From 27fe01cb8b7f55d3a3f85116633a42f45dc089f7 Mon Sep 17 00:00:00 2001 From: D Thomas <146stat@gmail.com> Date: Mon, 3 Aug 2026 01:56:33 +0000 Subject: [PATCH 1/2] docs: harden public installation across Linux and WSL --- .github/workflows/public-install.yml | 123 +++++++++++ ALPHA_TESTING.md | 49 ++--- CHANGELOG.md | 8 + CONTRIBUTING.md | 10 +- README.md | 26 ++- docs/getting-started/installation.md | 159 +++++++++++--- docs/getting-started/platform-support.md | 74 +++++++ mkdocs.yml | 1 + scripts/bootstrap_public_alpha.sh | 260 +++++++++++++++++++++++ 9 files changed, 633 insertions(+), 77 deletions(-) create mode 100644 .github/workflows/public-install.yml create mode 100644 docs/getting-started/platform-support.md create mode 100755 scripts/bootstrap_public_alpha.sh diff --git a/.github/workflows/public-install.yml b/.github/workflows/public-install.yml new file mode 100644 index 0000000..b31e1c4 --- /dev/null +++ b/.github/workflows/public-install.yml @@ -0,0 +1,123 @@ +name: QuantumD Public Install Compatibility + +on: + pull_request: + paths: + - ".github/workflows/public-install.yml" + - "ALPHA_TESTING.md" + - "CHANGELOG.md" + - "CONTRIBUTING.md" + - "README.md" + - "docs/getting-started/**" + - "mkdocs.yml" + - "pyproject.toml" + - "scripts/bootstrap_public_alpha.sh" + - "src/**" + push: + branches: + - main + - master + - "feature/**" + paths: + - ".github/workflows/public-install.yml" + - "ALPHA_TESTING.md" + - "CHANGELOG.md" + - "CONTRIBUTING.md" + - "README.md" + - "docs/getting-started/**" + - "mkdocs.yml" + - "pyproject.toml" + - "scripts/bootstrap_public_alpha.sh" + - "src/**" + +permissions: + contents: read + +concurrency: + group: quantumd-public-install-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + python-compatibility: + name: Python ${{ matrix.python-version }} compatibility + runs-on: ubuntu-24.04 + timeout-minutes: 35 + + strategy: + fail-fast: false + matrix: + python-version: + - "3.10" + - "3.11" + - "3.12" + + steps: + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + + - name: Set up Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: "${{ matrix.python-version }}" + cache: pip + cache-dependency-path: pyproject.toml + + - name: Install source and tests + run: | + python -m pip install --upgrade pip + python -m pip install -e ".[dev]" + + - name: Run regression suite + run: python -m pytest -q + + - name: Run local quickstart and verification + run: | + quantumd quickstart "$RUNNER_TEMP/quantumd-project" + quantumd doctor "$RUNNER_TEMP/quantumd-project" + quantumd verify-chain \ + "$RUNNER_TEMP/quantumd-project" \ + --latest + + ubuntu-22-public-bootstrap: + name: Ubuntu 22.04 public bootstrap + runs-on: ubuntu-22.04 + timeout-minutes: 40 + + steps: + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + + - name: Run exact published-alpha bootstrap + run: | + bash scripts/bootstrap_public_alpha.sh \ + --venv "$RUNNER_TEMP/quantumd-alpha" \ + --project "$RUNNER_TEMP/quantumd-project" + + ubuntu-20-public-bootstrap: + name: Ubuntu 20.04 container public bootstrap + runs-on: ubuntu-24.04 + timeout-minutes: 45 + + steps: + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + + - name: Run bootstrap in Ubuntu 20.04 + run: | + docker run \ + --rm \ + --volume "$PWD:/workspace:ro" \ + ubuntu:20.04 \ + bash -lc ' + set -euo pipefail + apt-get update + DEBIAN_FRONTEND=noninteractive \ + apt-get install -y \ + build-essential \ + ca-certificates \ + curl \ + git + bash /workspace/scripts/bootstrap_public_alpha.sh \ + --venv /tmp/quantumd-alpha \ + --project /tmp/quantumd-project + ' diff --git a/ALPHA_TESTING.md b/ALPHA_TESTING.md index 05020b9..e839409 100644 --- a/ALPHA_TESTING.md +++ b/ALPHA_TESTING.md @@ -19,50 +19,25 @@ The