vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-05-01 21:10:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

Require signed unified agent release assets

Browse source
This commit is contained in:
rcourtman 2026-04-22 02:00:29 +01:00
parent 7b1520b760
commit 7be844f23a
24 changed files with 976 additions and 115 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/release-control/v6/internal/subsystems/deployment-installability.md
View file

@ -975,3 +975,11 @@ routing on both sides instead of relying only on generic API fallback
coverage: update transport changes must continue to carry the direct
`updates-api-surface` installability proof together with a direct
API-contract proof path.
That same governed release-promotion boundary now also owns detached agent and
installer signatures. `scripts/build-release.sh`,
`scripts/release_update_key.go`, `scripts/release_ldflags.sh`, and
`.github/workflows/create-release.yml` must derive the embedded update trust
root from the governed release signing key, emit `.sig` sidecars for shipped
agent binaries and installer assets, and upload those signatures with the
matching release packet so published RC/stable downloads can keep the updater
trust chain fail-closed instead of downgrading to checksum-only trust.