3 Commits

Include renames

Author	SHA1	Message	Date
archipelagoandClaude Fable 5	cfd1b4c731	chore(trust): flip the signing checks to the new release root ... v1.7.122-alpha was the last release signed with the old root — it is the release that installed the new pin on every node. From v1.7.123 the new root signs, and a node running .122+ rejects an old-key signature. The ARCHY_RELEASE_ROOT_PUBKEY override is no longer needed either: the signer built from this tree pins the same key we now sign with. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-05 09:31:28 -04:00
archipelagoandClaude Fable 5	b92e16abc0	fix(release): sign v1.7.122 with the OLD root — the rotation moved the checks a release early ... The rotation commit pointed create-release.sh and publish-release-assets.sh at the NEW root in the same commit that pins it in the binary. But the release CARRYING the rotation must be signed with the OLD root: every node is still running the previous binary, which pins the old key. So the tooling would have rejected the only signature the fleet can accept, and the signature it demanded would have ended OTA fleet-wide. Both checks now expect the old DID for this cycle, with the flip to the new one called out for v1.7.123+. sign-manifest.sh documents the ARCHY_RELEASE_ROOT_PUBKEY override needed because the signer built from this tree already pins the new anchor and would fail to verify its own correct output. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-05 07:48:51 -04:00
archipelagoandClaude Fable 5	51647b21cd	feat(trust): verify release-root signature on the OTA manifest ... check_for_updates now fetches the manifest as raw JSON and runs trust::verify_detached before parsing: a tampered or wrong-signer signature rejects the mirror outright, and unsigned manifests are offered for MANUAL apply only — the 3 AM auto-apply scheduler refuses them, closing the unattended remote-root hole (§A of the 1.8.0 hardening plan). UpdateState gains manifest_signed so the UI can surface authenticity. Publisher side: create-release.sh signs the manifest during the release (ceremony, mnemonic via TTY/env only), publish-release-assets hard-refuses to ship an unsigned manifest (grep + new 'ceremony verify' cryptographic gate), and scripts/sign-manifest.sh covers re-signing outside a release run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 12:33:01 -04:00