy detached-output mode. The immutable release and failed harness run remain as evidence; the negative test is corrected in the next version.
+- `v0.1.0-alpha.18` makes the wrong-identity negative test select cosign v3's explicit detached-output mode, matching the production consumer's detached signature and certificate contract. It is the first release required to complete both automatic `workflow_run` verification and manual `workflow_dispatch` re-verification.
 
 Every release candidate must pass a branch `workflow_dispatch` run of the Release pipeline before its immutable version tag is created. The release owner has sole write ownership of version sources, `deploy/**`, `tests/bootstrap/**`, release workflows, the root README release status, and translated README release statuses. Other contributors request changes to those paths in their report; they do not edit or bump them directly. One pull request covers one release topic and may merge only after required CI is green.

tests/bootstrap/test-cosign-provisioning.sh

@@ -106,4 +106,18 @@ chmod 0755 "$install_path"
 run_ensure_cosign x86_64 "$(printf '0%.0s' {1..64})" "$(printf '0%.0s' {1..64})" "$install_path"
 [[ ! -s "$work/urls" ]]
 
+# Bash caches successful command lookups. The release acceptance test removes
+# its own provisioned cosign to exercise install-node from a clean state, so it
+# must clear that cache before checking PATH again.
+(
+    PATH="$work/installed:$work/bin:/usr/bin:/bin"
+    cosign version >/dev/null
+    rm -f -- "$install_path"
+    hash -r
+    if command -v cosign >/dev/null 2>&1; then
+        printf '%s\n' 'cosign remained discoverable after hash reset' >&2
+        exit 1
+    fi
+)
+
 printf '%s\n' 'COSIGN_PROVISIONING=PASS'

tests/bootstrap/test-release-contract.sh

@@ -18,7 +18,7 @@ v1_fixture="$root/tests/fixtures/alpha8-v1-release"
     exit 1
 }
 bash -n "$setup"
-grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.15"' "$setup"
+grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.18"' "$setup"
 grep -Fq 'install-hub PUBLIC_HOST [HTTPS_PORT] [WG_PORT]' "$setup"
 grep -Fxq '  install-node' "$setup"
 if grep -Fq 'validate_control_url' "$setup" || grep -Fq '${CONTROL_URL%/}/control' "$setup"; then
@@ -60,6 +60,12 @@ grep -Fq 'server-monitor-manager-manifest.pem' "$workflow"
 grep -Fq 'v0.1.0-alpha.13' "$policy"
 grep -Fq 'v0.1.0-alpha.14' "$policy"
 grep -Fq 'v0.1.0-alpha.15' "$policy"
+grep -Fq 'v0.1.0-alpha.16' "$policy"
+grep -Fq 'v0.1.0-alpha.17' "$policy"
+grep -Fq 'v0.1.0-alpha.18' "$policy"
+grep -Fq 'hash -r' "$root/tests/release-verification/run-positive-installation.sh"
+grep -Fq -- '--use-signing-config=false --new-bundle-format=false' \
+    "$root/tests/release-verification/run-negative-tests.sh"
 grep -Fq 'readonly COSIGN_VERSION="v3.1.3"' "$bootstrap"
 grep -Fq 'readonly COSIGN_SHA256_AMD64="4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71"' "$bootstrap"
 grep -Fq 'readonly COSIGN_SHA256_ARM64="c5d324e091826b0d7a78eb16fef316450b4eb9aaec045611c08ba06f5e73220a"' "$bootstrap"
@@ -107,6 +113,10 @@ mkdir -p "$work/bin" "$work/home"
 cat >"$work/inner.sh" <<'INNER'
 #!/usr/bin/env bash
 set -Eeuo pipefail
+if [[ "${1:-}" == "node-code" ]]; then
+    printf '%s\n' 'SMMNODE1.fixture'
+    exit 0
+fi
 printf 'INNER_ARGS='
 printf '%s ' "$@"
 printf '\n'
@@ -183,8 +193,14 @@ chmod +x "$work/bin/uname"
 
 HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" version >"$work/output"
 grep -Fq 'INNER_ARGS=version ' "$work/output"
-grep -Fq '/releases/download/v0.1.0-alpha.15/ochenstarik-server-monitor-manager.sh' "$work/urls"
-grep -Fq '/releases/download/v0.1.0-alpha.15/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls"
+grep -Fq '/releases/download/v0.1.0-alpha.18/ochenstarik-server-monitor-manager.sh' "$work/urls"
+grep -Fq '/releases/download/v0.1.0-alpha.18/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls"
+
+node_code="$(HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" node-code fixture-node)"
+[[ "$node_code" == 'SMMNODE1.fixture' ]] || {
+    printf 'machine-readable node-code output was contaminated: %q\n' "$node_code" >&2
+    exit 1
+}
 
 if HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" install-hub >"$work/invalid.out" 2>&1; then
     printf '%s\n' 'install-hub accepted a missing PUBLIC_HOST' >&2

tests/release-verification/run-negative-tests.sh

@@ -72,6 +72,7 @@ echo "Test 4: Signature made by another identity"
 export COSIGN_PASSWORD=""
 cosign generate-key-pair >/dev/null
 cosign sign-blob --yes --key cosign.key \
+    --use-signing-config=false --new-bundle-format=false \
     --output-signature fake.sig server-monitor-manager-manifest.json >/dev/null
 if ./ochenstarik-server-monitor-manager.sh verify-manifest server-monitor-manager-manifest.json \
     fake.sig server-monitor-manager-manifest.pem >/dev/null 2>&1; then

tests/release-verification/run-positive-installation.sh

@@ -87,6 +87,7 @@ NODE_CODE="$(sudo bash smm-setup.sh --tag "$TAG" node-code test-node)"
 # Remove only that test-provisioned copy so install-node is also exercised from
 # a host without cosign.
 sudo rm -f -- /usr/local/bin/cosign
+hash -r
 if command -v cosign >/dev/null 2>&1; then
     echo "FAIL: cosign is still present before the clean-host install-node test" >&2
     exit 1