Repository navigation
feat(launcher): add a pinned, checksum-verified install command - #49
Merged
Merged
Conversation
Release tags now publish the launcher with a SHA256SUMS file. The README install command downloads both for a named tag, checks the launcher against the checksum, and runs it only on a match. A wrong, empty or missing checksum file stops it before anything runs. A test extracts the documented command from the README and runs it against local fixtures. Closes dmfdeploy/dmfdeploy#736 Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
znerol2
added
the
hold
v0.3.6 is the first release the launcher workflow builds, so it is the first one with a SHA256SUMS asset. The install test now takes the fixture release directory from the README's version= line, so the next version bump needs no test change. Refs dmfdeploy/dmfdeploy#736 Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
Open
3 tasks
… v0.4.0 The published launcher defaulted to the :latest image, so a launcher that passed its checksum could start a newer, unverified image. The release workflow now stamps the release tag into a copy of the launcher before it computes SHA256SUMS. The stamp fails unless the marker line appears exactly once. The image workflow pushes the semver tag without the leading "v", so the stamp does the same. The --image flag still overrides the default. This also bumps VERSION, pyproject.toml, and the README install command to 0.4.0, and adds the stamp tests to the launcher CI job. Refs dmfdeploy/dmfdeploy#736 Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
The install command now downloads each asset with its own curl call into a new temporary directory, requires SHA256SUMS to hold exactly one "<digest> dmf-init" line, and compares the digest of the downloaded file itself. A file already in the working directory can no longer run, and a checksum file that names another file no longer passes. The launcher job moves into publish-image.yml and runs only after the image build job succeeds. It stamps the launcher with the image digest from that build, so the published launcher points at exactly the image that was pushed. scripts/build-launcher-release.sh holds the stamp-then-checksum order, and a test checks that SHA256SUMS matches the final bytes. The README now says the launcher assets start at v0.4.0. Refs dmfdeploy/dmfdeploy#736 Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
On macOS, `cd ""` succeeds and stays in the current directory, so a failed mktemp let the downloads overwrite files there and run a launcher from it. The README command now creates the directory into a variable and requires a non-empty path to an existing directory before it changes into it. The install-command test now serves a local HTTP fixture that returns 404 and 500 responses with valid bodies, so removing `curl -f` fails a test. It also shadows mktemp with a failing stub in bash and zsh and checks that planted files and a symlink stay unchanged. CI requires python3 for the HTTP cases. Refs dmfdeploy/dmfdeploy#736 Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
Refs dmfdeploy/dmfdeploy#736 Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
znerol2
removed
the
hold
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The README told users to fetch
bin/dmf-initfrommainand pipe a script frommainintobash. This PR replaces that with a pinned, checksum-verified install:.github/workflows/release-launcher.ymlruns onv*tags. It attachesbin/dmf-initand a one-lineSHA256SUMSto the release. Actions are pinned by SHA, and the only permission iscontents: write.version=vX.Y.Z, download both assets from that tag's release, verify withsha256sum -c(orshasum -a 256 -con macOS), then runbash dmf-init up. Each step runs only if the previous one succeeds. A paragraph explains how to pick a version and what the check does and doesn't prove.bashfrommain.test/launcher/test-install-command.sh, run by a newlauncherCI job. It extracts the README command and runs it against local fixture files, with no network. It checks that the command:/mainsha256sumand withshasumonlyRelease plan
The README pins
v0.3.6. That will be the first release built by the new workflow, so the first one withSHA256SUMS.v0.3.6gets tagged right after this PR merges. Until then, the documented command fails closed with a 404, soholdstays on until the review is done.Not in this PR
:latest.Checks
shellcheckandactionlintpass.Closes dmfdeploy/dmfdeploy#736