Fix: Adopt a Terra the machine already trusts
The repository audit made any Terra that is not Panama's own pinned form a trust-root failure, and status 78 then stopped every stage before it ran. A machine that installed Terra the way Terra documents it -- terra-release's own repo file, a metalink, the key at its stock path -- was classified hostile and had no way back, because install_terra_repository refused to touch a machine terra-release had already reached. A gate with no door. The trust root is the signing key, and that key is byte-for-byte the fingerprint this repository reviewed and pinned, with every signature check already on. So verify the fingerprint and adopt the configuration into the pinned form instead of refusing it. Adoption needs no network and no DNF, it runs before any other transaction in the stage, and it is repeatable, which it has to be: terra-release owns that file and restores it on update. Adoption stays narrow. The pinned fingerprint must match both the reviewed key and the key the machine actually verifies against, the gpgkey must be a local file under the system trust directory, and the endpoint must be one Terra itself serves -- so the reviewed baseurl or the reviewed metalink host, now pinned as TERRA_METALINK_BASEURL. An unknown key, a redirected baseurl, a second enabled Terra, or a disabled signature check is still a hard refusal. A refusal also stops less than it did. It suppresses the stages that open DNF and the migrations, which may run a transaction of their own, and the run still exits 78. It no longer stops link-dotfiles, link-skills or link-user, which read no repository and install no package. Exiting before them is what left this laptop with a stale ~/.claude/skills and no shipped skill reachable. Also stub ensure_flathub_remote in the extras contract, which has been failing since that call was added to install_extra_category without one. Claude-Session: https://claude.ai/code/session_01PeTrG9dGY89UWuhGm4Pr1s
This commit is contained in:
Gabriel Brown
@@ -65,6 +65,12 @@ trap 'rm -rf "$work"' EXIT
|
||||
|
||||
filter="$(sed -n '/^packages_in()/,/^}/p' "$installer")"
|
||||
loop="$(sed -n '/^install_extra_category()/,/^}/p' "$installer")"
|
||||
# install_extra_category verifies the Flathub remote before installing a
|
||||
# flatpak, and records a soft failure when it cannot. Both live outside the
|
||||
# extracted function and have contracts of their own, so they stand in here as
|
||||
# trusted -- what is under test is which targets reach which installer.
|
||||
deps='ensure_flathub_remote() { :; }
|
||||
softly_failed=()'
|
||||
[[ -n "$filter" && -n "$loop" ]] || {
|
||||
printf 'extras contract: install-packages no longer defines packages_in and install_extra_category\n' >&2
|
||||
exit 1
|
||||
@@ -99,6 +105,7 @@ LIST
|
||||
source "$catalog"
|
||||
eval "$filter"
|
||||
eval "$loop"
|
||||
eval "$deps"
|
||||
install_extra_category "$fixture"
|
||||
)
|
||||
|
||||
@@ -132,6 +139,7 @@ printf 'flatpak:org.example.OnlyFlatpak\n' >"$flatpak_only"
|
||||
source "$catalog"
|
||||
eval "$filter"
|
||||
eval "$loop"
|
||||
eval "$deps"
|
||||
install_extra_category "$flatpak_only"
|
||||
)
|
||||
flatpak_only_status=$?
|
||||
@@ -149,6 +157,7 @@ grep -q 'flatpak install -y flathub org.example.OnlyFlatpak' <<<"$(cat "$calls"
|
||||
source "$catalog"
|
||||
eval "$filter"
|
||||
eval "$loop"
|
||||
eval "$deps"
|
||||
EXTRAS_DIR="$extras_dir"
|
||||
for extra in ${PANAMA_EXTRAS:-}; do
|
||||
[[ -f "$EXTRAS_DIR/$extra" ]] && install_extra_category "$EXTRAS_DIR/$extra"
|
||||
|
||||
@@ -894,7 +894,16 @@ if [[ -n "$query" ]]; then
|
||||
trusted|wrong-key) mode=trusted ;;
|
||||
nogpg) mode=legacy ;;
|
||||
wrong-url) mode=override-url ;;
|
||||
stock|stock-wrong-key) mode=stock ;;
