From 13ba022ab24c8df3e6656b890acebcfa31aecff9 Mon Sep 17 00:00:00 2001 From: Shadowfetch Studio <209457103+ShadowfetchStudio@users.noreply.github.com> Date: Mon, 2 Nov 2026 00:09:19 -0500 Subject: [PATCH] Fix release trust and prepare 2.3.3 --- .github/workflows/release.yml | 25 +++++++++++++++++++ CHANGELOG.md | 6 ++++- Cargo.lock | 4 +-- Cargo.toml | 2 +- docs/PLATFORM_QUALIFICATION.md | 2 ++ docs/RELEASE_NOTES.md | 4 +++ .../com.shadowfetch.shadowcode.appdata.xml | 2 +- packaging/shadow-agent.desktop | 2 +- release/trust/policy | 2 +- scripts/test-native-release-signing.mjs | 2 +- src-tauri/tauri.conf.json | 2 +- ui/package-lock.json | 4 +-- ui/package.json | 2 +- 13 files changed, 47 insertions(+), 12 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 59b9a602..31d6b6ef 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,6 +39,31 @@ jobs: assert.match(env.SIGNING_ENVIRONMENT || '', /^[A-Za-z0-9][A-Za-z0-9 _.-]{0,254}$/, 'Provision an existing protected signing environment'); appendFileSync(env.GITHUB_OUTPUT, `tooling=${env.TOOLING_COMMIT}\nenvironment=${env.SIGNING_ENVIRONMENT}\n`); NODE + - name: Checkout reviewed signing policy + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + ref: ${{ steps.validate.outputs.tooling }} + path: trusted-policy + persist-credentials: false + - name: Checkout candidate policy + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + path: candidate-policy + persist-credentials: false + - name: Check reviewed and candidate trust cover the release + run: | + node --input-type=module <<'NODE' + import assert from 'node:assert/strict'; + import { readFile } from 'node:fs/promises'; + import { parseTrustPolicy, compareVersions } from './trusted-policy/scripts/native-release-auth.mjs'; + const trusted = await readFile('trusted-policy/release/trust/policy'); + const candidate = await readFile('candidate-policy/release/trust/policy'); + assert(trusted.equals(candidate), 'Candidate and independently reviewed trust policies differ'); + const policy = parseTrustPolicy(trusted), version = process.env.GITHUB_REF_NAME.slice(1); + for (const target of ['x86_64-unknown-linux-gnu', 'aarch64-unknown-linux-gnu']) assert(policy.targets.includes(target), `Trust policy lacks ${target}`); + assert(compareVersions(version, policy.minimumVersion) >= 0, 'Release is below the trust floor'); + assert(policy.keys.some(key => key.epoch >= policy.minimumEpoch && compareVersions(version, key.minimum) >= 0 && compareVersions(version, key.maximum) <= 0), 'No trusted key interval covers this release'); + NODE build: needs: configuration runs-on: ubuntu-24.04 diff --git a/CHANGELOG.md b/CHANGELOG.md index 39318e8f..ac6363ca 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,11 @@ ## Unreleased -## 2.3.2: Desktop reliability +## 2.3.3: Desktop reliability + +Extends the existing Linux release signing key trust interval through 2.3.3. The tagged 2.3.2 candidate was not published because its trust interval ended at 2.3.1. + +## 2.3.2: Desktop reliability (unpublished candidate) - Relocate bundled WebKit helper paths so AppImages do not depend on the build host's Debian filesystem layout. Verify relocation against the shipped library bytes. - On compatible non-Debian desktop layouts, select a complete host WebKit/GTK stack to avoid mixing newer Mesa drivers with the bundled Debian graphics stack. Both helper executables and all native dependencies are checked; the bundled fallback remains available. No sandbox is disabled. diff --git a/Cargo.lock b/Cargo.lock index 1c8f429b..362781e3 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4512,7 +4512,7 @@ dependencies = [ [[package]] name = "shadowcode-core" -version = "2.3.2" +version = "2.3.3" dependencies = [ "anyhow", "base64 0.22.1", @@ -4575,7 +4575,7 @@ dependencies = [ [[package]] name = "shadowcode-desktop" -version = "2.3.2" +version = "2.3.3" dependencies = [ "anyhow", "gdk", diff --git a/Cargo.toml b/Cargo.toml index abd0651b..979edc6a 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -5,7 +5,7 @@ exclude = ["vendor/glib-0.18.5"] resolver = "2" [workspace.package] -version = "2.3.2" +version = "2.3.3" edition = "2021" rust-version = "1.95" license = "Apache-2.0" diff --git a/docs/PLATFORM_QUALIFICATION.md b/docs/PLATFORM_QUALIFICATION.md index 40cecd41..973c9423 100644 --- a/docs/PLATFORM_QUALIFICATION.md +++ b/docs/PLATFORM_QUALIFICATION.md @@ -1,5 +1,7 @@ # Physical-machine platform qualification +The 2.3.3 candidate carries the 2.3.2 candidate fixes and extends the existing Linux signing-key interval through 2.3.3. Evidence below is for the 2.3.2 candidate and does not qualify the 2.3.3 artifacts; final package and physical-device testing remains pending. + ## 2.3.2 candidate — November 1, 2026 This is a qualification record, not a claim that the candidate has been released. diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md index 51789b24..0c4d6f5e 100644 --- a/docs/RELEASE_NOTES.md +++ b/docs/RELEASE_NOTES.md @@ -1,3 +1,7 @@ +# ShadowCode 2.3.3 — candidate + +This candidate includes the desktop fixes described below and extends the existing Linux release signing key trust interval through 2.3.3. The 2.3.2 tag was not published: its trusted key interval ended at 2.3.1. Final artifacts and physical-device qualification remain pending. + # ShadowCode 2.3.2 — candidate This source candidate addresses an AppImage desktop-startup failure reproduced on diff --git a/packaging/com.shadowfetch.shadowcode.appdata.xml b/packaging/com.shadowfetch.shadowcode.appdata.xml index cb820967..5aaa21ad 100644 --- a/packaging/com.shadowfetch.shadowcode.appdata.xml +++ b/packaging/com.shadowfetch.shadowcode.appdata.xml @@ -29,7 +29,7 @@ shadowcode - +

Improves AppImage startup on rolling Linux desktops, model-picker focus, and platform keyboard hints.

