pulse

mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-10 18:45:53 +00:00

Files

T

rcourtman ce7d7c1956 Fix stale README signature key and guard against future drift

The README's secure-install snippet has pinned the wrong ed25519 key
since commit a60fa03d7 (April 22, 2026), so v6 rc.2 through rc.5 all
shipped with a documented verification step that does not work.

I downloaded the published rc.5 install.sh + install.sh.sshsig and
ran ssh-keygen -Y verify with both candidate keys:
  Ds21c5... (README's pinned key) -> Could not verify signature
  MZd/DaH... (key embedded in install.sh and pulse-auto-update.sh) -> OK

Customers who actually followed the README's secure-install path saw
"Could not verify signature" and aborted. Most users curl-pipe the
script unverified so the drift went unreported.

Replace the stale key in README.md and docs/INSTALL.md with the actual
pipeline signing key (MZd/...).

Add a validate-release.sh smoke that extracts the README's pinned key
and runs the exact ssh-keygen -Y verify command against the signed
install.sh.sshsig. Any future drift between documented key and actual
signing key fails the release before publish.

Lock both the correct-key presence and the stale-key absence in
build_release_assets_test.go for README and docs/INSTALL.md so a manual
edit cannot regress the docs back to the broken state.

2026-05-12 10:30:42 +01:00

backfill_release_assets_test.go

Add historical release asset backfill workflow

2026-04-22 17:25:58 +01:00

build_release_assets_test.go

Fix stale README signature key and guard against future drift

2026-05-12 10:30:42 +01:00

docker_entrypoint_test.go

Avoid tenant runtime image copy-up

2026-04-24 09:21:42 +01:00

install_docker_sh_test.go

Fix RC4 release validation blockers