c1e47684e6
PR #40 correctly publishes the keyless signing certificate and makes verify_archive require manifest, signature and certificate together. Three things around it were inconsistent. The release-verification scripts fetched assets with `gh release download`. The workspace-isolation step deliberately removes `.git` so that the install comes from the release rather than the source tree, and `gh` resolves the repository from that git context — the tool fought the isolation it runs inside, which is what broke the first runs. An operator has neither `gh` nor a token, so the scripts now use public `curl`, `sha256sum` and `cosign` only. `verify-assets.sh` keeps `gh`: it runs before isolation and only lists assets. The monitor check addressed a user and a home directory that do not exist. The bootstrap creates `ochenstarik-monitor` with `/var/lib/ochenstarik-monitor`; the script used `ochenstarik-smm-monitor` under the Control state directory, so that section could never have passed. It now also asserts that the forced command is pinned in `authorized_keys` before running it, and quotes the command instead of splitting it on whitespace. The expected asset list did not include the new certificate, so a correct release would have been reported as unexpected. Also: a negative case for an archive published without its certificate, removal of drafting comments that quoted the task text, and documentation of the three signature files, since `verify-release` now requires them beside the archive and the documented download list stopped being sufficient. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
52 lines
1.4 KiB
Bash
52 lines
1.4 KiB
Bash
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
TAG="${1:-}"
|
|
|
|
if [[ -z "$TAG" ]]; then
|
|
echo "Usage: $0 <tag>"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Verifying assets for release $TAG..."
|
|
|
|
# Fetch the list of assets from the release
|
|
ACTUAL_ASSETS=$(gh release view "$TAG" --json assets -q '.assets[].name' | sort)
|
|
|
|
EXPECTED_ASSETS=$(cat <<EOF | sort
|
|
ochenstarik-server-monitor-manager.sh
|
|
ochenstarik-server-monitor-manager.sh.sha256
|
|
server-monitor-manager-linux-x64.tar.gz
|
|
server-monitor-manager-linux-x64.tar.gz.sha256
|
|
server-monitor-manager-linux-arm64.tar.gz
|
|
server-monitor-manager-linux-arm64.tar.gz.sha256
|
|
server-monitor-manager-linux-x64-sbom.json
|
|
server-monitor-manager-linux-arm64-sbom.json
|
|
server-monitor-manager-win-x64-sbom.json
|
|
ServerMonitorManager-win-x64.msix
|
|
ServerMonitorManager-test-signing.cer
|
|
SHA256SUMS
|
|
smm-setup.sh
|
|
smm-setup.sh.sha256
|
|
server-monitor-manager-manifest.json
|
|
server-monitor-manager-manifest.sig
|
|
server-monitor-manager-manifest.pem
|
|
EOF
|
|
)
|
|
|
|
if [[ "$ACTUAL_ASSETS" == "$EXPECTED_ASSETS" ]]; then
|
|
echo "All expected assets are present."
|
|
else
|
|
echo "Asset mismatch!"
|
|
echo "Expected:"
|
|
echo "$EXPECTED_ASSETS"
|
|
echo "---"
|
|
echo "Actual:"
|
|
echo "$ACTUAL_ASSETS"
|
|
echo "---"
|
|
echo "Missing in Actual:"
|
|
comm -23 <(echo "$EXPECTED_ASSETS") <(echo "$ACTUAL_ASSETS")
|
|
echo "Unexpected in Actual:"
|
|
comm -13 <(echo "$EXPECTED_ASSETS") <(echo "$ACTUAL_ASSETS")
|
|
exit 1
|
|
fi
|