fix: publish SHA-256 node-agent package manifests

.github/workflows/codeql-verification.yml

@@ -38,7 +38,10 @@ jobs:
           set -euo pipefail
           test -z "$(git status --porcelain)"
           git merge-base --is-ancestor c8663d12dd253ef13258750dca056d4b1219fc10 HEAD
-          grep -Fq 'VERSION_OVERRIDE: v0.13.24' .github/workflows/validate.yml
+          grep -Fq 'VERSION_OVERRIDE: v0.13.25' .github/workflows/validate.yml
+          grep -Fq 'SHA256SUMS' scripts/package
+          grep -Fq 'bash scripts/verify-package "$linux_asset"' .github/workflows/validate.yml
+          grep -Fq 'bash scripts/verify-package dist/artifacts/node-agent-0.13.25.tar.gz' .github/workflows/security-release-gate.yml
 
       - name: Install the release Go toolchain
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -65,7 +68,7 @@ jobs:
           export GOFLAGS=-mod=vendor
           mkdir -p "$GITHUB_WORKSPACE/bin"
           CGO_ENABLED=0 go build -trimpath -tags 'netgo osusergo' \
-            -ldflags='-w -s -X main.VERSION=v0.13.24' \
+            -ldflags='-w -s -X main.VERSION=v0.13.25' \
             -o "$GITHUB_WORKSPACE/bin/node-agent" ./
 
       - name: Analyze without publishing temporary alerts

.github/workflows/security-release-gate.yml

@@ -19,9 +19,9 @@ jobs:
     timeout-minutes: 120
     env:
       DAPPER_IMAGE: pasturestack/node-agent-dapper:${{ github.sha }}
-      RUNTIME_IMAGE: pasturestack/node-agent:v0.13.24
+      RUNTIME_IMAGE: pasturestack/node-agent:v0.13.25
       TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
-      VERSION_OVERRIDE: v0.13.24
+      VERSION_OVERRIDE: v0.13.25
     steps:
       - name: Check out candidate
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -38,6 +38,7 @@ jobs:
           mkdir -p evidence
           git rev-parse HEAD > evidence/source-revision.txt
           sha256sum Dockerfile.dapper package/Dockerfile tests/requirements.lock \
+            scripts/package scripts/verify-package \
             .github/workflows/codeql-verification.yml \
             .github/workflows/security-release-gate.yml \
             security/dapper.openvex.json \
@@ -49,19 +50,20 @@ jobs:
           set -euo pipefail
           CROSS=1 VERSION_OVERRIDE="$VERSION_OVERRIDE" make DAPPER_IMAGE="$DAPPER_IMAGE" ci
           make DAPPER_IMAGE="$DAPPER_IMAGE" IMAGE_NAME=pasturestack/node-agent \
-            TAG=v0.13.24 VERSION_OVERRIDE="$VERSION_OVERRIDE" package-image
-          test -s dist/artifacts/node-agent-0.13.24.tar.gz
-          test -s dist/artifacts/node-agent-0.13.24-windows-amd64.zip
+            TAG=v0.13.25 VERSION_OVERRIDE="$VERSION_OVERRIDE" package-image
+          test -s dist/artifacts/node-agent-0.13.25.tar.gz
+          test -s dist/artifacts/node-agent-0.13.25-windows-amd64.zip
           test "$(cat dist/image)" = "$RUNTIME_IMAGE"
-          gzip -t dist/artifacts/node-agent-0.13.24.tar.gz
-          unzip -t dist/artifacts/node-agent-0.13.24-windows-amd64.zip
-          sha256sum dist/artifacts/node-agent-0.13.24.tar.gz \
-            dist/artifacts/node-agent-0.13.24-windows-amd64.zip \
+          gzip -t dist/artifacts/node-agent-0.13.25.tar.gz
+          bash scripts/verify-package dist/artifacts/node-agent-0.13.25.tar.gz
+          unzip -t dist/artifacts/node-agent-0.13.25-windows-amd64.zip
+          sha256sum dist/artifacts/node-agent-0.13.25.tar.gz \
+            dist/artifacts/node-agent-0.13.25-windows-amd64.zip \
             bin/node-agent > evidence/product-artifacts.sha256
           docker image inspect "$RUNTIME_IMAGE" > evidence/runtime-image-inspect.json
           docker run --rm --entrypoint /usr/bin/node-agent "$RUNTIME_IMAGE" --version \
             > evidence/runtime-version.txt
-          grep -Fxq 'node-agent version v0.13.24' evidence/runtime-version.txt
+          grep -Fxq 'node-agent version v0.13.25' evidence/runtime-version.txt
 
