Repository navigation
Support pinned AWF installs without runtime attestation lookups - #11558
Conversation
…on lookups Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
…rtifact Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
lpcox
changed the title
There was a problem hiding this comment.
🟡 Changes recommended
Installer failures can bypass diagnostics and Node.js fallback, checksum matching can accept the wrong filename, and helper-reinstallation guidance omits the required flag.
3 open issues
What changed in this PR
Introduces checksum-pinned AWF CLI installation without runtime attestation lookups, while retaining stronger verification for privileged enclave-helper provisioning.
Changes:
- Add explicit-version manifest pins and rootless installation.
- Require explicit helper provisioning and preserve its attestation checks.
- Expand regression coverage and document the trust contract and gh-aw adoption guidance.
| File | Description |
|---|---|
| scripts/ci/release-bootstrap-provenance.test.ts | Covers pinned installs, rootless mode, verification failures, and helper attestations. |
| README.md | Adds installation examples and explains helper opt-in. |
| install.sh | Implements manifest pins, rootless installation, and separate helper provisioning. |
| docs/releasing.md | Defines verification guarantees, trusted pin review, and downstream adoption. |
| docs/enclaves-architecture.md | Clarifies explicit provisioning requirements for privileged storage helpers. |
Review effort: Max (dynamic)
| @@ -1,9 +1,9 @@ | |||
| #!/bin/bash | |||
| set -e | |||
| set -e -o pipefail | |||
| # Format: "checksum filename" (two spaces) - use exact filename match at end of line | ||
| local expected_sum | ||
| expected_sum=$(awk -v fname="$BINARY_NAME" '$2 == fname {print $1; exit}' "$checksums_file") | ||
| expected_sum=$(awk -v fname="$BINARY_NAME" '$2 == fname || $2 == "*" fname {count++; digest=$1} END {if (count == 1) print digest}' "$checksums_file") |
| # Only the authenticated, version-matched helper is authorized, never mount, | ||
| # chown, a shell, or an arbitrary Python script. | ||
| install_enclave_storage_helper() { | ||
| [ "$INSTALL_HELPER" = true ] || return 0 |
|
@copilot address review feedback |
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Addressed in |
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
Documentation PreviewDocumentation has been built for this PR. To view locally:
Built from commit 989f363 |
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Smoke CodexOutcome: The agent completed and reported one or more actions. The no-op output is a completion signal, not a claim that no action was taken. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
📡 Smoke OTel Tracing is starting OTel tracing validation... |
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Smoke Copilot Network IsolationOutcome: The agent completed and reported one or more actions. The no-op output is a completion signal, not a claim that no action was taken. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ Smoke Claude passed
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
🚀 Security Guard has started processing this pull request |
|
Testing chroot feature Smoke Chroot is validating functionality... |
|
Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.
|
This comment has been minimized.
This comment has been minimized.
Retain skip-pull for prepared images only when routing is disabled. Capture actual generated AWF arguments in regressions and run CLI flag validation before routing bootstrap. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅
|
|
🚀 Security Guard has started processing this pull request |
|
✅ Build Test Suite completed successfully! Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "169.254.169.254"See Network Configuration for more information.
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Smoke CodexOutcome: The agent completed and reported one or more actions. The no-op output is a completion signal, not a claim that no action was taken. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. Smoke ChrootOutcome: The agent completed and reported one or more actions. The no-op output is a completion signal, not a claim that no action was taken. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ Smoke OTel TracingOutcome: The agent completed and reported one or more actions. The no-op output is a completion signal, not a claim that no action was taken. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
✅ Smoke Claude passed
|
|
Smoke Test: Copilot engine for PR #11558
Overall: PASS Author: @lpcox | Assignees: @lpcox, Copilot
|
|
Cloud Hypervisor + Copilot smoke test
Overall: PASS
|
|
Merged PRs: chore: refresh canonical model sources; Prevent CI Doctor updater from exhausting its budget without saving progress
|
|
Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS ✅ MCP connectivity verified (gh-aw-firewall recent PRs fetched) Running in direct BYOK mode via
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS All 8 repositories cloned successfully. Runner-specific workarounds were needed for three ecosystems. None of them change build or test semantics:
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "169.254.169.254"See Network Configuration for more information.
|
Smoke Test: Claude Engine Validation
Overall result: PASS
|
|
Smoke services: ✅ Redis PONG, ✅ pg_isready, ✅ SELECT 1 — PASS
|
Smoke Test: API Proxy OpenTelemetry Tracing
No unexpected failures, so no issue was filed.
|
Smoke Test: Copilot Network Isolation ✅Both egress checks passed successfully.
EGRESS_RESULT allow=pass deny=pass Overall: PASS — Network isolation is working as expected.
|
Chroot version comparison
Result:
|
AWF installation repeats online provenance checks even when consumers independently pin the checksum manifest, introducing GitHub authentication and API-quota dependencies. This change separates ordinary CLI installation from privileged-helper provisioning.
Pinned CLI installation
--checksums-sha256with an explicit release version.gh, token, or attestation lookup. Add--rootlessfor installation into$HOME/.local/bin.Privileged provisioning
--install-enclave-storage-helperopt-in.Trust contract and adoption
bash ./install.sh vX.Y.Z \ --checksums-sha256 "$REVIEWED_MANIFEST_SHA256" \ --rootlessThe digest must come from independently reviewed configuration, not the executable’s download channel.