diff --git a/docs/MSP.md b/docs/MSP.md index 855a76365..cb746ec8a 100644 --- a/docs/MSP.md +++ b/docs/MSP.md @@ -271,7 +271,7 @@ before money changes hands. ### Evaluating without a licence Self-service evaluation is available from the signed provider bundle published -with Pulse v6.2.1. Use this exact release asset and its integrity sidecars; do +with Pulse v6.4.1. Use this exact release asset and its integrity sidecars; do **not** download the moving `main` branch archive or run its `setup.sh` as root. For a later release, first confirm its release page contains the versioned provider archive, checksum, and SSH signature before changing the @@ -281,7 +281,7 @@ Download the versioned asset, verify it with Pulse's pinned release key, and only then extract and run the guided setup: ```bash -export PULSE_VERSION=v6.2.1 +export PULSE_VERSION=v6.4.1 export PULSE_MSP_BUNDLE="pulse-provider-msp-${PULSE_VERSION}.tar.gz" export PULSE_RELEASE_BASE="https://github.com/rcourtman/Pulse/releases/download/${PULSE_VERSION}" @@ -301,8 +301,11 @@ cd "pulse-provider-msp-${PULSE_VERSION}" sudo -E bash ./setup.sh ``` -The v6.2.1 evaluation request is anonymous. If you want setup help, start from -the [Pulse MSP evaluation page](https://pulserelay.pro/msp.html#evaluate) first; +The licence request omits an email address unless you export +`PULSE_PROVIDER_MSP_EVAL_EMAIL` before running `setup.sh`, in which case that +address is included in the request. If you +want setup help, start from the +[Pulse MSP evaluation page](https://pulserelay.pro/msp.html#evaluate) first; that contact request remains separate from the licence activation. The host needs Ubuntu 24.04 or similar, a domain you can point at it, and @@ -313,9 +316,11 @@ Traefik dnsChallenge provider works by setting `ACME_DNS_PROVIDER` in `.env` and putting that provider's credential variables in `dns-credentials.env`. Leave `CP_PROVIDER_MSP_LICENSE_FILE` blank and `setup.sh` self-issues a -2-client evaluation licence. The v6.2.1 bundle sends only the public half of -the signing key generated on your host. The private key, client inventory, -credentials, and contact details never leave the machine. You can then onboard +2-client evaluation licence. The v6.4.1 bundle sends the public half of the +signing key generated on your host, a setup-stage marker, and a signup-source +label, plus the optional email address. This licence-request payload does not +include the private key, client inventory or credentials; this is not a claim +that setup makes no other network requests. You can then onboard two real clients and confirm the isolation boundary on your own infrastructure before buying. diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index 02ffbb702..d99a4ef3e 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -5373,3 +5373,20 @@ trust suite verifies every consumer pin, absence of the affected auth assumption workflow trust controls and the retained native Windows command/lifecycle proof steps. Native Windows execution remains a hosted check, not a local Linux claim. This upgrade is independent of the grouped signing/Docker/Tailscale updates. + +### Published MSP evaluation bundle guidance + +The MSP guide and its shipped mirror select the signed v6.4.1 provider archive, +not a moving source archive. Verification of the pinned SSH identity/namespace +and checksum precedes extraction and privileged setup. The licence request +contains the generated public key, setup-stage and signup-source fields, plus +email only when explicitly supplied. Describe that request rather than asserting +anonymous setup or absence of all outbound credentials/network traffic. + +`TestProviderMSPEvaluationDocsUsePublishedSignedBundle` checks the synchronized +guides, exact version, verification commands and bounded payload disclosure. +Retained provider delivery verification establishes archive SHA256 +`a2f3f6df98385e7dbc47e5df9ca014046b8d81eba353420d8f22a668de621b88`, +a valid pinned SSH signature and the extracted request expression with absent +and synthetic email. It does not establish installed onboarding, server acceptance +or legal identity. See the qualification evidence below. diff --git a/frontend-modern/public/docs/MSP.md b/frontend-modern/public/docs/MSP.md index 855a76365..cb746ec8a 100644 --- a/frontend-modern/public/docs/MSP.md +++ b/frontend-modern/public/docs/MSP.md @@ -271,7 +271,7 @@ before money changes hands. ### Evaluating without a licence Self-service evaluation is available from the signed provider bundle published -with Pulse v6.2.1. Use this exact release asset and its integrity sidecars; do +with Pulse v6.4.1. Use this exact release asset and its integrity sidecars; do **not** download the moving `main` branch archive or run its `setup.sh` as root. For a later release, first confirm its release page contains the versioned provider archive, checksum, and SSH signature