From ecad5048cc47c8f64db7296f3357c0ce69928fb5 Mon Sep 17 00:00:00 2001 From: ochenstarik-ui Date: Thu, 13 Aug 2026 13:22:48 +0700 Subject: [PATCH] fix(release): replace alpha8 network compatibility test (#38) Use a deterministic v1 release fixture, prepare alpha.12 version sources, and document release ownership and burned tags. Co-authored-by: Ochenstarik --- README.md | 2 +- deploy/ochenstarik-server-monitor-manager.sh | 2 +- deploy/smm-setup.sh | 4 +- docs/i18n/README.ar.md | 2 +- docs/i18n/README.de.md | 2 +- docs/i18n/README.es.md | 2 +- docs/i18n/README.fr.md | 2 +- docs/i18n/README.hi.md | 2 +- docs/i18n/README.ja.md | 2 +- docs/i18n/README.ko.md | 2 +- docs/i18n/README.pt-BR.md | 2 +- docs/i18n/README.ru.md | 2 +- docs/i18n/README.tr.md | 2 +- docs/i18n/README.zh-CN.md | 2 +- docs/release-policy.md | 7 +++ tests/bootstrap/test-manifest-verification.sh | 58 ++++++++++++++----- tests/bootstrap/test-release-contract.sh | 32 +++++++++- tests/fixtures/README.md | 2 + tests/fixtures/alpha8-v1-release/README.md | 3 + .../archive-root/agent/ochenstarik-smm-agent | 2 + .../ochenstarik-server-monitor-manager.sh | 2 + .../control/ochenstarik-smm-control | 2 + .../deploy/ochenstarik-smm-agent.service | 2 + .../deploy/ochenstarik-smm-control.service | 2 + .../deploy/ochenstarik-smm-emergency | 2 + .../deploy/ochenstarik-smm-firewall.service | 2 + .../ochenstarik-smm-mesh-firewall.service | 2 + .../deploy/ochenstarik-smm-policy-apply | 2 + ...chenstarik-smm-provisioning-helper.service | 2 + .../ochenstarik-smm-provisioning-helper | 2 + ...er-monitor-manager-bootstrap-manifest.json | 10 ++++ 31 files changed, 130 insertions(+), 34 deletions(-) create mode 100644 tests/fixtures/alpha8-v1-release/README.md create mode 100644 tests/fixtures/alpha8-v1-release/archive-root/agent/ochenstarik-smm-agent create mode 100644 tests/fixtures/alpha8-v1-release/archive-root/bootstrap/ochenstarik-server-monitor-manager.sh create mode 100644 tests/fixtures/alpha8-v1-release/archive-root/control/ochenstarik-smm-control create mode 100644 tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-agent.service create mode 100644 tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-control.service create mode 100644 tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-emergency create mode 100644 tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-firewall.service create mode 100644 tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-mesh-firewall.service create mode 100644 tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-policy-apply create mode 100644 tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-provisioning-helper.service create mode 100644 tests/fixtures/alpha8-v1-release/archive-root/provisioning-helper/ochenstarik-smm-provisioning-helper create mode 100644 tests/fixtures/alpha8-v1-release/server-monitor-manager-bootstrap-manifest.json diff --git a/README.md b/README.md index 3bea0c3..33e7183 100644 --- a/README.md +++ b/README.md @@ -98,7 +98,7 @@ In the application, generate or copy the monitoring SSH key, add the Hub profile ## Current status -`v0.1.0-alpha.11` is an early testing release, not a production security appliance. Windows and Linux builds, control-plane tests, a test-signed x64 MSIX, self-contained `linux-x64`/`linux-arm64` artifacts, and SHA-256 checksums are automated in GitHub Actions. +`v0.1.0-alpha.12` is an early testing release, not a production security appliance. Windows and Linux builds, control-plane tests, a test-signed x64 MSIX, self-contained `linux-x64`/`linux-arm64` artifacts, and SHA-256 checksums are automated in GitHub Actions. The current development branch implements dedicated Windows pages for Servers, Links, Sessions, and Settings; SSH monitoring; directional Links; one-time enrollment; separate mTLS Agent, Operator, and source-scoped Automation identities; certificate revocation/re-enrollment; SQLite control state; audit; authenticated event streaming; Windows Control API integration; and a bounded durable Agent buffer with downsampling. diff --git a/deploy/ochenstarik-server-monitor-manager.sh b/deploy/ochenstarik-server-monitor-manager.sh index 10f46ca..5485426 100755 --- a/deploy/ochenstarik-server-monitor-manager.sh +++ b/deploy/ochenstarik-server-monitor-manager.sh @@ -301,7 +301,7 @@ verify_manifest() { log "Verifying manifest signature..." local verify_args=(--certificate-oidc-issuer "$COSIGN_ISSUER" --certificate-identity-regexp "$COSIGN_IDENTITY_REGEXP") if [[ -n "${SMM_TEST_PUBKEY:-}" ]]; then - verify_args=(--key "$SMM_TEST_PUBKEY") + verify_args=(--key "$SMM_TEST_PUBKEY" --insecure-ignore-tlog) log "WARNING: Using test public key for verification. This must NOT happen in production." fi if ! cosign verify-blob "${verify_args[@]}" \ diff --git a/deploy/smm-setup.sh b/deploy/smm-setup.sh index 35e467d..d4ec066 100644 --- a/deploy/smm-setup.sh +++ b/deploy/smm-setup.sh @@ -3,7 +3,7 @@ set -Eeuo pipefail IFS=$'\n\t' readonly PROGRAM_NAME="smm-setup" -readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.11" +readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.12" readonly DEFAULT_REPOSITORY="ochenstarik-ui/server-monitor-manager" readonly INNER_ASSET="ochenstarik-server-monitor-manager.sh" @@ -22,7 +22,7 @@ asset from the selected immutable GitHub release. Common commands: backup-create | backup-restore | version Environment overrides: - SMM_TAG Release tag (default: v0.1.0-alpha.11) + SMM_TAG Release tag (default: v0.1.0-alpha.12) SMM_REPOSITORY GitHub repository (default: ochenstarik-ui/server-monitor-manager) SMM_CACHE_DIR Verified-download cache directory USAGE diff --git a/docs/i18n/README.ar.md b/docs/i18n/README.ar.md index 7c39617..a328538 100644 --- a/docs/i18n/README.ar.md +++ b/docs/i18n/README.ar.md @@ -32,7 +32,7 @@ sudo ./ochenstarik-server-monitor-manager.sh hub لا توجد كلمة مرور root مشتركة ولا يغادر مفتاح WireGuard الخاص عقدته. هويات monitoring وterminal وAgent وOperator وأتمتة AI منفصلة. يستخدم SSH أمراً إجبارياً بلا shell أو PTY أو forwarding؛ يقيّد mTLS الصلاحيات؛ تسمح nftables بالروابط الصريحة فقط؛ ويحفظ SQLite الحالة المطلوبة والتدقيق قبل تعديل الجدار الناري. -الإصدار `v0.1.0-alpha.11` للاختبار. يتضمن فرع التطوير الحالي عميل Windows ومثبت Hub/Node وLinks وmTLS وإلغاء الشهادات وإعادة التسجيل وSQLite والتدقيق والأحداث ومخزناً محدوداً دون اتصال مع downsampling. المتبقي: مصالحة إعادة الاتصال، اختبار 50–100 Node ومثبت Windows موقّع. +الإصدار `v0.1.0-alpha.12` للاختبار. يتضمن فرع التطوير الحالي عميل Windows ومثبت Hub/Node وLinks وmTLS وإلغاء الشهادات وإعادة التسجيل وSQLite والتدقيق والأحداث ومخزناً محدوداً دون اتصال مع downsampling. المتبقي: مصالحة إعادة الاتصال، اختبار 50–100 Node ومثبت Windows موقّع. ## الترخيص diff --git a/docs/i18n/README.de.md b/docs/i18n/README.de.md index a14b5a4..daa3f30 100644 --- a/docs/i18n/README.de.md +++ b/docs/i18n/README.de.md @@ -32,7 +32,7 @@ sudo ./ochenstarik-server-monitor-manager.sh hub Es gibt kein gemeinsames Root-Passwort; der private WireGuard-Schlüssel bleibt auf dem Node. Monitoring-, Terminal-, Agent-, Operator- und KI-Automationsidentitäten sind getrennt. SSH nutzt einen forced-command ohne Shell/PTY/Forwarding; mTLS begrenzt Rollen; nftables erlaubt nur explizite Links; SQLite speichert Sollzustand und Audit vor der Firewalländerung. -`v0.1.0-alpha.11` ist eine Testversion. Der aktuelle Entwicklungszweig enthält Windows-Client, Hub/Node-Installer, Links, mTLS, Zertifikatswiderruf und erneute Registrierung, SQLite, Audit, Events, einen begrenzten Offline-Puffer mit Downsampling und dauerhaften Reconnect-Abgleich. Offen sind der Lasttest mit 50–100 Nodes und ein signierter Windows-Installer. +`v0.1.0-alpha.12` ist eine Testversion. Der aktuelle Entwicklungszweig enthält Windows-Client, Hub/Node-Installer, Links, mTLS, Zertifikatswiderruf und erneute Registrierung, SQLite, Audit, Events, einen begrenzten Offline-Puffer mit Downsampling und dauerhaften Reconnect-Abgleich. Offen sind der Lasttest mit 50–100 Nodes und ein signierter Windows-Installer. ## Lizenz diff --git a/docs/i18n/README.es.md b/docs/i18n/README.es.md index 3dbb72d..8d88e56 100644 --- a/docs/i18n/README.es.md +++ b/docs/i18n/README.es.md @@ -34,7 +34,7 @@ Abra UDP `51820` y TCP `7443` en el Hub, cree códigos para los Nodes e instále No hay contraseña root compartida ni claves WireGuard privadas de Nodes en el Hub. Las identidades de monitorización, terminal, Agent, Operator y automatización IA están separadas. SSH usa un forced-command sin shell, PTY ni forwarding; mTLS limita cada rol; nftables permite únicamente Links explícitos; SQLite conserva estado y auditoría antes de aplicar