- commit
- 795ac58605237bdde31ccea954bea75d6ee93d07
- parent
- f53de5e47c6a2cadc2e3f951d89281f1ef61adef
- author
- Dami <dami.etoile@gmail.com>
@@ -133,7 +133,9 @@ jobs:
133133 release_json="$(gh release view "$RELEASE_TAG" --json isDraft,tagName,assets)"134134 test "$(jq -r '.isDraft' <<<"$release_json")" = true135135 test "$(jq -r '.tagName' <<<"$release_json")" = "$RELEASE_TAG"136- sigil_asset="sigil-$RELEASE_TAG-bazzite-x86_64.tar.gz"136+ target_contract="$(<release/sigil-target-contract.txt)"137+ test "$target_contract" = linux-glibc2.17-x86_64138+ sigil_asset="sigil-$RELEASE_TAG-$target_contract.tar.gz"137139 expected="$(printf '%s\n' "$sigil_asset" "$sigil_asset.sha256" | sort)"138140 actual="$(jq -r '.assets[].name' <<<"$release_json" | sort)"139141 test "$actual" = "$expected" || {@@ -163,7 +165,9 @@ jobs:
163165 test "$(jq -r '.isDraft' <<<"$release_json")" = true164166 test "$(jq -r '.tagName' <<<"$release_json")" = "$RELEASE_TAG"165167 version="${RELEASE_TAG#v}"166- sigil_asset="sigil-$RELEASE_TAG-bazzite-x86_64.tar.gz"168+ target_contract="$(<release/sigil-target-contract.txt)"169+ test "$target_contract" = linux-glibc2.17-x86_64170+ sigil_asset="sigil-$RELEASE_TAG-$target_contract.tar.gz"167171 expected="$(printf '%s\n' \168172 "$sigil_asset" \169173 "$sigil_asset.sha256" \@@ -94,7 +94,9 @@ jobs:
9494 id: candidate9595 run: |9696 source_commit="$(git rev-parse HEAD)"97- asset_name="sigil-$RELEASE_TAG-bazzite-x86_64.tar.gz"97+ target_contract="$(<release/sigil-target-contract.txt)"98+ test "$target_contract" = linux-glibc2.17-x86_6499+ asset_name="sigil-$RELEASE_TAG-$target_contract.tar.gz"98100 output_dir="$RUNNER_TEMP/sigil-release"99101 install -d -m 0700 "$output_dir"100102 archive="$output_dir/$asset_name"@@ -174,7 +176,9 @@ jobs:
174176 release_json="$(gh release view "$RELEASE_TAG" --json isDraft,tagName,assets)"175177 test "$(jq -r '.isDraft' <<<"$release_json")" = true176178 test "$(jq -r '.tagName' <<<"$release_json")" = "$RELEASE_TAG"177- asset_name="sigil-$RELEASE_TAG-bazzite-x86_64.tar.gz"179+ target_contract="$(<release/sigil-target-contract.txt)"180+ test "$target_contract" = linux-glibc2.17-x86_64181+ asset_name="sigil-$RELEASE_TAG-$target_contract.tar.gz"178182 version="${RELEASE_TAG#v}"179183 expected="$(printf '%s\n' \180184 "$asset_name" \@@ -233,6 +237,6 @@ jobs:
233237 gh release edit "$RELEASE_TAG" \234238 --draft=false \235239 --prerelease \236- --notes "Verified public alpha for $RELEASE_TAG: signed Bazzite Sigil host package plus Developer ID signed, notarized, stapled macOS arm64 Portal. Hardware UAT remains tracked separately."240+ --notes "Verified public alpha for $RELEASE_TAG: signed Linux glibc 2.17 x86_64 Sigil host package, validated on the supported Bazzite appliance, plus Developer ID signed, notarized, stapled macOS arm64 Portal. Hardware UAT remains tracked separately."237241 test "$(gh release view "$RELEASE_TAG" --json isDraft --jq '.isDraft')" = false238242 test "$(gh release view "$RELEASE_TAG" --json isPrerelease --jq '.isPrerelease')" = true@@ -102,6 +102,11 @@ Sigil host.