initial group should include: Complete the installation and quickstart without a live walkthrough. Record where the documentation creates confusion, skepticism, or unnecessary work. -## Secure TestPyPI installation +## Secure public-alpha installation -Create an isolated environment: +Use the [installation guide](docs/getting-started/installation.md). The +recommended Linux and WSL path is the repository bootstrap: ```bash -python3.12 -m venv .venv -source .venv/bin/activate -python -m pip install --upgrade pip -``` - -Download the exact QuantumD wheel from TestPyPI without resolving dependencies -from that index: - -```bash -python -m pip download \ - --no-deps \ - --only-binary=:all: \ - --index-url https://test.pypi.org/simple/ \ - quantumd==0.7.4a0 -``` - -Install the downloaded wheel. Its dependencies will resolve from the default -Python Package Index: - -```bash -python -m pip install \ - ./quantumd-0.7.4a0-py3-none-any.whl -``` +curl -fsSLO \ + https://raw.githubusercontent.com/WindDAnalytics/quantumd/main/scripts/bootstrap_public_alpha.sh -Run the first governed local workflow: - -```bash -quantumd quickstart my-first-quantumd-project +less bootstrap_public_alpha.sh +bash bootstrap_public_alpha.sh ``` -Inspect the environment and independently verify the evidence: +The evaluator should review the script before running it. The bootstrap creates +an isolated Python 3.12 environment, verifies the exact public wheel, runs the +local quickstart, and independently verifies the resulting evidence. -```bash -quantumd doctor my-first-quantumd-project - -quantumd verify-chain \ - my-first-quantumd-project \ - --latest -``` +Record the operating system, architecture, Python bootstrap method, installation +time, and time to the first verified chain. ## Expected security boundary diff --git a/CHANGELOG.md b/CHANGELOG.md index bfeba38..00fc3db 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog +## Unreleased +### Public installation hardening +- Added a guided Linux and WSL bootstrap using a `uv`-managed Python 3.12 environment. +- Added explicit platform-support labels and a compatibility matrix. +- Documented Ubuntu 20.04 default-Python and missing-`venv` failure modes. +- Added compatibility testing for Python 3.10, 3.11, and 3.12. +- Added public bootstrap acceptance for Ubuntu 22.04 and Ubuntu 20.04 in a container. + ## 0.7.4a0 - 2026-08-02 ### Public-alpha acceptance hardening diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6499969..aace75f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -12,13 +12,19 @@ Use Python 3.12 for the reference development environment. git clone https://github.com/WindDAnalytics/quantumd.git cd quantumd -python3.12 -m venv .venv +curl -LsSf https://astral.sh/uv/install.sh | sh +export PATH="$HOME/.local/bin:$PATH" + +uv python install 3.12 +uv venv --python 3.12 --seed .venv source .venv/bin/activate -python -m pip install --upgrade pip python -m pip install -e ".[dev]" ``` +Contributors who already have Python 3.12 and working standard-library virtual +environment support may use `python3.12 -m venv .venv`. + Run the regression suite: ```bash diff --git a/README.md b/README.md index 261707d..0514be5 100644 --- a/README.md +++ b/README.md @@ -99,16 +99,25 @@ QuantumD `0.7.4a0` is published on TestPyPI. Use an isolated Python environment and download only the QuantumD wheel from TestPyPI. Dependencies are installed from the default Python Package Index. -### 1. Create an isolated environment +### 1. Create a supported isolated environment + +The recommended Linux and WSL path uses `uv`, so the setup does not depend on +the operating system's default Python or `venv` package: ```bash -python3.12 -m venv .venv -source .venv/bin/activate -python -m pip install --upgrade pip +curl -LsSf https://astral.sh/uv/install.sh | sh +export PATH="$HOME/.local/bin:$PATH" + +uv python install 3.12 +uv venv --python 3.12 --seed ~/.venvs/quantumd-alpha +source ~/.venvs/quantumd-alpha/bin/activate +python --version ``` QuantumD supports Python 3.10 and newer. Python 3.12 is the reference alpha -environment. +environment. Users who already have a supported Python and working `venv` may +use the standard-library environment path described in the +[installation guide](docs/getting-started/installation.md). ### 2. Download and verify the exact wheel @@ -163,9 +172,10 @@ KMS contacted: False Hardware action: None ``` -For expanded instructions, WSL guidance, checksum details, and source -development installation, see the -[installation guide](docs/getting-started/installation.md). +For expanded instructions, the guided bootstrap, WSL troubleshooting, +checksum details, and source development installation, see the +[installation guide](docs/getting-started/installation.md) and +[platform-support matrix](docs/getting-started/platform-support.md). ## The Evidence Graph diff --git a/docs/getting-started/installation.md b/docs/getting-started/installation.md index a0b6359..f35eaec 100644 --- a/docs/getting-started/installation.md +++ b/docs/getting-started/installation.md @@ -1,21 +1,56 @@ # Installation -QuantumD runs on Linux, Windows Subsystem for Linux, Cloud Shell, and other -compatible Python environments. +QuantumD runs on Linux, Windows Subsystem for Linux, Google Cloud Shell, and +other compatible Python environments. The public alpha requires Python 3.10 or newer. Python 3.12 is the reference -environment used by the release and acceptance workflows. +environment used by release and acceptance workflows. -## Install the published alpha +## Recommended environment setup + +Use `uv` when the computer does not already have a supported Python and working +virtual-environment support. This is the recommended path for WSL and for older +Linux distributions. -Create an isolated environment: +Install `uv` for the current user: ~~~bash -python3.12 -m venv .venv -source .venv/bin/activate -python -m pip install --upgrade pip +curl -LsSf https://astral.sh/uv/install.sh | sh +export PATH="$HOME/.local/bin:$PATH" +~~~ + +Install the reference Python and create one dedicated environment: + +~~~bash +uv python install 3.12 +uv venv --python 3.12 --seed ~/.venvs/quantumd-alpha +source ~/.venvs/quantumd-alpha/bin/activate +python --version ~~~ +Expected Python output begins with `Python 3.12`. + +For later terminal sessions, do not recreate the environment. Activate the same +one: + +~~~bash +source ~/.venvs/quantumd-alpha/bin/activate +~~~ + +!!! note "Already have Python 3.10 or newer?" + You may use the standard library instead: + + ~~~bash + python3 -m venv ~/.venvs/quantumd-alpha + source ~/.venvs/quantumd-alpha/bin/activate + python -m pip install --upgrade pip + ~~~ + + If environment creation fails or the available Python is older than 3.10, + use the recommended `uv` path. + +## Install the published alpha + Download only the exact QuantumD wheel from TestPyPI: ~~~bash @@ -41,15 +76,13 @@ python -m pip install \ ./quantumd-0.7.4a0-py3-none-any.whl ~~~ -Because the wheel is installed from a local file, its dependencies resolve -from the default Python Package Index rather than TestPyPI. +Because the wheel is installed from a local file, its dependencies resolve from +the default Python Package Index rather than TestPyPI. !!! warning "Do not use TestPyPI as the only dependency index" - - Avoid `using TestPyPI as the sole package index`. TestPyPI is - a testing service and may contain unrelated or incomplete