morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #3590] [MERGED] fix(hopper)!: verify current Linux releases with the publisher key #5842

New issue

Closed

opened 2026-10-31 01:09:50 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:09:50 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3590
Author: @N0zoM1z0
Created: 10/14/2026
Status: ✅ Merged
Merged: 10/15/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/linux-hopper-release-feed

📝 Commits (10+)

23a7131 fix(hopper)!: verify current Linux releases with the publisher key
0ac43ad fix(hopper): retain launcher digests in verification diagnostics
fd6f996 fix(hopper): preserve publisher rejection before application execution
b0de9a5 fix(verify): request JSON for modified Hopper rejection
4572486 chore(hopper): integrate latest main before review
41189f8 chore(hopper): preserve unrelated main tests during integration
80ca14f fix(hopper): recover approved caches and retain verification cleanup
d80d03a fix(hopper): preserve cache repair recovery diagnostics
66fca32 fix(hopper): serialize signed cache publication across processes
0022c9a chore(hopper): sync current main for final publisher validation

📊 Changes

49 files changed (+3191 additions, -219 deletions)

View changed files

📝 docs/installation.md (+31 -0)
📝 licenses/npm-dependencies.txt (+6 -1)
📝 licenses/npm-runtime-notices.txt (+175 -1)
📝 package-lock.json (+19 -0)
📝 package.json (+1 -0)
📝 scripts/hopper-demo-x11.py (+12 -10)
📝 scripts/verify-linux-setup-e2e.mjs (+15 -6)
📝 scripts/verify-package-environment.mjs (+9 -0)
📝 scripts/verify-package-platform.mjs (+20 -5)
📝 scripts/verify-real-hopper-fat.mjs (+1 -1)
📝 scripts/verify-real-hopper.mjs (+1 -1)
📝 src/application/Doctor.fixture.ts (+11 -1)
📝 src/application/Doctor.test.ts (+12 -2)
📝 src/application/Doctor.ts (+8 -3)
📝 src/application/DoctorDiagnostics.ts (+30 -13)
📝 src/application/HopperDownload.ts (+18 -4)
➕ src/application/HopperReleaseFeed.test.ts (+77 -0)
➕ src/application/HopperReleaseFeed.ts (+125 -0)
📝 src/application/LinuxHopper.test.ts (+79 -25)
📝 src/application/LinuxHopper.ts (+171 -98)

...and 29 more files

📄 Description

Summary

Fixes #3577. Replace Linux Hopper's fixed 6.4.2 URLs/digests with current public-demo metadata and verification under the vendor's stable primary PGP key. Approved setup retains authenticated package evidence for offline doctor and launches.

Problem and expected behavior

REA 6.5.0's public doctor rejects the official 6.6.0 demo; the affected pinned-main source has the same fixed allowlist. The historical 404 reported by the vendor was not reproduced—the old deb URL returned 200 during this investigation.

Current deb and Arch launcher digests match the feed. Fedora's signed RPM has a different launcher digest from its feed row: #3578. This change fails before privileged installation on that inconsistency; it does not hardcode an exception.

Change and scope

One release owner parses platform rows independently, preserves vendor metadata, verifies complete package signatures and signed launcher identity, and retains signed archives rather than trusting editable digest receipts. Setup, doctor and the Python pre-execution guard consume its facts. Eight process-local proofs bound reuse; installed/cache bytes are still checked. This repairs existing installer/provider admission, without adding provider capabilities or target execution authority.

