Isolate BOS signing from privileged Actions runners

Breadway commented

2026-09-30 18:58:06 +08:00

Owner

Actions currently imports one shared private key on the privileged ISO builder and uses it for pacman repository signing. This change prepares unsigned repository artifacts and ISO draft candidates instead. Separate offline signers pin the public identity, require finite future expiry, reject reuse of the repository identity for ISO checksums, and refuse Actions environments. The ISO signer verifies one BOS ISO checksum before signing SHA256SUMS. Candidates are immutable: any existing tag release or draft makes the builder refuse all mutations. Every new upload checks draft state. Offline publication must wait for the associated build run to complete successfully, with the documented exclusive handoff.

Verified with temporary unrelated signing identities: real ISO checksum signature, rejection of altered bytes and extra checksum entries, rejection of a shared or non-expiring identity, real pacman package/database signatures, and Actions refusal. Workflow YAML, every workflow shell block, Python compilation, and diff checks pass.

Activation remains required before production adoption: provision the distinct expiring ISO public key and record its actual fingerprint, move repository private material to a dedicated non-runner signer, remove the former shared Actions secret everywhere, and independently approve candidate publication. Existing installed repository trust and production secrets are unchanged. New ISO publication/GitHub announcement/stable promotion now follow offline approval. docs/signed-repo.md records these steps explicitly; this PR does not claim that production migration has happened.

Closes #39

Actions currently imports one shared private key on the privileged ISO builder and uses it for pacman repository signing. This change prepares unsigned repository artifacts and ISO draft candidates instead. Separate offline signers pin the public identity, require finite future expiry, reject reuse of the repository identity for ISO checksums, and refuse Actions environments. The ISO signer verifies one BOS ISO checksum before signing SHA256SUMS. Candidates are immutable: any existing tag release or draft makes the builder refuse all mutations. Every new upload checks draft state. Offline publication must wait for the associated build run to complete successfully, with the documented exclusive handoff. Verified with temporary unrelated signing identities: real ISO checksum signature, rejection of altered bytes and extra checksum entries, rejection of a shared or non-expiring identity, real pacman package/database signatures, and Actions refusal. Workflow YAML, every workflow shell block, Python compilation, and diff checks pass. Activation remains required before production adoption: provision the distinct expiring ISO public key and record its actual fingerprint, move repository private material to a dedicated non-runner signer, remove the former shared Actions secret everywhere, and independently approve candidate publication. Existing installed repository trust and production secrets are unchanged. New ISO publication/GitHub announcement/stable promotion now follow offline approval. docs/signed-repo.md records these steps explicitly; this PR does not claim that production migration has happened. Closes #39

Breadway added 1 commit

2026-09-30 18:58:06 +08:00

fix: isolate BOS signing from privileged Actions runners 1556c1d555

Breadway referenced this pull request

2026-09-30 18:58:09 +08:00

One passphrase-less key signs ISOs and the pacman repo on a privileged self-hosted runner #39

Breadway added 1 commit

2026-09-30 23:51:34 +08:00

fix: keep unsigned ISO candidates immutable 1c6e242f6e

Breadway commented

2026-09-30 23:57:40 +08:00

Author

Owner

Independent source and isolated integration review PASS at 1c6e242f6e. Offline signing tests independently verify distinct expiring temporary identities, ISO checksum-only signing, tamper rejection, signed pacman packages/database, and Actions refusal. Reviewed and requested removal of mutable draft rebuilds; revised workflow refuses all existing candidates and checks draft state before each fresh upload. Mocked workflow checks confirm existing tags and API failures cause no mutation, fresh candidates upload exactly two assets, and a changed draft state stops the next upload. YAML, every workflow shell block, signing Python/shell and diff checks pass. No configured CI statuses.

This is a reviewed migration implementation, with production activation outstanding. The second ISO public fingerprint is not provisioned; private material relocation, deletion of old Actions secrets, protected policy/source, provenance approval and publication exclusion remain required as explicitly documented. No production keys or trust were changed, and this review does not claim the security migration is activated.

Independent source and isolated integration review PASS at 1c6e242f6e0aa6301d382edb18a84a4519e6e43a. Offline signing tests independently verify distinct expiring temporary identities, ISO checksum-only signing, tamper rejection, signed pacman packages/database, and Actions refusal. Reviewed and requested removal of mutable draft rebuilds; revised workflow refuses all existing candidates and checks draft state before each fresh upload. Mocked workflow checks confirm existing tags and API failures cause no mutation, fresh candidates upload exactly two assets, and a changed draft state stops the next upload. YAML, every workflow shell block, signing Python/shell and diff checks pass. No configured CI statuses. This is a reviewed migration implementation, with production activation outstanding. The second ISO public fingerprint is not provisioned; private material relocation, deletion of old Actions secrets, protected policy/source, provenance approval and publication exclusion remain required as explicitly documented. No production keys or trust were changed, and this review does not claim the security migration is activated.

Breadway referenced this pull request

2026-09-30 23:57:43 +08:00

One passphrase-less key signs ISOs and the pacman repo on a privileged self-hosted runner #39

Breadway referenced this pull request

2026-09-30 23:57:47 +08:00

Verify protected package provenance before repository signing #78

Breadway referenced this pull request

2026-09-30 23:57:51 +08:00

Repo signing signs whatever is in the package registry #40

Breadway referenced this pull request

2026-09-30 23:59:30 +08:00

One passphrase-less key signs ISOs and the pacman repo on a privileged self-hosted runner #39