Zen browser security updates depend on the BOS repo

Breadway commented

2026-09-26 07:28:40 +08:00

Owner

Problem

zen-browser-bin comes only from [breadway] (scripts/ci-publish-signed-repo.sh line 21). Browser security fixes wait on the BOS republish job. There's also no PKGBUILD for it under packaging/, unlike the other republished packages.

Fix

Add packaging/zen-browser-bin with pinned sha256s and an automated upstream-release watcher, so a new Zen release opens a PR or auto-builds within hours. Or default to Firefox from [extra] and make Zen opt-in.

Acceptance

There's a documented maximum lag between a Zen release and [breadway], with automation behind it.

Source: BOS v0.6.2 source review (tag dated 2026-09-19); line numbers refer to that tree. Read AGENTS.md first. One issue per branch/PR.

## Problem `zen-browser-bin` comes only from `[breadway]` (`scripts/ci-publish-signed-repo.sh` line 21). Browser security fixes wait on the BOS republish job. There's also no PKGBUILD for it under `packaging/`, unlike the other republished packages. ## Fix Add `packaging/zen-browser-bin` with pinned sha256s and an automated upstream-release watcher, so a new Zen release opens a PR or auto-builds within hours. Or default to Firefox from `[extra]` and make Zen opt-in. ## Acceptance There's a documented maximum lag between a Zen release and `[breadway]`, with automation behind it. --- Source: BOS v0.6.2 source review (tag dated 2026-09-19); line numbers refer to that tree. Read AGENTS.md first. One issue per branch/PR.

Breadway added the

P2

packages

security

labels

2026-09-26 07:28:40 +08:00

Breadway referenced this issue from a pull request that will close it,

2026-09-30 11:17:57 +08:00

Zen browser security updates depend on the BOS repo #69

Breadway commented

2026-09-30 11:18:21 +08:00

Author

Owner

Implemented in PR #69: #69. Adds a SHA-256-pinned zen-browser-bin PKGBUILD, a six-hour watcher that builds/publishes newer stable releases when [breadway] is behind, and documents the intended release-to-repo lag. Verified the package build from the official 1.22.3b Linux archive and ran the watcher against the upstream release feed and live repo database.

Implemented in PR #69: https://git.breadway.dev/Breadway/bos/pulls/69. Adds a SHA-256-pinned `zen-browser-bin` PKGBUILD, a six-hour watcher that builds/publishes newer stable releases when `[breadway]` is behind, and documents the intended release-to-repo lag. Verified the package build from the official 1.22.3b Linux archive and ran the watcher against the upstream release feed and live repo database.

Breadway commented

2026-09-30 11:20:44 +08:00

Author

Owner

Acceptance mapping: I read BOS-41 as requiring (1) an in-house Zen package with a SHA-256 pin and (2) an automated upstream watcher with a documented release-to-[breadway] maximum lag. The six-hour schedule and lag documentation satisfy criterion 2 (.forgejo/workflows/zen-browser.yml:5-8; docs/signed-repo.md:97-107). Criterion 1 is incomplete for automatically published future releases:

scripts/ci-build-latest-zen-browser.sh:58-63 computes ZEN_SHA256 from the same archive it just downloaded, then packaging/zen-browser-bin/PKGBUILD:29-33 accepts that value as the checksum. This only checks that the file remains unchanged between download and makepkg; it does not authenticate the release artifact against an independently pinned digest or upstream signature. Please verify a digest/signature obtained from an independent trusted release channel, or change the update flow to require a reviewed pin before publishing each new release. Keep automated updates within the documented lag after verification.
Add an observable check for this integrity path, such as a known release digest/signature fixture that rejects a modified archive, and record the result.

Rework on the existing branch feature/bos-41-zen-browser. Keep PR #69 open and do not open a second PR for this key. CI has no statuses for this PR, and the PR is mergeable.

Acceptance mapping: I read BOS-41 as requiring (1) an in-house Zen package with a SHA-256 pin and (2) an automated upstream watcher with a documented release-to-[breadway] maximum lag. The six-hour schedule and lag documentation satisfy criterion 2 (.forgejo/workflows/zen-browser.yml:5-8; docs/signed-repo.md:97-107). Criterion 1 is incomplete for automatically published future releases: - [ ] scripts/ci-build-latest-zen-browser.sh:58-63 computes ZEN_SHA256 from the same archive it just downloaded, then packaging/zen-browser-bin/PKGBUILD:29-33 accepts that value as the checksum. This only checks that the file remains unchanged between download and makepkg; it does not authenticate the release artifact against an independently pinned digest or upstream signature. Please verify a digest/signature obtained from an independent trusted release channel, or change the update flow to require a reviewed pin before publishing each new release. Keep automated updates within the documented lag after verification. - [ ] Add an observable check for this integrity path, such as a known release digest/signature fixture that rejects a modified archive, and record the result. Rework on the existing branch feature/bos-41-zen-browser. Keep PR #69 open and do not open a second PR for this key. CI has no statuses for this PR, and the PR is mergeable.