102102 the allowlisted runtime payload, carry complete checksums/provenance, and have103103 a detached Minisign signature. Installation must preserve identity and host104104 configuration and must not silently start, restart, or enable the service.105+- Product Sigil assets use the target-contract suffix106+ `linux-glibc2.17-x86_64`, pinned by107+ `release/sigil-target-contract.txt`. That name describes the binary ABI, not108+ validated host support; the public bootstrap remains Bazzite-only until109+ another environment passes its own packaging and hardware gates.105110 - Portal is a compiled desktop download, never a shell install. The first106111 public target is macOS arm64 and requires Developer ID signing, hardened107112 runtime, notarization, stapling, and strict Gatekeeper verification. Its@@ -241,7 +241,7 @@ temporary testing:
241241 ```bash242242 scripts/package-bazzite-release.sh \243243 --release-tag v0.1.0 \244- --output /tmp/sigil-v0.1.0-bazzite-x86_64.tar.gz244+ --output /tmp/sigil-v0.1.0-linux-glibc2.17-x86_64.tar.gz245245 246246 # Temporary development package only:247247 scripts/package-bazzite-release.sh \@@ -611,12 +611,12 @@ cd /Users/dami/Developer/sigil-spark
611611 source ~/.cargo/env612612 scripts/package-bazzite-release.sh \613613 --release-tag v0.1.0 \614- --output /tmp/sigil-v0.1.0-bazzite-x86_64.tar.gz614+ --output /tmp/sigil-v0.1.0-linux-glibc2.17-x86_64.tar.gz615615 616616 # Verify the candidate before it crosses the offline signing boundary.617617 scripts/verify-sigil-release.sh \618618 --tag v0.1.0 \619- --archive /tmp/sigil-v0.1.0-bazzite-x86_64.tar.gz \619+ --archive /tmp/sigil-v0.1.0-linux-glibc2.17-x86_64.tar.gz \620620 --source-commit "$(git rev-parse HEAD)" \621621 --candidate622622 @@ -624,19 +624,19 @@ scripts/verify-sigil-release.sh \
624624 # reviewed public key before extraction. See docs/public-release-delivery.md.625625 scripts/verify-sigil-release.sh \626626 --tag v0.1.0 \627- --archive /tmp/sigil-v0.1.0-bazzite-x86_64.tar.gz \627+ --archive /tmp/sigil-v0.1.0-linux-glibc2.17-x86_64.tar.gz \628628 --source-commit "$(git rev-parse HEAD)" \629629 --public-key-file /absolute/path/to/sigil-minisign.pub630-shasum -a 256 -c /tmp/sigil-v0.1.0-bazzite-x86_64.tar.gz.sha256631-scp /tmp/sigil-v0.1.0-bazzite-x86_64.tar.gz tank@umpc:/tmp/630+shasum -a 256 -c /tmp/sigil-v0.1.0-linux-glibc2.17-x86_64.tar.gz.sha256631+scp /tmp/sigil-v0.1.0-linux-glibc2.17-x86_64.tar.gz tank@umpc:/tmp/632632 633633 ssh tank@umpc '634634 set -eu635635 incoming="$HOME/.local/share/sigil-spark/incoming"636636 install -d -m 0700 "$incoming"637637 run_dir="$(mktemp -d "$incoming/package.XXXXXX")"638- tar -tzf /tmp/sigil-v0.1.0-bazzite-x86_64.tar.gz639- tar -xzf /tmp/sigil-v0.1.0-bazzite-x86_64.tar.gz -C "$run_dir"638+ tar -tzf /tmp/sigil-v0.1.0-linux-glibc2.17-x86_64.tar.gz639+ tar -xzf /tmp/sigil-v0.1.0-linux-glibc2.17-x86_64.tar.gz -C "$run_dir"640640 cd "$run_dir/payload"641641 sha256sum -c PACKAGE-SHA256SUMS642642 bash -n stage-this-release.sh@@ -24,7 +24,7 @@ uat_dir="$PWD-private/goq-uat-rc1"
2424 ./scripts/public-alpha-uat.sh init \2525 --evidence-dir "$uat_dir" \2626 --release-tag v0.1.0-rc.1 \27- --sigil-archive /absolute/path/sigil-v0.1.0-rc.1-bazzite-x86_64.tar.gz \27+ --sigil-archive /absolute/path/sigil-v0.1.0-rc.1-linux-glibc2.17-x86_64.tar.gz \2828 --sigil-bin /absolute/path/to/sigil \2929 --portal-assets /absolute/path/to/portal-v0.1.0-rc.1-assets3030 ```@@ -311,7 +311,7 @@ Stored hashes alone are not sufficient:
311311 ```bash312312 ./scripts/public-alpha-uat.sh verify \313313 --evidence-dir "$uat_dir" \314- --sigil-archive /absolute/path/sigil-v0.1.0-rc.1-bazzite-x86_64.tar.gz \314+ --sigil-archive /absolute/path/sigil-v0.1.0-rc.1-linux-glibc2.17-x86_64.tar.gz \315315 --sigil-bin /absolute/path/to/sigil \316316 --portal-assets /absolute/path/to/portal-v0.1.0-rc.1-assets317317 ```@@ -9,12 +9,18 @@ Neither path may fall back to an unsigned development build.
