fix(release): reject invalid Desktop archives during recovery by devantler · Pull Request #8316 · devantler-tech/ksail

devantler · 2026-11-11T03:55:59Z

🤖 Generated by the Agentic Engineer

Why

Release recovery can deliver a Desktop download that matches its checksum but has a broken macOS signature.

What

Verify the published Desktop download before delivering its Homebrew update, including during recovery. Refuse an invalid app while allowing the separate CLI update to finish.

Part of #8305

Verify the immutable published ZIP before either open or merged cask handoff. Keep the CLI cask independent, and exercise real macOS resource seals in required CI. Part of #8305

Re-establish the shipped dependency graph verdict after the post-publication Desktop signature gate. The full Go suite passes with pinned action commits required. Part of #8305

devantler · 2026-11-11T03:57:19Z

🤖 Generated by the Agentic Engineer

Validation for fb90c896613ca2010e2c4d68be1a9ebb149fba97:

The regression first reproduced the existing handoff accepting the Desktop path after signature rejection. The fixed workflow stops before both open-PR delivery and merged-PR recovery, while the CLI path still proceeds.
Native macOS tests use real signed app bundles and ZIP extraction. A valid publication passes; changed download bytes and a checksum-matching ZIP with a changed signed resource are rejected.
The real published v7.212.40 ZIP passes the new recovery verifier. The real v7.212.39 ZIP matches its publication digest but fails strict bundle verification, so recovery refuses it.
The complete cask handoff suite, ShellCheck, shell formatting, and full Go suite pass. The Go run required the pinned KSail action commits; the existing release-configuration audit receipt was refreshed after re-establishing that audit. Release build inputs are unchanged.

The local Actionlint version reports the existing code-quality permission and concurrency.queue syntax on both unchanged main and this branch. No suppression was added; hosted validation remains required.

This stays draft until current-head hosted checks and independent review pass. #8305 remains open for post-merge release/recovery acceptance; #8307 tracks the separate Gatekeeper requirement.

github-actions · 2026-11-11T04:02:22Z

✅⚠️MegaLinter analysis: Success with warnings

⚠️ BASH / bash-exec - 1 error

Results of bash-exec linter (version 5.3.9)
See documentation on https://megalinter.io/10.2.0/descriptors/bash_bash_exec/
-----------------------------------------------

