From c2be209fed13f87db44bab9ac36b87392fd0406a Mon Sep 17 00:00:00 2001 From: A Tobey Date: Wed, 2 Sep 2026 20:59:02 -0400 Subject: [PATCH] docs: the cosign floor was wrong in two more places, one of them the release page MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #175 measured the floor and corrected README.md. It corrected only README.md — I grepped one file instead of the repo, on a change whose whole subject was a claim repeated across surfaces. Two instances survived: - `.github/release-body.md:36` — **this becomes the GitHub release page body** (`release.yml:235` runs it through envsubst into `body_path`). It is the copy every person downloading v0.4.0 would have read, and it would have shipped with tomorrow's tag telling them to go get cosign 3. - `docs/releases.md:62` — the pipeline plan, stating the same floor as fact. Both now say 2.5, the measured floor: 2.4.0 cannot read the bundle format, 2.5.0 and up verify a real release with both negative controls refusing. Found by a `consult` on the release branch, run as a live end-to-end check of the 0.17.1 shell before tagging. It caught `docs/releases.md`; the repo-wide grep I ran to verify its citation caught the release page, which is the one that mattered. Neither the review nor the grep alone would have found both. Also here, same family — prose the recent changes left stale: - `docs/sandbox-probes.md:24` promised "paths outside the mount resolve to nothing" in the summary at the top, which 0.17.1's walkable prefix directories made too broad. Battery C already carved out the exception a hundred lines down; the headline now says what it means (a file read) and points at C. The changelog bullet moves from naming README to naming the floor, since the release page carried it too. Not taken from the same review: it also reported CHANGELOG.md's "kaish upgraded to 0.17.1 (from 0.14.0)" as stale against AGENTS.md's "from 0.14.1". The changelog is right. `git show v0.3.0:Cargo.toml` pins the last release at kaish-kernel 0.14.0, and a changelog's baseline is the last release; AGENTS.md's 0.14.1 is the pre-bump working pin, a different and internal baseline. Reviewed-by: kaibo cast `crusoe` (DeepSeek-V4-Flash explorer, GLM-5.2 synth) Co-Authored-By: Claude Opus 5 --- .github/release-body.md | 2 +- CHANGELOG.md | 4 ++-- docs/releases.md | 2 +- docs/sandbox-probes.md | 5 +++-- 4 files changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/release-body.md b/.github/release-body.md index ad5dfc93..5058c4fe 100644 --- a/.github/release-body.md +++ b/.github/release-body.md @@ -33,7 +33,7 @@ gh attestation verify kaibo-${TAG}-x86_64-unknown-linux-musl.tar.gz -R tobert/ka gh attestation verify oci://ghcr.io/tobert/kaibo:${VERSION} -R tobert/kaibo ``` -Or keyless-verify the signed checksum manifest with cosign ≥ 3 (covers every file it lists, works offline): +Or keyless-verify the signed checksum manifest with cosign ≥ 2.5 (covers every file it lists, works offline): ```sh cosign verify-blob \ diff --git a/CHANGELOG.md b/CHANGELOG.md index 9c309e4e..baa54cfc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -103,8 +103,8 @@ record. Each later release appends a new section at the top. ### Fixed -- **The README's cosign floor said 3, and 2.5 verifies a release** — the old floor turned - away working installs. +- **The cosign floor said 3, and 2.5 verifies a release** — the old floor turned away + working installs, and the release page repeated it. - **The explorer's shell no longer drops piped or buffered stdin** across `read`/`grep`/`cat`, and a loop that exits early keeps what it already printed. diff --git a/docs/releases.md b/docs/releases.md index 30ef412a..da895963 100644 --- a/docs/releases.md +++ b/docs/releases.md @@ -59,7 +59,7 @@ publish job, so a `workflow_dispatch` smoke run never mints an OIDC identity (bu keep `contents: read`; the publish job adds `id-token: write` + `attestations: write`). The layout, decided with Amy: **one signed aggregate `checksums.txt`** (cosign keyless — verify once, `sha256sum -c` covers any file it lists; one signature shape, the -self-contained `.sigstore.json` bundle, which verifies offline with cosign ≥ 3; the +self-contained `.sigstore.json` bundle, which verifies offline with cosign ≥ 2.5; the per-artifact `.sha256` sidecars stay for the README's download one-liner), **per-artifact SLSA provenance** via `actions/attest-build-provenance` (stored in GitHub's attestation store — `gh attestation verify -R tobert/kaibo`, zero extra diff --git a/docs/sandbox-probes.md b/docs/sandbox-probes.md index eb6cca93..377146e1 100644 --- a/docs/sandbox-probes.md +++ b/docs/sandbox-probes.md @@ -21,8 +21,9 @@ What we're verifying, concretely: 1. **No write reaches the project** — every mutation path is refused, and nothing lands on real disk. 2. **No external command runs** — the host is unreachable from inside the shell. -3. **No read escapes the root** — paths outside the mount (absolute, `..`, or via a - `path` arg) resolve to nothing; adjacent secrets stay unreadable. +3. **No read escapes the root** — a file read outside the mount (absolute, `..`, or via + a `path` arg) resolves to nothing; adjacent secrets stay unreadable. The mount's own + prefix directories list, and only ever name the next component toward it — Battery C. 4. **No secret leaks via the environment** — the sandbox runs with an empty env. The structural design these probes exercise lives in `src/sandbox.rs` (the four