feat: add safe Gitea sync and signed updates
This commit is contained in:
NuklearRabbit
@@ -51,4 +51,4 @@ ForgeFlow writes its configuration atomically. Explicit server reconciliation ad
|
||||
- Read-only repository-scoped deploy keys for server pull.
|
||||
- SSH host-key changes fail closed.
|
||||
- Live commit, remote commit and runtime health remain separate evidence.
|
||||
- Packaged updates must fail closed on missing or mismatched release assets and SHA-256 evidence; paid code signing is optional.
|
||||
- Packaged updates fail closed on missing or mismatched release assets, SHA-256 evidence and the pinned Ed25519 publisher signature; paid Authenticode remains optional.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
# ForgeFlow 0.10.13
|
||||
|
||||
## Veilige synchronisatie en aantoonbare release-integriteit
|
||||
|
||||
- **Gitea workspace sync** toont eerst de exacte additions, wijzigingen en deletions ten opzichte van de actuele upstream-SHA. Lokale commits worden beschermd in een recovery branch; staged, unstaged en untracked werk gaat naar een stash. Genegeerde runtimebestanden blijven onaangeroerd.
|
||||
- Read-only achtergrondfetch houdt `ahead` en `behind` actueel zonder projectbestanden automatisch te wijzigen. Interval `0` schakelt netwerkfetch volledig uit.
|
||||
- Stale deployment links blokkeren niet langer de automatische, bewijsgebaseerde koppeling van de werkelijk draaiende vervangende workload.
|
||||
- SSH-hostidentiteit wordt vóór het verzenden van credentials getoond en bij bevestiging exact vastgepind. Gitea-tokens vereisen HTTPS, behalve bij expliciete loopbackontwikkeling.
|
||||
- Packaged updates vereisen een **Ed25519-signed release manifest** dat versie, tag, broncommit, artifactnaam, bytegrootte en SHA-256 bindt aan de ingebouwde publisher key. Hiervoor is geen betaald certificaat of Azure-dienst nodig.
|
||||
- Diagnostische bundels exporteren geen ruwe remote output meer. Untracked diffs kunnen geen junction of symlink buiten de repository volgen en zijn begrensd op bestandsgrootte.
|
||||
- De Git-toolsgrid behoudt nu de volledige inhoudshoogte binnen zijn eigen scrollvlak; workspace sync en troubleshooting overlappen niet meer. De demo bridge ondersteunt dezelfde recoveryflow als de desktopapp.
|
||||
- Repositorymonitoring, deploymentpolling, Docker-inspect en SSH-verbindingen gebruiken begrensde paralleliteit en hergebruik waar dat veilig is.
|
||||
|
||||
## Verificatie
|
||||
|
||||
- Volledige Node-testset, coveragepoort, architectuuraudit en dependency-audit.
|
||||
- 72 browserflows over dark/light, compact/desktop/wide, 100–150% schaal en reduced motion.
|
||||
- Windows installer en portable build, SHA-256-sidecars, provenance, CycloneDX-SBOM en ondertekend releasemanifest.
|
||||
+10
-8
@@ -19,11 +19,13 @@ no certificate, Azure or other paid-service dependency:
|
||||
npm run dist:win
|
||||
```
|
||||
|
||||
This produces the installer and portable executable, SHA-256 sidecars, a
|
||||
CycloneDX SBOM and provenance evidence. The in-app updater downloads only the
|
||||
matching Gitea release asset, checks its Windows executable format and verifies
|
||||
the published SHA-256 digest before staging it. The update helper verifies the
|
||||
digest again immediately before replacing the installed executable.
|
||||
Run `npm run signing:setup` once on the release workstation. It stores the
|
||||
private Ed25519 key outside the repository and writes only its public key into
|
||||
the packaged app. `npm run dist:win` then produces the installer and portable
|
||||
executable, SHA-256 sidecars, CycloneDX SBOM, provenance and an Ed25519-signed
|
||||
manifest bound to the exact source commit. The updater verifies the pinned
|
||||
publisher key before trusting the artifact digest and verifies that digest again
|
||||
immediately before replacing the installed executable.
|
||||
|
||||
Windows can display an `Unknown publisher` warning for an unsigned installer.
|
||||
That warning concerns public publisher reputation; it does not prevent ForgeFlow
|
||||
@@ -34,9 +36,9 @@ correct operation.
|
||||
## Atomic publication
|
||||
|
||||
`npm run release:binary` keeps the Gitea release in draft state while uploading
|
||||
the installer, portable executable, two checksums, provenance and SBOM. It only
|
||||
publishes after all six assets are present. A failed upload leaves a draft rather
|
||||
than exposing an incomplete updater target.
|
||||
the installer, portable executable, two checksums, provenance, SBOM, signed
|
||||
manifest and signature. It only publishes after all eight assets are present. A
|
||||
failed upload leaves a draft rather than exposing an incomplete updater target.
