install.sh: darwin codesign rescue + failure classification so a broken binary can't strand a user #24

New issue

Closed

opened 2026-10-06 18:51:26 +00:00 by jsutter · 2 comments

jsutter commented

2026-10-06 18:51:26 +00:00

Owner

Motivating incident: ditc v3.5.0 on macOS 26 (Apple Silicon) — install completed, ditc --version killed by the kernel (invalid embedded signature, page-0 hash mismatch). The installer printed WARNING: installed binary failed --version check, exited 3, and left the dead binary at ~/.local/bin/ditc for the next shell to find.

Scope

Darwin rescue: after install and before the --version check, run codesign --force -s - "$install_path" on macOS. Idempotent, unconditional, cheap. It re-signs a binary whose release authenticity was already proven (minisign/SSHSIG verification happened before install); it asserts nothing new about trust — it only restores exec-ability for the invalidated-embedded-signature class.
Failure classification: when the post-install --version check fails, classify the failure (SIGKILL on darwin = signature class), print the class + exact remediation + a copy-ready diagnostics block, rename the binary to ditc.broken (so no shell silently finds it), and suppress the PATH/"Next steps" success messaging. Never leave a dead binary silently in place.
Mirror the same rescue in the README-adjacent docs the installer prints on failure.

Acceptance criteria

On Linux CI, a shim-stubbed codesign and a kill-simulating stub binary prove both branches: rescue applied before --version, and the failure branch renames + reports.
The failure output names the remediation for the signature class specifically.
Real-darwin confirmation is tracked on the pipeline ticket (verification boundary: no macOS CI exists in the fleet).

Companion to the darwin page-0 signature pipeline ticket (filed the same day, deepnet/dit-client). The pipeline fix repairs FUTURE releases; this ticket repairs the install experience for releases that already shipped (v3.5.0 today) so the next macOS user is not stranded while the pipeline fix lands. Motivating incident: ditc v3.5.0 on macOS 26 (Apple Silicon) — install completed, `ditc --version` killed by the kernel (invalid embedded signature, page-0 hash mismatch). The installer printed `WARNING: installed binary failed --version check`, exited 3, and left the dead binary at `~/.local/bin/ditc` for the next shell to find. ## Scope 1. Darwin rescue: after install and before the `--version` check, run `codesign --force -s - "$install_path"` on macOS. Idempotent, unconditional, cheap. It re-signs a binary whose release authenticity was already proven (minisign/SSHSIG verification happened before install); it asserts nothing new about trust — it only restores exec-ability for the invalidated-embedded-signature class. 2. Failure classification: when the post-install `--version` check fails, classify the failure (SIGKILL on darwin = signature class), print the class + exact remediation + a copy-ready diagnostics block, rename the binary to `ditc.broken` (so no shell silently finds it), and suppress the PATH/"Next steps" success messaging. Never leave a dead binary silently in place. 3. Mirror the same rescue in the README-adjacent docs the installer prints on failure. ## Acceptance criteria - On Linux CI, a shim-stubbed `codesign` and a kill-simulating stub binary prove both branches: rescue applied before `--version`, and the failure branch renames + reports. - The failure output names the remediation for the signature class specifically. - Real-darwin confirmation is tracked on the pipeline ticket (verification boundary: no macOS CI exists in the fleet).

jsutter commented

2026-10-06 19:25:14 +00:00

Author

Owner

Critic review amendments (2026-10-06):

The failure-class string table (signature-class, download, verify, swap, exec, ...) is owned HERE (this ticket is the producer) and becomes the wire vocabulary for #298 auto-filing and the feedbackd fingerprint contract — define the exact strings in this ticket's implementation.
Sequencing with #298: the classified payload is written to the install-failure marker in the same failure branch, BEFORE the ditc.broken rename.
Machine hint (hostname + username, best-effort) goes into the classified payload per the #298 Operator decision; the payload passes the zero-secret scan apart from that deliberate field.

Critic review amendments (2026-10-06): 1. The failure-class string table (signature-class, download, verify, swap, exec, ...) is owned HERE (this ticket is the producer) and becomes the wire vocabulary for #298 auto-filing and the feedbackd fingerprint contract — define the exact strings in this ticket's implementation. 2. Sequencing with #298: the classified payload is written to the install-failure marker in the same failure branch, BEFORE the ditc.broken rename. 3. Machine hint (hostname + username, best-effort) goes into the classified payload per the #298 Operator decision; the payload passes the zero-secret scan apart from that deliberate field.

jsutter commented

2026-10-06 21:02:52 +00:00

Author

Owner

Implemented on branch arc/23-24-installer-rescue (unpushed): 34c982a codesign rescue + classified marker (<config_dir>/install-failure.json, machine_hint, fingerprint) + <tool>.broken rename + best-effort POST, 74ce636 endpoint alignment (/v1/report). Class vocabulary landed exactly as pinned. Pending: real-darwin confirmation (Operator), push/PR.

Implemented on branch `arc/23-24-installer-rescue` (unpushed): 34c982a codesign rescue + classified marker (`<config_dir>/install-failure.json`, machine_hint, fingerprint) + `<tool>.broken` rename + best-effort POST, 74ce636 endpoint alignment (/v1/report). Class vocabulary landed exactly as pinned. Pending: real-darwin confirmation (Operator), push/PR.

jsutter referenced this issue from a commit

2026-10-06 22:27:20 +00:00

feat(#24): darwin codesign rescue + classified install-failure marker and report

jsutter referenced this issue from a commit

2026-10-06 22:27:20 +00:00

fix(#24): report POST targets /v1/report (feedbackd#13 endpoint-layer scope isolation)

jsutter referenced this issue from a pull request that will close it,

2026-10-06 22:27:49 +00:00

arc: install rescue — SSHSIG-prefer verification + darwin codesign rescue + POST wiring (#23 #24) #25

jsutter closed this issue

2026-10-06 22:28:02 +00:00

jsutter referenced this issue from a commit