gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WIP: Paused over-hardening fix wave (boot checkout verification, double-read package manifest)

Browse Source
This commit is contained in:
Gabriel Brown
2026-09-17 11:44:01 -04:00
parent 28e387868f
commit a69cacc006
14 changed files with 2549 additions and 326 deletions
Download Patch File Download Diff File Expand all files Collapse all files
setup/provenance/README.md
+52 -31
View File
@@ -11,17 +11,24 @@ content before the applicable verification succeeds.
Each command below was run in a private temporary directory on 2026-08-27.
The resulting armored public key is vendored under `keys/`; each output was
checked with the listed complete primary fingerprint before it was committed.
The verification commands use Panama's status-preserving helper: it captures
GPG's output only after GPG succeeds, then requires exactly one primary key.
```bash
source setup/lib/artifact-provenance
key_fingerprint_matches KEY.asc EXPECTED_COMPLETE_PRIMARY_FINGERPRINT
```
| Key | Source URL | Expected primary fingerprint | Verification command |
| --- | --- | --- | --- |
| Terra 44 | `https://repos.fyralabs.com/terra44/key.asc` | `AE09157A4DE88B497EA1D5D300CDAB43DE226D6F` | `gpg --batch --with-colons --import-options show-only --import terra44.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
| Anthropic Claude Code | `https://downloads.claude.ai/keys/claude-code.asc` | `31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE` | `gpg --batch --with-colons --import-options show-only --import claude-code.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
| Bun releases | `https://keys.openpgp.org/vks/v1/by-fingerprint/F3DCC08A8572C0749B3E18888EAB4D40A7B22B59` | `F3DCC08A8572C0749B3E18888EAB4D40A7B22B59` | `gpg --batch --with-colons --import-options show-only --import bun.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
| RPM Fusion free | `https://download1.rpmfusion.org/free/fedora/RPM-GPG-KEY-rpmfusion-free-fedora-2020` | `E9A491A3DE247814E7E067EAE06F8ECDD651FF2E` | `gpg --batch --with-colons --import-options show-only --import rpmfusion-free.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
| RPM Fusion nonfree | `https://download1.rpmfusion.org/nonfree/fedora/RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020` | `79BDB88F9BBF73910FD4095B6A2AF96194843C65` | `gpg --batch --with-colons --import-options show-only --import rpmfusion-nonfree.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
| lionheartp/Hyprland COPR | `https://download.copr.fedorainfracloud.org/results/lionheartp/Hyprland/pubkey.gpg` | `97E23476C89635135407C7D5E9BA41342C4B2995` | `gpg --batch --with-colons --import-options show-only --import hyprland-copr.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
| Flathub | `https://flathub.org/repo/flathub.flatpakrepo` | `6E5C05D979C76DAF93C081354184DD4D907A7CAE` | `awk -F= '/^GPGKey=/{print $2}' flathub.flatpakrepo \| base64 --decode \| gpg --batch --with-colons --import-options show-only --import \| awk -F: '$1 == "fpr" { print $10; exit }'` |
| Claude Desktop Extra | `https://patrickjaja.github.io/claude-desktop-extra/gpg-key.asc` | `825A7D15D78BABE45646D5DF382409F597908867` | `gpg --batch --with-colons --import-options show-only --import claude-desktop.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
| Terra 44 | `https://repos.fyralabs.com/terra44/key.asc` | `AE09157A4DE88B497EA1D5D300CDAB43DE226D6F` | `key_fingerprint_matches terra44.asc AE09157A4DE88B497EA1D5D300CDAB43DE226D6F` |
| Anthropic Claude Code | `https://downloads.claude.ai/keys/claude-code.asc` | `31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE` | `key_fingerprint_matches claude-code.asc 31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE` |
| Bun releases | `https://keys.openpgp.org/vks/v1/by-fingerprint/F3DCC08A8572C0749B3E18888EAB4D40A7B22B59` | `F3DCC08A8572C0749B3E18888EAB4D40A7B22B59` | `key_fingerprint_matches bun.asc F3DCC08A8572C0749B3E18888EAB4D40A7B22B59` |
| RPM Fusion free | `https://download1.rpmfusion.org/free/fedora/RPM-GPG-KEY-rpmfusion-free-fedora-2020` | `E9A491A3DE247814E7E067EAE06F8ECDD651FF2E` | `key_fingerprint_matches rpmfusion-free.asc E9A491A3DE247814E7E067EAE06F8ECDD651FF2E` |
| RPM Fusion nonfree | `https://download1.rpmfusion.org/nonfree/fedora/RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020` | `79BDB88F9BBF73910FD4095B6A2AF96194843C65` | `key_fingerprint_matches rpmfusion-nonfree.asc 79BDB88F9BBF73910FD4095B6A2AF96194843C65` |
| lionheartp/Hyprland COPR | `https://download.copr.fedorainfracloud.org/results/lionheartp/Hyprland/pubkey.gpg` | `97E23476C89635135407C7D5E9BA41342C4B2995` | `key_fingerprint_matches hyprland-copr.asc 97E23476C89635135407C7D5E9BA41342C4B2995` |
| Flathub | `https://flathub.org/repo/flathub.flatpakrepo` | `6E5C05D979C76DAF93C081354184DD4D907A7CAE` | `key_fingerprint_matches flathub.asc 6E5C05D979C76DAF93C081354184DD4D907A7CAE` |
| Claude Desktop Extra | `https://patrickjaja.github.io/claude-desktop-extra/gpg-key.asc` | `825A7D15D78BABE45646D5DF382409F597908867` | `key_fingerprint_matches claude-desktop.asc 825A7D15D78BABE45646D5DF382409F597908867` |
The retrieval command for every direct key was:
@@ -98,16 +105,28 @@ digest, then update the command and this ledger in a second commit.