99 The first public release is a draft or prerelease until capability-ticket1010 onboarding and the release-candidate hardware pass are complete.1111 12-Sigil publishes exactly these x86_64 Bazzite assets for a tag such as12+Sigil publishes exactly these Linux glibc 2.17 x86_64 assets for a tag such as1313 `v0.3.0-alpha.1`:1414 15-- `sigil-v0.3.0-alpha.1-bazzite-x86_64.tar.gz`16-- `sigil-v0.3.0-alpha.1-bazzite-x86_64.tar.gz.sha256`17-- `sigil-v0.3.0-alpha.1-bazzite-x86_64.tar.gz.minisig`15+- `sigil-v0.3.0-alpha.1-linux-glibc2.17-x86_64.tar.gz`16+- `sigil-v0.3.0-alpha.1-linux-glibc2.17-x86_64.tar.gz.sha256`17+- `sigil-v0.3.0-alpha.1-linux-glibc2.17-x86_64.tar.gz.minisig`18+19+The Sigil asset suffix names the binary target contract, not a support claim.20+The public bootstrap and package-owned activation path remain restricted to the21+Bazzite appliance until SteamOS or another host environment passes its own22+packaging, capability, cold-boot, and hardware acceptance gates. The canonical23+suffix is pinned in `release/sigil-target-contract.txt`.1824 1925 Portal preserves the package builder's versioned macOS contract:2026 @@ -77,8 +83,8 @@ environment builds clean tagged source, runs the complete repository gate,
7783 creates exactly these unsigned draft assets, and retains the same bytes as a7884 short-lived Actions artifact:7985 80-- `sigil-$tag-bazzite-x86_64.tar.gz`81-- `sigil-$tag-bazzite-x86_64.tar.gz.sha256`86+- `sigil-$tag-linux-glibc2.17-x86_64.tar.gz`87+- `sigil-$tag-linux-glibc2.17-x86_64.tar.gz.sha256`8288 8389 Move those bytes to the offline publisher machine. After independently8490 confirming the tag commit and reviewed public key, sign without exporting the@@ -87,7 +93,7 @@ secret key or its passphrase:
8793 ```bash8894 scripts/sign-bazzite-release.sh \8995 --tag "$tag" \90- --archive "/absolute/offline/path/sigil-$tag-bazzite-x86_64.tar.gz" \96+ --archive "/absolute/offline/path/sigil-$tag-linux-glibc2.17-x86_64.tar.gz" \9197 --source-commit "$tag_commit" \9298 --minisign-key /absolute/offline/path/sigil-release.key \9399 --public-key-file /absolute/offline/path/sigil-minisign.pub@@ -118,6 +124,11 @@ development flags are an inseparable escape hatch and cannot claim a release
118124 tag. `scripts/verify-sigil-release.sh` is the common candidate, offline, and119125 promotion verifier.120126 127+No public goq release exists under the former distro-named suffix. Unpublished128+drafts or locally staged candidates using `bazzite-x86_64` must be discarded129+and rebuilt; release verification intentionally provides no compatibility130+alias that could make two names identify the same public bytes.131+121132 ## Public Bazzite acceptance record122133 123134 Repository tests exercise a complete package fixture through fresh install,@@ -0,0 +1 @@
1+linux-glibc2.17-x86_64@@ -26,6 +26,7 @@ die() {
2626 2727 script_dir="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"2828 payload_dir="$script_dir"29+readonly asset_target_contract="linux-glibc2.17-x86_64"2930 3031 while [[ $# -gt 0 ]]; do3132 case "$1" in@@ -250,13 +251,14 @@ validate_release_tree() {
250251 cd "$path"251252 sha256sum -c SHA256SUMS252253 )253- python3 - "$path/release-manifest.json" <<'PY'254+ python3 - "$path/release-manifest.json" "$asset_target_contract" <<'PY'254255 import json255256 import pathlib256257 import re257258 import sys258259 259260 path = pathlib.Path(sys.argv[1])261+asset_target_contract = sys.argv[2]260262 try:261263 manifest = json.loads(path.read_text())262264 except (OSError, UnicodeDecodeError, json.JSONDecodeError) as error:@@ -289,7 +291,7 @@ if not isinstance(commit, str) or re.fullmatch(r"[0-9a-f]{40}", commit) is None:
