Loading…
Reference in a new issue
No description provided.
Delete branch "arc/23-24-installer-rescue"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Closes deepnet/dit-releases#23, closes deepnet/dit-releases#24.
dit-releases), minisign as fallback; installer verification rework./v1/report(feedbackd#13 endpoint-layer scope).Authorization note: the Operator explicitly authorized push → PR → merge → release for this install-arc batch (substantial tier). This is the worker's own tested work; merged under that standing authorization. The
.sshsigpublishing step (#23 scope item 1) is completed in a follow-up commit on dit-client main before the release cut.Repair the install experience for releases that already shipped so a broken binary cannot strand the user (dit-releases#24): - Darwin rescue: after install and before the --version check, run 'codesign --force -s -' on macOS — idempotent, unconditional; the release bytes were already proven authentic, so the ad-hoc re-sign asserts no new trust, it only restores exec-ability for the invalidated-embedded-signature class (the v3.5.0 page-0 SIGKILL). A failing rescue is non-fatal: warn, continue, let --version classify. - Failure classification with the fleet wire vocabulary (produced here, pinned by feedbackd#13): download-failed, verify-failed, exec-failed-signature (darwin SIGKILL/137), exec-failed-other, swap-failed. On --version failure the class + remediation + a copy-ready diagnostics block print, PATH/Next-steps success messaging is suppressed, and the exit stays non-zero (3). - Failure marker: <config dir>/install-failure.json (platform split via the same helper the config.toml write now uses) with exactly tool, version, class, os, arch, binary_sha256, machine_hint {hostname, username}, correlation — written BEFORE the <tool>.broken rename. download-failed (nothing downloaded) writes no marker. - Best-effort direct submission (dit-client#298): POST the classified payload wrapped in the feedbackd FeedbackReport envelope to /v1/feedback with the report-only bearer key (REPORT_KEY placeholder SET-AT-RELEASE + TODO — the swap activates the POST; skipped on DITC_FEEDBACK=off). Bounded ~5s, silent failure; the marker always lands so a later successful ditc run files it (FR-9/FR-10). - Correlation fingerprint, identical fleet-wide: first 16 hex of sha256('<tool>|install|<class>'). - install.ps1 parity: same classification + marker (%APPDATA% split) + report POST + fingerprint; every --version failure classifies exec-failed-other (Windows has no SIGKILL/137 semantics) and now also checks the native exit code, which the old try/catch missed; codesign rescue is N/A on Windows. The vendored-minisign and .minisig fetches classify verify-failed. - INSTALL.md: prerequisites/verification story for the sshsig-prefer installer, download-then-run quick install (no piped invocation), failure-class table + marker lifecycle in Troubleshooting. Tests: install-signing.sh pins all five class strings in both installers and the sh marker/report constants; install-ps1-signing.ps1 pins the ps1 classification surface + the fingerprint algorithm; tests/install-e2e.sh gains the darwin-shim rescue/classification/rename proof, exec-failed-other, swap-failed, the POST contract (bearer key, endpoint, valid FeedbackReport envelope, exit-code invariance) and the DITC_FEEDBACK=off zero-network proof. Assisted-by: worker:synthetic/hf:zai-org/GLM-5.3-Flash