Docs: Pin the verified Panama bootstrap

2026-08-27 10:14:55 -04:00
parent 0d1841cf86
commit dce00e45d1
5 changed files with 156 additions and 16 deletions
@@ -20,6 +20,74 @@ panama="$repo_dir/bin/panama"
 findings=()
 note() { findings+=("$1"); }

+# ── Verified bootstrap command ───────────────────────────────────────────────
+
+if grep -qE 'bash[[:space:]]+<\(curl[^)]*/raw/branch/main/boot' "$readme"; then
+    note 'the README still executes the mutable main-branch bootstrap'
+fi
+if grep -q '/raw/branch/main/boot' "$readme"; then
+    note 'the README still names the mutable main-branch boot URL'
+fi
+
+require_bootstrap_occurrences() {
+    local pattern="$1" expected="$2" explanation="$3" actual
+    actual="$(grep -cE -- "$pattern" "$readme")"
+    (( actual == expected )) || note "$explanation"
+}
+
+mapfile -t documented_commits < <(
+    sed -nE "s/^bootstrap_commit=['\"]?([0-9a-f]{40})['\"]?$/\1/p" "$readme" | sort -u
+)
+mapfile -t documented_shas < <(
+    sed -nE "s/^bootstrap_sha=['\"]?([0-9a-f]{64})['\"]?$/\1/p" "$readme" | sort -u
+)
+
+if (( ${#documented_commits[@]} != 1 )); then
+    note 'the README does not declare one full lowercase 40-hex bootstrap commit'
+else
+    documented_commit="${documented_commits[0]}"
+    if ! git -C "$repo_dir" cat-file -e "$documented_commit^{commit}" 2>/dev/null; then
+        note 'the documented bootstrap commit does not resolve to a repository commit'
+    fi
+fi
+
+if (( ${#documented_shas[@]} != 1 )); then
+    note 'the README does not declare one lowercase 64-hex bootstrap SHA-256'
+else
+    documented_sha="${documented_shas[0]}"
+fi
+
+if [[ -n "${documented_commit:-}" && -n "${documented_sha:-}" ]] \
+    && [[ "$(git -C "$repo_dir" show "$documented_commit:boot" 2>/dev/null | sha256sum | cut -d' ' -f1)" != "$documented_sha" ]]; then
+    note 'the documented SHA-256 does not match boot in the documented commit'
+fi
+
+require_bootstrap_occurrences '^bootstrap_commit=[0-9a-f]{40}$' 2 \
+    'the desktop and server commands do not declare the same full bootstrap commit'
+require_bootstrap_occurrences '^bootstrap_sha=[0-9a-f]{64}$' 2 \
+    'the desktop and server commands do not declare the same full bootstrap SHA-256'
+require_bootstrap_occurrences 'https://git\.gbrown\.org/gib/Panama/raw/commit/\$bootstrap_commit/boot' 2 \
+    'the desktop and server commands do not both use the commit-addressed boot URL'
+require_bootstrap_occurrences '--connect-timeout 10' 2 \
+    'the desktop and server commands do not both use the 10-second connect timeout'
+require_bootstrap_occurrences '--max-time 30' 2 \
+    'the desktop and server commands do not both use the 30-second total timeout'
+require_bootstrap_occurrences '--max-filesize 262144' 2 \
+    'the desktop and server commands do not both use the 256 KiB response limit'
+require_bootstrap_occurrences 'mktemp[[:space:]]+-d' 2 \
+    'the desktop and server commands do not both use a private temporary directory'
+require_bootstrap_occurrences 'sha256sum[[:space:]]+-c' 2 \
+    'the desktop and server commands do not both verify with sha256sum -c'
+require_bootstrap_occurrences 'PANAMA_BOOT_REVISION="?\$bootstrap_commit"?[[:space:]]+PANAMA_BOOT_SHA256="?\$bootstrap_sha"?' 2 \
+    'the desktop and server commands do not both pass the verified pins to boot'
+grep -qE 'bash[[:space:]]+"?\$bootstrap"?([[:space:]]|$)' "$readme" \
+    || note 'the README bootstrap does not execute the verified temporary file'
+grep -qE 'bash[[:space:]]+"?\$bootstrap"?[[:space:]]+--server' "$readme" \
+    || note 'the server bootstrap does not reuse the verified temporary file'
+if grep -qE 'curl[^|]*\|[[:space:]]*(bash|sh)|bash[[:space:]]+<\(curl' "$readme"; then
+    note 'the README pipes a network response into a shell'
+fi
+
 # ── The contract count ───────────────────────────────────────────────────────
 #
 # Counted the way `panama test` collects the suite, so the README agrees with