deepnet/dit-releases
Watch
7
0
Fork
You've already forked dit-releases
 0
Code Issues 1 Pull requests Projects Releases 252 Packages Wiki Activity Actions

fix(S011): vendored minisign 0.11 — real $MinisignExeSha256 replaces the fail-closed placeholder #20

Merged
jsutter merged 2 commits from fix/s011-vendor-minisign into main 2026-09-12 01:01:28 +00:00
Conversation 0 Commits 2 Files changed 4 +71 -7
jsutter commented 2026-09-12 01:01:16 +00:00
Owner
Copy link

Publishes the vendored Windows minisign verifier so install.ps1's fail-closed $MinisignExeSha256 gate passes on a stock golden.

Provenance (tools/minisign-0.11/PROVENANCE.md; hash also recorded in releases/README.md):

  • upstream jedisct1/minisign 0.11 minisign-0.11-win64.zip over HTTPS from github.com (zip sha256 b9c31c2c3034f81f0e5f5d92cbcc20e67a9671b6e5455661588638848dc58031)
  • detached .minisig verified against the upstream-published release key RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3 (key id 1fe8b442180f62e7) by two independent implementations — minisign 0.12 and rsign2 — both exit 0
  • only minisign-win64/minisign.exe extracted; vendored asset sha256 6537b1da726d593877dc21720d8f8c44e6c7485da3dfddddee73e8b457e49b1a (PE machine 0x8664)
  • the binary ships as the forge release asset tools-minisign-0.11/minisign.exe (published right after merge), never in git (releases/README.md rule)

Also (pre-existing, unblocks the suite): tests/install-ps1-signing.ps1 carried a stray ) that closed the section-2 literal array early — the file could not parse under any PowerShell version. One-character repair, separate commit.

Tests (local, this host): sh tests/install-signing.sh with minisign 0.12 on PATH → ALL CHECKS PASSED incl. behavioral tamper-refusal; pwsh tests/install-ps1-signing.ps1 with MINISIGN_EXE set → ALL CHECKS PASSED incl. section 4. Live end-to-end lands with the S011 win11-test run.

Merge order: this PR first, then the forge release tools-minisign-0.11 (asset minisign.exe), then dit-client release/ditc-v3.1.2 tag — the release workflow fetches install.ps1 from this repo's main at release time.

Publishes the vendored Windows minisign verifier so install.ps1's fail-closed `$MinisignExeSha256` gate passes on a stock golden. **Provenance** (tools/minisign-0.11/PROVENANCE.md; hash also recorded in releases/README.md): - upstream jedisct1/minisign 0.11 `minisign-0.11-win64.zip` over HTTPS from github.com (zip sha256 `b9c31c2c3034f81f0e5f5d92cbcc20e67a9671b6e5455661588638848dc58031`) - detached `.minisig` verified against the upstream-published release key `RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3` (key id `1fe8b442180f62e7`) by two independent implementations — minisign 0.12 and rsign2 — both exit 0 - only `minisign-win64/minisign.exe` extracted; vendored asset sha256 `6537b1da726d593877dc21720d8f8c44e6c7485da3dfddddee73e8b457e49b1a` (PE machine 0x8664) - the binary ships as the forge release asset `tools-minisign-0.11/minisign.exe` (published right after merge), never in git (releases/README.md rule) **Also (pre-existing, unblocks the suite):** tests/install-ps1-signing.ps1 carried a stray `)` that closed the section-2 literal array early — the file could not parse under any PowerShell version. One-character repair, separate commit. **Tests (local, this host):** `sh tests/install-signing.sh` with minisign 0.12 on PATH → ALL CHECKS PASSED incl. behavioral tamper-refusal; `pwsh tests/install-ps1-signing.ps1` with MINISIGN_EXE set → ALL CHECKS PASSED incl. section 4. Live end-to-end lands with the S011 win11-test run. Merge order: this PR first, then the forge release `tools-minisign-0.11` (asset `minisign.exe`), then dit-client `release/ditc-v3.1.2` tag — the release workflow fetches install.ps1 from this repo's main at release time.
The suite could not parse under any PowerShell version (pwsh 7.6.2:
MissingEndCurlyBrace-class ParserError at the foreach body). Pre-existing
on main; found while running installer/signing coverage for S011.
The Windows installer's fail-closed minisign gate now passes on a stock
golden: the placeholder is replaced with the hash of the published
tools-minisign-0.11/minisign.exe release asset.

Provenance (tools/minisign-0.11/PROVENANCE.md, hash also recorded in
releases/README.md):
- upstream jedisct1/minisign 0.11 minisign-0.11-win64.zip
  (zip sha256 b9c31c2c3034f81f0e5f5d92cbcc20e67a9671b6e5455661588638848dc58031),
  downloaded over HTTPS from github.com
- detached .minisig verified against the upstream-published release key
  RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3 (key id
  1fe8b442180f62e7) by two independent implementations (minisign 0.12,
  rsign2), both exit 0
- only minisign-win64/minisign.exe extracted; asset sha256
  6537b1da726d593877dc21720d8f8c44e6c7485da3dfddddee73e8b457e49b1a
  (PE machine 0x8664)

Tests: sh tests/install-signing.sh (with minisign on PATH) and
pwsh tests/install-ps1-signing.ps1 (MINISIGN_EXE set) — ALL CHECKS PASSED,
behavioral sections included. Live end-to-end lands with the S011
win11-test run.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
deepnet/dit-releases!20
No description provided.