gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: Adopt a Terra the machine already trusts

Browse Source 
The repository audit made any Terra that is not Panama's own pinned form a
trust-root failure, and status 78 then stopped every stage before it ran. A
machine that installed Terra the way Terra documents it -- terra-release's own
repo file, a metalink, the key at its stock path -- was classified hostile and
had no way back, because install_terra_repository refused to touch a machine
terra-release had already reached. A gate with no door.

The trust root is the signing key, and that key is byte-for-byte the
fingerprint this repository reviewed and pinned, with every signature check
already on. So verify the fingerprint and adopt the configuration into the
pinned form instead of refusing it. Adoption needs no network and no DNF, it
runs before any other transaction in the stage, and it is repeatable, which it
has to be: terra-release owns that file and restores it on update.

Adoption stays narrow. The pinned fingerprint must match both the reviewed key
and the key the machine actually verifies against, the gpgkey must be a local
file under the system trust directory, and the endpoint must be one Terra
itself serves -- so the reviewed baseurl or the reviewed metalink host, now
pinned as TERRA_METALINK_BASEURL. An unknown key, a redirected baseurl, a
second enabled Terra, or a disabled signature check is still a hard refusal.

A refusal also stops less than it did. It suppresses the stages that open DNF
and the migrations, which may run a transaction of their own, and the run still
exits 78. It no longer stops link-dotfiles, link-skills or link-user, which
read no repository and install no package. Exiting before them is what left
this laptop with a stale ~/.claude/skills and no shipped skill reachable.

Also stub ensure_flathub_remote in the extras contract, which has been failing
since that call was added to install_extra_category without one.

Claude-Session: https://claude.ai/code/session_01PeTrG9dGY89UWuhGm4Pr1s
This commit is contained in:
Gabriel Brown
2026-08-28 14:53:48 -04:00
parent b5832fc94a
commit fa8b14e05e
7 changed files with 323 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
setup/lib/artifact-provenance
+1
View File
@@ -112,6 +112,7 @@ load_installer_provenance() {
RUSTDESK_VERSION RUSTDESK_X86_64_URL RUSTDESK_X86_64_SHA256 RUSTDESK_X86_64_MAX_BYTES \
FEDORA_RELEASE RPMFUSION_FREE_RELEASE_URL RPMFUSION_FREE_RELEASE_MAX_BYTES \
RPMFUSION_NONFREE_RELEASE_URL RPMFUSION_NONFREE_RELEASE_MAX_BYTES TERRA_BASEURL \
TERRA_METALINK_BASEURL \
HYPRLAND_COPR_BASEURL FLATHUB_DESCRIPTOR_URL FLATHUB_DESCRIPTOR_MAX_BYTES \
CLAUDE_CODE_BASEURL CLAUDE_DESKTOP_BASEURL TERRA_FINGERPRINT CLAUDE_CODE_FINGERPRINT \
BUN_FINGERPRINT RPMFUSION_FREE_FINGERPRINT RPMFUSION_NONFREE_FINGERPRINT \
setup/provenance/installers.conf
+1
View File
@@ -35,6 +35,7 @@ RPMFUSION_FREE_RELEASE_MAX_BYTES=4194304
RPMFUSION_NONFREE_RELEASE_URL=https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-44.noarch.rpm
RPMFUSION_NONFREE_RELEASE_MAX_BYTES=4194304
TERRA_BASEURL=https://repos.fyralabs.com/terra44
TERRA_METALINK_BASEURL=https://tetsudou.fyralabs.com/metalink
HYPRLAND_COPR_BASEURL=https://download.copr.fedorainfracloud.org/results/lionheartp/Hyprland/fedora-$releasever-$basearch/
FLATHUB_DESCRIPTOR_URL=https://flathub.org/repo/flathub.flatpakrepo
FLATHUB_DESCRIPTOR_MAX_BYTES=1048576
setup/scripts/install-packages
+162 -23
View File
@@ -725,8 +725,17 @@ _publish_repository_pair() {
return "$status"
