harden the app-artifact build: hash-pin wheels, split build from publish

Two supply-chain hardenings for build-app.yml:

1. Hash-pin the bundled PyPI wheels. The .deb and AppImage previously
   pip-installed version-pinned wheels with no integrity check, so a
   mutated wheel of the same version would be accepted. Move the curated
   closures into third_party/requirements-{deb,appimage}.txt with a
   SHA-256 per wheel and install with --require-hashes --only-binary=:all:
   --no-deps, so pip rejects any mismatch and never builds from an sdist.

2. Least-privilege CI. The build job held contents:write + id-token +
   attestations while running build scripts and downloading deps. Drop it
   to contents:read, upload the artifacts, and attest/publish them from a
   separate job that holds the elevated scopes and touches only the
   already-built files.

Update the packaging policy tests to assert the hardened install flags and
that the requirement files carry both the version pins and the hashes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014pmkUWS6teoMZUUnMJG7Gr

Author: CryptoFewka

.github/workflows/build-app.yml

@@ -42,12 +42,13 @@ permissions:
   contents: read
 
 jobs:
+  # Build with least privilege: read-only token, no attest/publish scopes. The
+  # artifacts are handed to the elevated `publish` job below, so nothing that
+  # runs build scripts / downloads deps ever holds a write or signing token.
   build:
     runs-on: ubuntu-24.04
     permissions:
-      contents: write
-      id-token: write
-      attestations: write
+      contents: read
     env:
       GH_TOKEN: ${{ github.token }}
       APPIMAGE_EXTRACT_AND_RUN: "1"
@@ -128,8 +129,41 @@ jobs:
           scripts/build-release.sh
           echo "VER=$(grep -m1 '^VERSION = ' bol/config.py | cut -d'"' -f2)" >> "$GITHUB_ENV"
 
+      - name: Upload the built artifacts for the publish job
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: app-artifacts
+          if-no-files-found: error
+          retention-days: 1
+          path: |
+            dist/bedrock-on-linux_*.deb
+            dist/bedrock-on-linux-*.pyz
+            dist/BedrockOnLinux-*-x86_64.AppImage
+            dist/BedrockOnLinux-*-x86_64.flatpak
+            dist/BedrockOnLinux-*-SHA256SUMS
+
+  # Attest + publish only. Runs on tag push or an explicit publish request, holds
+  # the write/id-token/attestations scopes the build job does not, and touches
+  # only the already-built artifacts (never build scripts or third-party deps).
+  publish:
+    needs: build
+    if: ${{ github.event_name == 'push' || inputs.publish }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Download the built artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: app-artifacts
+          path: dist
+
       - name: Attest application artifacts
-        if: ${{ github.event_name == 'push' || inputs.publish }}
         uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
         with:
           subject-path: |
@@ -140,7 +174,6 @@ jobs:
             dist/BedrockOnLinux-*-SHA256SUMS
 
       - name: Compute release metadata + bill of materials
-        if: ${{ github.event_name == 'push' || inputs.publish }}
         run: |
           ver="$(grep -m1 '^VERSION = ' bol/config.py | cut -d'"' -f2)"
           eng_rev="$(grep -m1 '^WINEGDK_BUILD_REV = ' bol/config.py | cut -d'"' -f2)"
@@ -173,7 +206,7 @@ jobs:
           } >> "$GITHUB_ENV"
 
       - name: Roll the nightly tag to the current commit
-        if: ${{ (github.event_name == 'push' || inputs.publish) && env.RELEASE_TAG == 'nightly' }}
+        if: ${{ env.RELEASE_TAG == 'nightly' }}
         run: |
           # softprops does not move an existing tag, so delete the rolling nightly
           # release + tag first; the publish step recreates it at the current commit
@@ -185,7 +218,6 @@ jobs:
           fi
 
