Post-merge audit of Phases 1-4: unauthenticated-gh attestation degrade + Roadmap fixes - #23
Merged
Merged
Conversation
All eight "Now — v1.2 candidates" items (PRs #4, #15–#20) and the three Process items (PR #21) have merged to main, but only the Monitoring integration steps carried the file's (done) convention — a Roadmap reader could not tell the v1.2 'Now' list is finished. Mark them the same way. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… 4); Roadmap fact fixes Round-1 external review findings on the phases 1-4 post-merge audit: F1 (Major, GPT-5.6-sol): 'gh attestation verify' requires a github.com credential even for public repos. A fresh host with gh installed but never 'gh auth login'ed passed the version gate, then verify exited 4 (gh's documented 'requires authentication' code) and aborted a checksum-verified install. Inability to check is not a rejection: exit 4 now degrades to checksum-only with a loud note; any other non-zero verify exit stays fatal. Reproduced locally in an isolated GH_CONFIG_DIR (rc=4 before the artifact is examined; an authenticated failing verify exits 1). Docs swept: README (en+zh), Configuration, Stability, Release-Checklist, CHANGELOG. New fake-gh test locks the degrade path; the verify_exit=1 fatal test still locks the fail-closed path. F2 (Minor, GPT-5.6-sol): Roadmap done-marker pass left stale facts — the diagnose item described a wrong detection precedence (identity file before flag, env missing; actual: flag > CONNECTOR_TAG env > identity file > convention, diagnose.sh:27-29,97-108), and the OpenRC/macOS items still said 'currently has systemd/launchd/cron' / 'only fake-command tests exercise today'. Rewritten to match shipped reality. 454 tests green; shellcheck/parity/docs-links clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…tation egress hosts Round-2 external review findings (GPT-5.6-sol), both validated: F3: GH_TELEMETRY=false does not cover gh's separate update notifier — gh checks for its own new releases once every 24h on ANY command (documented in gh help environment), contradicting PRIVACY.md's 'no update check' promise. Both gh invocations now also set GH_NO_UPDATE_NOTIFIER=1; the fake-gh call log records and asserts both env values on every call. F4: PRIVACY.md's 'every external service' install inventory omitted the attestation-verification egress: the GitHub Attestations API (api.github.com) and the TUF trust-root hosts (tuf-repo.github.com, tuf-repo-cdn.sigstore.dev, tmaproduction.blob.core.windows.net) — host set confirmed against GHSA-8xvp-7hj6-mcj9. Added the table row + wrapper note; SECURITY.md's external-services list now names the GitHub endpoints too. 454 tests green; shellcheck/ruff/mypy/parity/docs-links clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…d degrade The egress row scoped the endpoints to 'an authenticated gh', but an unauthenticated gh >= 2.93.0 still attempts the verify (and may contact api.github.com) before install.sh degrades to checksum-only on exit 4. An inventory documents when contact CAN happen, so widen the wording (reviewer nearest-failure note, validated). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…itHub egress Same class as the round-3 F4 fix, second exhaustive claim swept: the No-Telemetry paragraph's category list omitted GitHub release-download / branch-archive / attestation (API + TUF) traffic, so an operator building an allowlist from that paragraph alone would block the installer's verification path (GPT-5.6-sol round-4 F5, validated). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ll install.sh GitHub traffic is 'verification' The bullet's exhaustive claim omitted the codeload branch-archive download (install.sh's TAILSCALE_AI_EGRESS_BRANCH path), and labeling the GitHub endpoints as used 'during verification' mislabeled that explicitly unverified path (GPT-5.6-sol round-5 F6, validated). Mirrors the wording already used by the No-Telemetry paragraph; class sweep shows no further exhaustive egress claims. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Post-merge audit of the six merged Phase 1-4 PRs (#16-#21), with fixes for everything the audit surfaced:
gh attestation verifyrequires a github.com credential even for public repos. A fresh host with gh installed but nevergh auth logined passed the version gate, then verify exited 4 (gh's documented "requires authentication" code) and aborted a checksum-verified install. Exit 4 now degrades to checksum-only with a loud note; any other non-zero verify exit stays fatal (authenticated rejection). No preflight auth probe:gh auth tokencan succeed from the macOS keychain in the same environment where verify reports unauthenticated, so the verify call's own documented exit code is the only faithful discriminator. New fake-gh test locks the degrade path; the verify_exit=1 test still locks the fatal path. Docs swept: README (en+zh), Configuration, Stability, Release-Checklist, CHANGELOG.(**done**)convention, and three stale facts were corrected (diagnose tag-detection precedence is flag > CONNECTOR_TAG env > identity file > convention; OpenRC examples now ship; macOS coverage is no longer fake-only).Verification
GH_CONFIG_DIR-> verify rc=4 pre-artifact; authenticated bogus verify rc=1;gh help exit-codesdocuments 4 = requires authentication.Review status
🤖 Generated with Claude Code