Verify the release bundle hash before extracting (both images)#141
Merged
Conversation
This was referenced Jul 12, 2026
Reconciles the bundle-integrity feature (#141) onto testing. A single common/download_and_verify_bundle.sh downloads the prod bundle, resolves its bundle_sha256 (md5 fallback) from the updates feed, verifies fail-closed, then extracts — so a swapped S3 object aborts the build instead of being baked into a published image. Both image generators COPY + run it. Reconciled with testing's PREGA_BUNDLE_FALLBACK: a RELEASED build is always verified against the prod bundle; the pre-GA CI fallback to bundles-test skips verification (the release has no published hash yet) and warns loudly — never for a released image. The full image keeps its separate release-SQL download. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jsokol
force-pushed
the
FEATURE-bundle-integrity-verification
branch
from
b6d1117 to
c622c2e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Both production images built by streaming
curl … | tar xzwith no integrity check on the release bundle. This adds a download → verify → extract step: a newcommon/download_and_verify_bundle.shdownloads the bundle, resolves the publishedbundle_sha256(md5 fallback, fail-closed if neither) fromupdates.simplerisk.com/releases.xml, verifies, then extracts. Bothgenerate_dockerfile.shrelease variants nowCOPY+ run the script instead of streaming; the full image keeps its trailing SQL download in the sameRUN. Thetestingvariant (which COPYs local code, no download) is untouched. Both committed Dockerfiles are regenerated.Defense-in-depth: the bundle (S3
public/bundles) and its hash (served updates feed) are independently stored, so a swapped S3 object fails the build instead of being baked into a published image. The hash is resolved at build time becausegenerate_dockerfile.shruns at version-bump time, before the new release's feed entry exists.No runtime/entrypoint change — the resulting image filesystem is identical (same bundle), so EKS and every consumer run it exactly as before.
generate_dockerfile.shalso gains aYYYYMMDD-NNN|testingversion-format guard.Design: code-development
docs/superpowers/specs/2026-06-07-docker-bundle-verification-design.md.Testing
20260519-001bundle →Bundle sha256 verified (7d7fb2…)→ extracted) and negative (byte-corrupted bundle →sha256 mismatch, exit 1).docker buildshowsBundle sha256 verified+Extracted bundle to /var/wwwin the downloader stage; boot smoke (mysql + container) reachesSetup has been applied successfully!and returns HTTP 200 — runtime unchanged.docker buildshows the verify step + the preserved SQL download, build completes.container-validation.ymlruns the full release build of all four images on this PR.🤖 Generated with Claude Code