       - name: Publish the application release
-        if: ${{ github.event_name == 'push' || inputs.publish }}
         uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           tag_name: ${{ env.RELEASE_TAG }}

scripts/build-appimage.sh

@@ -134,12 +134,11 @@ for library in "$PYLIB/libtcl8.6.so" "$PYLIB/libtk8.6.so"; do
 done
 
 echo "== installing portable cryptography + certifi + customtkinter + python-xlib into the bundle"
+# Hash-pinned, wheels only, no sdist builds: the closure + SHA-256s live in
+# third_party/requirements-appimage.txt (--require-hashes rejects any mismatch).
 "$PYBIN" -m pip install --no-cache-dir --no-compile \
-    --no-deps \
-    'cryptography==43.0.3' 'certifi==2026.6.17' \
-    'cffi==2.0.0' 'pycparser==3.0' \
-    'customtkinter==5.2.2' 'darkdetect==0.8.0' 'packaging==26.2' \
-    'python-xlib==0.33' 'six==1.17.0' \
+    --no-deps --require-hashes --only-binary=:all: \
+    -r "$SRC/third_party/requirements-appimage.txt" \
     >/dev/null
 
 PY3="$PYLIB/python3.12"

scripts/build-deb.sh

@@ -31,10 +31,12 @@ cp -r "$SRC/bol"                       "$PKG/usr/lib/bedrock-on-linux/bol"
 # customtkinter's theme/font assets load fine. cryptography/tk stay apt deps.
 # python-xlib (+ six) is bundled the same way for bol.x11's primary-monitor
 # lookup; it's optional (bol.x11 falls back to the xrandr CLI without it).
-python3 -m pip install --quiet --no-cache-dir --no-compile --no-deps --target \
+# Hash-pinned, wheels only, no sdist builds: closure + SHA-256s live in
+# third_party/requirements-deb.txt (--require-hashes rejects any mismatch).
+python3 -m pip install --quiet --no-cache-dir --no-compile --no-deps \
+  --require-hashes --only-binary=:all: --target \
   "$PKG/usr/lib/bedrock-on-linux" \
-  'customtkinter==5.2.2' 'darkdetect==0.8.0' 'packaging==26.2' \
-  'python-xlib==0.33' 'six==1.17.0'
+  -r "$SRC/third_party/requirements-deb.txt"
 rm -rf "$PKG/usr/lib/bedrock-on-linux"/bin 2>/dev/null || true
 find "$PKG/usr/lib/bedrock-on-linux" -name __pycache__ -type d -exec rm -rf {} +
 for metadata in \

tests/test_application_packaging.py

@@ -28,18 +28,30 @@ def test_appimage_is_relocatable_licensed_and_version_pinned(self):
         self.assertIn('rm -f "$DYN"/_crypt.*.so', script)
         self.assertIn('"libcrypt.so.1", "libXss.so.1"', script)
         self.assertIn('runtime is not statically linked', script)
+        # Wheels are hash-pinned, binary-only, no sdist builds; the pinned
+        # closure lives in the requirements file the script installs from.
+        self.assertIn("--require-hashes --only-binary=:all:", script)
+        self.assertIn("third_party/requirements-appimage.txt", script)
+        reqs = (ROOT / "third_party/requirements-appimage.txt").read_text(
+            encoding="utf-8")
         for requirement in (
                 "cryptography==43.0.3", "cffi==2.0.0", "pycparser==3.0",
                 "customtkinter==5.2.2", "darkdetect==0.8.0",
                 "packaging==26.2"):
-            self.assertIn(requirement, script)
+            self.assertIn(requirement, reqs)
+        self.assertIn("--hash=sha256:", reqs)
 
     def test_deb_preserves_dependency_licenses_and_normalizes_modes(self):
         script = (ROOT / "scripts/build-deb.sh").read_text(encoding="utf-8")
+        self.assertIn("--require-hashes --only-binary=:all:", script)
+        self.assertIn("third_party/requirements-deb.txt", script)
+        reqs = (ROOT / "third_party/requirements-deb.txt").read_text(
+            encoding="utf-8")
         for requirement in (
                 "customtkinter==5.2.2", "darkdetect==0.8.0",
                 "packaging==26.2"):
-            self.assertIn(requirement, script)
+            self.assertIn(requirement, reqs)
+        self.assertIn("--hash=sha256:", reqs)
         self.assertNotIn('*.dist-info', script)
         self.assertIn("usr/share/doc/bedrock-on-linux/copyright", script)
         self.assertIn("-iname 'LICENSE*'", script)