dependency - packages. Download the exact QuantumD artifact first, then install the - local wheel. + TestPyPI is a testing service and may contain unrelated or incomplete + dependency packages. Download the exact QuantumD artifact first, verify its + checksum, and then install the local wheel. Confirm the installation: @@ -57,6 +90,26 @@ Confirm the installation: quantumd --help ~~~ +## Guided Linux and WSL bootstrap + +The repository includes a bootstrap script that installs an isolated Python +3.12 environment, downloads the exact public-alpha wheel, verifies its SHA-256 +digest, installs QuantumD, runs the local quickstart, and independently verifies +the evidence chain. + +Download and review the script before running it: + +~~~bash +curl -fsSLO \ + https://raw.githubusercontent.com/WindDAnalytics/quantumd/main/scripts/bootstrap_public_alpha.sh + +less bootstrap_public_alpha.sh +bash bootstrap_public_alpha.sh +~~~ + +The script does not replace the operating system's Python. Its default +environment is `~/.venvs/quantumd-alpha`. + ## Run the first governed workflow ~~~bash @@ -78,27 +131,66 @@ simulator path. ## Windows Subsystem for Linux -From a WSL terminal: +Older WSL distributions may ship with an unsupported default Python. Ubuntu +20.04, for example, commonly provides Python 3.8. Installing a newer interpreter +through `apt` may still leave the matching `venv` package unavailable. + +Use the recommended `uv` setup rather than replacing `/usr/bin/python3`. + +If the terminal prompt appears nested, such as `((.venv))`, open a clean shell +and activate only the standard QuantumD environment: + +~~~bash +exec bash +source ~/.venvs/quantumd-alpha/bin/activate +~~~ + +Repeated activation does not corrupt QuantumD, but it creates confusing shell +prompts. + +## Troubleshooting + +### `uv: command not found` + +Add the user installation directory to the current shell: ~~~bash -cd ~ +export PATH="$HOME/.local/bin:$PATH" +~~~ -python3.12 -m venv quantumd-alpha -source quantumd-alpha/bin/activate -python -m pip install --upgrade pip +To make that persistent in Bash: -python -m pip download \ - --no-deps \ - --only-binary=:all: \ - --index-url https://test.pypi.org/simple/ \ - quantumd==0.7.4a0 +~~~bash +echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc +source ~/.bashrc +~~~ -python -m pip install \ - ./quantumd-0.7.4a0-py3-none-any.whl +### Python is older than 3.10 + +Do not modify the operating system's default Python. Use: + +~~~bash +uv python install 3.12 +uv venv --python 3.12 --seed ~/.venvs/quantumd-alpha +~~~ + +### `python3.12-venv` cannot be located + +This can occur on older Ubuntu releases. Use the `uv` path instead of adding +more operating-system Python repositories. -quantumd quickstart ~/quantumd-first-run +### A dependency fails while compiling + +One dependency may need standard build tools on some Linux systems. On Ubuntu +or Debian: + +~~~bash +sudo apt-get update +sudo apt-get install -y build-essential ~~~ +Then rerun the installation. + ## Install from source for development Clone the repository only when contributing or evaluating unreleased changes: @@ -107,9 +199,13 @@ Clone the repository only when contributing or evaluating unreleased changes: git clone https://github.com/WindDAnalytics/quantumd.git cd quantumd -python3.12 -m venv .venv +curl -LsSf https://astral.sh/uv/install.sh | sh +export PATH="$HOME/.local/bin:$PATH" + +uv python install 3.12 +uv venv --python 3.12 --seed .venv source .venv/bin/activate -python -m pip install --upgrade pip + python -m pip install -e ".