Harden Pi updater, release workflows, and isolated PR CI #1

Closed

jdh wants to merge 13 commits from integration/pi-safe-candidate-20260721 into main

pull from: integration/pi-safe-candidate-20260721

merge into: jdh:main

jdh:main

Conversation 0 Commits 13 Files changed 27 +1072 -67

jdh commented 2026-07-21 09:38:11 -04:00

Owner

Copy link

Superseded by PR #2, which contains the complete release-ready candidate and the fail-closed staged-systemd CI repair.

Superseded by PR #2, which contains the complete release-ready candidate and the fail-closed staged-systemd CI repair.

jdh added 4 commits 2026-07-21 09:38:11 -04:00

Add manual protected Linux updater gate 798894d1f2

Authenticate complete staged runtime tree 91428d7f41

Pin release and image workflow checkouts 18ca907744

Add isolated unprivileged Pi pull request CI 64adc0cae7

jdh added 1 commit 2026-07-21 10:12:24 -04:00

Harden privileged Pi release workflows c996b6383c

jdh changed title from Add protected Pi updater and isolated PR CI candidate to Harden Pi updater, release workflows, and isolated PR CI 2026-07-21 10:12:39 -04:00

jdh added 1 commit 2026-07-21 11:47:30 -04:00

Require explicit browser scanner pairing de4cfb1d0d

jdh force-pushed integration/pi-safe-candidate-20260721 from de4cfb1d0d to 22e2b79226 2026-07-21 14:17:32 -04:00 Compare

jdh added 1 commit 2026-07-21 15:06:45 -04:00

Bind QEMU attempts to emulator provenance 83f6038663

jdh added 1 commit 2026-07-21 15:10:53 -04:00

Classify Pi image QEMU evidence 4a1a0e4576

jdh added 1 commit 2026-07-21 16:57:09 -04:00

Contain Pi file selection and correct scanner claims cc51715000

jdh added 1 commit 2026-07-21 17:39:16 -04:00

Require Pi QEMU guest contract evidence f3349a52c7

jdh added 1 commit 2026-07-21 20:36:59 -04:00

Fix kiosk boot-blocking runtime.env perms and cage VT escape ... 51ca144b79

Adversarial release audit of the Pi image recipe found a ship-stopper and
a lockdown gap that the host/QEMU evidence levels cannot observe.

- CRITICAL: printago-kiosk-configure wrote /etc/printago-kiosk/runtime.env
  mode 0640 with no chown, so as root it stayed root:root. The kiosk
  launcher sources that file as the unprivileged kiosk user under set -eu,
  which then hits EACCES and the kiosk service crash-loops into its start
  limit into a permanent black screen. The serial-scanner unit masks it
  (systemd reads its EnvironmentFile as root) and the QEMU smoke masks the
  kiosk service, so no automated level catches it. Write runtime.env 0644
  (named RUNTIME_ENV_MODE) so the root-owned file is readable by the kiosk
  user; it holds no secrets and its root:kiosk 0750 parent still blocks
  other users.
- MEDIUM: the kiosk cage session ran with -s (Allow VT switching), so a
  physical Ctrl+Alt+F<n> could leave the kiosk for a getty login. Drop -s
  (cage's secure default).

Regression coverage: test_configure pins runtime.env other-readability
(portable constant check plus a POSIX stat check); validate-mounted-image
asserts runtime.env 0644 and that the cage session does not enable VT
switching; README adds a VT-switch physical acceptance item. Pi suite
104 tests, 5 POSIX-only skips, recipe validation passes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

jdh added 2 commits 2026-07-22 09:47:40 -04:00

Merge remote-tracking branch 'origin/main' into claude/pi-lock09-current ... b9ea80c64e

# Conflicts:
#	README.md

State absent-release reality in flash guide and runner evidence in status ... d22744798f

- docs/FLASH-AND-DEPLOY.md: lead with the fact that zero releases exist, so
  the download/verify steps are not followable yet.
- CURRENT-RELEASE-STATUS.md: list both required runner labels
  (printago-pi-builder, printago-pi-ci) and record zero Actions runs and
  zero published releases as of 2026-07-22.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

jdh added 1 commit 2026-07-22 11:15:32 -04:00

Merge remote-tracking branch 'origin/main' into claude/pi-lock09-current ... dcfc2434c4

# Conflicts:
#	README.md

jdh referenced this pull request 2026-07-23 12:11:36 -04:00

Integrate verified Pi kiosk release-readiness work #2

jdh closed this pull request 2026-07-23 12:11:58 -04:00

Some checks failed

Hide checks

CI / verify (pull_request) Failing after 4s

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jdh/printago-pi-kiosk!1

No description provided.