From 4c3e0756e3bc74596782ff24ddfcbfef084c2866 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Mon, 13 Jul 2026 16:27:04 +0100 Subject: [PATCH] Guard the allowed_signers format in the install verification docs --- scripts/installtests/build_release_assets_test.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go index 7123731da..00c71bed4 100644 --- a/scripts/installtests/build_release_assets_test.go +++ b/scripts/installtests/build_release_assets_test.go @@ -523,6 +523,15 @@ func TestReleaseValidationRequiresSignedSidecars(t *testing.T) { if strings.Contains(readme, staleReadmeKey) { t.Fatalf("README.md still references the stale pulse-installer key Ds21c5...; rc.2 → rc.5 shipped this drift") } + // Format drift guard — ssh-keygen -Y verify -f expects an allowed_signers + // file whose FIRST field is the principal. The docs shipped the key in + // authorized_keys order (principal last, parsed as a comment), so the + // documented verification failed against a perfectly good signature. + // Reported by a customer against v6.0.5 on 2026-07-13. + const allowedSignersLine = `pulse-installer namespaces="pulse-install" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZd/DaH+BldzOkq1A8KVTcFk73nAyrE8aJOyf7i00jm pulse-installer` + if !strings.Contains(readme, allowedSignersLine) { + t.Fatalf("README.md verification snippet must publish the key as an allowed_signers line (principal first), not authorized_keys order") + } installDocsBytes, err := os.ReadFile(repoFile("docs", "INSTALL.md")) if err != nil { @@ -535,6 +544,9 @@ func TestReleaseValidationRequiresSignedSidecars(t *testing.T) { if strings.Contains(installDocs, staleReadmeKey) { t.Fatalf("docs/INSTALL.md still references the stale pulse-installer key Ds21c5...") } + if !strings.Contains(installDocs, allowedSignersLine) { + t.Fatalf("docs/INSTALL.md verification snippet must publish the key as an allowed_signers line (principal first), not authorized_keys order") + } for _, needle := range localRequired { if !strings.Contains(localValidator, needle) { t.Fatalf("validate-release.sh missing signed sidecar validation: %s", needle)