✅ [SUCCESS] .github/actions/cleanup-hetzner/cleanup-hetzner.sh
✅ [SUCCESS] .github/actions/cleanup-hetzner/cleanup-hetzner.test.sh
✅ [SUCCESS] .github/actions/free-disk-space/free-disk-space.sh
✅ [SUCCESS] .github/actions/ksail-cluster/hetzner-inventory-config.sh
✅ [SUCCESS] .github/actions/ksail-system-test/argocd-adoption.sh
✅ [SUCCESS] .github/actions/ksail-system-test/autoscaler-audit-trial.sh
✅ [SUCCESS] .github/actions/ksail-system-test/calico-migration.sh
✅ [SUCCESS] .github/actions/ksail-system-test/calico-migration.test.sh
✅ [SUCCESS] .github/actions/ksail-system-test/chart-values-drift.sh
✅ [SUCCESS] .github/actions/ksail-system-test/helm-cli.sh
✅ [SUCCESS] .github/actions/ksail-system-test/helm-values-precedence.sh
✅ [SUCCESS] .github/actions/ksail-system-test/offline-ecr-upstream.sh
✅ [SUCCESS] .github/actions/ksail-system-test/offline-ecr-upstream.test.sh
✅ [SUCCESS] .github/actions/ksail-system-test/talos-kubernetes-upgrade.sh
✅ [SUCCESS] .github/actions/ksail-system-test/verify-offline-ecr-pull.sh
✅ [SUCCESS] .github/actions/ksail-system-test/verify-offline-ecr-pull.test.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/install-with-recovery.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/install-with-recovery.test.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/reject-remote-kustomize-resources.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/remote-resource-guard.test.sh
✅ [SUCCESS] .github/actions/pull-registry-image/pull-registry-image.sh
✅ [SUCCESS] .github/actions/rate-limit-gate/wait-for-rate-limit.sh
✅ [SUCCESS] .github/actions/rate-limit-gate/wait-for-rate-limit.test.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/cache-validation.test.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/mirror-artifact.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/pull-helper-image.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/pull-helper-image.test.sh
✅ [SUCCESS] .github/scripts/assert-gitops-deployed.sh
✅ [SUCCESS] .github/scripts/assert-gitops-deployed.test.sh
✅ [SUCCESS] .github/scripts/assert-k3k-server-creator.sh
✅ [SUCCESS] .github/scripts/assert-k3k-server-creator.test.sh
✅ [SUCCESS] .github/scripts/build-calico-migration-baseline.sh
✅ [SUCCESS] .github/scripts/cask-pr-handoff-workflow.test.sh
✅ [SUCCESS] .github/scripts/cask-read-api.sh
✅ [SUCCESS] .github/scripts/cask-read-api.test.sh
✅ [SUCCESS] .github/scripts/cask-rendering.test.sh
✅ [SUCCESS] .github/scripts/check-eks-capacity.sh
✅ [SUCCESS] .github/scripts/check-eks-capacity.test.sh
✅ [SUCCESS] .github/scripts/codeql-autobuild-prepare.sh
✅ [SUCCESS] .github/scripts/codeql-autobuild-prepare.test.sh
✅ [SUCCESS] .github/scripts/codeql-source.sh
✅ [SUCCESS] .github/scripts/collect-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/collect-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/collect-release-build-experiment.sh
✅ [SUCCESS] .github/scripts/delete-eks-smoke-cluster.sh
✅ [SUCCESS] .github/scripts/delete-eks-smoke-cluster.test.sh
✅ [SUCCESS] .github/scripts/delete-old-workflow-runs.sh
✅ [SUCCESS] .github/scripts/delete-old-workflow-runs.test.sh
✅ [SUCCESS] .github/scripts/diagnostics-artifact-fixture.sh
✅ [SUCCESS] .github/scripts/diagnostics-artifact-fixture.test.sh
✅ [SUCCESS] .github/scripts/diagnostics-artifact-ksail-fixture.sh
✅ [SUCCESS] .github/scripts/download-go-modules.sh
✅ [SUCCESS] .github/scripts/eks-report-test-lib.sh
✅ [SUCCESS] .github/scripts/find-merged-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/find-merged-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/finish-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/finish-cask-pr-handoff.test.sh
❌ [ERROR] .github/scripts/generate-completions.sh
    Error: File:[.github/scripts/generate-completions.sh] is not executable