before changing the @@ -281,7 +281,7 @@ Download the versioned asset, verify it with Pulse's pinned release key, and only then extract and run the guided setup: ```bash -export PULSE_VERSION=v6.2.1 +export PULSE_VERSION=v6.4.1 export PULSE_MSP_BUNDLE="pulse-provider-msp-${PULSE_VERSION}.tar.gz" export PULSE_RELEASE_BASE="https://github.com/rcourtman/Pulse/releases/download/${PULSE_VERSION}" @@ -301,8 +301,11 @@ cd "pulse-provider-msp-${PULSE_VERSION}" sudo -E bash ./setup.sh ``` -The v6.2.1 evaluation request is anonymous. If you want setup help, start from -the [Pulse MSP evaluation page](https://pulserelay.pro/msp.html#evaluate) first; +The licence request omits an email address unless you export +`PULSE_PROVIDER_MSP_EVAL_EMAIL` before running `setup.sh`, in which case that +address is included in the request. If you +want setup help, start from the +[Pulse MSP evaluation page](https://pulserelay.pro/msp.html#evaluate) first; that contact request remains separate from the licence activation. The host needs Ubuntu 24.04 or similar, a domain you can point at it, and @@ -313,9 +316,11 @@ Traefik dnsChallenge provider works by setting `ACME_DNS_PROVIDER` in `.env` and putting that provider's credential variables in `dns-credentials.env`. Leave `CP_PROVIDER_MSP_LICENSE_FILE` blank and `setup.sh` self-issues a -2-client evaluation licence. The v6.2.1 bundle sends only the public half of -the signing key generated on your host. The private key, client inventory, -credentials, and contact details never leave the machine. You can then onboard +2-client evaluation licence. The v6.4.1 bundle sends the public half of the +signing key generated on your host, a setup-stage marker, and a signup-source +label, plus the optional email address. This licence-request payload does not +include the private key, client inventory or credentials; this is not a claim +that setup makes no other network requests. You can then onboard two real clients and confirm the isolation boundary on your own infrastructure before buying. diff --git a/scripts/installtests/provider_msp_deploy_test.go b/scripts/installtests/provider_msp_deploy_test.go index e53cace76..113218d23 100644 --- a/scripts/installtests/provider_msp_deploy_test.go +++ b/scripts/installtests/provider_msp_deploy_test.go @@ -498,20 +498,27 @@ func TestProviderMSPEvaluationDocsUsePublishedSignedBundle(t *testing.T) { doc := string(repoDocBytes) assertContainsAll(t, doc, "signed provider bundle published", - "with Pulse v6.2.1", + "with Pulse v6.4.1", "**not** download the moving `main` branch archive", - `export PULSE_VERSION=v6.2.1`, + `export PULSE_VERSION=v6.4.1`, `PULSE_MSP_BUNDLE="pulse-provider-msp-${PULSE_VERSION}.tar.gz"`, `releases/download/${PULSE_VERSION}`, "ssh-keygen -Y verify", `-s "${PULSE_MSP_BUNDLE}.sshsig" < "${PULSE_MSP_BUNDLE}"`, `sha256sum -c "${PULSE_MSP_BUNDLE}.sha256"`, - "The v6.2.1 evaluation request is anonymous", + "The licence request omits an email address unless you export", + "`PULSE_PROVIDER_MSP_EVAL_EMAIL` before running `setup.sh`", + "address is included in the request", + "a setup-stage marker, and a signup-source", + "this is not a claim", + "that setup makes no other network requests", "contact request remains separate from the licence activation", `sudo -E bash ./setup.sh`, ) assertNotContainsAny(t, doc, "Pulse/archive/refs/heads/main.tar.gz", + "evaluation request is anonymous", + "credentials never leave the", "cd Pulse-main/deploy/provider-msp", "sudo -E ./setup.sh", ) diff --git a/tests/qualification/provider-delivery/README.md b/tests/qualification/provider-delivery/README.md new file mode 100644 index 000000000..f117d2004 --- /dev/null +++ b/tests/qualification/provider-delivery/README.md @@ -0,0 +1,19 @@ +# Provider bundle delivery verification — 9 September 2026 + +The public v6.4.1 release delivered `pulse-provider-msp-v6.4.1.tar.gz` and its +`.sha256` and `.sshsig` sidecars. Retained verification: +- SHA256: a2f3f6df98385e7dbc47e5df9ca014046b8d81eba353420d8f22a668de621b88 +- Checksum verification passed. +- SSH signature verification passed using identity `pulse-installer`, + namespace `pulse-install`, fingerprint + `SHA256:WjzDnbyb4fF3hPGRE1ZLtYcXzLimGpJq6Ou4opquTV0`. +- Extracted setup.sh lines 23–24 default email empty and source + `provider_msp_setup`; lines 410–419 form the licence request. +- Offline execution of that exact jq expression passed with absent email and + synthetic .invalid email, checking the complete field allowlist. + +These are retained delivery and offline payload results, not a new installation +test. Setup, key generation, licence activation and customer lookup were not run. +The current documentation regression checks version selection, signature/checksum +commands, request-specific disclosure and byte-identical shipped documentation. +This does not qualify later provider archives or prove server-side acceptance.