gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-10 10:35:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

Require VCS metadata in rootless packet builds

Browse Source
This commit is contained in:
rcourtman
2026-09-01 19:37:23 +01:00
parent 67dce69e73
commit e89eaac9d4
4 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/release-control/v6/internal/subsystems/agent-lifecycle.md
+4
View File
@@ -7338,6 +7338,10 @@ standalone `secure-runtime-rootless-v1` receipt only after exact socket
ownership, daemon rootless attestation, installer pinning, direct telemetry,
same-family typed-helper fallback, recovery without collector restart,
ambiguity refusal, authority isolation, and cleanup are recorded.
The wrapper must compile every Go artifact with mandatory VCS stamping so a
missing revision or unavailable clean-worktree proof fails before live evidence
can be emitted; the receipt and validator retain the exact artifact hashes and
source commit.
Any failed runtime test must retain the disposable host's systemd journal and
container log before strict nonce-bound cleanup; a missing receipt never
silently substitutes for causal failure evidence.
docs/release-control/v6/internal/subsystems/deployment-installability.md
+3 -1
View File
@@ -278,7 +278,9 @@ Its standalone `secure-runtime-rootless-v1` receipt must bind the exact
qualification, collector, helper, installer, source-manifest, socket,
fresh-install, legacy-migration, restart, fallback, recovery, ambiguity,
authority, and cleanup evidence before the independent validator can emit a
local artifact-bound self-attestation. Checking in the harness or passing its
local artifact-bound self-attestation. All three Go artifacts require explicit
VCS stamping at build time; unavailable revision or clean-worktree metadata is
a build failure rather than an attestable omission. Checking in the harness or passing its
ordinary contract tests is not live qualification. Until a complete
secret-free receipt and attestation are retained, this surface remains
implemented-but-unqualified and cannot change the opt-in safe-profile default.
scripts/installtests/secure_runtime_rootless_qualification_test.go
+3
View File
@@ -1605,6 +1605,9 @@ func TestRootlessQualificationGuardAndWrapperInvariants(t *testing.T) {
t.Fatalf("rootless qualification wrapper missing %q", required)
}
}
if count := strings.Count(script, `-buildvcs=true`); count != 3 {
t.Fatalf("rootless qualification wrapper must require VCS metadata for all three Go artifacts: got %d", count)
}
for _, forbidden := range []string{"/var/run/docker.sock:", "/run/podman/podman.sock:", "/sys/fs/cgroup:/sys/fs/cgroup", "--cgroupns=host", "-v $", "--volume"} {
if strings.Contains(script, forbidden) {
t.Fatalf("rootless qualification wrapper contains forbidden host-runtime mount marker %q", forbidden)
scripts/run-secure-runtime-rootless-qualification.sh
+3 -3
View File
@@ -152,9 +152,9 @@ helper_ldflags="$(cd "${REPO_ROOT}" && ./scripts/release_ldflags.sh agent --vers
(
cd "${REPO_ROOT}"
CGO_ENABLED=0 GOOS=linux GOARCH="$(go env GOARCH)" GOFLAGS= GOWORK=off go build -trimpath -ldflags "${agent_ldflags}" -o "${PACKET_DIR}/pulse-agent" ./cmd/pulse-agent
CGO_ENABLED=0 GOOS=linux GOARCH="$(go env GOARCH)" GOFLAGS= GOWORK=off go build -trimpath -ldflags "${helper_ldflags}" -o "${PACKET_DIR}/pulse-agent-helper" ./cmd/pulse-agent-helper
CGO_ENABLED=0 GOOS=linux GOARCH="$(go env GOARCH)" GOFLAGS= GOWORK=off go test -c -trimpath -o "${PACKET_DIR}/dockeragent.test" ./scripts/installtests
CGO_ENABLED=0 GOOS=linux GOARCH="$(go env GOARCH)" GOFLAGS= GOWORK=off go build -trimpath -buildvcs=true -ldflags "${agent_ldflags}" -o "${PACKET_DIR}/pulse-agent" ./cmd/pulse-agent
CGO_ENABLED=0 GOOS=linux GOARCH="$(go env GOARCH)" GOFLAGS= GOWORK=off go build -trimpath -buildvcs=true -ldflags "${helper_ldflags}" -o "${PACKET_DIR}/pulse-agent-helper" ./cmd/pulse-agent-helper
CGO_ENABLED=0 GOOS=linux GOARCH="$(go env GOARCH)" GOFLAGS= GOWORK=off go test -c -trimpath -buildvcs=true -o "${PACKET_DIR}/dockeragent.test" ./scripts/installtests
)
openssl pkeyutl -sign -rawin -inkey "${PACKET_DIR}/update-private.pem" -in "${PACKET_DIR}/pulse-agent" | openssl base64 -A >"${PACKET_DIR}/pulse-agent.sig"
printf '\n' >>"${PACKET_DIR}/pulse-agent.sig"