34 lines
2.4 KiB
Markdown
34 lines
2.4 KiB
Markdown
# #1050 C1 fix-round verification
|
|
|
|
Frozen reviewed head before remediation: `378bc1afe3bc485adb8614897d66c5edccd4a527`.
|
|
|
|
Status: **believed-fixed, pending jarvis validation**. PR #1054 is not self-merged and issue #1050 remains open.
|
|
|
|
## Blocker B — fail-closed test enumeration
|
|
|
|
The RED-first control used a real filesystem permission failure, not binary shadowing or PATH interception.
|
|
|
|
1. A planted `{"status":"in-progress"}` file in a readable P2 fault tree made the complete real walk fail the frozen suite at `P2 left an in-progress transaction` (`01-pre-fix-positive-control.log`, exit 1).
|
|
2. The same planted defect beneath a target-owned mode-0100 directory made real `find` report a permission failure. The frozen suite erased the producer failure and exited 0 with `installer next lane tests passed` (`02-pre-fix-permission-failure-attack.log`).
|
|
3. The committed regression control initially failed because the child full-suite attack still exited 0 (`03-regression-test-red.log`).
|
|
4. After remediation, the same child full-suite input exits 1 and names `[test] ERROR: P2 fault-state enumeration failed` (`04-post-fix-permission-failure-attack.log`). The ordinary full suite remains green.
|
|
|
|
`tools/test-enumeration-assertions.sh` now captures each complete NUL-delimited population and checks the producer status before asserting absence. Content checks inspect the captured population and distinguish “no match” from a read error. The shared fail-closed implementation covers:
|
|
|
|
- `tools/install-next-lane.test.sh`: redacted staging-file cleanup and fault-state transaction scan;
|
|
- `tools/verified-installer-fetch.test.sh`: temporary-download cleanup;
|
|
- `tools/install-state-machine.test.sh`: symlink-target non-mutation;
|
|
- `docs/reports/verification/1050-b8-redaction-control/positive-control.test.sh`: both copied counterparts.
|
|
|
|
No assertion was loosened. A1, A2, upgrade-guard, source-root, the species-2 sweep, #869, and expected-RED verdict rows remain outside this remediation.
|
|
|
|
## Blocker A — installer digest
|
|
|
|
The stale sidecar value was replaced with the exact `sha256sum` record for `tools/install.sh`:
|
|
|
|
```text
|
|
e59cb441a2f37ae9150f8eae470238e9d858a1816df93343d9784a6796676096 install.sh
|
|
```
|
|
|
|
Local `sha256sum -c tools/install.sh.sha256` and the workflow's exact expected/actual equality both pass. The immutable provider-fetch arm at the new `${CI_COMMIT_SHA}` is recorded in the freeze artifact after push; local equality alone is not treated as sufficient evidence.
|