[GH-ISSUE #3577] [Bug] Linux Hopper verification rejects current official releases behind the 6.4.2 pin #1328

New issue

Closed

opened 2026-10-16 21:04:20 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:04:20 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3577

Area

Setup, packaging, or upgrade; provider discovery.

Observed behavior

REA 6.5.0's public rea doctor --provider hopper --format json rejects the official Linux Hopper 6.6.0 demo on Ubuntu 24.04 x86_64: hopper-version is config_drift, although the launcher and shared-library checks pass. Latest main ca1b2f8608c52ed721d3576ba5eeb1d66717b08c retains the same hardcoded 6.4.2 package URLs and launcher allowlist (source-derived).

Reproduction

Download the Ubuntu/Mint demo selected by Hopper's official release API.
Extract the 6.6.0 deb into an isolated Ubuntu 24.04 container with the Hopper runtime dependencies.
Run REA 6.5.0's public CLI doctor with HOPPER_LAUNCHER_PATH=/opt/hopper/bin/Hopper.
Observe healthy: false and hopper-version: config_drift. Executed once; actual digest: b2271008fb82bf14cfae5c3644cdde2b11fc6804bd7c99d67032ec1b1942d53c.

Expected behavior / impact

Use the official current Linux demo without requiring a REA release for each new launcher digest. Authenticate downloads with the feed's detached PGP signature and the vendor's stable primary key, then validate installed launcher bytes against authenticated package facts and main_exe_hash. Preserve offline verification and stop before privileged installation on an invalid signature or inconsistent metadata.

Environment / failure stage

REA 6.5.0; pinned-main source ca1b2f8; Node 24.18.0; Linux x86_64, Ubuntu 24.04 container; official Hopper demo 6.6.0. CLI / Package setup; setup or provider admission.

Evidence and limitations

The current deb, RPM and Arch detached signatures verify with both GnuPG and OpenPGP.js under primary 7C2D73BAFAF5B9A710A69DA1A26DF815099B1BCD. The public key is provided by Hopper. Current deb/Arch payload hashes match the feed. RPM has a separate metadata inconsistency reported independently.

The vendor reports discontinued 6.4.2 URLs returning 404. That historical outage was not reproduced: the deb URL returned 200 during this investigation. This report's executed reproduction is rejection of the current build; current-main policy was checked in source, not presented as a current-main CLI execution.

Originally created by @N0zoM1z0 on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3577 ### Area Setup, packaging, or upgrade; provider discovery. ### Observed behavior REA 6.5.0's public `rea doctor --provider hopper --format json` rejects the official Linux Hopper 6.6.0 demo on Ubuntu 24.04 x86_64: `hopper-version` is `config_drift`, although the launcher and shared-library checks pass. Latest main `ca1b2f8608c52ed721d3576ba5eeb1d66717b08c` retains the same hardcoded 6.4.2 package URLs and launcher allowlist (source-derived). ### Reproduction 1. Download the Ubuntu/Mint demo selected by [Hopper's official release API](https://www.hopperapp.com/include/files-api.php?request=releases&public=true). 2. Extract the 6.6.0 deb into an isolated Ubuntu 24.04 container with the Hopper runtime dependencies. 3. Run REA 6.5.0's public CLI doctor with `HOPPER_LAUNCHER_PATH=/opt/hopper/bin/Hopper`. 4. Observe `healthy: false` and `hopper-version: config_drift`. Executed once; actual digest: `b2271008fb82bf14cfae5c3644cdde2b11fc6804bd7c99d67032ec1b1942d53c`. ### Expected behavior / impact Use the official current Linux demo without requiring a REA release for each new launcher digest. Authenticate downloads with the feed's detached PGP signature and the vendor's stable primary key, then validate installed launcher bytes against authenticated package facts and `main_exe_hash`. Preserve offline verification and stop before privileged installation on an invalid signature or inconsistent metadata. ### Environment / failure stage REA 6.5.0; pinned-main source ca1b2f8; Node 24.18.0; Linux x86_64, Ubuntu 24.04 container; official Hopper demo 6.6.0. CLI / Package setup; setup or provider admission. ### Evidence and limitations The current deb, RPM and Arch detached signatures verify with both GnuPG and OpenPGP.js under primary `7C2D73BAFAF5B9A710A69DA1A26DF815099B1BCD`. The public key is [provided by Hopper](https://www.hopperapp.com/hopper-public-key.asc). Current deb/Arch payload hashes match the feed. RPM has a separate metadata inconsistency reported independently. The vendor reports discontinued 6.4.2 URLs returning 404. That historical outage was **not reproduced**: the deb URL returned 200 during this investigation. This report's executed reproduction is rejection of the current build; current-main policy was checked in source, not presented as a current-main CLI execution.

bsakaguchi closed this issue

2026-10-16 21:04:20 +00:00

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:10:26 +00:00

[PR #1328] [CLOSED] fix(javascript): preserve semantic evidence through satisfies #2804