[dev]" ~~~ @@ -119,3 +215,6 @@ Run the development acceptance checks: python -m pytest -q bash scripts/public_alpha_acceptance.sh ~~~ + +See [Platform support](platform-support.md) for the current verification matrix +and support boundaries. diff --git a/docs/getting-started/platform-support.md b/docs/getting-started/platform-support.md new file mode 100644 index 0000000..f9bc1fb --- /dev/null +++ b/docs/getting-started/platform-support.md @@ -0,0 +1,74 @@ +# Platform support + +QuantumD is Python software, but a successful public installation also depends +on the operating system, Python bootstrap method, package architecture, and +native build tools. + +The support labels below distinguish tested behavior from expected behavior. + +## Current matrix + +| Platform | Status | Installation path | Notes | +|---|---|---|---| +| WSL2 with Ubuntu 20.04 x86_64 | Verified manually | `uv` with Python 3.12 | Default Python 3.8 is unsupported. The `python3.12-venv` package may be unavailable. | +| Ubuntu 20.04 x86_64 container | CI verified | Public bootstrap | Tested through a container because GitHub retired its hosted Ubuntu 20.04 runner image. | +| Ubuntu 22.04 x86_64 | CI verified | Public bootstrap | Full wheel verification, quickstart, doctor, and chain verification. | +| Ubuntu 24.04 x86_64 | CI verified | Standard CI and public acceptance | Reference hosted Linux environment. | +| Google Cloud Shell | Verified | Existing Python 3.12 environment | Used for development and release acceptance. | +| Other x86_64 Linux distributions | Expected to work | `uv` with Python 3.12 | Not all package managers and libc versions are tested. | +| macOS | Not yet verified | Manual installation only | Do not interpret Linux CI as macOS support evidence. | +| Native Windows PowerShell or Command Prompt | Not yet supported | Use WSL2 | Current commands and verification scripts are designed for a POSIX shell. | +| Linux ARM64 | Not yet verified | Manual installation only | Binary dependency availability has not been accepted. | + +## Python versions + +QuantumD package metadata requires Python 3.10 or newer. + +The project tests: + +- Python 3.10 +- Python 3.11 +- Python 3.12 + +Python 3.12 is the reference environment for published-alpha acceptance. + +Python 3.13 and newer are not yet part of the accepted compatibility matrix. + +## What the compatibility checks prove + +The public-install checks require: + +- creation of an isolated Python environment +- download of the exact TestPyPI QuantumD wheel +- SHA-256 verification of the wheel +- dependency installation from the default Python Package Index +- CLI availability +- governed local quickstart completion +- `LOCAL_DEVELOPMENT` trust +- `LOCAL_SIMULATION_ONLY` scope +- explicit hardware prohibition +- independent evidence-chain verification +- confirmation that IBM and KMS were not contacted + +They do not prove: + +- support for every Linux distribution +- support for native Windows +- compatibility with every Python package combination +- hardware authorization from local-development trust +- production suitability for regulated or safety-critical systems + +## Report a compatibility problem + +Open a GitHub issue for reproducible installation failures and include: + +- operating system and version +- architecture +- WSL version, when applicable +- `python --version` +- `uv --version`, when used +- the failing command +- the error text with credentials and private paths removed + +Do not publish tokens, private keys, cloud identifiers, confidential workloads, +or sensitive evidence. diff --git a/mkdocs.yml b/mkdocs.yml index c76c920..0a1083d 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -47,6 +47,7 @@ nav: - Getting Started: - Installation: getting-started/installation.md + - Platform Support: getting-started/platform-support.md - Local Quickstart: getting-started/quickstart.md - Core Concepts: diff --git a/scripts/bootstrap_public_alpha.sh b/scripts/bootstrap_public_alpha.sh new file mode 100755 index 0000000..f84b513 --- /dev/null +++ b/scripts/bootstrap_public_alpha.sh @@ -0,0 +1,260 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +VERSION="0.7.4a0" +WHEEL="quantumd-0.7.4a0-py3-none-any.whl" +EXPECTED_SHA256="761a865a5aaf655f570fa3ae6f1d0f9b1b09cb89ee5519ac1843b738d251b7d2" + +VENV="${QUANTUMD_BOOTSTRAP_VENV:-$HOME/.venvs/quantumd-alpha}" +PROJECT="${QUANTUMD_BOOTSTRAP_PROJECT:-$HOME/quantumd-first-run}" +PROJECT_EXPLICIT="false" +SKIP_QUICKSTART="false" +FORCE="false" + +usage() { + cat <<'EOF' +Usage: + bash scripts/bootstrap_public_alpha.sh [options] + +Options: + --venv PATH Virtual environment location. + --project PATH Quickstart project location. + --skip-quickstart Install and verify the CLI without running a project. + --force Recreate an existing virtual environment. + -h, --help Show this help text. + +Environment variables: + QUANTUMD_BOOTSTRAP_VENV + QUANTUMD_BOOTSTRAP_PROJECT +EOF +} + +fail() { + echo + echo "BOOTSTRAP FAILED: $1" >&2 + exit 1 +} + +section() { + echo + echo "------------------------------------------------------" + echo "$1" + echo "------------------------------------------------------" +} + +while [ "$#" -gt 0 ]; do + case "$1" in + --venv) + [ "$#" -ge 2 ] || fail "--venv requires a path." + VENV="$2" + shift 2 + ;; + --project) + [ "$#" -ge 2 ] || fail "--project requires a path." + PROJECT="$2" + PROJECT_EXPLICIT="true" + shift 2 + ;; + --skip-quickstart) + SKIP_QUICKSTART="true" + shift + ;; + --force) + FORCE="true" + shift + ;; + -h|--help) + usage + exit 0 + ;; + *) + fail "Unknown option: $1" + ;; + esac +done + +echo "======================================================" +echo "QuantumD Public Alpha Bootstrap" +echo "======================================================" +echo "Package version: $VERSION" +echo "Environment: $VENV" +echo "Project: $PROJECT" + +section "1. Checking the host" + +[ "$(uname -s)" = "Linux" ] || + fail "This bootstrap currently supports Linux and WSL. See the installation guide for other platforms." + +command -v curl >/dev/null 2>&1 || + fail "curl is required." +command -v sha256sum >/dev/null 2>&1 || + fail "sha256sum is required." + +if grep -qi microsoft /proc/version 2>/dev/null; then + echo "Host: WSL" +else + echo "Host: Linux" +fi + +if [ -n "${VIRTUAL_ENV:-}" ]; then + echo "NOTICE: Another virtual environment is active:" + echo " $VIRTUAL_ENV" + echo "This script does not modify or nest that environment." +fi + +if ! command -v cc >/dev/null 2>&1; then + echo + echo "NOTICE: A C compiler was not detected." + echo "If dependency installation fails while building crcmod, install" + echo "your distribution's build tools. On Ubuntu or Debian:" + echo + echo " sudo apt-get update" + echo " sudo apt-get install -y build-essential" +fi + +section "2. Installing or locating uv" + +if command -v uv >/dev/null 2>&1; then + UV="$(command -v uv)" +else + curl -LsSf https://astral.sh/uv/install.sh | sh + export PATH="$HOME/.local/bin:$HOME/.cargo/bin:$PATH" + command -v uv >/dev/null 2>&1 || + fail "uv installed but was not found on PATH." + UV="$(command -v uv)" +fi + +"$UV" --version + +section "3. Installing the reference Python" + +"$UV" python install 3.12 +MANAGED_PYTHON="$("$UV" python find 3.12)" +"$MANAGED_PYTHON" --version + +section "4. Creating the isolated environment" + +if [ -e "$VENV" ]; then + if [ "$FORCE" = "true" ]; then + rm -rf "$VENV" + elif [ ! -x "$VENV/bin/python" ]; then + fail "$VENV exists but is not a usable virtual environment. Remove it or rerun with --force." + else + EXISTING_VERSION="$( + "$VENV/bin/python" -c \ + 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")' + )" + [ "$EXISTING_VERSION" = "3.12" ] || + fail "$VENV uses Python $EXISTING_VERSION, not Python 3.12. Remove it or rerun with --force." + echo "Reusing existing Python 3.12 environment." + fi +fi + +if [ ! -x "$VENV/bin/python" ]; then + mkdir -p "$(dirname "$VENV")" + "$UV" venv \ + --python 3.12 \ + --seed \ + "$VENV" +fi + +PYTHON="$VENV/bin/python" +QUANTUMD="$VENV/bin/quantumd" + +"$PYTHON" --version +"$PYTHON" -m pip --version + +section "5. Downloading the exact public-alpha wheel" + +ROOT="$(mktemp -d "${TMPDIR:-/tmp}/quantumd-bootstrap.XXXXXX")" +trap 'rm -rf "$ROOT"' EXIT + +cd "$ROOT" + +"$PYTHON" -m pip download \ + --disable-pip-version-check \ + --no-deps \ + --only-binary=:all: \ + --index-url https://test.pypi.org/simple/ \ + "quantumd==$VERSION" + +[ -f "$WHEEL" ] || + fail "Expected wheel was not downloaded." + +section "6. Verifying the published artifact" + +printf '%s %s\n' \ + "$EXPECTED_SHA256" \ + "$WHEEL" | + sha256sum --check + +section "7. Installing QuantumD" + +"$PYTHON" -m pip install \ + --disable-pip-version-check \ + --upgrade \ + "./$WHEEL" + +[ -x "$QUANTUMD" ] || + fail "QuantumD CLI was not installed." + +"$QUANTUMD" --help >/dev/null +echo "PASS: QuantumD CLI is available." + +if [ "$SKIP_QUICKSTART" = "true" ]; then + echo + echo "======================================================" + echo "QUANTUMD PUBLIC ALPHA INSTALLATION COMPLETE" + echo "======================================================" + echo "Activate later with:" + echo " source \"$VENV/bin/activate\"" + exit 0 +fi + +section "8. Running the governed local workflow" + +if [ -e "$PROJECT" ]; then + if [ "$PROJECT_EXPLICIT" = "true" ]; then + fail "Project path already exists: $PROJECT" + fi + PROJECT="${PROJECT}-$(date +%Y%m%d-%H%M%S)" + echo "Default project already existed." + echo "Using: $PROJECT" +fi + +QUICKSTART_LOG="$ROOT/quickstart.log" +DOCTOR_LOG="$ROOT/doctor.log" +VERIFY_LOG="$ROOT/verify.log" + +"$QUANTUMD" quickstart "$PROJECT" | + tee "$QUICKSTART_LOG" + +"$QUANTUMD" doctor "$PROJECT" | + tee "$DOCTOR_LOG" + +"$QUANTUMD" verify-chain "$PROJECT" --latest | + tee "$VERIFY_LOG" + +grep -F "LOCAL_DEVELOPMENT" "$DOCTOR_LOG" >/dev/null || + fail "Doctor did not report LOCAL_DEVELOPMENT." +grep -F "LOCAL_SIMULATION_ONLY" "$DOCTOR_LOG" >/dev/null || + fail "Doctor did not report LOCAL_SIMULATION_ONLY." +grep -F "Hardware authorization: PROHIBITED" "$DOCTOR_LOG" >/dev/null || + fail "Hardware was not explicitly prohibited." +grep -F "COMPLETE EVIDENCE CHAIN VERIFIED" "$VERIFY_LOG" >/dev/null || + fail "Independent chain verification did not complete." +grep -F "IBM contacted: False" "$VERIFY_LOG" >/dev/null || + fail "Verification did not confirm IBM isolation." +grep -F "KMS contacted: False" "$VERIFY_LOG" >/dev/null || + fail "Verification did not confirm KMS isolation." +grep -F "Hardware action: None" "$VERIFY_LOG" >/dev/null || + fail "Verification reported a hardware action." + +echo +echo "======================================================" +echo "QUANTUMD PUBLIC ALPHA BOOTSTRAP PASSED" +echo "======================================================" +echo "Environment: $VENV" +echo "Project: $PROJECT" +echo "Activate later with:" +echo " source \"$VENV/bin/activate\"" From f3326b6a9739fa0871651fafd35ce81e5f1bc16d Mon Sep 17 00:00:00 2001 From: D Thomas <146stat@gmail.com> Date: Mon, 3 Aug 2026 02:20:39 +0000 Subject: [PATCH 2/2] fix: preserve compatibility and isolate public bootstrap --- .github/workflows/public-install.yml | 5 ++++ scripts/bootstrap_public_alpha.sh | 36 +++++++++++++++++++++------- src/quantumd/submission.py | 9 +++---- 3 files changed, 37 insertions(+), 13 deletions(-) diff --git a/.github/workflows/public-install.yml b/.github/workflows/public-install.yml index b31e1c4..9ee759d 100644 --- a/.github/workflows/public-install.yml +++ b/.github/workflows/public-install.yml @@ -67,6 +67,9 @@ jobs: python -m pip install --upgrade pip python -m pip install -e ".