289291 if not isinstance(asset_name, str) or re.fullmatch(r"[A-Za-z0-9._-]+[.]tar[.]gz", asset_name) is None:290292 raise SystemExit("package install failed: release manifest asset name is invalid")291293 if release_kind == "product-candidate":292- if release_tag != f"v{version}" or asset_name != f"sigil-{release_tag}-bazzite-x86_64.tar.gz":294+ if release_tag != f"v{version}" or asset_name != f"sigil-{release_tag}-{asset_target_contract}.tar.gz":293295 raise SystemExit("package install failed: product release identity is inconsistent")294296 if manifest.get("git_dirty") is not False:295297 raise SystemExit("package install failed: product release claims dirty source")@@ -12,6 +12,8 @@ allow_unsigned=false
1212 release_tag=""1313 linux_target="x86_64-unknown-linux-gnu.2.17"1414 linux_output_target="x86_64-unknown-linux-gnu"15+asset_target_contract_file="$repo_dir/release/sigil-target-contract.txt"16+asset_target_contract=""1517 1618 usage() {1719 cat <<'EOF'@@ -19,7 +21,9 @@ Usage: scripts/package-bazzite-release.sh --output /absolute/path/package.tar.gz
1921 2022 Create an allowlisted, deterministic Bazzite host runtime package. Product mode2123 exports the clean source HEAD and builds both generic Linux release binaries in22-an isolated Cargo target directory. The package includes atomic install,24+an isolated Cargo target directory. Its public asset name describes that25+Linux/glibc/architecture contract rather than the validated host distribution.26+The package includes atomic install,2327 upgrade/rollback support, the systemd user unit, PipeWire sink, staged udev2428 rule, complete checksums, and build provenance. It never includes the source2529 tree, host identity, hardware configuration, environment files, or evidence.@@ -95,6 +99,13 @@ while [[ $# -gt 0 ]]; do
9599 done96100 97101 [[ -n "$output_path" ]] || die "--output is required"102+[[ -f "$asset_target_contract_file" && ! -L "$asset_target_contract_file" ]] \103+ || die "Sigil asset target contract is missing or unsafe"104+[[ "$(wc -l <"$asset_target_contract_file" | tr -d ' ')" == 1 ]] \105+ || die "Sigil asset target contract must contain exactly one line"106+asset_target_contract="$(<"$asset_target_contract_file")"107+[[ "$asset_target_contract" == linux-glibc2.17-x86_64 ]] \108+ || die "Sigil asset target contract does not match the approved Linux build target"98109 case "$output_path" in99110 /*.tar.gz) ;;100111 *) die "--output must be an absolute .tar.gz path" ;;@@ -123,7 +134,7 @@ if $allow_dirty || $allow_unsigned || $caller_supplied_binaries; then
123134 else124135 [[ "$release_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z][0-9A-Za-z.-]*)?$ ]] \125136 || die "product mode requires --release-tag vVERSION"126- expected_asset="sigil-$release_tag-bazzite-x86_64.tar.gz"137+ expected_asset="sigil-$release_tag-$asset_target_contract.tar.gz"127138 [[ "$(basename -- "$output_path")" == "$expected_asset" ]] \128139 || die "product output must be named $expected_asset"129140 fi@@ -8,6 +8,7 @@ MAX_SOURCE_BYTES=$((1024 * 1024))
88 DEFAULT_MAX_AGE_SECONDS=$((7 * 24 * 60 * 60))99 FUTURE_SKEW_SECONDS=3001010 GITHUB_REPOSITORY='FelineStateMachine/goq'11+SIGIL_ASSET_TARGET_CONTRACT='linux-glibc2.17-x86_64'1112 required_kinds=(cold-boot controller mouse soak network-direct network-relay reconnect second-client)1213 all_kinds=("${required_kinds[@]}" loopback-preflight)1314 script_dir="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"@@ -647,6 +648,7 @@ reject_sensitive_source() {
647648 validate_manifest() {648649 local directory="$1"649650 local manifest="$directory/manifest.tsv"651+ local sigil_archive_name650652 local key651653 local record_kind652654 local record_field@@ -671,7 +673,9 @@ validate_manifest() {