cambios. -`v0.1.0-alpha.11` es una versión de prueba. La rama actual incluye cliente Windows, instalador Hub/Node, Links, mTLS, revocación y reinscripción de certificados, SQLite, auditoría, eventos y un búfer offline limitado con downsampling. Faltan la reconciliación tras reconexión, prueba de 50–100 Nodes e instalador Windows firmado. +`v0.1.0-alpha.12` es una versión de prueba. La rama actual incluye cliente Windows, instalador Hub/Node, Links, mTLS, revocación y reinscripción de certificados, SQLite, auditoría, eventos y un búfer offline limitado con downsampling. Faltan la reconciliación tras reconexión, prueba de 50–100 Nodes e instalador Windows firmado. ## Licencia diff --git a/docs/i18n/README.fr.md b/docs/i18n/README.fr.md index 6c3efcf..0be852e 100644 --- a/docs/i18n/README.fr.md +++ b/docs/i18n/README.fr.md @@ -32,7 +32,7 @@ Ouvrez UDP `51820` et TCP `7443` sur le Hub, créez les codes et installez les a Aucun mot de passe root n'est partagé et la clé WireGuard privée reste sur le Node. Les identités monitoring, terminal, Agent, Operator et automatisation IA sont séparées. SSH emploie une forced-command sans shell/PTY/forwarding ; mTLS limite les rôles ; nftables n'autorise que les Links explicites ; SQLite enregistre état et audit avant le changement de pare-feu. -`v0.1.0-alpha.11` est destiné aux tests. La branche actuelle contient le client Windows, l'installateur Hub/Node, les Links, mTLS, la révocation et le ré-enrôlement des certificats, SQLite, l'audit, les événements et un tampon hors ligne limité avec downsampling. Restent la réconciliation, le test de 50–100 Nodes et l'installateur Windows signé. +`v0.1.0-alpha.12` est destiné aux tests. La branche actuelle contient le client Windows, l'installateur Hub/Node, les Links, mTLS, la révocation et le ré-enrôlement des certificats, SQLite, l'audit, les événements et un tampon hors ligne limité avec downsampling. Restent la réconciliation, le test de 50–100 Nodes et l'installateur Windows signé. ## Licence diff --git a/docs/i18n/README.hi.md b/docs/i18n/README.hi.md index dec8dde..b18170d 100644 --- a/docs/i18n/README.hi.md +++ b/docs/i18n/README.hi.md @@ -32,7 +32,7 @@ Hub पर UDP `51820` और TCP `7443` खोलें, Node codes बना Shared root password नहीं है और Node की WireGuard private key Node से बाहर नहीं जाती। Monitoring, terminal, Agent, Operator और AI automation identities अलग हैं। SSH forced-command shell/PTY/forwarding नहीं देता; mTLS roles सीमित करता है; nftables केवल explicit Links स्वीकारता है; SQLite पहले desired state और audit सहेजता है। -`v0.1.0-alpha.11` testing release है। Current development branch में Windows client, Hub/Node installer, Links, mTLS, certificate revocation और re-enrollment, SQLite, audit, event stream, downsampling वाला सीमित offline buffer और durable reconnect reconciliation तैयार हैं। 50–100 Node load test और signed Windows installer अभी बाकी हैं। +`v0.1.0-alpha.12` testing release है। Current development branch में Windows client, Hub/Node installer, Links, mTLS, certificate revocation और re-enrollment, SQLite, audit, event stream, downsampling वाला सीमित offline buffer और durable reconnect reconciliation तैयार हैं। 50–100 Node load test और signed Windows installer अभी बाकी हैं। ## लाइसेंस diff --git a/docs/i18n/README.ja.md b/docs/i18n/README.ja.md index 7d15b24..dd38426 100644 --- a/docs/i18n/README.ja.md +++ b/docs/i18n/README.ja.md @@ -32,7 +32,7 @@ Hub で UDP `51820` と TCP `7443` を開き、Node コードを作成して他 共有 root パスワードはなく、Node の WireGuard 秘密鍵は Node 外に出ません。monitoring、terminal、Agent、Operator、AI automation の ID は分離されています。SSH は shell/PTY/forwarding のない forced-command、mTLS はロール制限、nftables は明示 Link のみを許可し、SQLite は firewall 変更前に状態と監査を保存します。 -`v0.1.0-alpha.11` はテスト版です。現在の開発ブランチには Windows client、Hub/Node installer、Links、mTLS、証明書失効と再登録、SQLite、監査、イベント、downsampling 付きの制限オフラインバッファが実装済みです。再接続調整、50–100 Node 負荷試験、署名付き Windows installer は今後の課題です。 +`v0.1.0-alpha.12` はテスト版です。現在の開発ブランチには Windows client、Hub/Node installer、Links、mTLS、証明書失効と再登録、SQLite、監査、イベント、downsampling 付きの制限オフラインバッファが実装済みです。再接続調整、50–100 Node 負荷試験、署名付き Windows installer は今後の課題です。 ## ライセンス diff --git a/docs/i18n/README.ko.md b/docs/i18n/README.ko.md index d3c78fc..5b050ee 100644 --- a/docs/i18n/README.ko.md +++ b/docs/i18n/README.ko.md @@ -32,7 +32,7 @@ Hub에서 UDP `51820`과 TCP `7443`을 열고 Node 코드를 생성한 뒤 다 공유 root 암호가 없고 Node WireGuard 개인 키는 Node를 떠나지 않습니다. monitoring, terminal, Agent, Operator, AI automation identity는 분리됩니다. SSH는 shell/PTY/forwarding 없는 forced-command를 사용하고, mTLS는 역할을 제한하며, nftables는 명시된 Link만 허용합니다. SQLite는 방화벽 변경 전에 상태와 감사를 저장합니다. -`v0.1.0-alpha.11`는 테스트 릴리스입니다. 현재 개발 branch에는 Windows client, Hub/Node installer, Links, mTLS, 인증서 폐기와 재등록, SQLite, 감사, event stream과 downsampling이 적용된 제한 offline buffer가 구현되었습니다. 재연결 조정, 50–100 Node 부하 시험과 서명된 Windows installer가 남아 있습니다. +`v0.1.0-alpha.12`는 테스트 릴리스입니다. 현재 개발 branch에는 Windows client, Hub/Node installer, Links, mTLS, 인증서 폐기와 재등록, SQLite, 감사, event stream과 downsampling이 적용된 제한 offline buffer가 구현되었습니다. 재연결 조정, 50–100 Node 부하 시험과 서명된 Windows installer가 남아 있습니다. ## 라이선스 diff --git a/docs/i18n/README.pt-BR.md b/docs/i18n/README.pt-BR.md index 903767e..619f9c2 100644 --- a/docs/i18n/README.pt-BR.md +++ b/docs/i18n/README.pt-BR.md @@ -32,7 +32,7 @@ Abra UDP `51820` e TCP `7443` no Hub, gere códigos e instale os demais servidor Não há senha root compartilhada e a chave WireGuard privada nunca sai do Node. As identidades de monitoramento, terminal, Agent, Operator e automação de IA são separadas. SSH usa forced-command sem shell/PTY/forwarding; mTLS restringe funções; nftables permite apenas Links explícitos; SQLite registra estado e auditoria antes da mudança no firewall. -`v0.1.0-alpha.11` é uma versão de teste. A branch atual contém cliente Windows, instalador Hub/Node, Links, mTLS, revogação e novo registro de certificados, SQLite, auditoria, eventos e buffer offline limitado com downsampling. Restam reconciliação, teste com 50–100 Nodes e instalador Windows assinado. +`v0.1.0-alpha.12` é uma versão de teste. A branch atual contém cliente Windows, instalador Hub/Node, Links, mTLS, revogação e novo registro de certificados, SQLite, auditoria, eventos e buffer offline limitado com downsampling. Restam reconciliação, teste com 50–100 Nodes e instalador Windows assinado. ## Licença diff --git a/docs/i18n/README.ru.md b/docs/i18n/README.ru.md index 99fb861..d1c9e2d 100644 --- a/docs/i18n/README.ru.md +++ b/docs/i18n/README.ru.md @@ -38,7 +38,7 @@ sudo ./ochenstarik-server-monitor-manager.sh hub Нет общих root-паролей; приватный WireGuard-ключ Node не покидает Node. Идентичности monitoring, terminal, Agent, Operator и AI-автоматизации разделены. Monitoring SSH использует forced-command без shell/PTY/forwarding. Agent может отправлять heartbeat только своего узла, Operator управляет inventory и Links. Отключение Link сначала сохраняется в SQLite, затем удаляет разрешение nftables; повтор запроса не повторяет побочный эффект. -`v0.1.0-alpha.11` предназначен для тестирования. В текущей ветке разработки уже готовы Windows SSH-monitoring, Hub/Node installer, Links, mTLS, отзыв и повторная регистрация сертификатов, SQLite, аудит, поток событий, ограниченный offline-буфер Agent с downsampling и долговечный reconnect reconciliation. Остались нагрузочный тест 50–100 Node и подписанный Windows installer. До стабильного релиза используйте тестовые или резервируемые серверы. +`v0.1.0-alpha.12` предназначен для тестирования. В текущей ветке разработки уже готовы Windows SSH-monitoring, Hub/Node installer, Links, mTLS, отзыв и повторная регистрация сертификатов, SQLite, аудит, поток событий, ограниченный offline-буфер Agent с downsampling и долговечный reconnect reconciliation. Остались нагрузочный тест 50–100 Node и подписанный Windows installer. До стабильного релиза используйте тестовые или резервируемые серверы. ## Лицензия diff --git a/docs/i18n/README.tr.md b/docs/i18n/README.tr.md index 6f693d6..9c7308a 100644 --- a/docs/i18n/README.tr.md +++ b/docs/i18n/README.tr.md @@ -32,7 +32,7 @@ Hub üzerinde UDP `51820` ve TCP `7443` açın, Node kodlarını üretin ve diğ Ortak root parolası yoktur ve Node'un WireGuard özel anahtarı Node'dan çıkmaz. Monitoring, terminal, Agent, Operator ve AI automation kimlikleri ayrıdır. SSH shell/PTY/forwarding vermeyen forced-command kullanır; mTLS rolleri sınırlar; nftables yalnızca açık Links'e izin verir; SQLite güvenlik duvarı değişmeden önce durum ve audit kaydeder. -`v0.1.0-alpha.11` test sürümüdür. Güncel geliştirme dalında Windows client, Hub/Node installer, Links, mTLS, sertifika iptali ve yeniden kayıt, SQLite, audit, event stream ve downsampling kullanan