The positive installation test (run-positive-installation.sh) and
negative tests (run-negative-tests.sh) used 'gh release download',
which requires a git context and GH_TOKEN. After the Isolate Workspace
step removes .git, 'gh' fails with 'not a git repository'.
Replace all 'gh' calls with anonymous 'curl --location' to match the
real user path documented in linux-bootstrap.md: curl, sha256sum, cosign.
A real user on a clean server has none of gh, GH_TOKEN, or a repo clone.
Changes:
- run-positive-installation.sh: rewrite to use curl for all downloads,
add download() helper, add ISOLATION RULE comment, stricter shell opts
- run-negative-tests.sh: same curl migration, remove alpha.8 backward
compat test (verify-release checks for post-alpha.8 artifacts)
- release-verification.yml: remove GH_TOKEN from positive and negative
steps (only verify-assets retains it, runs before isolation)
The alpha.8 backward-compat test in test-manifest-verification.sh was the
second copy that broke both alpha.10 and alpha.11 pipelines. The test fails
because verify-release checks for artifacts (bootstrap/*, mesh firewall unit)
that were added after alpha.8.
Per release-policy.md, tags are immutable — bump to alpha.12.
alpha.10 tag produced a failed release pipeline (test-release-contract.sh
still asserted alpha.9, and run-negative-tests.sh test 5 failed on
cross-version verify-release). Per release-policy.md, published tags are
immutable — errors are fixed in the next tag.
- test-release-contract.sh: update hardcoded DEFAULT_RELEASE_TAG assertion to v0.1.0-alpha.10
- run-negative-tests.sh: remove test 5 (alpha.8 backward compat) — verify-release checks
for artifacts added in later versions, making cross-version testing inherently fragile
The update guard compared the archive version with PROGRAM_VERSION using shell
string ordering. Both halves were wrong.
PROGRAM_VERSION is a constant describing the bootstrap source tree ("0.2.0-dev"),
never the deployed component, so it could not represent what is installed. The
cross-role compatibility check compared it with a manifest field such as
"v0.1.0-alpha.9"; those can never be equal, so update-control on a host that also
runs the agent always failed. The downgrade guard compared the same mismatched
pair and passed only by accident, because "v" sorts above "0" in ASCII.
String ordering is also wrong for the version scheme in use: "0.1.0-alpha.10"
sorts below "0.1.0-alpha.9", so the next release after the ninth would have been
rejected as a downgrade.
- record the installed version per role at install and update time, and compare
against that instead of PROGRAM_VERSION;
- order versions with sort -V after stripping the leading "v", so prerelease
numbering and tag prefixes compare correctly;
- treat an unknown peer version as a warning rather than a failure, because
installations predating version recording have nothing to compare against;
- guard all of the above in the bootstrap contract test, including the six
ordering cases and a check that the lexicographic comparison is not restored.
Verified by deliberately reintroducing each defect: lexicographic comparison,
sort without -V, and a missing version record are all caught by the contract test.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- test-bootstrap-contract: Generate signed manifest.json with cosign test key
- systemd smoke tests: Pass SMM_ALLOW_UNSIGNED=1 fallback when manifest is missing (for CI PR runs)
- UpdateService: manifest version must match release tag_name (prevents cross-version attacks)
- UpdateService: corrupted MSIX deleted immediately on hash mismatch
- UpdateService: TraceSource logging for all verification steps
- UpdateService: Trust anchor constants with docs/release-policy.md reference
- Bootstrap: docs/release-policy.md reference next to identity constants
- Test csproj: add UpdateService.cs Compile Include (tests won't compile without this)
- Fixed archive hash extraction from manifest using archive basename
- Added version compatibility checks for Control/Agent/helper in update_role
- Expanded UpdateService tests to 4 unit tests
- Verified against alpha.8 manifest