671673 require_equal "$(manifest_get "$manifest" format)" "$FORMAT" format672674 require_commit "$(manifest_get "$manifest" git_commit)" manifest673675 require_release_tag "$(manifest_get "$manifest" release_tag)"674- [[ "$(manifest_get "$manifest" sigil_archive_name)" =~ ^sigil-v[0-9A-Za-z.-]+-bazzite-x86_64\.tar\.gz$ ]] \676+ sigil_archive_name="$(manifest_get "$manifest" sigil_archive_name)"677+ [[ "$sigil_archive_name" =~ ^sigil-v[0-9A-Za-z.-]+-[0-9A-Za-z._-]+[.]tar[.]gz$ \678+ && "$sigil_archive_name" == sigil-v*-"$SIGIL_ASSET_TARGET_CONTRACT".tar.gz ]] \675679 || die "invalid manifest Sigil archive name"676680 [[ "$(manifest_get "$manifest" portal_dmg_name)" =~ ^Portal-[0-9A-Za-z.-]+-arm64\.dmg$ ]] \677681 || die "invalid manifest Portal DMG name"@@ -7,7 +7,7 @@ usage() {
77 cat <<'EOF'88 Usage: scripts/sign-bazzite-release.sh \99 --tag vVERSION \10- --archive /absolute/path/sigil-vVERSION-bazzite-x86_64.tar.gz \10+ --archive /absolute/path/sigil-vVERSION-linux-glibc2.17-x86_64.tar.gz \1111 --minisign-key /absolute/offline/path/to/release.key \1212 --public-key-file /absolute/path/to/sigil-minisign.pub \1313 [--source-commit HEX]@@ -33,7 +33,7 @@ make_payload() {
3333 local root="$1"3434 local tag="$2"3535 local commit="$3"36- local asset_name="sigil-$tag-bazzite-x86_64.tar.gz"36+ local asset_name="sigil-$tag-linux-glibc2.17-x86_64.tar.gz"3737 local release="$root/release"3838 local true_binary3939 true_binary="$(readlink -f /usr/bin/true 2>/dev/null || readlink -f /bin/true)"@@ -29,6 +29,7 @@ for path in \
2929 scripts/70-sigil-remote-input.rules \3030 scripts/72-sigil-uinput.rules \3131 scripts/99-sigil-uinput.rules \32+ release/sigil-target-contract.txt \3233 docs/sigil-host-activation.md \3334 crates/sigil-host/Cargo.toml \3435 Cargo.lock rust-toolchain.toml LICENSE@@ -67,7 +68,7 @@ git -C "$fixture_repo" commit -qm 'fixture release'
6768 git -C "$fixture_repo" tag v0.1.06869 source_commit="$(git -C "$fixture_repo" rev-parse HEAD)"6970 70-archive="$temp_root/output/sigil-v0.1.0-bazzite-x86_64.tar.gz"71+archive="$temp_root/output/sigil-v0.1.0-linux-glibc2.17-x86_64.tar.gz"7172 PATH="$temp_root/bin:$PATH" "$fixture_repo/scripts/package-bazzite-release.sh" \7273 --release-tag v0.1.0 --output "$archive" >"$temp_root/product.log"7374 grep -Fq 'publisher_signature=pending-offline' "$temp_root/product.log"@@ -110,7 +111,7 @@ assert_rejected() {
110111 local tag="$3"111112 local output_dir="$temp_root/$name"112113 install -d -m 0700 "$output_dir"113- local output="$output_dir/sigil-$tag-bazzite-x86_64.tar.gz"114+ local output="$output_dir/sigil-$tag-linux-glibc2.17-x86_64.tar.gz"114115 local log="$output_dir/rejected.log"115116 if PATH="$temp_root/bin:$PATH" "$fixture_repo/scripts/package-bazzite-release.sh" \116117 --release-tag "$tag" --output "$output" >"$log" 2>&1@@ -69,8 +69,22 @@ assert_rejected inline-secret-key \
6969 assert_rejected missing-release-tag \7070 'product mode requires --release-tag vVERSION'7171 assert_rejected wrong-product-name \72- 'product output must be named sigil-v0.1.0-bazzite-x86_64.tar.gz' \72+ 'product output must be named sigil-v0.1.0-linux-glibc2.17-x86_64.tar.gz' \7373 --release-tag v0.1.074+legacy_contract="bazzite""-x86_64"75+legacy_output="$temp_root/sigil-v0.1.0-$legacy_contract.tar.gz"76+legacy_log="$temp_root/legacy-product-name.log"77+if "$package_script" --output "$legacy_output" --release-tag v0.1.0 \78+ >"$legacy_log" 2>&179+then80+ printf 'FAIL: distro-named product output unexpectedly succeeded\n' >&281+ exit 182+fi83+grep -Fq \84+ 'product output must be named sigil-v0.1.0-linux-glibc2.17-x86_64.tar.gz' \85+ "$legacy_log"86+[[ ! -e "$legacy_output" && ! -e "$legacy_output.sha256" \87+ && ! -e "$legacy_output.minisig" ]]7488 7589 development_output="$temp_root/development-supplied.tar.gz"7690 development_log="$temp_root/development-supplied.log"@@ -84,7 +84,7 @@ printf '%s\n' \