|
||||
|
||||
The optional signing acceptance fixture can still validate the complete local
|
||||
Authenticode chain without purchasing or retaining a certificate:
|
||||
|
||||
+5
-1
@@ -124,9 +124,13 @@ included model uses:
|
||||
- SSH passwords and private-key passphrases use Electron `safeStorage`;
|
||||
- diagnostics receive those runtime secrets only for redaction and never export
|
||||
encrypted credential fields;
|
||||
- SSH deployment requires a pinned host-key fingerprint;
|
||||
- SSH host identity is previewed without credentials and authenticated sessions
|
||||
require the exact user-confirmed pinned fingerprint;
|
||||
- remote folders and Compose paths are validated against traversal;
|
||||
- tracked server-side changes block exact-SHA reset;
|
||||
- updater tokens are sent only to the configured Gitea origin;
|
||||
- non-loopback Gitea connections require HTTPS;
|
||||
- packaged updates require a publisher-signed Ed25519 manifest that binds the
|
||||
source commit, artifact identity, byte length and SHA-256 digest;
|
||||
- update archives are checksummed and validated by the full local quality gate;
|
||||
- source backup is restored when an update fails.
|
||||
|
||||
+9
-3
@@ -30,14 +30,20 @@ Update logs and status files are stored beneath ForgeFlow's local user-data `upd
|
||||
|
||||
## Packaged Windows updates
|
||||
|
||||
ForgeFlow 0.9.1 and newer use authenticated Gitea release assets when running from the installer or portable executable. The updater selects the installer or portable artifact that matches the current installation mode, requires its `.sha256` sidecar, validates the Windows executable header and SHA-256 digest, then verifies the digest again immediately before applying it. An external PowerShell helper waits for ForgeFlow to exit, installs or replaces the executable and restarts it.
|
||||
ForgeFlow uses authenticated Gitea release assets when running from the installer or portable executable. The updater selects the artifact that matches the current installation mode and requires its `.sha256` sidecar. From version 0.10.13 onward it also requires an Ed25519-signed release manifest. The embedded public key verifies that manifest before ForgeFlow trusts the artifact name, byte length, exact source commit or SHA-256 digest. The digest is checked again immediately before applying the update.
|
||||
|
||||
`Publish-ForgeFlow-Release.ps1` now treats source and binaries as one release transaction. By default it pushes the validated source, builds the exact published commit and uploads all four required assets:
|
||||
`Publish-ForgeFlow-Release.ps1` treats source and binaries as one release transaction. It pushes the validated source, builds the exact published commit and uploads eight required assets:
|
||||
|
||||
- `ForgeFlow-Setup-<version>-win-x64.exe`
|
||||
- `ForgeFlow-Setup-<version>-win-x64.exe.sha256`
|
||||
- `ForgeFlow-Portable-<version>-win-x64.exe`
|
||||
- `ForgeFlow-Portable-<version>-win-x64.exe.sha256`
|
||||
- `ForgeFlow-<version>-provenance.json`
|
||||
- `ForgeFlow-<version>-sbom.cdx.json`
|
||||
- `ForgeFlow-<version>-release-manifest.json`
|
||||
- `ForgeFlow-<version>-release-manifest.json.sig`
|
||||
|
||||
Run `npm run signing:setup` once on the release workstation. The private Ed25519 key stays outside the repository in ForgeFlow's user-data folder. This independent publisher signature is free; optional Authenticode can still be added later for Windows reputation.
|
||||
|
||||
Use `-SkipBinaryRelease` only when intentionally publishing source without enabling packaged auto-update.
|
||||
|
||||
@@ -70,6 +76,6 @@ Set-ExecutionPolicy -Scope Process Bypass
|
||||
.\Publish-ForgeFlow-Release.ps1
|
||||
```
|
||||
|
||||
The script installs dependencies, runs the complete quality gate, clones `git@gitea.itworx.tech:Jens/ForgeFlow.git` into a temporary folder, mirrors the validated source without `.git`, `node_modules`, `dist` or release archives, commits it and pushes `main`. It then compares local `HEAD` with `git ls-remote`, builds the exact published checkout and uploads the installer, portable executable and both checksums to the matching Gitea release. Publication fails when either the source commit or any required binary asset cannot be verified.
|
||||
The script installs dependencies, runs the complete quality gate, clones `git@gitea.itworx.tech:Jens/ForgeFlow.git` into a temporary folder, mirrors the validated source without `.git`, `node_modules`, `dist` or release archives, commits it and pushes `main`. It then compares local `HEAD` with `git ls-remote`, builds the exact published checkout and uploads all binaries, checksums and signed release evidence to the matching Gitea release. Publication fails when either the source commit, publisher signature or any required asset cannot be verified.
|
||||
|
||||
Keep the currently installed older ForgeFlow source folder untouched until the built-in updater test is complete.
|
||||
|
||||
Reference in New Issue
Block a user