Test: Add installer provenance boundary

2026-08-27 05:43:26 -04:00
parent fc8f226747
commit 27acbe7a95
20 changed files with 915 additions and 0 deletions
@@ -0,0 +1,74 @@
+# Installer provenance
+
+Reviewed on 2026-08-27. `installers.conf` is data, not a shell fragment: the
+installer reads it only with `load_installer_provenance`. Its versions, URLs,
+SHA-256 values, byte limits, and complete primary fingerprints are reviewed
+inputs. No installer path may substitute a `latest` URL or execute fetched
+content before the applicable verification succeeds.
+
+## Key retrieval and verification
+
+Each command below was run in a private temporary directory on 2026-08-27.
+The resulting armored public key is vendored under `keys/`; each output was
+checked with the listed complete primary fingerprint before it was committed.
+
+| Key | Source URL | Expected primary fingerprint | Verification command |
+| --- | --- | --- | --- |
+| Terra 44 | `https://repos.fyralabs.com/terra44/key.asc` | `AE09157A4DE88B497EA1D5D300CDAB43DE226D6F` | `gpg --batch --with-colons --import-options show-only --import terra44.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
+| Anthropic Claude Code | `https://downloads.claude.ai/keys/claude-code.asc` | `31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE` | `gpg --batch --with-colons --import-options show-only --import claude-code.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
+| Bun releases | `https://keys.openpgp.org/vks/v1/by-fingerprint/F3DCC08A8572C0749B3E18888EAB4D40A7B22B59` | `F3DCC08A8572C0749B3E18888EAB4D40A7B22B59` | `gpg --batch --with-colons --import-options show-only --import bun.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
+| RPM Fusion free | `https://download1.rpmfusion.org/free/fedora/RPM-GPG-KEY-rpmfusion-free-fedora-2020` | `E9A491A3DE247814E7E067EAE06F8ECDD651FF2E` | `gpg --batch --with-colons --import-options show-only --import rpmfusion-free.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
+| RPM Fusion nonfree | `https://download1.rpmfusion.org/nonfree/fedora/RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020` | `79BDB88F9BBF73910FD4095B6A2AF96194843C65` | `gpg --batch --with-colons --import-options show-only --import rpmfusion-nonfree.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
+| lionheartp/Hyprland COPR | `https://download.copr.fedorainfracloud.org/results/lionheartp/Hyprland/pubkey.gpg` | `97E23476C89635135407C7D5E9BA41342C4B2995` | `gpg --batch --with-colons --import-options show-only --import hyprland-copr.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
+| Flathub | `https://flathub.org/repo/flathub.flatpakrepo` | `6E5C05D979C76DAF93C081354184DD4D907A7CAE` | `awk -F= '/^GPGKey=/{print $2}' flathub.flatpakrepo \| base64 --decode \| gpg --batch --with-colons --import-options show-only --import \| awk -F: '$1 == "fpr" { print $10; exit }'` |
+| Claude Desktop Extra | `https://patrickjaja.github.io/claude-desktop-extra/gpg-key.asc` | `825A7D15D78BABE45646D5DF382409F597908867` | `gpg --batch --with-colons --import-options show-only --import claude-desktop.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
+
+The retrieval command for every direct key was:
+
+```bash
+curl --fail --location --connect-timeout 10 --max-time 60 --output KEY.asc SOURCE_URL
+```
+
+## Reviewed publisher records and artifact locations
+
+The key sources above are supported by these publisher-controlled records:
+
+- `https://github.com/terrapkg/packages/blob/frawhide/README.md`
+- `https://github.com/terrapkg/packages/discussions/7736`
+- `https://code.claude.com/docs/en/setup`
+- `https://github.com/oven-sh/bun/releases/tag/bun-v1.4.0`
+- `https://github.com/oven-sh/bun/blob/main/dockerhub/distroless/Dockerfile`
+- `https://github.com/nodejs/node/releases/tag/v24.20.0`
+- `https://github.com/nodejs/node/blob/main/README.md`
+- `https://github.com/openai/codex/releases/tag/rust-v0.150.1`
+- `https://github.com/openai/codex/blob/main/.github/workflows/rust-release.yml`
+- `https://github.com/rustdesk/rustdesk/releases/tag/1.4.9`
+
+The reviewed immutable artifact and repository URLs are:
+
+- `https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-x64.zip`
+- `https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip`
+- `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.xz`
+- `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz`
+- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz`
+- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz`
+- `https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm`
+- `https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-44.noarch.rpm`
+- `https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-44.noarch.rpm`
+- `https://repos.fyralabs.com/terra44`
+- `https://download.copr.fedorainfracloud.org/results/lionheartp/Hyprland/fedora-$releasever-$basearch/`
+- `https://downloads.claude.ai/claude-code/rpm/stable`
+- `https://patrickjaja.github.io/claude-desktop-extra/rpm/`
+
+Artifact digests were checked with `sha256sum ARTIFACT` against the lowercase
+64-hex values in `installers.conf`; all runtime downloads also enforce the
+recorded byte limit before atomic replacement.
+
+## Rotation policy
+
+Do not replace a key on an automated update. A key rotation is a reviewed
+repository change: obtain the new key from the publisher record, independently
+confirm its complete primary fingerprint, update the vendored key and
+`installers.conf` together, refresh this retrieval record, and add a focused
+contract case if the verification behavior changes. Until that review lands,
+verification fails closed and preserves any known-good destination.