       - name: Verify reproducible Linux binary
         shell: bash
@@ -141,7 +143,7 @@ jobs:
               and ((.impact_statement | length) > 0)
             )
           ' security/dapper.openvex.json >/dev/null
-          grep -F $'linux-libc-dev:amd64\t7.0.0-29.29' evidence/dapper-dpkg.tsv >/dev/null
+          grep -F $'linux-libc-dev:amd64\t7.0.0-30.30' evidence/dapper-dpkg.tsv >/dev/null
           if grep -Eq '^linux-(image|modules)([-:]|[[:space:]])' evidence/dapper-dpkg.tsv; then
             printf 'Unexpected Linux kernel runtime package in Dapper image\n' >&2
             exit 1

.github/workflows/validate.yml

@@ -34,32 +34,33 @@ jobs:
         id: package
         env:
           CROSS: "1"
-          VERSION_OVERRIDE: v0.13.24
+          VERSION_OVERRIDE: v0.13.25
         run: |
           set -euo pipefail
           make ci
-          linux_asset="dist/artifacts/node-agent-0.13.24.tar.gz"
-          windows_asset="dist/artifacts/node-agent-0.13.24-windows-amd64.zip"
+          linux_asset="dist/artifacts/node-agent-0.13.25.tar.gz"
+          windows_asset="dist/artifacts/node-agent-0.13.25-windows-amd64.zip"
           test -s "$linux_asset"
           test -s "$windows_asset"
           gzip -t "$linux_asset"
+          bash scripts/verify-package "$linux_asset"
           unzip -t "$windows_asset"
           (
             cd dist/artifacts
             sha256sum \
-              node-agent-0.13.24.tar.gz \
-              node-agent-0.13.24-windows-amd64.zip >SHA256SUMS
+              node-agent-0.13.25.tar.gz \
+              node-agent-0.13.25-windows-amd64.zip >SHA256SUMS
           )
           printf 'NODE_AGENT_VALIDATION_OK source=%s version=%s artifacts=linux,windows\n' \
             "$GITHUB_SHA" "$VERSION_OVERRIDE"
 
       - name: Retain reviewed release candidate
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: node-agent-0.13.24
+          name: node-agent-0.13.25
           path: |
-            dist/artifacts/node-agent-0.13.24.tar.gz
-            dist/artifacts/node-agent-0.13.24-windows-amd64.zip
+            dist/artifacts/node-agent-0.13.25.tar.gz
+            dist/artifacts/node-agent-0.13.25-windows-amd64.zip
             dist/artifacts/SHA256SUMS
           if-no-files-found: error
           retention-days: 30

README.md

@@ -33,7 +33,7 @@ client 0.5, gopsutil v4.26, mapstructure v2.5, netlink v1.3, and netns v0.0.5.
 The retired AWS SDK v1, Aliyungo, root Docker module, GOPATH/Godeps, and Trash
 dependency paths are not part of the build.
 
-For the reviewed `0.13.23` compatibility release, `VERSION_OVERRIDE=v0.13.23 CROSS=1 make package` produces the deterministic flat assets `node-agent-0.13.23.tar.gz` and `node-agent-0.13.23-windows-amd64.zip`. PastureStack Server serves both from its matching GitHub Release and verifies their SHA-256 entries before use; operators do not need an artifact mirror. The Windows ZIP uses the neutral `pasturestack/` include layout. A replacement Windows bootstrap image and upgrade/rollback tests are still required before Windows hosts are supported.
+For the reviewed `0.13.25` compatibility release, `VERSION_OVERRIDE=v0.13.25 CROSS=1 make package` produces the deterministic flat assets `node-agent-0.13.25.tar.gz` and `node-agent-0.13.25-windows-amd64.zip`. The Linux archive carries both the legacy SHA-1 manifests and the current SHA-256 manifests required by the host installer. PastureStack Server serves both assets from its matching GitHub Release and verifies their outer SHA-256 entries before use; operators do not need an artifact mirror. The Windows ZIP uses the neutral `pasturestack/` include layout. A replacement Windows bootstrap image and upgrade/rollback tests are still required before Windows hosts are supported.
 