third_party/requirements-appimage.txt

@@ -0,0 +1,43 @@
+# Hash-pinned wheel closure bundled into the AppImage (scripts/build-appimage.sh).
+# Install with: pip install --require-hashes --only-binary=:all: --no-deps -r <this>
+#   --require-hashes  every wheel must match a pin below (no silent substitution)
+#   --only-binary=:all:  never build from an sdist (no arbitrary setup.py at build)
+#   --no-deps  the list is the full, curated runtime closure; do not resolve more
+# Target interpreter: the bundled CPython 3.12 on the glibc-2.31 (Bullseye) base.
+# Regenerate the hashes from PyPI (pypi.org/pypi/<pkg>/<ver>/json) when a version
+# bumps; keep versions in step with build-deb.sh and the Flatpak manifest.
+
+# cryptography signs the MSA login; kept <44 for the glibc-2.31 baseline. abi3
+# wheels, so one set covers every CPython >= 3.7 on this base.
+cryptography==43.0.3 \
+    --hash=sha256:7e1ce50266f4f70bf41a2c6dc4358afadae90e2a1e5342d3c08883df1675374f \
+    --hash=sha256:74f57f24754fe349223792466a709f8e0c093205ff0dca557af51072ff47ab18 \
+    --hash=sha256:81ef806b1fef6b06dcebad789f988d3b37ccaee225695cf3e07648eee0fc6b73 \
+    --hash=sha256:0f996e7268af62598f2fc1204afa98a3b5712313a55c4c9d434aef49cadc91d4 \
+    --hash=sha256:c2e6fc39c4ab499049df3bdf567f768a723a5e8464816e8f009f121a5a9f4405 \
+    --hash=sha256:df6b6c6d742395dd77a23ea3728ab62f98379eff8fb61be2744d4679ab678f73 \
+    --hash=sha256:281c945d0e28c92ca5e5930664c1cefd85efe80e5c0d2bc58dd63383fda29f83 \
+    --hash=sha256:1ec0bcf7e17c0c5669d881b1cd38c4972fade441b27bda1051665faaa89bdcaa
+
+certifi==2026.6.17 \
+    --hash=sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db
+
+# cffi/pycparser back cryptography's FFI; cffi is compiled, so its wheels are
+# CPython-3.12 + linux/x86_64 specific.
+cffi==2.0.0 \
+    --hash=sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba \
+    --hash=sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187
+pycparser==3.0 \
+    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
+
+# GUI toolkit + X11 primary-monitor lookup (pure Python).
+customtkinter==5.2.2 \
+    --hash=sha256:14ad3e7cd3cb3b9eb642b9d4e8711ae80d3f79fb82545ad11258eeffb2e6b37c
+darkdetect==0.8.0 \
+    --hash=sha256:a7509ccf517eaad92b31c214f593dbcf138ea8a43b2935406bbd565e15527a85
+packaging==26.2 \
+    --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
+python-xlib==0.33 \
+    --hash=sha256:c3534038d42e0df2f1392a1b30a15a4ff5fdc2b86cfa94f072bf11b10a164398
+six==1.17.0 \
+    --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274

third_party/requirements-deb.txt

@@ -0,0 +1,15 @@
+# Hash-pinned wheels bundled into the .deb (scripts/build-deb.sh), installed with
+# --require-hashes --only-binary=:all: --no-deps into the package tree. These are
+# the pure-Python GUI/X11 helpers Debian does not package; cryptography and Tk
+# stay apt dependencies (see build-deb.sh). Keep versions in step with
+# requirements-appimage.txt; regenerate hashes from PyPI when a version bumps.
+customtkinter==5.2.2 \
+    --hash=sha256:14ad3e7cd3cb3b9eb642b9d4e8711ae80d3f79fb82545ad11258eeffb2e6b37c
+darkdetect==0.8.0 \
+    --hash=sha256:a7509ccf517eaad92b31c214f593dbcf138ea8a43b2935406bbd565e15527a85
+packaging==26.2 \
+    --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
+python-xlib==0.33 \
+    --hash=sha256:c3534038d42e0df2f1392a1b30a15a4ff5fdc2b86cfa94f072bf11b10a164398
+six==1.17.0 \
+    --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274