8484 ' esac' \8585 'done' \8686 '[[ "$tag" == v1.2.3 ]]' \87- '[[ "$(basename -- "$archive")" == sigil-v1.2.3-bazzite-x86_64.tar.gz ]]' \87+ '[[ "$(basename -- "$archive")" == sigil-v1.2.3-linux-glibc2.17-x86_64.tar.gz ]]' \8888 '[[ "$commit" =~ ^[0-9a-f]{40}$ ]]' \8989 '[[ -s "$archive.sha256" && "$(<"$archive.minisig")" == fixture-signature ]]' \9090 'grep -q fixture "$key"' \@@ -133,7 +133,7 @@ archive_dir="$temporary_root/sigil-assets"
133133 payload_root="$temporary_root/payload-root"134134 mkdir -p "$archive_dir" "$payload_root/payload/release"135135 cp "$sigil_bin" "$payload_root/payload/release/sigil"136-sigil_archive="$archive_dir/sigil-v1.2.3-bazzite-x86_64.tar.gz"136+sigil_archive="$archive_dir/sigil-v1.2.3-linux-glibc2.17-x86_64.tar.gz"137137 tar -czf "$sigil_archive" -C "$payload_root" payload138138 printf '%s\n' 'fixture checksum' > "$sigil_archive.sha256"139139 printf '%s\n' 'fixture-signature' > "$sigil_archive.minisig"@@ -401,7 +401,7 @@ rm "$fixture_repo/untracked-release-residue"
401401 402402 arbitrary_dir="$temporary_root/arbitrary-sigil"403403 mkdir "$arbitrary_dir"404-arbitrary_archive="$arbitrary_dir/sigil-v1.2.3-bazzite-x86_64.tar.gz"404+arbitrary_archive="$arbitrary_dir/sigil-v1.2.3-linux-glibc2.17-x86_64.tar.gz"405405 printf '%s\n' 'arbitrary text archive' > "$arbitrary_archive"406406 printf '%s\n' 'fixture checksum' > "$arbitrary_archive.sha256"407407 printf '%s\n' 'fixture-signature' > "$arbitrary_archive.minisig"@@ -0,0 +1,72 @@
1+2+3+set -euo pipefail4+5+script_dir="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"6+repo_dir="$(CDPATH='' cd -- "$script_dir/../.." && pwd -P)"7+contract_file="$repo_dir/release/sigil-target-contract.txt"8+expected_contract="linux-glibc2.17-x86_64"9+10+[[ -f "$contract_file" && ! -L "$contract_file" ]] \11+ || {12+ printf 'Sigil target contract file is missing or unsafe\n' >&213+ exit 114+ }15+[[ "$(wc -l <"$contract_file" | tr -d ' ')" == 1 ]] \16+ || {17+ printf 'Sigil target contract file must contain exactly one line\n' >&218+ exit 119+ }20+[[ "$(<"$contract_file")" == "$expected_contract" ]] \21+ || {22+ printf 'Sigil target contract does not match the approved build ABI\n' >&223+ exit 124+ }25+26+required_consumers=(27+ .github/workflows/portal-release.yml28+ .github/workflows/sigil-release.yml29+ AGENTS.md30+ README.md31+ docs/fresh-bazzite-host.md32+ docs/public-alpha-uat.md33+ docs/public-release-delivery.md34+ scripts/install-bazzite-package.sh35+ scripts/package-bazzite-release.sh36+ scripts/public-alpha-uat.sh37+ scripts/sign-bazzite-release.sh38+ scripts/verify-sigil-bootstrap.py39+ scripts/verify-sigil-release.sh40+ website/install-sigil41+)42+for relative in "${required_consumers[@]}"; do43+ grep -Fq "$expected_contract" "$repo_dir/$relative" || {44+ printf 'Sigil release target contract is missing from %s\n' "$relative" >&245+ exit 146+ }47+done48+49+# The old distro suffix may remain only in immutable Bazzite hardware-UAT50+# evidence and in the explicit migration note. It must never return as a51+# product release asset identity.52+while IFS=: read -r relative _ line; do53+ relative="${relative#./}"54+ case "$relative:$line" in55+ .github/workflows/sigil-hardware-uat.yml:*sigil-hardware-uat-*-bazzite-x86_64.tar.gz*) ;;56+ docs/hardware-uat/*:*sigil-hardware-uat-*-bazzite-x86_64.tar.gz*) ;;57+ scripts/run-bazzite-hardware-uat.sh:*sigil-hardware-uat-*-bazzite-x86_64.tar.gz*) ;;58+ docs/public-release-delivery.md:*candidates*using*bazzite-x86_64*) ;;59+ *)60+ printf 'legacy distro identity leaked outside its allowlist: %s: %s\n' \61+ "$relative" "$line" >&262+ exit 163+ ;;64+ esac65+done < <(66+ cd "$repo_dir"67+ rg -n --hidden --glob '!.git/**' --glob '!target/**' \68+ --glob '!scripts/tests/sigil-release-target-contract.sh' \69+ --fixed-strings 'bazzite-x86_64' .70+)71+72+printf 'sigil_release_target_contract_tests=ok\n'@@ -38,7 +38,7 @@ root = pathlib.Path(sys.argv[1])