 The `host.port.check` event performs a read-only host-port preflight through the existing agent event channel. It reports Docker bindings from running and stopped containers and, on Linux, listening TCP/UDP sockets visible through the existing host `/proc` mount. Incomplete host socket inspection is reported as unknown; it is never presented as an available port.
 

docs/releases/node-agent-0.13.25.md

@@ -0,0 +1,13 @@
+# Node Agent v0.13.25
+
+This release corrects the Linux compatibility archive consumed by existing
+PastureStack host installers.
+
+- Keep the legacy `SHA1SUMS` and `SHA1SUMSSUM` files for older hosts.
+- Add `SHA256SUMS` and `SHA256SUMSSUM` for current hosts.
+- Verify both checksum chains against the extracted release archive in CI.
+- Refresh the transparent build-only `linux-libc-dev` OpenVEX review for the
+  exact Ubuntu snapshot package used by the disposable Dapper image.
+
+Runtime hardware inventory and Docker request behavior are unchanged from
+v0.13.24.

scripts/package

@@ -35,9 +35,16 @@ cp -rf bin/node-agent build/${CONTENT}/bin
 
 pushd build >/dev/null
 
-find "${CONTENT}" -type f ! -name SHA1SUMS ! -name SHA1SUMSSUM -print0 | sort -z | \
-    xargs -0 sha1sum -b > "${CONTENT}/SHA1SUMS"
+find "${CONTENT}" -type f \
+    ! -name SHA1SUMS ! -name SHA1SUMSSUM \
+    ! -name SHA256SUMS ! -name SHA256SUMSSUM \
+    -print0 | sort -z | xargs -0 sha1sum -b > "${CONTENT}/SHA1SUMS"
 sha1sum "${CONTENT}/SHA1SUMS" > "${CONTENT}/SHA1SUMSSUM"
+find "${CONTENT}" -type f \
+    ! -name SHA1SUMS ! -name SHA1SUMSSUM \
+    ! -name SHA256SUMS ! -name SHA256SUMSSUM \
+    -print0 | sort -z | xargs -0 sha256sum -b > "${CONTENT}/SHA256SUMS"
+sha256sum "${CONTENT}/SHA256SUMS" > "${CONTENT}/SHA256SUMSSUM"
 
 archive_tmp=$(mktemp "../dist/artifacts/.node-agent-${RELEASE_VERSION}.tar.gz.XXXXXX")
 trap 'rm -f "$archive_tmp"' EXIT

scripts/verify-package

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+archive=${1:?Usage: scripts/verify-package ARCHIVE}
+test -s "$archive"
+gzip -t "$archive"
+
+workdir=$(mktemp -d)
+trap 'rm -rf "$workdir"' EXIT
+tar -xzf "$archive" -C "$workdir"
+
+mapfile -t roots < <(find "$workdir" -mindepth 1 -maxdepth 1 -type d -print)
+test "${#roots[@]}" -eq 1
+root=${roots[0]}
+test -z "$(find "$workdir" -mindepth 1 -maxdepth 1 ! -type d -print -quit)"
+test -f "$root/apply.sh"
+test -x "$root/bin/node-agent"
+
+(
+    cd "$workdir"
+    root_name=$(basename "$root")
+    sha1sum -c "$root_name/SHA1SUMSSUM"
+    sha1sum -c "$root_name/SHA1SUMS"
+    sha256sum -c "$root_name/SHA256SUMSSUM"
+    sha256sum -c "$root_name/SHA256SUMS"
+)
+
+printf 'NODE_AGENT_PACKAGE_OK archive=%s checksums=sha1,sha256\n' "$archive"