Breadway/bos
1
0
Fork 0
Code Issues 5 Pull requests 1 Projects Releases 9 Packages Wiki Activity Actions

Zen browser security updates depend on the BOS repo #69

Merged
Breadway merged 3 commits from feature/bos-41-zen-browser into main 2026-09-30 11:31:36 +08:00
Conversation 5 Commits 3 Files changed 12 +290 -6
Breadway commented 2026-09-30 11:17:57 +08:00
Owner
Copy link

Adds a SHA-256-pinned zen-browser-bin PKGBUILD and a six-hour watcher for Zen's stable releases. The watcher reads the archive digest from GitHub's Release Asset API and fails closed if the digest is missing, malformed, or differs from the downloaded bytes. A verified build uploads the package and triggers signed-repository publishing. Documents the intended six-hour release-to-repo lag.

Verified with a makepkg build of Zen 1.22.3b, an end-to-end watcher run against GitHub's release feed and the live [breadway] database, and scripts/test-ci-verify-zen-release-asset.sh. The test accepted the official release archive at GitHub's published digest 0aaee1b3f67f074aebf7fc6c2fe824441bcafd431e9991336479c16370519dd0 and rejected a one-byte-modified copy. Shell syntax, workflow YAML parsing, PKGBUILD metadata, and git diff --check also passed. CI reports no statuses for this PR.

Closes #41

Adds a SHA-256-pinned `zen-browser-bin` PKGBUILD and a six-hour watcher for Zen's stable releases. The watcher reads the archive digest from GitHub's Release Asset API and fails closed if the digest is missing, malformed, or differs from the downloaded bytes. A verified build uploads the package and triggers signed-repository publishing. Documents the intended six-hour release-to-repo lag. Verified with a `makepkg` build of Zen 1.22.3b, an end-to-end watcher run against GitHub's release feed and the live `[breadway]` database, and `scripts/test-ci-verify-zen-release-asset.sh`. The test accepted the official release archive at GitHub's published digest `0aaee1b3f67f074aebf7fc6c2fe824441bcafd431e9991336479c16370519dd0` and rejected a one-byte-modified copy. Shell syntax, workflow YAML parsing, PKGBUILD metadata, and `git diff --check` also passed. CI reports no statuses for this PR. Closes #41
Breadway commented 2026-09-30 11:18:57 +08:00
Author
Owner
Copy link

PR #69 is linked from BOS-41 and ready for independent review. Implementation evidence and acceptance mapping are on the parent issue.

PR #69 is linked from BOS-41 and ready for independent review. Implementation evidence and acceptance mapping are on the parent issue.
Breadway commented 2026-09-30 11:20:46 +08:00
Author
Owner
Copy link

Independent review sent BOS-41 to TODO: new watcher builds use a SHA-256 computed from the downloaded archive itself rather than an independent upstream pin/signature. Rework is requested on feature/bos-41-zen-browser; PR #69 stays open. See BOS-41 for the acceptance mapping and actionable checklist.

Independent review sent BOS-41 to TODO: new watcher builds use a SHA-256 computed from the downloaded archive itself rather than an independent upstream pin/signature. Rework is requested on feature/bos-41-zen-browser; PR #69 stays open. See BOS-41 for the acceptance mapping and actionable checklist.
Breadway commented 2026-09-30 11:27:23 +08:00
Author
Owner
Copy link

Reworked the integrity path on the existing branch. The watcher now reads digest for zen.linux-x86_64.tar.xz from GitHub's Release Asset API, validates the sha256: format, and compares the downloaded archive against that API value before passing it to makepkg. Missing or mismatched digests stop the job. The regression check accepted the fixed 1.22.3b release asset at 0aaee1b3f67f074aebf7fc6c2fe824441bcafd431e9991336479c16370519dd0 and rejected a one-byte-modified copy. The branch includes current main; PR #69 remains the only BOS-41 PR.

Reworked the integrity path on the existing branch. The watcher now reads `digest` for `zen.linux-x86_64.tar.xz` from GitHub's Release Asset API, validates the `sha256:` format, and compares the downloaded archive against that API value before passing it to makepkg. Missing or mismatched digests stop the job. The regression check accepted the fixed 1.22.3b release asset at `0aaee1b3f67f074aebf7fc6c2fe824441bcafd431e9991336479c16370519dd0` and rejected a one-byte-modified copy. The branch includes current main; PR #69 remains the only BOS-41 PR.
Breadway commented 2026-09-30 11:30:53 +08:00
Author
Owner
Copy link

Independent re-review at c846664013: PASS, ready for maintainer merge. Release Asset API digest is checked against downloaded bytes; missing/malformed/mismatched digest paths fail closed. The altered-archive regression logic passed with a synthetic fixture; could not fetch the real release asset here because github.com DNS resolution is unavailable. No CI statuses are configured, and PR #69 is mergeable. BOS is release-sensitive, so it remains unmerged. Full acceptance mapping is on BOS-41.

Independent re-review at c846664013ccd05039385a01ded84a33ae238fa6: PASS, ready for maintainer merge. Release Asset API digest is checked against downloaded bytes; missing/malformed/mismatched digest paths fail closed. The altered-archive regression logic passed with a synthetic fixture; could not fetch the real release asset here because github.com DNS resolution is unavailable. No CI statuses are configured, and PR #69 is mergeable. BOS is release-sensitive, so it remains unmerged. Full acceptance mapping is on BOS-41.
Breadway commented 2026-09-30 11:31:59 +08:00
Author
Owner
Copy link

PR #69 passed independent re-review and merged as 6f323f9f72ae5313cd022f3e71f5a417e66cdf96. No CI statuses are configured for this BOS PR; the reviewer verified the independent digest path and fail-closed validation.

PR #69 passed independent re-review and merged as `6f323f9f72ae5313cd022f3e71f5a417e66cdf96`. No CI statuses are configured for this BOS PR; the reviewer verified the independent digest path and fail-closed validation.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
P0

   
P1

   
P2

   
P3

   
audio

   
bakery

   
boot

   
breadbug

   
bug

   
build

   
ci

   
dependencies

   
design

   
disk

   
docs

   
encryption

   
final

   
firewall

   
graphics

   
hardware

   
idle

   
installer

   
keybinds

   
nvidia

   
packages

   
phase-1

   
polish

   
recovery

   
reliability

   
reproducibility

   
secure-boot

   
security

   
shell

   
signing

   
snapshots

   
supply-chain

   
swap

   
tech-debt

   
theming

   
ux

   
website
No labels
P0
P1
P2
P3
audio
bakery
boot
breadbug
bug
build
ci
dependencies
design
disk
docs
encryption
final
firewall
graphics
hardware
idle
installer
keybinds
nvidia
packages
phase-1
polish
recovery
reliability
reproducibility
secure-boot
security
shell
signing
snapshots
supply-chain
swap
tech-debt
theming
ux
website
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Breadway/bos!69
No description provided.