Fix fresh Linux installer asset retention

Author: gitcommit90

CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.27] - 2026-07-29
+
+### Fixed
+
+- Fresh Linux installs pin the intended 1Helm version without consuming
+  unauthenticated GitHub API quota, and download digest-pinned Ubuntu LXC
+  payloads retained as 1Helm release assets instead of short-lived upstream
+  image URLs.
+
 ## [0.0.26] - 2026-07-29
 
 ### Fixed
@@ -777,7 +786,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   notarization, stapled tickets, Gatekeeper verification, persistent
   Application Support, and isolated Apple container machines.
 
-[Unreleased]: https://github.com/gitcommit90/1Helm/compare/v0.0.26...HEAD
+[Unreleased]: https://github.com/gitcommit90/1Helm/compare/v0.0.27...HEAD
+[0.0.27]: https://github.com/gitcommit90/1Helm/compare/v0.0.26...v0.0.27
 [0.0.26]: https://github.com/gitcommit90/1Helm/compare/v0.0.23...v0.0.26
 [0.0.25]: https://github.com/gitcommit90/1Helm/compare/v0.0.23...v0.0.25
 [0.0.24]: https://github.com/gitcommit90/1Helm/compare/v0.0.23...v0.0.24

README.md

@@ -307,7 +307,7 @@ A fresh data directory opens first-run setup. The source runtime defaults to
 | `PORT` | `8123` | HTTP/WebSocket control-plane port. |
 | `CTRL_DATA_DIR` | `./data` | Databases, routing state, uploads, and narrow workspace mirrors. |
 | `HELM_CHANNEL_COMPUTER_BACKEND` | `apple` on macOS, `lxc` on Linux, `wsl` on Windows | Host isolation backend; `native` and `mock` are explicit development/test overrides. |
-| `HELM_CHANNEL_MACHINE_IMAGE` | `local/1helm-channel-machine:0.0.26` | Versioned channel-machine image contract. |
+| `HELM_CHANNEL_MACHINE_IMAGE` | `local/1helm-channel-machine:0.0.27` | Versioned channel-machine image contract. |
 
 ### Agent-first JSON CLI
 

package-lock.json

@@ -1,7 +1,7 @@
 {
   "name": "1helm",
   "productName": "1Helm",
-  "version": "0.0.26",
+  "version": "0.0.27",
   "private": true,
   "type": "module",
   "license": "AGPL-3.0-only",

package.json

@@ -16,11 +16,11 @@ NETWORK_HELPER="/usr/libexec/1helm-lxc-net"
 NAME_PATTERN='^1helm-[a-f0-9]{16}-channel-[0-9]+$'
 OWNER_PATTERN='^[a-f0-9]{16}:[0-9]+$'
 
-IMAGE_BUILD="20260723_07:42"
-AMD64_ROOTFS_SHA256="cbc98489455ce54b5fa8c9abf276f1cb39130376ef70b3b7151d18362cd6354f"
-AMD64_META_SHA256="630feddfe5982719a8409cee6356b9abc6297c5bc05c2f6043bc80dee04637cf"
-ARM64_ROOTFS_SHA256="f4752ea7e776f329f9f50aca59c1919f3dc841dc3ddf22beef2b1696c4b4e29e"
-ARM64_META_SHA256="9ef7cfca774a667f8eb187b1a0a7f47f0fd912b6a7da8dfa1c4d24213631f747"
+IMAGE_BUILD="20260726_07:42"
+AMD64_ROOTFS_SHA256="9c23724d6d22b3a5adf5d0f79d7e3779ded16a6d45f928bce93e14c48113d955"
+AMD64_META_SHA256="f8cdb7423ef4fdb103a134ff3fc7cc10aacd2b3448650ce28e33621de1638288"
+ARM64_ROOTFS_SHA256="d5351325dc23e344c4974d7ff546e5e0c91b8e47a9caeb26f39cdc60eaad19e8"
+ARM64_META_SHA256="b36e17b74d0d75c4f6e7a624a047ce5a40a39f52b43702f58ecf7b3f713c0b32"
 
 die() { printf '1Helm LXC runtime: %s\n' "$*" >&2; exit 1; }
 need_root() { [[ "${EUID}" -eq 0 ]] || die "must run as root"; }

scripts/1helm-lxc-runtime

@@ -19,7 +19,8 @@ CONFIG_PATH="/etc/1helm/lxc-unprivileged.conf"
 IDMAP_PATH="/etc/1helm/lxc-idmap"
 SUDOERS_PATH="/etc/sudoers.d/1helm-lxc-runtime"
 SERVICE_USER="1helm"
-IMAGE_BUILD="20260723_07:42"
+IMAGE_BUILD="20260726_07:42"
+IMAGE_RELEASE="0.0.27"
 