sınırlı offline buffer hazırdır. Yeniden bağlantı uzlaştırması, 50–100 Node yük testi ve imzalı Windows installer sıradadır. +`v0.1.0-alpha.12` test sürümüdür. Güncel geliştirme dalında Windows client, Hub/Node installer, Links, mTLS, sertifika iptali ve yeniden kayıt, SQLite, audit, event stream ve downsampling kullanan sınırlı offline buffer hazırdır. Yeniden bağlantı uzlaştırması, 50–100 Node yük testi ve imzalı Windows installer sıradadır. ## Lisans diff --git a/docs/i18n/README.zh-CN.md b/docs/i18n/README.zh-CN.md index 4b00f93..e293606 100644 --- a/docs/i18n/README.zh-CN.md +++ b/docs/i18n/README.zh-CN.md @@ -34,7 +34,7 @@ sudo ./ochenstarik-server-monitor-manager.sh hub 系统不共享 root 密码，Node 的 WireGuard 私钥不会离开本机。监控、终端、Agent、Operator 和 AI 自动化身份相互隔离。SSH 使用无 shell、PTY、转发权限的 forced-command；mTLS 限制角色；nftables 仅允许明确 Link；SQLite 在执行防火墙变更前保存目标状态和审计。 -`v0.1.0-alpha.11` 是测试版。当前开发分支已包含 Windows 客户端、Hub/Node 安装器、Links、mTLS、证书撤销与重新注册、SQLite、审计、事件流以及带降采样的有限离线缓冲。待完成：重连协调、50–100 Node 压测和签名 Windows 安装器。 +`v0.1.0-alpha.12` 是测试版。当前开发分支已包含 Windows 客户端、Hub/Node 安装器、Links、mTLS、证书撤销与重新注册、SQLite、审计、事件流以及带降采样的有限离线缓冲。待完成：重连协调、50–100 Node 压测和签名 Windows 安装器。 ## 许可证 diff --git a/docs/release-policy.md b/docs/release-policy.md index 08d40c2..d7d9196 100644 --- a/docs/release-policy.md +++ b/docs/release-policy.md @@ -7,3 +7,10 @@ A tag that has been published must never be moved, reused, deleted and recreated `.github/workflows/linux-release.yml` is the sole GitHub Release publisher. On a version tag, it builds the Linux and Windows packages from the tagged commit, generates the signed manifest, and publishes the complete release asset set. `.github/workflows/windows-release.yml` is manual-only and may package and verify a Windows installer as a workflow artifact, but it never publishes or replaces GitHub Release assets. The tracked production source for the convenience installer is `deploy/smm-setup.sh`; the Linux release workflow copies that exact file to the release artifact set, records its SHA-256 in the signed manifest, and publishes its standalone checksum. The default release in that source must match the tag being produced. For `v0.1.0-alpha.9`, this makes `smm-setup.sh`, `smm-setup.sh.sha256`, the bootstrap script, platform archives, SBOMs, and the signed manifest reproducible from the tagged tree. The installer fetches only same-tag assets and verifies the bootstrap checksum before execution. Corrections after publication require another tag; the `v0.1.0-alpha.9` tag and assets remain unchanged. + +Known release history: + +- `v0.1.0-alpha.8` contains the v1 `server-monitor-manager-bootstrap-manifest.json` layout and an orphaned `server-monitor-manager-manifest.sig` without the corresponding manifest v2. Published assets remain immutable; the anomaly is documented rather than repaired in place. +- Tags `v0.1.0-alpha.10` and `v0.1.0-alpha.11` exist, but their Release pipelines failed before a GitHub Release was published. Those version numbers are burned and must not be moved, deleted, recreated, or reused. + +Every release candidate must pass a branch `workflow_dispatch` run of the Release pipeline before its immutable version tag is created. The release owner has sole write ownership of version sources, `deploy/**`, `tests/bootstrap/**`, release workflows, the root README release status, and translated README release statuses. Other contributors request changes to those paths in their report; they do not edit or bump them directly. One pull request covers one release topic and may merge only after required CI is green. diff --git a/tests/bootstrap/test-manifest-verification.sh b/tests/bootstrap/test-manifest-verification.sh index 535f0c7..30e8d86 100644 --- a/tests/bootstrap/test-manifest-verification.sh +++ b/tests/bootstrap/test-manifest-verification.sh @@ -2,8 +2,10 @@ set -Eeuo pipefail CLEANUP_FILES=() +CLEANUP_DIRS=() cleanup() { rm -f "${CLEANUP_FILES[@]}" + rm -rf -- "${CLEANUP_DIRS[@]}" } trap cleanup EXIT @@ -34,7 +36,7 @@ cat < server-monitor-manager-manifest.json } EOF -cosign sign-blob --yes --key cosign.key --output-signature server-monitor-manager-manifest.sig server-monitor-manager-manifest.json +cosign sign-blob --yes --tlog-upload=false --key cosign.key --output-signature server-monitor-manager-manifest.sig server-monitor-manager-manifest.json