From 070adc2f28554e4fc29f398e76d177a284a8fdba Mon Sep 17 00:00:00 2001 From: Prekshi Vyas Date: Mon, 12 Oct 2026 13:40:06 -0700 Subject: [PATCH 1/2] chore(deps): trust OpenShell 0.1.2 supervisor template with #12928 Main's #12928 thread-group process reader changed the supervisor operational template, so the 0.1.2 selection hashes to 31e69236... which the trusted installer-pin parser does not list. The base-trusted verifier therefore rejects #12603 (check-hash) and the manual E2E planner. Add the exact hash to the 0.1.2 runtimeTemplateSha256 list; existing records are unchanged. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: Prekshi Vyas --- scripts/checks/extract-installer-pins.mts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/checks/extract-installer-pins.mts b/scripts/checks/extract-installer-pins.mts index 474c0de5d64..fc475603837 100644 --- a/scripts/checks/extract-installer-pins.mts +++ b/scripts/checks/extract-installer-pins.mts @@ -645,6 +645,8 @@ const TRUSTED_OPENSHELL_RELEASES: readonly OpenShellReleaseTrust[] = [ runtimeTemplateSha256: [ ...V00116_SUPERVISOR_TEMPLATE_BASELINE_SHA256, "dceba5ee9bf6d9cd20adf637d63d008c932f751c073bbb0a83cdce087518e917", + // Exact 0.1.2 selection with the merged #12928 thread-group process reader. + "31e6923609575d64ac36943e58218c801be366b782def8d33406df6e938ef5dd", ], }, pinLayout: V00116_OPENSHELL_PIN_LAYOUT, From f6511b1cda598490df948350ff6b945b0e4f40fc Mon Sep 17 00:00:00 2001 From: Prekshi Vyas Date: Mon, 12 Oct 2026 15:30:13 -0700 Subject: [PATCH 2/2] test(install): cover the 0.1.2 thread-group supervisor template trust prepareReleaseFixtureRuntime restores the historical process reader for its 0.1.2 fixture, so no test exercised the newly admitted 0.1.2/thread-group pair. Add an opt-in currentProcessReader mode and one case that accepts the exact template and rejects it after appending bytes to the runtime. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: Prekshi Vyas --- test/helpers/openshell-installer-template.ts | 21 ++++++++++++++------ test/install/installer-hash-check.test.ts | 8 ++++++++ 2 files changed, 23 insertions(+), 6 deletions(-) diff --git a/test/helpers/openshell-installer-template.ts b/test/helpers/openshell-installer-template.ts index 575a573feb6..7c1619bc658 100644 --- a/test/helpers/openshell-installer-template.ts +++ b/test/helpers/openshell-installer-template.ts @@ -176,14 +176,23 @@ export function removeV00106OperationalTrust(source: string): string { return `${withoutIdentity.slice(0, capabilityStart)}${withoutIdentity.slice(fallbackStart)}`; } -export function prepareReleaseFixtureRuntime(repoRoot: string, root: string): void { +export function prepareReleaseFixtureRuntime( + repoRoot: string, + root: string, + options: { currentProcessReader?: boolean } = {}, +): void { const runtimePath = "src/lib/onboard/docker-driver-gateway-runtime.ts"; const candidatePins = fs.readFileSync(path.join(root, runtimePath), "utf8"); - // The 0.1.2 release fixture predates the shared process reader. Keep its - // operational runtime bytes on the independently trusted historical template. - const source = selectHistoricalGatewayProcessReader( - fs.readFileSync(path.join(repoRoot, runtimePath), "utf8"), - ); + const checkoutSource = fs.readFileSync(path.join(repoRoot, runtimePath), "utf8"); + // By default the 0.1.2 release fixture predates the shared process reader, so keep + // its operational runtime bytes on the independently trusted historical template. + // currentProcessReader selects the checkout's thread-group reader for 0.1.2 instead. + const source = options.currentProcessReader + ? checkoutSource.replace( + 'const QUALIFIED_STABLE_OPENSHELL_VERSION = "0.0.116";', + 'const QUALIFIED_STABLE_OPENSHELL_VERSION = "0.1.2";', + ) + : selectHistoricalGatewayProcessReader(checkoutSource); const prepared = source.replace( /const OPENSHELL_SUPERVISOR_MANIFEST_DIGESTS: Readonly> = \{[\s\S]*?\n\};/, candidatePins.trim(), diff --git a/test/install/installer-hash-check.test.ts b/test/install/installer-hash-check.test.ts index e69fd41ab58..fd34b01a2a4 100644 --- a/test/install/installer-hash-check.test.ts +++ b/test/install/installer-hash-check.test.ts @@ -1052,6 +1052,14 @@ describe("installer hash verification", () => { ]); }); + it("admits only the exact thread-group supervisor template with OpenShell 0.1.2", () => { + const root = createFixture("0.1.2"); + prepareReleaseFixtureRuntime(REPO_ROOT, root, { currentProcessReader: true }); + const run = () => spawnSync("node", preparedReleaseArgs(REPO_ROOT, root), { encoding: "utf8" }); + expect(run().status).toBe(0); + fs.appendFileSync(path.join(root, "src/lib/onboard/docker-driver-gateway-runtime.ts"), "//x"); + expect(run()).toMatchObject({ status: 1, stderr: expect.stringContaining("not base-trusted") }); + }); it.each(V012_TRUST_MUTATIONS)( "rejects an altered OpenShell 0.1.2 %s", (_label, name, value, diagnostic) => {