 # v0.0.11's updater unit made the exact destination files writable under
 # ProtectSystem=strict. Atomic replacement still requires write access to each
@@ -70,13 +71,13 @@ fi
 case "$(uname -m)" in
   x86_64|amd64)
     IMAGE_ARCH="amd64"
-    ROOTFS_SHA256="cbc98489455ce54b5fa8c9abf276f1cb39130376ef70b3b7151d18362cd6354f"
-    META_SHA256="630feddfe5982719a8409cee6356b9abc6297c5bc05c2f6043bc80dee04637cf"
+    ROOTFS_SHA256="9c23724d6d22b3a5adf5d0f79d7e3779ded16a6d45f928bce93e14c48113d955"
+    META_SHA256="f8cdb7423ef4fdb103a134ff3fc7cc10aacd2b3448650ce28e33621de1638288"
     ;;
   aarch64|arm64)
     IMAGE_ARCH="arm64"
-    ROOTFS_SHA256="f4752ea7e776f329f9f50aca59c1919f3dc841dc3ddf22beef2b1696c4b4e29e"
-    META_SHA256="9ef7cfca774a667f8eb187b1a0a7f47f0fd912b6a7da8dfa1c4d24213631f747"
+    ROOTFS_SHA256="d5351325dc23e344c4974d7ff546e5e0c91b8e47a9caeb26f39cdc60eaad19e8"
+    META_SHA256="b36e17b74d0d75c4f6e7a624a047ce5a40a39f52b43702f58ecf7b3f713c0b32"
     ;;
   *) echo "Unsupported LXC architecture: $(uname -m)" >&2; exit 1 ;;
 esac
@@ -109,7 +110,7 @@ install -d -o root -g root -m 0755 "$NETWORK_STATE" "$NETWORK_STATE/misc"
 
 TEMP_ROOT="$(mktemp -d)"
 trap 'rm -rf -- "$TEMP_ROOT"' EXIT
-ASSET_URL="https://images.linuxcontainers.org/images/ubuntu/noble/$IMAGE_ARCH/default/$IMAGE_BUILD"
+ASSET_URL="https://github.com/gitcommit90/1Helm/releases/download/v$IMAGE_RELEASE/1Helm-$IMAGE_RELEASE-lxc-ubuntu-noble-$IMAGE_ARCH"
 ASSET_DIR="$RUNTIME_ROOT/$IMAGE_ARCH"
 install -d -o root -g root -m 0700 "$ASSET_DIR"
 for asset in rootfs.tar.xz meta.tar.xz; do
@@ -118,7 +119,7 @@ for asset in rootfs.tar.xz meta.tar.xz; do
   if [[ -f "$ASSET_DIR/$asset" ]] && printf '%s  %s\n' "$expected" "$ASSET_DIR/$asset" | sha256sum -c - >/dev/null 2>&1; then
     continue
   fi
-  curl -fsSL --proto '=https' --tlsv1.2 --retry 3 --max-time 1800 -o "$TEMP_ROOT/$asset" "$ASSET_URL/$asset"
+  curl -fsSL --proto '=https' --tlsv1.2 --retry 3 --max-time 1800 -o "$TEMP_ROOT/$asset" "$ASSET_URL-$asset"
   printf '%s  %s\n' "$expected" "$TEMP_ROOT/$asset" | sha256sum -c - >/dev/null \
     || { echo "Pinned LXC $asset failed SHA-256 verification." >&2; exit 1; }
   install -o root -g root -m 0600 "$TEMP_ROOT/$asset" "$ASSET_DIR/$asset"

site/public/install-lxc-runtime.sh

@@ -10,6 +10,7 @@ NODE_LINK="$INSTALL_ROOT/node-current"
 STATE_ROOT="/var/lib/1helm"
 SERVICE_USER="1helm"
 NODE_VERSION="22.23.1"
+RELEASE_VERSION="0.0.27"
 HOST_CONTRACT_PATHS=(
   /usr/libexec/1helm-lxc-runtime
   /usr/libexec/1helm-lxc-net
@@ -147,8 +148,7 @@ fi
 ln -sfn "$NODE_RELEASE" "$TEMP_ROOT/node-current"
 mv -Tf "$TEMP_ROOT/node-current" "$NODE_LINK"
 