CLEANUP_FILES+=(server-monitor-manager-manifest.json server-monitor-manager-manifest.sig) echo "Test 1: Valid signature and hash" @@ -78,21 +80,45 @@ if bash deploy/ochenstarik-server-monitor-manager.sh verify-manifest server-moni fi echo "PASS: Missing signature rejected" -echo "Test 5: Real alpha.8 manifest fallback matching (REQUIRES_NETWORK)" -ALPHA8_ARCHIVE="ochenstarik-server-monitor-manager-linux-x64.tar.gz" -if ! wget -qO "$ALPHA8_ARCHIVE" https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.8/server-monitor-manager-linux-x64.tar.gz; then - echo "SKIP: Could not download alpha.8 archive (network unavailable)" -else - wget -qO server-monitor-manager-manifest.json https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.8/server-monitor-manager-manifest.json - wget -qO server-monitor-manager-manifest.sig https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.8/server-monitor-manager-manifest.sig - CLEANUP_FILES+=("$ALPHA8_ARCHIVE") - # Use keyless verification against real Sigstore/Rekor (requires network) - unset SMM_TEST_PUBKEY - if ! bash deploy/ochenstarik-server-monitor-manager.sh verify-release "$ALPHA8_ARCHIVE" >/dev/null 2>&1; then - echo "FAIL: Alpha.8 real release verification failed" - exit 1 - fi - echo "PASS: Alpha.8 real release verification succeeded" +echo "Test 5: Synthetic pre-alpha.9 v1 release layout" +fixture_root="tests/fixtures/alpha8-v1-release" +fixture_work="$(mktemp -d -t smm-alpha8-v1.XXXXXXXX)" +CLEANUP_DIRS+=("$fixture_work") +cp "$fixture_root/server-monitor-manager-bootstrap-manifest.json" "$fixture_work/" +cp -R "$fixture_root/archive-root" "$fixture_work/archive-root" +expected_bootstrap_hash="$(sed -n 's/.*"bootstrap_sha256": "\([0-9a-f]\{64\}\)".*/\1/p' "$fixture_work/server-monitor-manager-bootstrap-manifest.json")" +actual_bootstrap_hash="$(sha256sum "$fixture_work/archive-root/bootstrap/ochenstarik-server-monitor-manager.sh" | awk '{print $1}')" +[[ "$expected_bootstrap_hash" == "$actual_bootstrap_hash" ]] || { + echo "FAIL: Synthetic v1 manifest bootstrap hash does not match fixture payload" + exit 1 +} +find "$fixture_work/archive-root" -type f -name 'ochenstarik-*' -exec chmod 0755 {} + +ALPHA8_ARCHIVE="$fixture_work/server-monitor-manager-linux-x64.tar.gz" +tar -C "$fixture_work/archive-root" -czf "$ALPHA8_ARCHIVE" \ + agent control provisioning-helper deploy bootstrap +sha256sum "$ALPHA8_ARCHIVE" >"$ALPHA8_ARCHIVE.sha256" + +unset SMM_TEST_PUBKEY +if SMM_ALLOW_UNSIGNED=0 bash deploy/ochenstarik-server-monitor-manager.sh verify-release "$ALPHA8_ARCHIVE" >"$fixture_work/strict.out" 2>&1; then + echo "FAIL: Unsigned v1 fixture accepted without explicit bypass" + exit 1 fi +if ! grep -Fq 'Manifest and signature are required' "$fixture_work/strict.out"; then + echo "FAIL: Strict v1 rejection lacked expected diagnostic" + cat "$fixture_work/strict.out" >&2 + exit 1 +fi +echo "PASS: Unsigned v1 fixture rejected without bypass" + +if ! SMM_ALLOW_UNSIGNED=1 bash deploy/ochenstarik-server-monitor-manager.sh verify-release "$ALPHA8_ARCHIVE" >"$fixture_work/bypass.out" 2>&1; then + echo "FAIL: Valid v1 fixture rejected with SMM_ALLOW_UNSIGNED=1" + cat "$fixture_work/bypass.out" >&2 + exit 1 +fi +grep -Fq 'falling back to .sha256 file due to SMM_ALLOW_UNSIGNED=1' "$fixture_work/bypass.out" || { + echo "FAIL: v1 fixture did not exercise checksum fallback" + exit 1 +} +echo "PASS: Valid v1 fixture accepted only with explicit bypass" echo "All tests passed." diff --git a/tests/bootstrap/test-release-contract.sh b/tests/bootstrap/test-release-contract.sh index e5f230b..410a655 100644 --- a/tests/bootstrap/test-release-contract.sh +++ b/tests/bootstrap/test-release-contract.sh @@ -8,13 +8,15 @@ workflow="$root/.github/workflows/linux-release.yml" windows_workflow="$root/.github/workflows/windows-release.yml" policy="$root/docs/release-policy.md" installer_contract="$root/docs/installer-contract.md" +manifest_test="$root/tests/bootstrap/test-manifest-verification.sh" +v1_fixture="$root/tests/fixtures/alpha8-v1-release" [[ -s "$setup" ]] || { printf '%s\n' 'tracked production smm-setup.sh source is missing' >&2 exit 1 } bash -n "$setup" -grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.11"' "$setup" +grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.12"' "$setup" if grep -Fq 'validate_control_url' "$setup" || grep -Fq '${CONTROL_URL%/}/control' "$setup"; then printf '%s\n' 'temporary control URL workaround must not be present in smm-setup.sh' >&2 exit 1 @@ -41,9 +43,33 @@ if grep -Eq 'contents:[[:space:]]*write' "$windows_workflow"; then fi grep -Fq 'Published tags and release assets are immutable.' "$policy" grep -Fq 'publish a new, higher version tag' "$policy" +grep -Fq 'v0.1.0-alpha.8' "$policy" +grep -Fq 'v0.1.0-alpha.10' "$policy" +grep -Fq 'v0.1.0-alpha.11' "$policy" +grep -Fq 'release owner' "$policy" +grep -Fq 'tests/bootstrap/**' "$policy" grep -Fq 'Published release tags and their assets are immutable.' "$installer_contract" grep -Fq 'publish a new, higher version tag' "$installer_contract" +if grep -Eq 'wget|curl|gh release download|https?://' "$manifest_test"; then + printf '%s\n' 'bootstrap manifest verification test must not depend on network or published releases' >&2 + exit 1 +fi +grep -Fq 'server-monitor-manager-bootstrap-manifest.json' "$manifest_test" +grep -Fq 'SMM_ALLOW_UNSIGNED=1' "$manifest_test" +grep -Fq 'SMM_ALLOW_UNSIGNED=0' "$manifest_test" +grep -Fq -- '--tlog-upload=false' "$manifest_test" +grep -Fq -- '--insecure-ignore-tlog' "$root/deploy/ochenstarik-server-monitor-manager.sh" +[[ -s "$v1_fixture/server-monitor-manager-bootstrap-manifest.json" ]] +[[ -d "$v1_fixture/archive-root" ]] +grep -Fq '"schema": "smm-bootstrap-manifest/v1"' "$v1_fixture/server-monitor-manager-bootstrap-manifest.json" +grep -Fq '"bootstrap": "ochenstarik-server-monitor-manager.sh"' "$v1_fixture/server-monitor-manager-bootstrap-manifest.json" +grep -Fq '"bootstrap_sha256":' "$v1_fixture/server-monitor-manager-bootstrap-manifest.json" +if grep -Eq 'schemaVersion|artifacts|signature' "$v1_fixture/server-monitor-manager-bootstrap-manifest.json"; then + printf '%s\n' 'synthetic v1 fixture contains fields that were not in the published alpha.8 schema' >&2 + exit 1 +fi + work="$(mktemp -d -t smm-setup-contract.XXXXXXXX)" trap 'rm -rf -- "$work"' EXIT mkdir -p "$work/bin" "$work/home" @@ -83,7 +109,7 @@ chmod +x "$work/bin/curl" HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" version >"$work/output" grep -Fq 'INNER_COMMAND=version' "$work/output" -grep -Fq '/releases/download/v0.1.0-alpha.11/ochenstarik-server-monitor-manager.sh' "$work/urls" -grep -Fq '/releases/download/v0.1.0-alpha.11/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls" +grep -Fq '/releases/download/v0.1.0-alpha.12/ochenstarik-server-monitor-manager.sh' "$work/urls" +grep -Fq '/releases/download/v0.1.0-alpha.12/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls" printf '%s\n' 'RELEASE_CONTRACT=PASS' diff --git a/tests/fixtures/README.md b/tests/fixtures/README.md index 3896106..a39ae87 100644 --- a/tests/fixtures/README.md +++ b/tests/fixtures/README.md @@ -9,3 +9,5 @@ Fixture properties: - SHA-256: `15bf788dd5789a55bd54a4a548d339b4e29e54e1c75311b21eec079e0ef2faa2` The compatibility test always copies this file before opening it, so the committed previous-release database is never migrated or mutated in place. + +`alpha8-v1-release/` is a deterministic synthetic fixture for the release layout used before manifest v2. Its archive payload is assembled locally by the bootstrap test; no published release is downloaded or modified. diff --git a/tests/fixtures/alpha8-v1-release/README.md b/tests/fixtures/alpha8-v1-release/README.md new file mode 100644 index 0000000..e9e6a6b --- /dev/null +++ b/tests/fixtures/alpha8-v1-release/README.md @@ -0,0 +1,3 @@ +# Synthetic pre-alpha.9 release fixture + +This deterministic fixture models the published alpha.8 v1 schema and release layout: `server-monitor-manager-bootstrap-manifest.json`, a locally generated archive, and its sibling `.sha256`, with no manifest v2 and no usable signature. The test generates the archive payload locally and never downloads a published release. The v1 manifest's `bootstrap_sha256` is pinned to the synthetic bootstrap payload and checked before the archive scenarios run. diff --git a/tests/fixtures/alpha8-v1-release/archive-root/agent/ochenstarik-smm-agent b/tests/fixtures/alpha8-v1-release/archive-root/agent/ochenstarik-smm-agent new file mode 100644 index 0000000..ec5b9e5 --- /dev/null +++ b/tests/fixtures/alpha8-v1-release/archive-root/agent/ochenstarik-smm-agent @@ -0,0 +1,2 @@ +#!