Repository navigation
Conversation
… 1 and signing Beta builds may be published as public GitHub pre-releases; the review-pass1 and authenticode gates may be waived for beta only, with SHA256SUMS.sig, the not-yet-reviewed notice and the key fingerprints in the README. Stable keeps every gate.
Stable still refuses both waivers; tests cover the beta record and the two stable refusals.
Size, SHA-256, signer and MSI UpgradeCodes recorded from the upstream files; dokan2.dll imports no VC++ runtime on x64 or x86, so the MSI form applies. ARM64 has no row yet.
tools/release/key-ceremony.ps1 generates the two roots and the release-beta key on an offline machine, signs keyset version 1 with both roots, verifies each signature and writes roots.txt, keyset.txt and the README fingerprints block. docs/dev/key-ceremony.md walks the maintainer through it (D48, 04 9.3).
…age (D48) SD_SETUP_PRERELEASE_NOTICE (default on for the beta channel) adds a visible notice to the welcome page in the six languages; unattended runs log it in English. Tests check the catalogs and when the flow shows it.
One sentence next to the interim rule in 04 §10 (beta setups carry the notice; silent runs log it in English) and a short paragraph in docs/dev/m4-notes.md with the option's default, the compile-in path and the tests.
sd-release keyring verifies the signed keyset of installer/keys/keyset.txt against the two root public keys of roots.txt (the keyset's root line encoding; comments and blank lines allowed) and writes the two include files deterministically into the build tree: setup_keyring.inc (the stub's payload keyring) and update_trust.inc (the update trust of shelldrive-host). cmake/SdKeyring.cmake runs it as a build step whenever installer/keys/ exists; without it the placeholders in the source tree are compiled in, so every verification still fails closed. The payload signature library splits: sd_payload_sig_text (pure verifier, linked by sd-release) and sd_payload_sig (the stub's keyring wrapper), so the keyring of the build can depend on the tool that generates it without a dependency cycle. sd-release joins the host tools of the ARM64 and ARM32 nested builds, since it now runs during the build there too. The includes are angle form and the generated directory goes first on the include path: a quoted include would always find the placeholder beside the sources, whatever the -I order (checked with cl). Test: tests/release/keyring_flow.cmake (ctest release.keyring) covers the generated entries, the inclusive unix-second dates, revocation, byte determinism, a keyset signed by an unknown root (exit 3) and malformed roots.txt variants (exit 2).
…-R23) The package job checks size and SHA-256 of every pinned Dokany file at embed time. The strict parser takes printable ASCII with LF or CRLF, the dokany-lock 1 header, known key lines and file lines only, and refuses unknown keys, duplicates and malformed file lines (exit 2); a file that is missing or differs exits 3. --arch checks one arch plus the bundle. Test release.dokany covers the cases with fake files.
sd-payload gains --dokany-x64/--dokany-x86: the lock-verified upstream packages ride as RT_RCDATA resources (04 6.1), unmodified. SdPayload passes them from the new SD_PAYLOAD_DOKANY_X64/X86 cache variables, so the packaging script can reconfigure with PAYLOAD_SIG and the Dokany resources in one attach step. Without them nothing changes.
…s1 (D48) The whole beta packaging, runnable locally and from CI: fresh -DSD_SETUP_CHANNEL=beta build trees (pre-release notice defaults ON), setup EXEs and MSIs of the producible flavours, dokany.lock verification of the upstream files (never a download), payload tables, and with -seed the payload-table signatures, the PAYLOAD_SIG reattach plus the DOKANY_X64/X86 resources, SHA256SUMS + SHA256SUMS.sig, the signed beta manifest and release notes that open with the not-yet-reviewed notice. Without -seed it stops after the unsigned artifacts and payload-tables.txt. What the repository cannot produce (x64 and x86-sse2 setups, MSIs without WiX, ARM64 Dokany) is skipped with a clear message, never faked.