}
# Reads the gpgkey of the single enabled Terra identity out of dnf's effective
# configuration, applying the structural safety rules either way: one enabled
# identity, named terra, with every signature check turned on.
#
# With require_pinned set it additionally demands Panama's own reviewed baseurl
# and key path. Without it, the answer is just "what trust root is this machine
# actually verifying against?" -- the question adoption turns on.
_effective_terra_key() {
awk -v reviewed_baseurl="${INSTALLER_PROVENANCE[TERRA_BASEURL]}" '
awk -v reviewed_baseurl="${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
-v reviewed_metalink="${INSTALLER_PROVENANCE[TERRA_METALINK_BASEURL]}" \
-v require_pinned="${1:-}" '
function reset_block() {
delete values
delete seen
@@ -746,10 +755,22 @@ _effective_terra_key() {
for (key in required) {
if (seen[key] != 1) bad = 1
}
if (values["baseurl"] != reviewed_baseurl || values["metalink"] != "" \
|| values["mirrorlist"] != "" || values["gpgcheck"] != "1" \
|| values["pkg_gpgcheck"] != "1" || values["repo_gpgcheck"] != "1" \
|| values["gpgkey"] != "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama") bad = 1
if (require_pinned != "") {
if (values["baseurl"] != reviewed_baseurl || values["metalink"] != "" \
|| values["mirrorlist"] != "" \
|| values["gpgkey"] != "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama") bad = 1
} else if (values["mirrorlist"] != "") {
bad = 1
} else if (values["baseurl"] == reviewed_baseurl && values["metalink"] == "") {
# Already on the reviewed baseurl, just not via the Panama key path.
} else if (values["baseurl"] == "" \
&& index(values["metalink"], reviewed_metalink "?") == 1) {
# The stock terra-release metalink, on the reviewed host.
} else {
bad = 1
}
if (values["gpgcheck"] != "1" || values["pkg_gpgcheck"] != "1" \
|| values["repo_gpgcheck"] != "1" || values["gpgkey"] == "") bad = 1
trusted_key = values["gpgkey"]
}
BEGIN {
@@ -807,12 +828,24 @@ _effective_terra_key() {
'
}
_terra_repo_config_dump() {
LC_ALL=C dnf --quiet --no-plugins --dump-repo-config='*'
}
# Status 0 is one trusted effective Terra identity, 1 is no enabled Terra
# identity, and 2 is an unsafe, duplicated, or unreadable effective state.
#
# Both this and _terra_adoptable_status take an already-read dump when the
# caller needs both verdicts, so the two cannot disagree about a configuration
# that changed between them.
_terra_effective_status() {
local dump gpgkey parse_status=0 local_key
dump="$(LC_ALL=C dnf --quiet --no-plugins --dump-repo-config='*')" || return 2
gpgkey="$(printf '%s\n' "$dump" | _effective_terra_key)" || parse_status=$?
if (( $# > 0 )); then
dump="$1"
else
dump="$(_terra_repo_config_dump)" || return 2
fi
gpgkey="$(printf '%s\n' "$dump" | _effective_terra_key pinned)" || parse_status=$?
(( parse_status == 0 )) || return "$parse_status"
[[ "$gpgkey" == 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' ]] || return 2
local_key="$PANAMA_SYSTEM_ETC/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama"