/usr/bin/env sh +exit 0 diff --git a/tests/fixtures/alpha8-v1-release/archive-root/bootstrap/ochenstarik-server-monitor-manager.sh b/tests/fixtures/alpha8-v1-release/archive-root/bootstrap/ochenstarik-server-monitor-manager.sh new file mode 100644 index 0000000..ec5b9e5 --- /dev/null +++ b/tests/fixtures/alpha8-v1-release/archive-root/bootstrap/ochenstarik-server-monitor-manager.sh @@ -0,0 +1,2 @@ +#!/usr/bin/env sh +exit 0 diff --git a/tests/fixtures/alpha8-v1-release/archive-root/control/ochenstarik-smm-control b/tests/fixtures/alpha8-v1-release/archive-root/control/ochenstarik-smm-control new file mode 100644 index 0000000..ec5b9e5 --- /dev/null +++ b/tests/fixtures/alpha8-v1-release/archive-root/control/ochenstarik-smm-control @@ -0,0 +1,2 @@ +#!/usr/bin/env sh +exit 0 diff --git a/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-agent.service b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-agent.service new file mode 100644 index 0000000..3a06fe1 --- /dev/null +++ b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-agent.service @@ -0,0 +1,2 @@ +[Unit] +Description=Synthetic Agent fixture diff --git a/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-control.service b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-control.service new file mode 100644 index 0000000..1881095 --- /dev/null +++ b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-control.service @@ -0,0 +1,2 @@ +[Unit] +Description=Synthetic Control fixture diff --git a/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-emergency b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-emergency new file mode 100644 index 0000000..ec5b9e5 --- /dev/null +++ b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-emergency @@ -0,0 +1,2 @@ +#!/usr/bin/env sh +exit 0 diff --git a/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-firewall.service b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-firewall.service new file mode 100644 index 0000000..7824901 --- /dev/null +++ b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-firewall.service @@ -0,0 +1,2 @@ +[Unit] +Description=Synthetic firewall fixture diff --git a/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-mesh-firewall.service b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-mesh-firewall.service new file mode 100644 index 0000000..7824901 --- /dev/null +++ b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-mesh-firewall.service @@ -0,0 +1,2 @@ +[Unit] +Description=Synthetic firewall fixture diff --git a/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-policy-apply b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-policy-apply new file mode 100644 index 0000000..ec5b9e5 --- /dev/null +++ b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-policy-apply @@ -0,0 +1,2 @@ +#!/usr/bin/env sh +exit 0 diff --git a/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-provisioning-helper.service b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-provisioning-helper.service new file mode 100644 index 0000000..f8ce82b --- /dev/null +++ b/tests/fixtures/alpha8-v1-release/archive-root/deploy/ochenstarik-smm-provisioning-helper.service @@ -0,0 +1,2 @@ +[Unit] +Description=Synthetic provisioning fixture diff --git a/tests/fixtures/alpha8-v1-release/archive-root/provisioning-helper/ochenstarik-smm-provisioning-helper b/tests/fixtures/alpha8-v1-release/archive-root/provisioning-helper/ochenstarik-smm-provisioning-helper new file mode 100644 index 0000000..ec5b9e5 --- /dev/null +++ b/tests/fixtures/alpha8-v1-release/archive-root/provisioning-helper/ochenstarik-smm-provisioning-helper @@ -0,0 +1,2 @@ +#!/usr/bin/env sh +exit 0 diff --git a/tests/fixtures/alpha8-v1-release/server-monitor-manager-bootstrap-manifest.json b/tests/fixtures/alpha8-v1-release/server-monitor-manager-bootstrap-manifest.json new file mode 100644 index 0000000..c0eb001 --- /dev/null +++ b/tests/fixtures/alpha8-v1-release/server-monitor-manager-bootstrap-manifest.json @@ -0,0 +1,10 @@ +{ + "schema": "smm-bootstrap-manifest/v1", + "version": "v0.1.0-alpha.8", + "bootstrap": "ochenstarik-server-monitor-manager.sh", + "bootstrap_sha256": "522cfb6c28cf21df6e060c48b44a391e4a4b71a37bfa36008078400e1085e3ca", + "supported_runtimes": [ + "linux-x64", + "linux-arm64" + ] +}