 diff --git a/packaging/shadow-agent.desktop b/packaging/shadow-agent.desktop index 7e4e00cb..6f4ae54a 100644 --- a/packaging/shadow-agent.desktop +++ b/packaging/shadow-agent.desktop @@ -13,4 +13,4 @@ Keywords=agent;llm;coding;shadowfetch; StartupNotify=true StartupWMClass=shadowcode X-GNOME-UsesNotifications=true -X-ShadowCode-Version=2.3.2 +X-ShadowCode-Version=2.3.3 diff --git a/release/trust/policy b/release/trust/policy index 25a04010..c937f0ee 100644 --- a/release/trust/policy +++ b/release/trust/policy @@ -7,4 +7,4 @@ channel=stable minimum-epoch=1 minimum-version=0.33.0 keys=ed25519-spki-sha256 -key=1 f0c60ff8228314616985712f8918c9798c0ecf72b7271e19343a041c25663b7f 0.33.0 2.3.1 +key=1 f0c60ff8228314616985712f8918c9798c0ecf72b7271e19343a041c25663b7f 0.33.0 2.3.3 diff --git a/scripts/test-native-release-signing.mjs b/scripts/test-native-release-signing.mjs index d31144e3..90f32f58 100644 --- a/scripts/test-native-release-signing.mjs +++ b/scripts/test-native-release-signing.mjs @@ -155,7 +155,7 @@ test('release workflow separates untrusted build from protected signing and writ }); test('workflow configuration fails closed without real provisioning; fixture-only inputs exercise its parser', () => testFixture(async f => { const workflow = await readFile(new URL('../.github/workflows/release.yml', import.meta.url), 'utf8'); - const body = / run: \|\n([\s\S]*?)\n build:/.exec(workflow)[1].replace(/^ /gm, ''); + const body = / run: \|\n([\s\S]*?)\n - name:/.exec(workflow)[1].replace(/^ /gm, ''); const env = { ...process.env, GITHUB_REPOSITORY: context.repo, REPOSITORY_ID: IDENTITY.repositoryId, OWNER_ID: IDENTITY.ownerId, GITHUB_EVENT_NAME: 'push', GITHUB_REF_TYPE: 'tag', GITHUB_REF_NAME: context.tag, TOOLING_COMMIT: '', SIGNING_ENVIRONMENT: '', GITHUB_OUTPUT: path.join(f.root, 'configuration-output') }; const run = extra => spawnSync('bash', ['-euo', 'pipefail', '-c', body], { env: { ...env, ...extra }, encoding: 'utf8', timeout: 20000 }); assert.notEqual(run({}).status, 0); diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json index b6d09aaf..1b4d0452 100644 --- a/src-tauri/tauri.conf.json +++ b/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "ShadowCode", - "version": "2.3.2", + "version": "2.3.3", "identifier": "com.shadowfetch.shadowcode", "build": { "beforeDevCommand": { diff --git a/ui/package-lock.json b/ui/package-lock.json index f5dc2931..5f15f353 100644 --- a/ui/package-lock.json +++ b/ui/package-lock.json @@ -1,12 +1,12 @@ { "name": "shadow-agent-ui", - "version": "2.3.2", + "version": "2.3.3", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "shadow-agent-ui", - "version": "2.3.2", + "version": "2.3.3", "license": "Apache-2.0", "dependencies": { "@codemirror/commands": "6.11.1", diff --git a/ui/package.json b/ui/package.json index 7cc3d372..50c8834e 100644 --- a/ui/package.json +++ b/ui/package.json @@ -1,6 +1,6 @@ { "name": "shadow-agent-ui", - "version": "2.3.2", + "version": "2.3.3", "private": true, "license": "Apache-2.0", "type": "module",