[dev]" + - name: Check parser compatibility + run: python -m compileall -q src tests + - name: Run regression suite run: python -m pytest -q @@ -89,6 +92,8 @@ jobs: - name: Run exact published-alpha bootstrap run: | + QUANTUMD_KMS_KEY_VERSION="projects/poisoned/locations/test/keyRings/test/cryptoKeys/test/cryptoKeyVersions/1" \ + GOOGLE_APPLICATION_CREDENTIALS="/tmp/nonexistent-quantumd-credentials.json" \ bash scripts/bootstrap_public_alpha.sh \ --venv "$RUNNER_TEMP/quantumd-alpha" \ --project "$RUNNER_TEMP/quantumd-project" diff --git a/scripts/bootstrap_public_alpha.sh b/scripts/bootstrap_public_alpha.sh index f84b513..d11d5cd 100755 --- a/scripts/bootstrap_public_alpha.sh +++ b/scripts/bootstrap_public_alpha.sh @@ -42,6 +42,15 @@ section() { echo "------------------------------------------------------" } +run_local_only() { + env \ + -u QUANTUMD_KMS_KEY_VERSION \ + -u GOOGLE_APPLICATION_CREDENTIALS \ + -u GOOGLE_GHA_CREDS_PATH \ + -u CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE \ + "$@" +} + while [ "$#" -gt 0 ]; do case "$1" in --venv) @@ -226,21 +235,30 @@ QUICKSTART_LOG="$ROOT/quickstart.log" DOCTOR_LOG="$ROOT/doctor.log" VERIFY_LOG="$ROOT/verify.log" -"$QUANTUMD" quickstart "$PROJECT" | +run_local_only "$QUANTUMD" quickstart "$PROJECT" | tee "$QUICKSTART_LOG" -"$QUANTUMD" doctor "$PROJECT" | +run_local_only "$QUANTUMD" doctor "$PROJECT" | tee "$DOCTOR_LOG" -"$QUANTUMD" verify-chain "$PROJECT" --latest | +run_local_only "$QUANTUMD" verify-chain "$PROJECT" --latest | tee "$VERIFY_LOG" -grep -F "LOCAL_DEVELOPMENT" "$DOCTOR_LOG" >/dev/null || - fail "Doctor did not report LOCAL_DEVELOPMENT." -grep -F "LOCAL_SIMULATION_ONLY" "$DOCTOR_LOG" >/dev/null || - fail "Doctor did not report LOCAL_SIMULATION_ONLY." -grep -F "Hardware authorization: PROHIBITED" "$DOCTOR_LOG" >/dev/null || - fail "Hardware was not explicitly prohibited." +grep -Fx "Active trust mode: LOCAL_DEVELOPMENT" "$DOCTOR_LOG" >/dev/null || + fail "Doctor did not report exact LOCAL_DEVELOPMENT trust." +grep -Fx "KMS key configured: False" "$DOCTOR_LOG" >/dev/null || + fail "Doctor detected inherited KMS configuration." +grep -Fx "Local identity present: True" "$DOCTOR_LOG" >/dev/null || + fail "Doctor did not report a local identity." +grep -Fx "Local identity valid: True" "$DOCTOR_LOG" >/dev/null || + fail "Doctor did not validate the local identity." +grep -Fx "Local trust scope: LOCAL_SIMULATION_ONLY" "$DOCTOR_LOG" >/dev/null || + fail "Doctor did not report exact local simulator scope." +grep -Fx "Hardware authorization: PROHIBITED" "$DOCTOR_LOG" >/dev/null || + fail "Doctor did not report exact hardware prohibition." +if grep -F "KMS_GOVERNED" "$DOCTOR_LOG" >/dev/null; then + fail "Doctor inherited KMS_GOVERNED trust." +fi grep -F "COMPLETE EVIDENCE CHAIN VERIFIED" "$VERIFY_LOG" >/dev/null || fail "Independent chain verification did not complete." grep -F "IBM contacted: False" "$VERIFY_LOG" >/dev/null || diff --git a/src/quantumd/submission.py b/src/quantumd/submission.py index 689c9c3..c81866e 100644 --- a/src/quantumd/submission.py +++ b/src/quantumd/submission.py @@ -1021,12 +1021,13 @@ def submit_command( print( "Hardware submitted: True" ) + submission_artifact = _relative_to_project( + submission_path, + context["project"], + ) print( "Submission artifact: " - f"{_relative_to_project( - submission_path, - context['project'], - )}" + f"{submission_artifact}" ) except Exception as exc: