From 26a11b77e77b53c1e5a0f204d90d5c26b3a268bc Mon Sep 17 00:00:00 2001 From: ochenstarik-ui Date: Tue, 18 Aug 2026 00:25:23 +0700 Subject: [PATCH] fix: select cosign v3 detached signing mode --- deploy/smm-setup.sh | 4 ++-- docs/linux-bootstrap.md | 6 +++--- docs/release-policy.md | 3 ++- tests/bootstrap/test-release-contract.sh | 9 ++++++--- tests/release-verification/run-negative-tests.sh | 1 + 5 files changed, 14 insertions(+), 9 deletions(-) diff --git a/deploy/smm-setup.sh b/deploy/smm-setup.sh index afb8919..a66e61c 100644 --- a/deploy/smm-setup.sh +++ b/deploy/smm-setup.sh @@ -3,7 +3,7 @@ set -Eeuo pipefail IFS=$'\n\t' readonly PROGRAM_NAME="smm-setup" -readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.17" +readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.18" readonly DEFAULT_REPOSITORY="ochenstarik-ui/server-monitor-manager" readonly INNER_ASSET="ochenstarik-server-monitor-manager.sh" @@ -27,7 +27,7 @@ force pass-through. Common bootstrap commands: backup-create | backup-restore | version Environment overrides: - SMM_TAG Release tag (default: v0.1.0-alpha.17) + SMM_TAG Release tag (default: v0.1.0-alpha.18) SMM_REPOSITORY GitHub repository (default: ochenstarik-ui/server-monitor-manager) SMM_CACHE_DIR Verified-download cache directory USAGE diff --git a/docs/linux-bootstrap.md b/docs/linux-bootstrap.md index 070d9bc..ae21afc 100644 --- a/docs/linux-bootstrap.md +++ b/docs/linux-bootstrap.md @@ -6,11 +6,11 @@ Server Monitor Manager устанавливает Control (Hub) и Agent (Node) ## Быстрая установка -Скачайте и проверьте convenience installer из `v0.1.0-alpha.17`: +Скачайте и проверьте convenience installer из `v0.1.0-alpha.18`: ```bash -curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.17/smm-setup.sh -curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.17/smm-setup.sh.sha256 +curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.18/smm-setup.sh +curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.18/smm-setup.sh.sha256 sha256sum -c smm-setup.sh.sha256 chmod 700 smm-setup.sh ``` diff --git a/docs/release-policy.md b/docs/release-policy.md index 217ecb2..8dd3ae6 100644 --- a/docs/release-policy.md +++ b/docs/release-policy.md @@ -18,6 +18,7 @@ Known release history: - `v0.1.0-alpha.14` is the first release with the complete manifest, keyless signature, and Fulcio certificate set, so its published assets can be verified. A clean host cannot install it because the release does not provision cosign. Preserve it for verification and historical evidence; do not use it for installation. - `v0.1.0-alpha.15` is the first release that provisions a pinned, checksum-verified cosign binary. Its automatically triggered Release Verification proved the clean-host Hub installation and manifest verification, then stopped before the clean-host Node installation because the acceptance script retained the deliberately removed cosign path in Bash's command hash. The immutable release and failed verification remain as evidence; the acceptance harness is corrected in the next version. - `v0.1.0-alpha.16` clears the acceptance shell's command hash after removing its test-provisioned cosign. Its automatic verification proved clean-host Hub installation, but the convenience installer wrote the bootstrap checksum success line to stdout before the machine-readable `SMMNODE2` enrollment code. Node installation therefore rejected the contaminated value. The immutable release and failed verification remain as evidence; stdout isolation is corrected in the next version. -- `v0.1.0-alpha.17` keeps checksum verification fail-closed while suppressing its success line, so pass-through commands such as `node-code` return only their machine-readable bootstrap output. It is the first release required to complete both automatic `workflow_run` verification and manual `workflow_dispatch` re-verification. +- `v0.1.0-alpha.17` keeps checksum verification fail-closed while suppressing its success line, so pass-through commands such as `node-code` return only their