workflow_dispatch gains the channel input, beta by default. package downloads the pinned Dokany files fresh from the lock's url-upstream (no caches, TM-R39) and runs package-beta.ps1 without the seed; sign-beta holds the release-beta seed in the protected beta-signing environment (secret RELEASE_BETA_SEED, written to a temp file and deleted after the run, never printed) and produces the signed release set; publish-beta is the only contents: write job and creates the v<V>-beta pre-release with the generated notes. Stable keeps every gate and its offline sessions: its package and finalize jobs fail closed as before.
docs/dev/release-beta.md: the one-time GitHub setup (beta-signing environment, RELEASE_BETA_SEED, installer/keys committed, the gates record), the CI job order and the local flow with tools/release/package-beta.ps1, plus what is skipped and why. key-ceremony.md points there from the release-beta seed section.
…fix the MSI copy source Extract PAYLOAD_TABLE, PAYLOAD_SIG and the Dokany resources from each final setup EXE, require them to be the signed/verified bytes, and verify the embedded signature. Collect the MSIs from the build tree, and fix the skipped-flavour message.
…h-beta The publish job has no checkout, so gh needs GH_REPO. It no longer binds beta-signing, which keeps RELEASE_BETA_SEED out of the job that holds contents: write.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tester channel: public beta pre-releases (D48), signed with our own ed25519 keys while Authenticode and crypto review pass 1 are pending.
Decision
review-pass1andauthenticodemay bewaivedon beta only (with a note); stable keeps every gate. Each beta carriesSHA256SUMS+ ed25519SHA256SUMS.sig, the "not yet externally reviewed" notice in setup and release notes, and the key fingerprints in the README.What changes
sd-release gates checkaccepts the two beta waivers (stable still refuses them).installer/dokany/dokany.lock: Dokany 2.3.1.1000 pinned from the upstream files (size, SHA-256, signer LEOSAC / Certum EV, MSI UpgradeCodes;dokan2.dllimports no VC++ runtime on x64/x86, so the MSI form applies; ARM64 has no row yet).sd-release dokany verifychecks files against it; the setup EXE embeds the verified MSIs asDOKANY_X64/X86.sd-release keyringturnsinstaller/keys/{roots.txt,keyset.txt}into the stub's keyring and the agent's update trust at build time (cmake/SdKeyring.cmake). Withoutinstaller/keys/every build keeps the revoked placeholder (fail closed), as today.tools/release/key-ceremony.ps1+docs/dev/key-ceremony.md: the offline ceremony (two roots, release-beta key, keyset v1 signed by both roots, fingerprints block).SD_SETUP_PRERELEASE_NOTICE(on for the beta channel) shows the notice on the welcome page in en/es/fr/pt-BR/it/de; unattended runs log it.tools/release/package-beta.ps1andrelease.ymlbeta path: build with the beta channel, verify and embed Dokany, sign payload tables, insertPAYLOAD_SIG,SHA256SUMS(.sig), manifest, verify everything,gh release create --prerelease. The seed lives only in the protectedbeta-signingenvironment (temp file, never printed, deleted in analways()step); only the publish job hascontents: write. Stable stays fail-closed. Guide:docs/dev/release-beta.md.Verification
tools/ci-local.ps1 -Pipeline: all five presets pass at 1fc4df9.sd-release keyring. The dry run found and fixed a bug in the second signature check.sd-release verifyOK,SHA256SUMSmatches, the embeddedPAYLOAD_SIGverifies against the compiled-in keyring and the embedded Dokany resources equal the locked files.tools/check-workflows.ps1: 0 warnings.Before the first real beta (maintainer)
installer/keys/roots.txtandkeyset.txt; add the fingerprints block to the README.beta-signing(required reviewer) with secretRELEASE_BETA_SEED; workflow permissions allowingcontents: writefor the publish job.installer/keys/release-gates.txtfor the version (channel beta).Known gaps
sd_setup_dokany_runis not called); the release notes say so.check-repro.sign-betarepackages from scratch instead of signing thepackagejob's artifacts.unit.svcsvc_autostart_failed_mount_is_replaced_by_a_new_mountassumes the same free drive letter while other gate tests mount drives.