mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 18:45:53 +00:00
rcourtman
2f0468a87b
The unattended timer (scripts/pulse-auto-update.sh) and the public bootstrap (scripts/install.sh, /install.sh) all verify the .sshsig sidecar against the pinned pulse-installer ed25519 key before trusting a release artifact. The in-app updater verified SHA256 only — same artifact, same root execution context, lower trust bar. Closing the asymmetry: the in-app tarball download in ApplyUpdate, adapter_installsh.go's install.sh download (piped into bash as root), and the rollback binary download now fetch and verify the .sshsig sidecar against the same pinned key, fail-closed. The signing infrastructure (release_asset_common.sh, validate-release.sh, backfill-release-assets.sh) already produces and validates these signatures for every release; this teaches the Go updater to honor what the shell paths have always required. ssh-keygen is shelled out to so the in-app updater shares the exact trust path used by the unattended path, with a package-level function variable for test injection so unit tests don't require ssh-keygen on the build host. Extends the deployment-installability contract's release-trust-fail-closed invariant to cover the in-app updater paths.