Contract and boundary impact

Owner: release parsing and Linux publisher verification; the generic lazy PGP primitive pins the primary and admits certified rotating signing subkeys.
Contribution scope: ordinary repair within existing Hopper setup/analysis boundaries; separate maintainer scope decision not applicable.
CLI/MCP catalog: unchanged success-analysis contracts. Setup discloses selected cache files and publisher verification. Doctor includes compact digests and provenance; unavailable verification remains unknown. Reported release versions are metadata, not PGP-signed JSON facts.
Compatibility: Linux public demos; macOS retains its Apple verification. Linux RPM header SHA-256, deb extraction and Arch selected-file extraction derive package facts before native installation.
Evidence: preserve release rows, archive bytes, key and digests; reauthenticate disk evidence offline. BYO inspection writes only owned temporary inspection data, with retryable cleanup, and no persistent cache.
Authority/cleanup: approval remains required for installation and cache retention. Existing private X display, owner stream, leases and cancellation boundaries remain in place.
Package impact: lazy external openpgp@6.3.2; locked dependency inventory and original LGPL notice retained from an integrity-verified npm archive. Ignored metadata regenerated; no binaries/projects committed.

Expected effects:

Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Partial-platform/malformed/channel/budget feed tests; real signatures with two signing subkeys, wrong primary, tampered payload and asynchronous cancellation; real deb/Arch test archives, edited receipts, offline cache, symlinks, missing metadata, pre-install rejection and cleanup retry. Test archives substitute only the fixture publisher; real vendor identity was independently verified below.
Baseline executed: official current deb in Ubuntu24, REA 6.5.0 public doctor -> hopper-version: config_drift. Current-main fixed policy is source evidence.
Current public output: offline ordinary-user doctor -> healthy: true, reported release 6.6.0, stable primary 7C2D73BAFAF5B9A710A69DA1A26DF815099B1BCD, source signed_package_cache.
Real Linux suite: CLI byte/function-dossier/literal-trace parity, target switching, caller cancellation/recovery, simultaneous-launch rejection, SIGINT/SIGKILL owner-exit recovery, unchanged source targets, clean shutdown and unrelated sentinel survival. Large inventories: 1,205 procedures and 1,205 strings in one call each. Named-selector/terminal-function CLI parity is unverified in this Linux fixture.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

On final source 0022c9af5 / main 4692bb333: full static and docs gates passed; 438 focused tests passed, with 6 platform-related skips in 43 files. Python guard tests passed on the unchanged guard implementation.
npm run verify:package passed installed/update CLI/MCP, Evidence, setup/uninstall, backup/idempotency and empty-lineage checks. All PR checks passed, including CI required, readiness and completed automated review; all five review findings are addressed and their threads resolved.
Official free Hopper 6.6.0 on Ubuntu24 passed clean public setup, doctor, full CLI/MCP and owner-exit recovery. Root and UID 1000 also passed real concurrent publication followed by cold offline verification, public doctor and actual Hopper analysis. Both publishers overlapped and succeeded; exactly one new backup preserved the old record. Every final task had no remaining observed processes.

Completed real Linux task	Wall / child CPU	Sampled summed-family RSS
Clean setup + full CLI/MCP	137.99 / 126.73 s	2.03 GiB
Public damaged-cache recovery + analysis + idempotency	30.11 / 32.32 s	0.81 GiB
Two publishers + offline CLI, UID 0	14.07 / 19.31 s	0.93 GiB
Two publishers + offline CLI, UID 1000	14.97 / 20.55 s	0.92 GiB

Single shared-host samples, 100 ms RSS sampling; summed RSS can double-count shared pages and miss short processes. No isolated causal speed comparison or actual model token/billing measurement. Retention transactions were 140–457 ms under contention. Earlier cold/warm completed verification measured deb 728/116 ms, Arch 1,369/100 ms and BYO inspection 8,882/19 ms. Feed/key/package payloads are not delivered to the agent.

Official deb/Arch payload verification passed; GnuPG independently agreed on all three package signatures. Native Fedora header/extraction confirmed #3578; corrected copied metadata was only a diagnostic probe. Full Fedora/Arch GUI and macOS/Windows Hopper runtime behavior remain unverified.