Do not replace a key on an automated update. A key rotation is a reviewed
repository change: obtain the new key from the publisher record, independently
confirm its complete primary fingerprint, update the vendored key and
`installers.conf` together, refresh this retrieval record, and add a focused
contract case if the verification behavior changes. Until that review lands,
verification fails closed and preserves any known-good destination.
confirm its complete primary fingerprint, and update every independent pin site
in one review:
## Container-only Terra 44 signed-bootstrap proof
- the armored key under `setup/provenance/keys/`;
- its fingerprint in `setup/provenance/installers.conf`;
- the matching `_require_policy_value` literal in
`setup/scripts/install-packages`;
- independent fingerprint expectations and command-log fixtures in
`tests/setup/package-provenance-contract`;
- this retrieval and evidence ledger at `setup/provenance/README.md`.
On 2026-08-27, a single disposable rootless Podman container proved the Terra
bootstrap path without changing the host package database, host keyring, or
host repository files. Podman reported `rootless=true`, `runtime=crun`, and a
Until all sites agree, verification fails closed and preserves any known-good
destination. Add or update a focused contract whenever verification behavior
changes.
## Historical container-only Terra 44 signed-bootstrap proof
On 2026-08-27, a single disposable rootless Podman container validated Terra's
then-reviewed signed bootstrap without changing the host package database,
host keyring, or host repository files. This is retained historical publisher
evidence; Panama's runtime installer no longer installs `terra-release`.
Podman reported `rootless=true`, `runtime=crun`, and a
user graph root. The fresh image was
`registry.fedoraproject.org/fedora@sha256:62f199d1eb34170a7bb2277485676d89c0e91aae4086151c4043062cce51c77c`
(`sha256:87d8a4a90c0457689db68624cac1026fb2201cbdc1e99cc5455a8f8876118498`).
@@ -115,12 +134,13 @@ The container (`5fc8fa42bb85afb3b57b336ca29b58a32fad50d460583329a4e910cc29fb4d2d
had no mounts and was removed automatically after `podman stop`.
Before copying the only host file admitted to the container,
`keys/terra44.asc`, this exact host check reported the complete primary
fingerprint `AE09157A4DE88B497EA1D5D300CDAB43DE226D6F`:
`keys/terra44.asc`, this status-preserving host check accepted the complete
primary fingerprint `AE09157A4DE88B497EA1D5D300CDAB43DE226D6F`:
```bash
gpg --batch --with-colons --import-options show-only --import setup/provenance/keys/terra44.asc \
| awk -F: '$1 == "fpr" { print $10; exit }'
source setup/lib/artifact-provenance
key_fingerprint_matches setup/provenance/keys/terra44.asc \
AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
```
Its SHA-256 was
@@ -144,14 +164,16 @@ podman exec panama-terra-proof-20260827 /bin/bash -lc '
'
```
Inside the container the copied and installed key both had the recorded
SHA-256 before and after installation. `terra-release-44-9.noarch` was
installed. Its effective `terra` configuration reported `gpgcheck = 1`,
`pkg_gpgcheck = 1`, and `repo_gpgcheck = 1`; no GPG-bypass option was used.
The package's own `/etc/yum.repos.d/terra.repo` uses its Terra metalink and
`RPM-GPG-KEY-terra44`. That differs from Panama's deliberately staged local
key/base-URL file in `install-packages`, which replaces the release-generated
file only after this verified bootstrap step.
The retained command output records the copied key's SHA-256 and DNF's
successful `terra-release-44-9.noarch` transaction. The command itself pins the
temporary Terra base URL and local staged key and enables package and repository
signature checks. It does not include a separate post-install fingerprint or
effective-repository query, so this ledger makes no independent post-check
claim. Production publishes the reviewed root-staged key/repository pair
directly and commits it only after the effective-repository post-check
succeeds; failure restores the prior pair. Publisher-only package transactions
use a fresh command-line repository identity, the reviewed base URL, and a
newly fingerprint-verified private root key snapshot.
Although the command runner returned after 30 seconds while DNF was still
loading metadata, Podman's retained event log records the exact command's
@@ -165,6 +187,5 @@ podman events --since '2026-08-27T10:55:00-04:00' --until '2026-08-27T11:02:00-0
The first `exec` event, at `timeNano=1787842633591543881`, is the documented
key-install and DNF command. Its matching first `exec_died` event, at
`timeNano=1787842671276003275`, records `ContainerExitCode:0`. The
same-container post-check independently confirmed the installed package and
effective signature settings above; no retry or second container was used.
`timeNano=1787842671276003275`, records `ContainerExitCode:0`. No retry or
second container was used, and no stronger post-check evidence is retained.