machine-readable bootstrap output. Its automatic verification completed the clean-host Hub and Node installation, then the negative-test harness stopped while creating a wrong-identity signature because cosign v3 requires an explicit bundle or legacy detached-output mode. The immutable release and failed harness run remain as evidence; the negative test is corrected in the next version. +- `v0.1.0-alpha.18` makes the wrong-identity negative test select cosign v3's explicit detached-output mode, matching the production consumer's detached signature and certificate contract. It is the first release required to complete both automatic `workflow_run` verification and manual `workflow_dispatch` re-verification. Every release candidate must pass a branch `workflow_dispatch` run of the Release pipeline before its immutable version tag is created. The release owner has sole write ownership of version sources, `deploy/**`, `tests/bootstrap/**`, release workflows, the root README release status, and translated README release statuses. Other contributors request changes to those paths in their report; they do not edit or bump them directly. One pull request covers one release topic and may merge only after required CI is green. diff --git a/tests/bootstrap/test-release-contract.sh b/tests/bootstrap/test-release-contract.sh index be02a0c..e2d1752 100644 --- a/tests/bootstrap/test-release-contract.sh +++ b/tests/bootstrap/test-release-contract.sh @@ -18,7 +18,7 @@ v1_fixture="$root/tests/fixtures/alpha8-v1-release" exit 1 } bash -n "$setup" -grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.17"' "$setup" +grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.18"' "$setup" grep -Fq 'install-hub PUBLIC_HOST [HTTPS_PORT] [WG_PORT]' "$setup" grep -Fxq ' install-node' "$setup" if grep -Fq 'validate_control_url' "$setup" || grep -Fq '${CONTROL_URL%/}/control' "$setup"; then @@ -62,7 +62,10 @@ grep -Fq 'v0.1.0-alpha.14' "$policy" grep -Fq 'v0.1.0-alpha.15' "$policy" grep -Fq 'v0.1.0-alpha.16' "$policy" grep -Fq 'v0.1.0-alpha.17' "$policy" +grep -Fq 'v0.1.0-alpha.18' "$policy" grep -Fq 'hash -r' "$root/tests/release-verification/run-positive-installation.sh" +grep -Fq -- '--use-signing-config=false --new-bundle-format=false' \ + "$root/tests/release-verification/run-negative-tests.sh" grep -Fq 'readonly COSIGN_VERSION="v3.1.3"' "$bootstrap" grep -Fq 'readonly COSIGN_SHA256_AMD64="4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71"' "$bootstrap" grep -Fq 'readonly COSIGN_SHA256_ARM64="c5d324e091826b0d7a78eb16fef316450b4eb9aaec045611c08ba06f5e73220a"' "$bootstrap" @@ -190,8 +193,8 @@ chmod +x "$work/bin/uname" HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" version >"$work/output" grep -Fq 'INNER_ARGS=version ' "$work/output" -grep -Fq '/releases/download/v0.1.0-alpha.17/ochenstarik-server-monitor-manager.sh' "$work/urls" -grep -Fq '/releases/download/v0.1.0-alpha.17/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls" +grep -Fq '/releases/download/v0.1.0-alpha.18/ochenstarik-server-monitor-manager.sh' "$work/urls" +grep -Fq '/releases/download/v0.1.0-alpha.18/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls" node_code="$(HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" node-code fixture-node)" [[ "$node_code" == 'SMMNODE1.fixture' ]] || { diff --git a/tests/release-verification/run-negative-tests.sh b/tests/release-verification/run-negative-tests.sh index a4bde31..34a18d4 100644 --- a/tests/release-verification/run-negative-tests.sh +++ b/tests/release-verification/run-negative-tests.sh @@ -72,6 +72,7 @@ echo "Test 4: Signature made by another identity" export COSIGN_PASSWORD="" cosign generate-key-pair >/dev/null cosign sign-blob --yes --key cosign.key \ + --use-signing-config=false --new-bundle-format=false \ --output-signature fake.sig server-monitor-manager-manifest.json >/dev/null if ./ochenstarik-server-monitor-manager.sh verify-manifest server-monitor-manager-manifest.json \ fake.sig server-monitor-manager-manifest.pem >/dev/null 2>&1; then -- 2.45.2