Failures are retained: initial harness fixture/init omissions, one final local download-stage failure (unchanged retry passed), and two standalone hosted clean-setup download failures. Their exact causes remain unknown. A separate hosted diagnostic run then passed clean setup, full CLI/MCP and idempotency with the identical product source 0022c9af5: the feed, deb and key all returned HTTP 200, and the verifier ended with no descendants. Only temporary workflow/logging instrumentation differed; it is not proposed for integration. This successful retry does not establish the causes of the earlier failures. The no-runner self-hosted Hopper lane is explicitly unverified.

Compatibility, safety, and release

Breaking provider admission change: older Linux builds previously admitted by the fixed allowlist now need retained signed package evidence or an approved update. The feed exposes only its current version. Migrate with approved rea setup --install-hopper; update/unset an explicit old HOPPER_LAUNCHER_PATH as appropriate. The previous build-specific exceptions are removed, so publisher authentication has one owner.

Real-provider coverage is Linux x86_64, free demo 6.6.0. Full Fedora GUI/installation is blocked by external metadata; full Arch GUI/installation and macOS/Windows runtime behavior were not verified. No Ghidra/IDA changes. Cache retention consumes one compressed signed package per distinct launcher digest and preserves historical evidence; lookup never claims cached history is the latest release.

Author readiness

Human owner: @N0zoM1z0

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Human owner explicitly confirmed the declaration on 2026-10-15.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3590 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/14/2026 **Status:** ✅ Merged **Merged:** 10/15/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/linux-hopper-release-feed` --- ### 📝 Commits (10+) - [`23a7131`](https://github.com/morluto/rea/commit/23a7131143e2ee593ec509ceb674e8ae214d069a) fix(hopper)!: verify current Linux releases with the publisher key - [`0ac43ad`](https://github.com/morluto/rea/commit/0ac43ad6047aad61b4f04d479c9896f62506ea16) fix(hopper): retain launcher digests in verification diagnostics - [`fd6f996`](https://github.com/morluto/rea/commit/fd6f99673310055eba6abf915e7d2e685cc30fba) fix(hopper): preserve publisher rejection before application execution - [`b0de9a5`](https://github.com/morluto/rea/commit/b0de9a5c72e995203c9ce194c070cb79a54bd6b4) fix(verify): request JSON for modified Hopper rejection - [`4572486`](https://github.com/morluto/rea/commit/4572486f4c1b680929e9278430b9383e730a756f) chore(hopper): integrate latest main before review - [`41189f8`](https://github.com/morluto/rea/commit/41189f88c4186c2ed922c4cf6400be5a05da1f61) chore(hopper): preserve unrelated main tests during integration - [`80ca14f`](https://github.com/morluto/rea/commit/80ca14f16daaebc83cd012e30d7c32a1f5bc066c) fix(hopper): recover approved caches and retain verification cleanup - [`d80d03a`](https://github.com/morluto/rea/commit/d80d03a9132c187396cc9f5f4f1e5eaa6f5d2e28) fix(hopper): preserve cache repair recovery diagnostics - [`66fca32`](https://github.com/morluto/rea/commit/66fca324d17d682866c2ec346a0daf13ad41f310) fix(hopper): serialize signed cache publication across processes - [`0022c9a`](https://github.com/morluto/rea/commit/0022c9af5bd9cf20ee08796a42d71cd11acd4728) chore(hopper): sync current main for final publisher validation ### 📊 Changes **49 files changed** (+3191 additions, -219 deletions) <details> <summary>View changed files</summary> 📝 `docs/installation.md` (+31 -0) 📝 `licenses/npm-dependencies.txt` (+6 -1) 📝 `licenses/npm-runtime-notices.txt` (+175 -1) 📝 `package-lock.json` (+19 -0) 📝 `package.json` (+1 -0) 📝 `scripts/hopper-demo-x11.py` (+12 -10) 📝 `scripts/verify-linux-setup-e2e.mjs` (+15 -6) 📝 `scripts/verify-package-environment.mjs` (+9 -0) 📝 `scripts/verify-package-platform.mjs` (+20 -5) 📝 `scripts/verify-real-hopper-fat.mjs` (+1 -1) 📝 `scripts/verify-real-hopper.mjs` (+1 -1) 📝 `src/application/Doctor.fixture.ts` (+11 -1) 📝 `src/application/Doctor.test.ts` (+12 -2) 📝 `src/application/Doctor.ts` (+8 -3) 📝 `src/application/DoctorDiagnostics.ts` (+30 -13) 📝 `src/application/HopperDownload.ts` (+18 -4) ➕ `src/application/HopperReleaseFeed.test.ts` (+77 -0) ➕ `src/application/HopperReleaseFeed.ts` (+125 -0) 📝 `src/application/LinuxHopper.test.ts` (+79 -25) 📝 `src/application/LinuxHopper.ts` (+171 -98) _...and 29 more files_ </details> ### 📄 Description ## Summary Fixes #3577. Replace Linux Hopper's fixed 6.4.2 URLs/digests with current public-demo metadata and verification under the vendor's stable primary PGP key. Approved setup retains authenticated package evidence for offline doctor and launches. ## Problem and expected behavior REA 6.5.0's public doctor rejects the official 6.6.0 demo; the affected pinned-main source has the same fixed allowlist. The historical 404 reported by the vendor was not reproduced—the old deb URL returned 200 during this investigation. Current deb and Arch launcher digests match the feed. Fedora's signed RPM has a different launcher digest from its feed row: #3578. This change fails before privileged installation on that inconsistency; it does not hardcode an exception. ## Change and scope One release owner parses platform rows independently, preserves vendor metadata, verifies complete package signatures and signed launcher identity, and retains signed archives rather than trusting editable digest receipts. Setup, doctor and the Python pre-execution guard consume its facts. Eight process-local proofs bound reuse; installed/cache bytes are still checked. This repairs existing installer/provider admission, without adding provider capabilities or target execution authority. ## Contract and boundary impact - Owner: release parsing and Linux publisher verification; the generic lazy PGP primitive pins the primary and admits certified rotating signing subkeys. - Contribution scope: ordinary repair within existing Hopper setup/analysis boundaries; separate maintainer scope decision not applicable. - CLI/MCP catalog: unchanged success-analysis contracts. Setup discloses selected cache files and publisher verification. Doctor includes compact digests and provenance; unavailable verification remains unknown. Reported release versions are metadata, not PGP-signed JSON facts. - Compatibility: Linux public demos; macOS retains its Apple verification. Linux RPM header SHA-256, deb extraction and Arch selected-file extraction derive package facts before native installation. - Evidence: preserve release rows, archive bytes, key and digests; reauthenticate disk evidence offline. BYO inspection writes only owned temporary inspection data, with retryable cleanup, and no persistent cache. - Authority/cleanup: approval remains required for installation and cache retention. Existing private X display, owner stream, leases and cancellation boundaries remain in place. - Package impact: lazy external `openpgp@6.3.2`; locked dependency inventory and original LGPL notice retained from an integrity-verified npm archive. Ignored metadata regenerated; no binaries/projects committed. Expected effects: - [x] Read existing files or captured data. - [x] Launch or attach to a process. - [x] Inject instrumentation or run scripts/code. - [x] Change process memory, registers, files, or configuration. - [x] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Partial-platform/malformed/channel/budget feed tests; real signatures with two signing subkeys, wrong primary, tampered payload and asynchronous cancellation; real deb/Arch test archives, edited receipts, offline cache, symlinks, missing metadata, pre-install rejection and cleanup retry. Test archives substitute only the fixture publisher; real vendor identity was independently verified below. - Baseline executed: official current deb in Ubuntu24, REA 6.5.0 public doctor -> `hopper-version: config_drift`. Current-main fixed policy is source evidence. - Current public output: offline ordinary-user doctor -> `healthy: true`, reported release `6.6.0`, stable primary `7C2D73BAFAF5B9A710A69DA1A26DF815099B1BCD`, source `signed_package_cache`. - Real Linux suite: CLI byte/function-dossier/literal-trace parity, target switching, caller cancellation/recovery, simultaneous-launch rejection, SIGINT/SIGKILL owner-exit recovery, unchanged source targets, clean shutdown and unrelated sentinel survival. Large inventories: 1,205 procedures and 1,205 strings in one call each. Named-selector/terminal-function CLI parity is unverified in this Linux fixture. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - On final source `0022c9af5` / main `4692bb333`: full static and docs gates passed; 438 focused tests passed, with 6 platform-related skips in 43 files. Python guard tests passed on the unchanged guard implementation. - `npm run verify:package` passed installed/update CLI/MCP, Evidence, setup/uninstall, backup/idempotency and empty-lineage checks. All PR checks passed, including `CI required`, readiness and completed automated review; all five review findings are addressed and their threads resolved. - Official free Hopper 6.6.0 on Ubuntu24 passed clean public setup, doctor, full CLI/MCP and owner-exit recovery. Root and UID 1000 also passed real concurrent publication followed by cold offline verification, public doctor and actual Hopper analysis. Both publishers overlapped and succeeded; exactly one new backup preserved the old record. Every final task had no remaining observed processes. | Completed real Linux task | Wall / child CPU | Sampled summed-family RSS | | --- | --- | --- | | Clean setup + full CLI/MCP | 137.99 / 126.73 s | 2.03 GiB | | Public damaged-cache recovery + analysis + idempotency | 30.11 / 32.32 s | 0.81 GiB | | Two publishers + offline CLI, UID 0 | 14.07 / 19.31 s | 0.93 GiB | | Two publishers + offline CLI, UID 1000 | 14.97 / 20.55 s | 0.92 GiB | Single shared-host samples, 100 ms RSS sampling; summed RSS can double-count shared pages and miss short processes. No isolated causal speed comparison or actual model token/billing measurement. Retention transactions were 140–457 ms under contention. Earlier cold/warm completed verification measured deb 728/116 ms, Arch 1,369/100 ms and BYO inspection 8,882/19 ms. Feed/key/package payloads are not delivered to the agent. Official deb/Arch payload verification passed; GnuPG independently agreed on all three package signatures. Native Fedora header/extraction confirmed #3578; corrected copied metadata was only a diagnostic probe. Full Fedora/Arch GUI and macOS/Windows Hopper runtime behavior remain unverified. Failures are retained: initial harness fixture/init omissions, one final local download-stage failure (unchanged retry passed), and two standalone hosted clean-setup download failures. Their exact causes remain unknown. A [separate hosted diagnostic run](https://github.com/morluto/rea/actions/runs/38679844717) then passed clean setup, full CLI/MCP and idempotency with the identical product source `0022c9af5`: the feed, deb and key all returned HTTP 200, and the verifier ended with no descendants. Only temporary workflow/logging instrumentation differed; it is not proposed for integration. This successful retry does not establish the causes of the earlier failures. The no-runner self-hosted Hopper lane is explicitly unverified. ## Compatibility, safety, and release **Breaking provider admission change:** older Linux builds previously admitted by the fixed allowlist now need retained signed package evidence or an approved update. The feed exposes only its current version. Migrate with approved `rea setup --install-hopper`; update/unset an explicit old `HOPPER_LAUNCHER_PATH` as appropriate. The previous build-specific exceptions are removed, so publisher authentication has one owner. Real-provider coverage is Linux x86_64, free demo 6.6.0. Full Fedora GUI/installation is blocked by external metadata; full Arch GUI/installation and macOS/Windows runtime behavior were not verified. No Ghidra/IDA changes. Cache retention consumes one compressed signed package per distinct launcher digest and preserves historical evidence; lookup never claims cached history is the latest release. ## Author readiness Human owner: @N0zoM1z0 - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. Human owner explicitly confirmed the declaration on 2026-10-15. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:09:51 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:45:17 +00:00

[PR #5852] [MERGED] fix(evidence): clear staged write cleanup state after a confirmed retry #7085

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5842

No description provided.

Rows
Columns