|
||||
esac
|
||||
# Adoption rewrites the repository file. Once it is the pinned form the
|
||||
# dump has to say so, or the re-verification adoption performs on itself
|
||||
# could never pass.
|
||||
if [[ "$mode" == stock && -f "$STUB_ETC/yum.repos.d/terra.repo" ]] \
|
||||
&& grep -q '^gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama$' \
|
||||
"$STUB_ETC/yum.repos.d/terra.repo"; then
|
||||
mode=trusted
|
||||
fi
|
||||
if [[ "$mode" == auto && -f "$STUB_ETC/yum.repos.d/terra.repo" ]] \
|
||||
&& grep -q '^baseurl=https://repos.fyralabs.com/terra44$' "$STUB_ETC/yum.repos.d/terra.repo"; then
|
||||
mode=trusted
|
||||
@@ -926,6 +935,13 @@ if [[ -n "$query" ]]; then
|
||||
printf 'metalink = https://tetsudou.fyralabs.com/terra44\nmirrorlist = \n'
|
||||
printf 'pkg_gpgcheck = 0\nrepo_gpgcheck = 0\n'
|
||||
;;
|
||||
stock)
|
||||
printf '======== "terra" repository configuration: ========\n'
|
||||
printf 'baseurl = \nenabled = 1\ngpgcheck = 1\n'
|
||||
printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44\n'
|
||||
printf 'metalink = https://tetsudou.fyralabs.com/metalink?repo=terra44&arch=x86_64\n'
|
||||
printf 'mirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n'
|
||||
;;
|
||||
override-url)
|
||||
printf '======== "terra" repository configuration: ========\n'
|
||||
printf 'baseurl = https://evil.invalid/terra44\nenabled = 1\ngpgcheck = 1\n'
|
||||
@@ -1120,6 +1136,17 @@ run_installer_function() {
|
||||
printf '[terra]\nbaseurl=https://evil.invalid/terra44\nenabled=1\ngpgcheck=1\nrepo_gpgcheck=1\ngpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama\n' \
|
||||
> "$case_root/etc/yum.repos.d/terra.repo"
|
||||
;;
|
||||
stock|stock-wrong-key)
|
||||
if [[ "${STUB_TERRA_REPO_MODE}" == stock ]]; then
|
||||
cp "$installer_fixture/setup/provenance/keys/terra44.asc" \
|
||||
"$case_root/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44"
|
||||
else
|
||||
cp "$installer_fixture/setup/provenance/keys/flathub.asc" \
|
||||
"$case_root/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44"
|
||||
fi
|
||||
printf '[terra]\nmetalink=https://tetsudou.fyralabs.com/metalink?repo=terra44&arch=$basearch\nenabled=1\ngpgcheck=1\nrepo_gpgcheck=1\ngpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44\n' \
|
||||
> "$case_root/etc/yum.repos.d/terra.repo"
|
||||
;;
|
||||
wrong-key)
|
||||
cp "$installer_fixture/setup/provenance/keys/flathub.asc" \
|
||||
"$case_root/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama"
|
||||
@@ -1770,6 +1797,39 @@ for mode in nogpg wrong-url wrong-key absent; do
|
||||
|| fail "untrusted existing Terra $mode state reached a mutation"
|
||||
done
|
||||
|
||||
# A machine that installed Terra the way Terra documents it. The repository file
|
||||
# is terra-release's own -- a metalink, and the key at its stock path -- so it is
|
||||
# not Panama's pinned form, but it IS the fingerprint this repository reviewed,
|
||||
# with every signature check on. That is an adoption, not a compromise.
|
||||
#
|
||||
# Refusing it was a gate with no door: the ordinary Fedora desktop could never
|
||||
# reach the pinned state, and status 78 then stopped every stage of every run,
|
||||
# including the ones that never open DNF.
|
||||
reset_installer_fixture
|
||||
STUB_TERRA_INSTALLED=1 STUB_TERRA_REPO_MODE=stock \
|
||||
expect_success run_installer_function terra-stock-preflight preflight_terra_trust
|
||||
|
||||
reset_installer_fixture
|
||||
STUB_TERRA_INSTALLED=1 STUB_TERRA_REPO_MODE=stock \
|
||||
expect_success run_installer_function terra-stock-adopt install_terra_repository
|
||||
terra_adopted="$test_tmp/cases/terra-stock-adopt/etc/yum.repos.d/terra.repo"
|
||||
grep -qx 'baseurl=https://repos.fyralabs.com/terra44' "$terra_adopted" \
|
||||
|| fail 'adoption left Terra off the reviewed baseurl'
|
||||
grep -qx 'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' "$terra_adopted" \
|
||||
|| fail 'adoption left Terra off the reviewed key path'
|
||||
grep -q 'metalink' "$terra_adopted" \
|
||||
&& fail 'adoption kept the metalink it was supposed to replace'
|
||||
[[ "$(<"$test_tmp/cases/terra-stock-adopt/commands.log")" != *'dnf:install'* ]] \
|
||||
|| fail 'adoption opened a DNF transaction it does not need'
|
||||
|
||||
# Adoption is anchored on the fingerprint, not the URL. The same stock shape
|
||||
# verifying against a key that is not Terra's is still a hard refusal.
|
||||
reset_installer_fixture
|
||||
STUB_TERRA_INSTALLED=1 STUB_TERRA_REPO_MODE=stock-wrong-key \
|
||||
expect_failure run_installer_function terra-stock-wrong-key install_terra_repository
|
||||
[[ "$(<"$test_tmp/cases/terra-stock-wrong-key/commands.log")" != *'sudo:'* ]] \
|
||||
|| fail 'a stock Terra signed by an unreviewed key reached a mutation'
