test: the curl installer's verification paths fail closed, proven by mutation - #884
Merged
Merged
Conversation
…mutation install.sh is the path a new operator runs before any of the bundle's own defenses exist, and its two security-critical branches — the bundle sha256 against the release manifest, and the cosign signature against the repo-pinned key — had no test: deleting either check kept the suite green. The new block stubs each remote artifact as a file served by basename (absent file = the curl -f failure the script already distinguishes) and pins the whole matrix: sha256 match proceeds to the setup handoff, mismatch installs nothing; a present-but-bad signature is fatal and installs nothing, absent signature and pre-sha manifests degrade with their notes; a signature whose pinned key can't be fetched is fatal; an occupied target dir and a bundle without a pithead executable refuse. Both fail-closed branches were mutation-tested: removing the sha comparison and downgrading the cosign failure to a note each break exactly the new assertions (3 failures each), so the suite now actually guards them. Closes #868 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #868
install.sh is the path a new operator runs before any of the bundle's own defenses exist, and its two security-critical branches — the bundle sha256 against the release manifest, and the cosign signature against the repo-pinned key — had no test: deleting either check kept the suite green, exactly as the issue predicted.
The new stack-suite block stubs each remote artifact as a file served by basename (absent file = the
curl -ffailure the script already distinguishes) and pins the whole matrix: sha256 match proceeds to the setup handoff, mismatch installs nothing; a present-but-bad signature is fatal and installs nothing; absent signature and pre-sha manifests degrade with their documented notes; a signature whose pinned key can't be fetched is fatal; an occupied target dir and a bundle without apitheadexecutable refuse.Mutation-tested: removing the sha comparison and downgrading the cosign failure to a note were each applied to install.sh and the suite run — each breaks exactly the new assertions (3 failures each), so the suite now genuinely guards both fail-closed branches.
Suite: 2135 passed, 0 failed.
make lintgreen. install.sh itself is untouched.🤖 Generated with Claude Code