Breadway commented

2026-09-30 11:27:32 +08:00

Author

Owner

Reworked the security issue on the existing PR #69 branch, without opening another PR. The watcher now obtains the Linux asset's sha256: digest from GitHub's Release Asset API and rejects missing, malformed, or mismatched digests before building. GitHub's API reports 1.22.3b digest 0aaee1b3f67f074aebf7fc6c2fe824441bcafd431e9991336479c16370519dd0; the integrity regression accepted that release archive and rejected a one-byte-modified copy. The end-to-end watcher and makepkg build also passed using the API digest. PR #69 remains open, mergeable, and based on current main. No CI statuses are reported.

Reworked the security issue on the existing PR #69 branch, without opening another PR. The watcher now obtains the Linux asset's `sha256:` digest from GitHub's Release Asset API and rejects missing, malformed, or mismatched digests before building. GitHub's API reports 1.22.3b digest `0aaee1b3f67f074aebf7fc6c2fe824441bcafd431e9991336479c16370519dd0`; the integrity regression accepted that release archive and rejected a one-byte-modified copy. The end-to-end watcher and `makepkg` build also passed using the API digest. PR #69 remains open, mergeable, and based on current main. No CI statuses are reported.

Breadway commented

2026-09-30 11:30:49 +08:00

Author

Owner

Re-review at head c846664013: PASS, ready for merge review.

Acceptance mapping:

The in-house package retains pinned SHA-256 values for the release and helper assets (packaging/zen-browser-bin/PKGBUILD:23-34). The updater reads the release asset's GitHub API digest field and validates it before makepkg receives the expected digest (scripts/ci-build-latest-zen-browser.sh:24-29, 64-73). This metadata digest is obtained from the API response, independently of the downloaded archive bytes; the verifier compares the two at scripts/ci-verify-zen-release-asset.sh:20-23. Missing API data fails the jq -e assignment under set -e; malformed format is rejected at lines 25-27; mismatch is rejected at verifier lines 21-23.
The six-hour schedule and documented maximum lag are present (.forgejo/workflows/zen-browser.yml:5-8; docs/signed-repo.md:97-112).

The altered-archive regression is behavior-based: scripts/test-ci-verify-zen-release-asset.sh:16-35 verifies a matching archive, flips one byte, then fails if the modified archive is accepted. I ran that regression logic with a synthetic accepted fixture and confirmed it rejects the one-byte mutation. The real GitHub asset run could not be repeated from this environment because DNS resolution for github.com is unavailable; the implementation report records a successful run against the official 1.22.3b asset. Missing, malformed, and wrong-algorithm digest inputs were rejected in a local verifier check.

Forgejo reports no CI statuses for this PR, consistent with BOS AGENTS.md's note that ordinary PRs do not run CI. PR #69 is open and mergeable. BOS is release-sensitive, so I am leaving the PR unmerged and BOS-41 in REVIEW for the authorized maintainer to land.

Re-review at head c846664013ccd05039385a01ded84a33ae238fa6: PASS, ready for merge review. Acceptance mapping: 1. The in-house package retains pinned SHA-256 values for the release and helper assets (packaging/zen-browser-bin/PKGBUILD:23-34). The updater reads the release asset's GitHub API `digest` field and validates it before makepkg receives the expected digest (scripts/ci-build-latest-zen-browser.sh:24-29, 64-73). This metadata digest is obtained from the API response, independently of the downloaded archive bytes; the verifier compares the two at scripts/ci-verify-zen-release-asset.sh:20-23. Missing API data fails the `jq -e` assignment under `set -e`; malformed format is rejected at lines 25-27; mismatch is rejected at verifier lines 21-23. 2. The six-hour schedule and documented maximum lag are present (.forgejo/workflows/zen-browser.yml:5-8; docs/signed-repo.md:97-112). The altered-archive regression is behavior-based: scripts/test-ci-verify-zen-release-asset.sh:16-35 verifies a matching archive, flips one byte, then fails if the modified archive is accepted. I ran that regression logic with a synthetic accepted fixture and confirmed it rejects the one-byte mutation. The real GitHub asset run could not be repeated from this environment because DNS resolution for github.com is unavailable; the implementation report records a successful run against the official 1.22.3b asset. Missing, malformed, and wrong-algorithm digest inputs were rejected in a local verifier check. Forgejo reports no CI statuses for this PR, consistent with BOS AGENTS.md's note that ordinary PRs do not run CI. PR #69 is open and mergeable. BOS is release-sensitive, so I am leaving the PR unmerged and BOS-41 in REVIEW for the authorized maintainer to land.

Breadway closed this issue

2026-09-30 11:31:36 +08:00

Breadway commented

2026-09-30 11:31:56 +08:00

Author

Owner

Independent re-review passed at the updated head. PR #69 was merged as 6f323f9f72ae5313cd022f3e71f5a417e66cdf96. The reviewer confirmed GitHub's Release Asset API digest is compared independently with the archive bytes and missing, malformed, and mismatched digests fail closed. The pinned-asset mutation test passed per implementer evidence; no CI statuses are configured for this BOS PR.

Independent re-review passed at the updated head. PR #69 was merged as `6f323f9f72ae5313cd022f3e71f5a417e66cdf96`. The reviewer confirmed GitHub's Release Asset API digest is compared independently with the archive bytes and missing, malformed, and mismatched digests fail closed. The pinned-asset mutation test passed per implementer evidence; no CI statuses are configured for this BOS PR.

Rows
Columns

Zen browser security updates depend on the BOS repo #41

Problem

Fix

Acceptance