|
||||
|
||||
# An optional security field may be absent, but duplicates are malformed even
|
||||
# when one copy looks safe. These cases catch the absent/duplicate conflation.
|
||||
for duplicate_case in \
|
||||
|
||||
@@ -360,30 +360,48 @@ fi
|
||||
grep -qx 'link-dotfiles' "$tmp/c/ran" \
|
||||
|| note 'an ordinary package-stage failure no longer allows later safe stages'
|
||||
|
||||
# An invalid enabled Terra root is not an ordinary package failure. It must
|
||||
# stop before the installer's bootstrap DNF and before every stage.
|
||||
# An untrusted Terra root is not an ordinary package failure, and it is not a
|
||||
# reason to abandon the machine either. It suppresses the stages that open DNF
|
||||
# and the migrations, which are free to run a transaction of their own. Every
|
||||
# stage that only links configuration still runs, and the status stays 78.
|
||||
SAFE_STAGES=(link-dotfiles link-skills link-user link-vicinae-scripts)
|
||||
DNF_SUPPRESSED=(install-packages change-settings install-hardware)
|
||||
|
||||
assert_trust_refusal() {
|
||||
local root="$1" label="$2" suppressed safe
|
||||
for suppressed in "${DNF_SUPPRESSED[@]}"; do
|
||||
grep -qx "$suppressed" "$root/ran" \
|
||||
&& note "$label still ran $suppressed"
|
||||
done
|
||||
grep -q '^migrate ' "$root/ran" \
|
||||
&& note "$label still ran migrations, which may open a DNF transaction"
|
||||
for safe in "${SAFE_STAGES[@]}"; do
|
||||
grep -qx "$safe" "$root/ran" \
|
||||
|| note "$label suppressed $safe, which touches no repository"
|
||||
done
|
||||
}
|
||||
|
||||
build_fixture "$tmp/terra-preflight-hard" 0 78
|
||||
install_status=0
|
||||
run_install "$tmp/terra-preflight-hard" >/dev/null || install_status=$?
|
||||
[[ "$install_status" -eq 78 ]] \
|
||||
|| note "initial Terra trust failure returned $install_status instead of 78"
|
||||
asserted_preflight="$(<"$tmp/terra-preflight-hard/ran")"
|
||||
[[ "$asserted_preflight" == trust-preflight ]] \
|
||||
|| note "initial Terra trust failure allowed later work: ${asserted_preflight//$'\n'/,}"
|
||||
grep -qx 'trust-preflight' "$tmp/terra-preflight-hard/ran" \
|
||||
|| note 'initial Terra trust fixture never reached the preflight'
|
||||
assert_trust_refusal "$tmp/terra-preflight-hard" 'initial Terra trust failure'
|
||||
|
||||
# The trust verifier is itself mandatory. Losing its executable adapter must
|
||||
# fail closed before interview, bootstrap, or stage work.
|
||||
# The trust verifier is itself mandatory. Losing its executable adapter refuses
|
||||
# package work exactly as a failing verdict does, rather than being ignored.
|
||||
build_fixture "$tmp/terra-preflight-missing"
|
||||
rm "$tmp/terra-preflight-missing/setup/scripts/install-packages"
|
||||
install_status=0
|
||||
run_install "$tmp/terra-preflight-missing" >/dev/null || install_status=$?
|
||||
[[ "$install_status" -eq 78 ]] \
|
||||
|| note "missing Terra trust verifier returned $install_status instead of 78"
|
||||
[[ ! -s "$tmp/terra-preflight-missing/ran" ]] \
|
||||
|| note 'missing Terra trust verifier allowed later work'
|
||||
assert_trust_refusal "$tmp/terra-preflight-missing" 'missing Terra trust verifier'
|
||||
|
||||
# The package stage repeats the preflight to close a configuration-change race.
|
||||
# Its hard status must also stop link stages and install-hardware immediately.
|
||||
# Its hard status suppresses the DNF stages that would have followed it.
|
||||
build_fixture "$tmp/terra-stage-hard" 78 0
|
||||
install_status=0
|
||||
run_install "$tmp/terra-stage-hard" >/dev/null || install_status=$?
|
||||
@@ -391,10 +409,16 @@ run_install "$tmp/terra-stage-hard" >/dev/null || install_status=$?
|
||||
|| note "stage-time Terra trust failure returned $install_status instead of 78"
|
||||
grep -qx 'install-packages' "$tmp/terra-stage-hard/ran" \
|
||||
|| note 'stage-time Terra trust fixture never reached install-packages'
|
||||
for suppressed in link-dotfiles link-skills link-user change-settings install-hardware dnf-transaction; do
|
||||
for suppressed in change-settings install-hardware; do
|
||||
grep -qx "$suppressed" "$tmp/terra-stage-hard/ran" \
|
||||
&& note "stage-time Terra trust failure still ran $suppressed"
|
||||
done
|
||||
grep -q '^migrate ' "$tmp/terra-stage-hard/ran" \
|
||||
&& note 'stage-time Terra trust failure still ran migrations'
|
||||
for safe in "${SAFE_STAGES[@]}"; do
|
||||
grep -qx "$safe" "$tmp/terra-stage-hard/ran" \
|
||||
|| note "stage-time Terra trust failure suppressed $safe"
|
||||
done
|
||||
|
||||
# A full install always runs the stage, whatever any recorded hash says.
|
||||
build_fixture "$tmp/d"
|
||||
|
||||
Reference in New Issue
Block a user