3838 tag = sys.argv[2]3939 commit = sys.argv[3]4040 variant = sys.argv[4]41-asset = f"sigil-{tag}-bazzite-x86_64.tar.gz"41+asset = f"sigil-{tag}-linux-glibc2.17-x86_64.tar.gz"4242 archive_path = root / asset4343 4444 manifest = {@@ -154,10 +154,18 @@ assert_rejected() {
154154 155155 valid_dir="$temp_root/valid"156156 make_fixture "$valid_dir"157-archive="$valid_dir/sigil-$release_tag-bazzite-x86_64.tar.gz"157+archive="$valid_dir/sigil-$release_tag-linux-glibc2.17-x86_64.tar.gz"158158 "$verifier" --tag "$release_tag" --archive "$archive" \159159 --source-commit "$source_commit" --candidate | grep -Fq 'sigil_release_verification=ok'160160 161+legacy_contract="bazzite""-x86_64"162+legacy_archive="$valid_dir/sigil-$release_tag-$legacy_contract.tar.gz"163+cp "$archive" "$legacy_archive"164+cp "$archive.sha256" "$legacy_archive.sha256"165+assert_rejected legacy-distro-name \166+ "archive must be named sigil-$release_tag-linux-glibc2.17-x86_64.tar.gz" \167+ "$verifier" --tag "$release_tag" --archive "$legacy_archive" --candidate168+161169 printf 'not a signature\n' >"$archive.minisig"162170 key_file="$temp_root/test.pub"163171 printf '%s\n%s\n' 'untrusted comment: test key' \@@ -176,7 +184,7 @@ assert_rejected wrong-commit 'commit does not match' \
176184 177185 bad_checksum_dir="$temp_root/bad-checksum"178186 make_fixture "$bad_checksum_dir"179-bad_archive="$bad_checksum_dir/sigil-$release_tag-bazzite-x86_64.tar.gz"187+bad_archive="$bad_checksum_dir/sigil-$release_tag-linux-glibc2.17-x86_64.tar.gz"180188 printf '%064d %s\n' 0 "$(basename -- "$bad_archive")" >"$bad_archive.sha256"181189 assert_rejected bad-checksum 'checksum declaration does not exactly match' \182190 "$verifier" --tag "$release_tag" --archive "$bad_archive" --candidate@@ -184,7 +192,7 @@ assert_rejected bad-checksum 'checksum declaration does not exactly match' \
184192 for variant in symlink duplicate unexpected default-features demo-auth-bypass; do185193 fixture_dir="$temp_root/$variant"186194 make_fixture "$fixture_dir" "$variant"187- fixture_archive="$fixture_dir/sigil-$release_tag-bazzite-x86_64.tar.gz"195+ fixture_archive="$fixture_dir/sigil-$release_tag-linux-glibc2.17-x86_64.tar.gz"188196 case "$variant" in189197 symlink) expected='unsafe type' ;;190198 duplicate) expected='duplicate members' ;;@@ -26,7 +26,8 @@ SPEC.loader.exec_module(VERIFIER)
2626 PUBLISHER_KEY = base64.b64encode(b"Ed" + b"A" * 8 + b"B" * 32).decode("ascii")2727 OTHER_PUBLISHER_KEY = base64.b64encode(b"Ed" + b"C" * 8 + b"D" * 32).decode("ascii")2828 RELEASE_TAG = "v1.2.3-alpha.1"29-ASSET_NAME = f"sigil-{RELEASE_TAG}-bazzite-x86_64.tar.gz"29+ASSET_TARGET_CONTRACT = "linux-glibc2.17-x86_64"30+ASSET_NAME = f"sigil-{RELEASE_TAG}-{ASSET_TARGET_CONTRACT}.tar.gz"3031 ASSET_BASE = (3132 "https://github.com/FelineStateMachine/goq/releases/download/"3233 f"{RELEASE_TAG}/{ASSET_NAME}"@@ -178,12 +179,16 @@ class SigilBootstrapContractTests(unittest.TestCase):
178179 179180 def test_verifier_provisioning_is_bound_to_reviewed_exact_pins(self) -> None:180181 pins = VERIFIER.parse_bootstrap_pins(self.bootstrap_source)182+ self.assertEqual(pins["asset_target_contract"], ASSET_TARGET_CONTRACT)181183 self.assertEqual(pins["minisign_version"], MINISIGN_VERSION)182184 self.assertEqual(pins["minisign_url"], MINISIGN_URL)183185 self.assertEqual(pins["minisign_sha256"], MINISIGN_SHA256)184186 185187 public_key = "unconfigured\n"186188 replacements = {189+ f'readonly asset_target_contract="{ASSET_TARGET_CONTRACT}"': (190+ 'readonly asset_target_contract="' + "bazzite" + '-x86_64"'191+ ),187192 'readonly minisign_version="0.12"': 'readonly minisign_version="0.13"',188193 f'readonly minisign_url="{MINISIGN_URL}"': (189194 'readonly minisign_url="https://example.invalid/minisign.tar.gz"'@@ -13,6 +13,7 @@ import sys