@@ -824,18 +857,71 @@ _terra_effective_status() {
|| return 2
}
# Whether an effective Terra that is not in Panama's pinned form can be safely
# converted into it rather than refused.
#
# The trust root is the signing key, not the URL it is served from. A machine
# that installed Terra the way Terra documents has terra-release's own repo
# file: a metalink instead of the reviewed baseurl, and the key at
# RPM-GPG-KEY-terra44 rather than Panama's renamed copy. Every signature check
# is already on, and that key is the same fingerprint this repository reviewed
# and pinned. Cosmetics, in other words -- not a compromised trust root.
#
# Refusing it outright built a gate with no door. install_terra_repository
# declined to touch a machine terra-release had already reached, so an ordinary
# Fedora desktop could never reach the pinned state, and a routine `panama
# update` died before it ran a single stage. Adoption is the door.
#
# It is deliberately narrow: the pinned fingerprint must match on both the
# reviewed key and the key the machine actually verifies against, and the
# gpgkey must be a local file under the system trust directory. An unknown key,
# a remote gpgkey, a second enabled Terra, or a disabled signature check is
# still a hard refusal.
_terra_adoptable_status() {
local dump gpgkey parse_status=0 key_file key_path
_require_policy_value TERRA_METALINK_BASEURL 'https://tetsudou.fyralabs.com/metalink' || return 2
if (( $# > 0 )); then
dump="$1"
else
dump="$(_terra_repo_config_dump)" || return 2
fi
gpgkey="$(printf '%s\n' "$dump" | _effective_terra_key)" || parse_status=$?
(( parse_status == 0 )) || return "$parse_status"
key_file="${gpgkey#file://}"
[[ "$gpgkey" == "file://$key_file" && "$key_file" == /etc/pki/rpm-gpg/* ]] || return 2
[[ "$key_file" != *..* ]] || return 2
key_path="$PANAMA_SYSTEM_ETC${key_file#/etc}"
[[ -f "$key_path" && ! -L "$key_path" ]] || return 2
key_fingerprint_matches "$PANAMA_PATH/setup/provenance/keys/terra44.asc" \
"${INSTALLER_PROVENANCE[TERRA_FINGERPRINT]}" \
&& key_fingerprint_matches "$key_path" \
"${INSTALLER_PROVENANCE[TERRA_FINGERPRINT]}" \
|| return 2
}
TERRA_TRUST_FAILURE_STATUS=78
preflight_terra_trust() {
local status=0
local status=0 adoptable_status=0 dump
_require_policy_value TERRA_BASEURL 'https://repos.fyralabs.com/terra44' \
|| return "$TERRA_TRUST_FAILURE_STATUS"
_require_policy_value TERRA_FINGERPRINT AE09157A4DE88B497EA1D5D300CDAB43DE226D6F \
|| return "$TERRA_TRUST_FAILURE_STATUS"
_terra_effective_status || status=$?
dump="$(_terra_repo_config_dump)" || {
log "Effective Terra repository configuration is not trusted; refusing all package work"
return "$TERRA_TRUST_FAILURE_STATUS"
}
_terra_effective_status "$dump" || status=$?
if (( status == 0 || status == 1 )); then
return 0
fi
# Terra signed by the pinned key, on a reviewed endpoint, passes here because
# install-packages adopts it into the pinned form before it opens any other
# DNF transaction.
_terra_adoptable_status "$dump" || adoptable_status=$?
if (( adoptable_status == 0 )); then
return 0
fi
log "Effective Terra repository configuration is not trusted; refusing all package work"
return "$TERRA_TRUST_FAILURE_STATUS"
}
@@ -907,18 +993,67 @@ install_rpmfusion_repositories() {
return "$status"
}
# Rewrites an adoptable Terra into Panama's pinned form.
#
# No network and no DNF: terra-release is already installed, so this is only the
# key copy and the repository file, published as one pair so a half-written
# trust root rolls back. The effective state is re-read afterwards, because the
# only acceptable proof that adoption worked is the check that judged it.
#
# terra-release owns /etc/yum.repos.d/terra.repo, so a later update to that
# package restores the stock file. That is fine and deliberate: the next run
# adopts it again, which is why adoption has to be repeatable rather than a
# one-time migration.
adopt_terra_repository() {
local work staged_key staged_repo status=0 effective_status=0
work="$(mktemp -d)" || return 1
chmod 0700 "$work"
staged_key="$work/terra44.asc"
staged_repo="$work/terra.repo"
if ! _stage_reviewed_key "$PANAMA_PATH/setup/provenance/keys/terra44.asc" "$staged_key" \
TERRA_FINGERPRINT AE09157A4DE88B497EA1D5D300CDAB43DE226D6F; then
rm -rf -- "$work"
return 1
fi
printf '%s\n' \
'[terra]' \
'name=Panama reviewed Terra 44' \
"baseurl=${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
'enabled=1' \
'gpgcheck=1' \
'repo_gpgcheck=1' \
'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' > "$staged_repo"
chmod 0600 "$staged_repo"
_publish_repository_pair \
"$staged_key" /etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama \
"$staged_repo" /etc/yum.repos.d/terra.repo || status=$?
if (( status == 0 )); then
_terra_effective_status || effective_status=$?
(( effective_status == 0 )) || status="$TERRA_TRUST_FAILURE_STATUS"
fi
rm -rf -- "$work"
return "$status"
}
install_terra_repository() {
local work staged_key staged_repo status effective_status=0
local work staged_key staged_repo status effective_status=0 adoptable_status=0 dump
require_reviewed_fedora_release || return 1
_require_policy_value TERRA_BASEURL 'https://repos.fyralabs.com/terra44' || return 1
_require_policy_value TERRA_FINGERPRINT AE09157A4DE88B497EA1D5D300CDAB43DE226D6F || return 1
_terra_effective_status || effective_status=$?
dump="$(_terra_repo_config_dump)" || return 1
_terra_effective_status "$dump" || effective_status=$?
if (( effective_status == 0 )); then
log "Terra repository already configured and verified"
return 0
elif (( effective_status != 1 )); then
log "Effective Terra repository configuration is not trusted"
return "$TERRA_TRUST_FAILURE_STATUS"
_terra_adoptable_status "$dump" || adoptable_status=$?
if (( adoptable_status != 0 )); then
log "Effective Terra repository configuration is not trusted"
return "$TERRA_TRUST_FAILURE_STATUS"
fi
log "Adopting the existing Terra repository into Panama's reviewed form"
adopt_terra_repository
return $?
fi
if rpm -q terra-release >/dev/null 2>&1; then
log "terra-release is installed without one trusted enabled Terra repository"
@@ -1177,16 +1312,9 @@ if [[ "$ROLE" == server ]]; then
fi
echo -e "\n--- Installing Repositories ---"
log "Installing RPM Fusion Free and Nonfree Repositories"
install_rpmfusion_repositories > /dev/null
log "Enabling Fedora Cisco OpenH264 Repository"
# soft: this repo does not exist on every spin, and its absence must not cost
# the desktop -- the ordering rule at soft()'s definition applies to the
# repository extras just as much as to the codec swaps below.
soft "enabling the openh264 repository" sudo dnf config-manager setopt fedora-cisco-openh264.enabled=1
log "Installing RPM Fusion AppStream Metadata"
soft "the core group update" sudo dnf update @core -y
soft "the RPM Fusion appstream metadata" sudo dnf install -y rpmfusion-\*-appstream-data
# Terra goes first so a machine whose Terra is enabled but not yet in Panama's
# reviewed form is adopted before any other transaction below runs against it.
#
# Terra bootstraps itself: --repofrompath defines a throwaway repo just long
# enough to install terra-release, which then writes the real /etc/yum.repos.d
# entry. Doing that a second time is not harmless -- dnf5 refuses the whole
@@ -1200,6 +1328,17 @@ soft "the RPM Fusion appstream metadata" sudo dnf install -y rpmfusion-\*-appstr
log "Installing Terra Repository"
install_terra_repository > /dev/null
log "Installing RPM Fusion Free and Nonfree Repositories"
install_rpmfusion_repositories > /dev/null
log "Enabling Fedora Cisco OpenH264 Repository"
# soft: this repo does not exist on every spin, and its absence must not cost
# the desktop -- the ordering rule at soft()'s definition applies to the
# repository extras just as much as to the codec swaps below.
soft "enabling the openh264 repository" sudo dnf config-manager setopt fedora-cisco-openh264.enabled=1
log "Installing RPM Fusion AppStream Metadata"
soft "the core group update" sudo dnf update @core -y
soft "the RPM Fusion appstream metadata" sudo dnf install -y rpmfusion-\*-appstream-data
echo -e "\n--- Installing relevant packages ---"
log "Updating all packages. This may take a while"
sudo dnf update -y --refresh > /dev/null