-VERSION="$(curl -fsSL https://api.github.com/repos/gitcommit90/1Helm/releases/latest | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"v\([^"]*\)".*/\1/p' | head -n1)"
-[[ -n "$VERSION" ]] || { echo "Could not resolve the latest public 1Helm release." >&2; exit 1; }
+VERSION="$RELEASE_VERSION"
 git clone --depth 1 --branch "v$VERSION" "$REPO" "$TEMP_ROOT/source"
 RELEASE_SHA="$(git -C "$TEMP_ROOT/source" rev-parse HEAD)"
 [[ "$RELEASE_SHA" =~ ^[a-f0-9]{40}$ ]] || { echo "Could not resolve the checked-out release commit." >&2; exit 1; }

site/public/install.sh

@@ -67,7 +67,7 @@ const APPLE_RUNTIME_VERSION = "1.1.0";
 export const APPLE_RUNTIME_PACKAGE = `container-${APPLE_RUNTIME_VERSION}-installer-signed.pkg`;
 export const APPLE_RUNTIME_URL = `https://github.com/apple/container/releases/download/${APPLE_RUNTIME_VERSION}/${APPLE_RUNTIME_PACKAGE}`;
 export const APPLE_RUNTIME_SHA256 = "0ca1c42a2269c2557efb1d82b1b38ac553e6a3a3da1b1179c439bcee1e7d6714";
-export const DEFAULT_CHANNEL_IMAGE = process.env.HELM_CHANNEL_MACHINE_IMAGE || "local/1helm-channel-machine:0.0.26";
+export const DEFAULT_CHANNEL_IMAGE = process.env.HELM_CHANNEL_MACHINE_IMAGE || "local/1helm-channel-machine:0.0.27";
 const CONTAINER_CANDIDATES = [process.env.HELM_CONTAINER_CLI, "/usr/local/bin/container", "/opt/homebrew/bin/container", "container"].filter(Boolean) as string[];
 const LXC_RUNTIME_VERSION = "1helm-lxc-runtime-v1";
 const LXC_HELPER_CANDIDATES = [

src/server/channel-computers.ts

@@ -1009,7 +1009,7 @@ export function migrate(): void {
     const platformBackend = process.platform === "darwin" ? "apple" : process.platform === "win32" ? "wsl" : "lxc";
     const configuredBackend = String(process.env.HELM_CHANNEL_COMPUTER_BACKEND || platformBackend);
     const backend = ["apple", "lxc", "wsl", "native", "mock"].includes(configuredBackend) ? configuredBackend : platformBackend;
-    const image = String(process.env.HELM_CHANNEL_MACHINE_IMAGE || "local/1helm-channel-machine:0.0.26");
+    const image = String(process.env.HELM_CHANNEL_MACHINE_IMAGE || "local/1helm-channel-machine:0.0.27");
     // Earlier Linux/Windows releases persisted the compatibility `native`
     // seam into every channel row. A production host update must actually
     // move those rows onto the platform isolation backend; changing the unit's

src/server/db.ts

@@ -168,7 +168,7 @@ test("Apple channel-computer contract preserves isolation, files, wakes, archive
 test("runtime digest and packaged image recipe stay pinned", async () => {
   assert.equal(computers.APPLE_RUNTIME_SHA256, "0ca1c42a2269c2557efb1d82b1b38ac553e6a3a3da1b1179c439bcee1e7d6714");
   assert.match(computers.APPLE_RUNTIME_URL, /\/1\.1\.0\/container-1\.1\.0-installer-signed\.pkg$/);
-  assert.equal(computers.DEFAULT_CHANNEL_IMAGE, "local/1helm-channel-machine:0.0.26");
+  assert.equal(computers.DEFAULT_CHANNEL_IMAGE, "local/1helm-channel-machine:0.0.27");
   const packaging = await readFile(join(root, "scripts", "package-mac-dmg.cjs"), "utf8");
   assert.match(packaging, /container\(\?:\$\|\\\/\)/, "release packaging includes container/ image assets");
   const image = await readFile(join(root, "container", "Containerfile"), "utf8");