Reapply release qualification corrections

Harden workflow-scoped kind and kubectl setup with deterministic checksum validation and keep native-platform test fixtures portable.

Contract-Neutral: Release-workflow hardening and test-fixture portability do not change the product runtime contract.

.github/workflows/qualify-release-containers.yml

@@ -133,31 +133,38 @@ jobs:
             local name="$1"
             local url="$2"
             local expected_sha="$3"
+            local destination="$RUNNER_TEMP/$name"
+            local download="$destination.download"
             local installed_path=""
             installed_path="$(command -v "$name" 2>/dev/null || true)"
 
             if [ -n "$installed_path" ] && printf '%s  %s\n' "$expected_sha" "$installed_path" | sha256sum --check --status; then
-              ln -sf "$installed_path" "$RUNNER_TEMP/$name"
+              install -m 0755 "$installed_path" "$destination"
             else
-              curl -fsSL -o "$RUNNER_TEMP/$name" "$url"
-              printf '%s  %s\n' "$expected_sha" "$RUNNER_TEMP/$name" | sha256sum --check
-              chmod +x "$RUNNER_TEMP/$name"
+              rm -f "$download"
+              curl -fsSL -o "$download" "$url"
+              printf '%s  %s\n' "$expected_sha" "$download" | sha256sum --check
+              chmod 0755 "$download"
+              mv "$download" "$destination"
             fi
+
+            printf '%s  %s\n' "$expected_sha" "$destination" | sha256sum --check
+            test -x "$destination"
           }
 
           prepare_cluster_tool \
             kind \
             https://kind.sigs.k8s.io/dl/v0.20.0/kind-linux-amd64 \
-            513a7213d6d3332dd9ef27c24dab35e5ef10a04fa27274fe1c14d8a246493ded &
-          kind_setup_pid=$!
+            513a7213d6d3332dd9ef27c24dab35e5ef10a04fa27274fe1c14d8a246493ded
           prepare_cluster_tool \
             kubectl \
             https://dl.k8s.io/release/v1.27.3/bin/linux/amd64/kubectl \
-            fba6c062e754a120bc8105cde1344de200452fe014a8759e06e4eec7ed258a09 &
-          kubectl_setup_pid=$!
-          wait "$kind_setup_pid"
-          wait "$kubectl_setup_pid"
+            fba6c062e754a120bc8105cde1344de200452fe014a8759e06e4eec7ed258a09
           export PATH="$RUNNER_TEMP:$PATH"
+          test "$(command -v kind)" = "$RUNNER_TEMP/kind"
+          test "$(command -v kubectl)" = "$RUNNER_TEMP/kubectl"
+          kind version
+          kubectl version --client=true
 
           cleanup
           kind create cluster --name pulse-test --wait 5m

internal/dockeragent/registry_credentials_test.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -35,18 +36,30 @@ func basicAuthValue(username, secret string) string {
 }
 
 func newTestCredentialStore(files map[string]string, env map[string]string) *dockerConfigCredentials {
+	nativeFiles := make(map[string]string, len(files))
+	for path, content := range files {
+		nativeFiles[filepath.FromSlash(path)] = content
+	}
+	nativeEnv := make(map[string]string, len(env))
+	for key, value := range env {
+		switch key {
+		case "HOME", "DOCKER_CONFIG", "REGISTRY_AUTH_FILE", "XDG_RUNTIME_DIR":
+			value = filepath.FromSlash(value)
+		}
+		nativeEnv[key] = value
+	}
 	c := &dockerConfigCredentials{
 		logger: zerolog.Nop(),
 		cache:  map[string]credentialCacheEntry{},
-		getenv: func(key string) string { return env[key] },
+		getenv: func(key string) string { return nativeEnv[key] },
 		homeDir: func() (string, error) {
-			if home, ok := env["HOME"]; ok {
+			if home, ok := nativeEnv["HOME"]; ok {
 				return home, nil
 			}
 			return "", errors.New("no home")
 		},
 		readFile: func(path string) ([]byte, error) {
-			if content, ok := files[path]; ok {
+			if content, ok := nativeFiles[path]; ok {
 				return []byte(content), nil
 			}
 			return nil, os.ErrNotExist
@@ -272,7 +285,7 @@ func TestDockerConfigCredentials_CacheAvoidsRepeatResolution(t *testing.T) {
 	store := newTestCredentialStore(nil, map[string]string{"HOME": "/home/agent"})
 	store.readFile = func(path string) ([]byte, error) {
 		reads++
-		if path == "/home/agent/.docker/config.json" {
+		if path == filepath.FromSlash("/home/agent/.docker/config.json") {
 			return []byte(fmt.Sprintf(`{"auths":{"registry.example.com":{"auth":%q}}}`, auth)), nil
 		}
 		return nil, os.ErrNotExist

internal/hostagent/privilege_test.go

@@ -2,6 +2,7 @@ package hostagent
 
 import (
 	"os"
+	"path/filepath"
 	"testing"
 )
 
@@ -35,7 +36,8 @@ func TestCollectPrivilegeStatusReportsHelperOverrides(t *testing.T) {
 }
 
 func TestResolvePctPathHonorsAbsoluteOverride(t *testing.T) {
-	t.Setenv("PULSE_PCT_PATH", "/usr/local/lib/pulse-agent/pct-helper")
+	override := filepath.Join(t.TempDir(), "pct-helper")
+	t.Setenv("PULSE_PCT_PATH", override)
 
 	resolved, err := resolvePctPath(func(string) (string, error) {
 		t.Fatal("lookPath must not be consulted when the override is set")
@@ -44,7 +46,7 @@ func TestResolvePctPathHonorsAbsoluteOverride(t *testing.T) {
 	if err != nil {
 		t.Fatalf("resolvePctPath: %v", err)
 	}
-	if resolved != "/usr/local/lib/pulse-agent/pct-helper" {
+	if resolved != override {
 		t.Fatalf("resolved = %q", resolved)
 	}
 }

scripts/installtests/build_release_assets_test.go

@@ -1343,8 +1343,12 @@ func TestReleaseWorkflowsUseSecretSafeAttestedImageBuilds(t *testing.T) {
 		`513a7213d6d3332dd9ef27c24dab35e5ef10a04fa27274fe1c14d8a246493ded`,
 		`https://dl.k8s.io/release/v1.27.3/bin/linux/amd64/kubectl`,
 		`fba6c062e754a120bc8105cde1344de200452fe014a8759e06e4eec7ed258a09`,
-		`wait "$kind_setup_pid"`,
-		`wait "$kubectl_setup_pid"`,
+		`printf '%s  %s\n' "$expected_sha" "$destination" | sha256sum --check`,
+		`test -x "$destination"`,
+		`test "$(command -v kind)" = "$RUNNER_TEMP/kind"`,
+		`test "$(command -v kubectl)" = "$RUNNER_TEMP/kubectl"`,
+		`kind version`,
+		`kubectl version --client=true`,
 		`./scripts/prepare-release-container-context.sh`,
 		`container_artifact_name`,
 		`container_artifact: ${{ needs.build_release_candidate.outputs.container_artifact_name }}`,