1313 1414 REPOSITORY = "FelineStateMachine/goq"1515 UNCONFIGURED = "unconfigured"16+ASSET_TARGET_CONTRACT = "linux-glibc2.17-x86_64"1617 MINISIGN_VERSION = "0.12"1718 MINISIGN_URL = (1819 "https://github.com/jedisct1/minisign/releases/download/0.12/"@@ -56,6 +57,7 @@ def parse_bootstrap_pins(source: str) -> dict[str, str]:
5657 "repository",5758 "publisher_key",5859 "release_tag",60+ "asset_target_contract",5961 "minisign_version",6062 "minisign_url",6163 "minisign_sha256",@@ -67,6 +69,10 @@ def parse_bootstrap_pins(source: str) -> dict[str, str]:
6769 pins["repository"] == REPOSITORY,6870 "bootstrap repository pin is not the Goq release repository",6971 )72+ require(73+ pins["asset_target_contract"] == ASSET_TARGET_CONTRACT,74+ "bootstrap asset target contract is not the reviewed build ABI",75+ )7076 require(7177 pins["minisign_version"] == MINISIGN_VERSION,7278 "bootstrap Minisign version is not the reviewed verifier version",@@ -5,10 +5,12 @@ set -euo pipefail
55 usage() {66 cat <<'EOF'77 Usage: scripts/verify-sigil-release.sh \8- --tag vVERSION --archive /absolute/path/sigil-vVERSION-bazzite-x86_64.tar.gz \8+ --tag vVERSION --archive /absolute/path/sigil-vVERSION-linux-glibc2.17-x86_64.tar.gz \99 [--source-commit HEX] [--candidate | --public-key-file PATH]1010 11-Verify the exact Sigil Bazzite release asset contract without extracting it.11+Verify the exact Sigil Linux/glibc/x86_64 release asset contract without12+extracting it. This target identity does not broaden the separately validated13+host-distribution support boundary.1214 Candidate mode verifies a clean, unsigned product candidate before it crosses1315 the offline signing boundary. Published mode additionally requires and verifies1416 ARCHIVE.minisig with the reviewed Minisign public key file.@@ -20,6 +22,17 @@ die() {
2022 exit 12123 }2224 25+script_dir="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"26+repo_dir="$(CDPATH='' cd -- "$script_dir/.." && pwd -P)"27+asset_target_contract_file="$repo_dir/release/sigil-target-contract.txt"28+[[ -f "$asset_target_contract_file" && ! -L "$asset_target_contract_file" ]] \29+ || die "Sigil asset target contract is missing or unsafe"30+[[ "$(wc -l <"$asset_target_contract_file" | tr -d ' ')" == 1 ]] \31+ || die "Sigil asset target contract must contain exactly one line"32+asset_target_contract="$(<"$asset_target_contract_file")"33+[[ "$asset_target_contract" == linux-glibc2.17-x86_64 ]] \34+ || die "Sigil asset target contract does not match the approved Linux build target"35+2336 sha256_file() {2437 if command -v sha256sum >/dev/null 2>&1; then2538 sha256sum "$1" | awk '{print $1}'@@ -75,7 +88,7 @@ done
7588 [[ "$archive_path" == /* ]] || die "--archive must be absolute"7689 [[ -f "$archive_path" && ! -L "$archive_path" ]] || die "archive is missing or unsafe"7790 78-asset_name="sigil-$release_tag-bazzite-x86_64.tar.gz"91+asset_name="sigil-$release_tag-$asset_target_contract.tar.gz"7992 [[ "$(basename -- "$archive_path")" == "$asset_name" ]] \8093 || die "archive must be named $asset_name"8194 checksum_path="$archive_path.sha256"@@ -9,6 +9,7 @@ readonly release_tag="unconfigured"
99 readonly minisign_version="0.12"1010 readonly minisign_url="https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-linux.tar.gz"1111 readonly minisign_sha256="9a599b48ba6eb7b1e80f12f36b94ceca7c00b7a5173c95c3efc88d9822957e73"12+readonly asset_target_contract="linux-glibc2.17-x86_64"1213 1314 die() {1415 printf 'Sigil setup failed: %s\n' "$*" >&2@@ -32,7 +33,7 @@ done
3233 [[ "$release_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z][0-9A-Za-z.-]*)?$ ]] \3334 || die "the release tag is malformed"3435 35-asset_name="sigil-$release_tag-bazzite-x86_64.tar.gz"36+asset_name="sigil-$release_tag-$asset_target_contract.tar.gz"3637 asset_base="https://github.com/$repository/releases/download/$release_tag/$asset_name"3738 temp_parent="${TMPDIR:-/tmp}"3839 temp_parent="${temp_parent%/}"