✅ [SUCCESS] .github/scripts/go-notices-release.test.sh
✅ [SUCCESS] .github/scripts/install-release.test.sh
✅ [SUCCESS] .github/scripts/list-link-check-files.sh
✅ [SUCCESS] .github/scripts/prepare-nested-kind-host.sh
✅ [SUCCESS] .github/scripts/prepare-nested-kind-host.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-cohort.sh
✅ [SUCCESS] .github/scripts/profile-codeql-compare.sh
✅ [SUCCESS] .github/scripts/profile-codeql-compare.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-files.sh
✅ [SUCCESS] .github/scripts/profile-codeql-files.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-go.sh
✅ [SUCCESS] .github/scripts/profile-codeql-go.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-swap.sh
✅ [SUCCESS] .github/scripts/profile-codeql-swap.test.sh
✅ [SUCCESS] .github/scripts/publish-mcp-registry.sh
✅ [SUCCESS] .github/scripts/publish-mcp-registry.test.sh
✅ [SUCCESS] .github/scripts/publish-operator-chart.sh
✅ [SUCCESS] .github/scripts/redraft-evergreen-cask-prs.sh
✅ [SUCCESS] .github/scripts/redraft-evergreen-cask-prs.test.sh
✅ [SUCCESS] .github/scripts/release-build-collector.test.sh
✅ [SUCCESS] .github/scripts/release-build-experiment.test.sh
✅ [SUCCESS] .github/scripts/release-build-samples.lib.sh
✅ [SUCCESS] .github/scripts/report-eks-account-capacity.sh
✅ [SUCCESS] .github/scripts/report-eks-account-capacity.test.sh
✅ [SUCCESS] .github/scripts/report-eks-create-failure.sh
✅ [SUCCESS] .github/scripts/report-eks-create-failure.test.sh
✅ [SUCCESS] .github/scripts/resolve-cask-publication.sh
✅ [SUCCESS] .github/scripts/resolve-cask-publication.test.sh
✅ [SUCCESS] .github/scripts/resolve-release-publish-state.sh
✅ [SUCCESS] .github/scripts/resolve-release-publish-state.test.sh
✅ [SUCCESS] .github/scripts/resolve-release-replay.sh
✅ [SUCCESS] .github/scripts/strict-link-transport.sh
✅ [SUCCESS] .github/scripts/strict-link-transport.test.sh
✅ [SUCCESS] .github/scripts/style-clean-cask-branch.sh
✅ [SUCCESS] .github/scripts/style-clean-cask-branch.test.sh
✅ [SUCCESS] .github/scripts/summarize-mutation-report.sh
✅ [SUCCESS] .github/scripts/summarize-mutation-report.test.sh
✅ [SUCCESS] .github/scripts/summarize-nested-kubelet.sh
✅ [SUCCESS] .github/scripts/upload-release-assets.sh
✅ [SUCCESS] .github/scripts/upload-release-assets.test.sh
✅ [SUCCESS] .github/scripts/validate-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/validate-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/validate-release-ref.sh
✅ [SUCCESS] .github/scripts/validate-release-ref.test.sh
✅ [SUCCESS] .github/scripts/verify-desktop-codeql.sh
✅ [SUCCESS] .github/scripts/verify-desktop-codeql.test.sh
✅ [SUCCESS] .github/scripts/verify-diagnostics-artifact.sh
✅ [SUCCESS] .github/scripts/verify-go-archive-parity.sh
✅ [SUCCESS] .github/scripts/verify-go-archive-parity.test.sh
✅ [SUCCESS] .github/scripts/verify-otelzap-parity.sh
✅ [SUCCESS] .github/scripts/verify-otelzap-parity.test.sh
✅ [SUCCESS] .github/scripts/verify-published-desktop-archive.sh
✅ [SUCCESS] .github/scripts/verify-published-desktop-archive.test.sh
✅ [SUCCESS] .github/scripts/verify-vendored-comment-scan.sh
✅ [SUCCESS] .github/scripts/wait-for-github-api-budget.sh
✅ [SUCCESS] .github/scripts/wait-for-github-api-budget.test.sh
✅ [SUCCESS] desktop/scripts/make-icns.sh
✅ [SUCCESS] desktop/scripts/make-info-plist.sh
✅ [SUCCESS] desktop/scripts/make-macos-app.sh
✅ [SUCCESS] desktop/scripts/verify-macos-archive.sh
✅ [SUCCESS] docs/demos/render.sh
✅ [SUCCESS] images/ksail-analysis-runner/smoke.sh
✅ [SUCCESS] install.sh
✅ [SUCCESS] internal/ciharness/testdata/schematic_fake_ksail.sh
✅ [SUCCESS] pkg/svc/provisioner/cluster/vcluster/containerd_registry_hosts.sh
✅ [SUCCESS] scripts/stage-webui.sh

✅ Linters with no issues

actionlint, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

devantler added 2 commits November 11, 2026 04:30

fix(release): verify reused Desktop archive signatures

d8b10d5

Verify the immutable published ZIP before either open or merged cask handoff. Keep the CLI cask independent, and exercise real macOS resource seals in required CI. Part of #8305

test(release): refresh the audited handoff configuration

fb90c89

Re-establish the shipped dependency graph verdict after the post-publication Desktop signature gate. The full Go suite passes with pinned action commits required. Part of #8305

github-project-automation Bot added this to 🌊 Project Board Nov 11, 2026

github-project-automation Bot moved this to 🫴 Ready in 🌊 Project Board Nov 11, 2026

Navigation Menu

Repository navigation

fix(release): reject invalid Desktop archives during recovery - #8316

fix(release): reject invalid Desktop archives during recovery#8316
devantler wants to merge 2 commits into
mainfrom
codex/desktop-recovery-signature-8305

devantler commented Nov 11, 2026

Uh oh!

devantler commented Nov 11, 2026

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

devantler commented Nov 11, 2026

Why

What

Uh oh!

devantler commented Nov 11, 2026

Uh oh!

github-actions Bot commented Nov 11, 2026

✅⚠️MegaLinter analysis: Success with warnings

✅ Linters with no issues

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant