[SashaMIT]

Summary

Stack: #395 ← #397 (cursor/intel-package-name-1297, this PR's base) ← #398 (this) ← #399.

Head: da63c235. Draft. Do not merge. The base (#397, 8dd9e851) is merged in (29733e73, merge, not rebase); it carries the zip 9 fix from #417 so cargo-audit can pass, #394's 36720070 (/healthz and the gateway start prove that the gateway holds the lock from the held flock; docs/LAUNCHER_CONTRACT.md, "What proves that this gateway holds the lock") and #395's macOS smoke test fixes through 3cffaad4. 32f4abfd merges #397 at 56a8084f (no conflicts), which carries #394's 4bb19dcf: the ownership proof is one step (each registry entry keeps a second descriptor of the locked open file, and the registry mutex is held from the lookup to the end of the probe; 85f3142e); the managed-runtime subordinate lane uses the same proof as /healthz, and a Home terminal gets an inherited lock descriptor, ELASTOS_GATEWAY_HOST_LOCK_FD (eed83a72); a held lock whose record cannot be read still counts as held (4bb19dcf). 9c7ebae6 merges #397 at aa7bd1ce (no conflicts; docs/LAUNCHER_CONTRACT.md and scripts/gateway-healthz-smoke-test.py auto-merged), which carries #394's 13cdcad0 (the contract states that the host lock proves possession, not that the holder is the gateway) and #395's 630efc6d (the default-command smoke test no longer depends on port 8090). The base merges do not change this PR's diff against #397.

Round 4 commits on top of 29733e73:

• f8defe86 test only: the swapped-Runtime test now swaps the real download on macOS too (see "Why the swap test failed on a Mac").
• 112e168f install.sh: the staged Runtime runs from one held file, not by path (item 5 below).

Round 5 commit:

• da63c235 test only: the Linux case of the swapped-Runtime test no longer uses the host's mktemp (see "Round 5: the Linux case assumed GNU mktemp").

What this PR does in scripts/install.sh:

1. Intel Mac stop. detect_platform stops an Intel Mac before any download and exits 1 with exactly Intel Mac is not supported yet. The text lives once, in INTEL_MAC_UNSUPPORTED (install.sh:327); the stop (:357) and --help (:113) print that variable. docs/MAC.md#intel-mac names the variable and quotes it.
2. Rosetta. A Terminal under Rosetta on an Apple silicon Mac reports uname -m x86_64. On Darwin x86_64, mac_has_apple_silicon (install.sh:332) asks the kernel: sysctl -in sysctl.proc_translated or sysctl -in hw.optional.arm64 must print 1. Then the platform is aarch64-darwin. That build is arm64 only (package-release-binaries.sh refuses a universal binary), so macOS runs it natively when the Rosetta shell starts it. Any other answer, a failed sysctl or a missing sysctl proves nothing, so the installer stops with the Intel Mac message before any download (fail closed).
3. Verified head CID. A non-empty HEAD_CID stamp must equal the UnixFS CIDv0 of the verified release-head.json bytes, or the run exits 1. An empty stamp stays empty, so a frozen installer does not cache a head CID (8e3c774f).
4. Use only checked envelope bytes.
   • verify_signature (install.sh:760) reads the envelope once and returns the SHA-256 of the bytes whose signature passed (HEAD_SHA256 :1427, RELEASE_SHA256 :1459).
   • Every later read (bind_verified_head_cid, json_get, validate_release_identity) takes that SHA-256 and stops with RELEASE_CHANGED (:161) for other bytes.
   • sources.json pins MAINTAINER_DID (:1557), the trust root that verify_signature compared with the signer. Before, it read d["signer_did"] from the file again.
   • The writer (update.rs install_release) reads each file once, checks those bytes against the pin, version, channel and any stamp in sources.json, and installs those same bytes. It admits the candidate Runtime only if the bytes it read have the signed SHA-256 (installed_release.rs admit_candidate).
5. Run the staged Runtime from one held file (112e168f). Before, the installer hashed the staged copy by path, then ran it by path three times (--version, install-release --check, install-release). The staged Runtime is the installer's writer, so a process that replaced or rewrote that path between the hash and a run got its own program run as the writer. Now:
   • The copy sits read-only (0500) in a new 0700 folder made by mktemp -d inside the checked install directory (:1518).
   • It is opened once on fd 9 (:1526). held_runtime hash (:408) takes its SHA-256 from that open file and records its identity (device, inode, size, mtime, ctime).
   • Before each run, held_runtime check (:1540, :1622, :1635) refuses with RUNTIME_CHANGED (:159) unless the held file is unchanged, is a regular file of this user with mode 0500 and one link, and the path still names it.
   • Where the kernel can start an open file (Linux, /proc/self/fd/9, :1533), run_held_runtime (:449) starts the held file itself, so a path swapped after the last check cannot run. macOS has no way to start an open file (no fexecve), so there the path runs right after the check. fd 9 is closed after the install (:1638).

Why the swap test failed on a Mac

The round-3 hook swapped a file only when its path was under TMPDIR. Apple's mktemp -d (no template) ignores TMPDIR: in its implied -t mode it uses the per-user folder from confstr(_CS_DARWIN_USER_TEMP_DIR) (apple-oss-distributions/shell_cmds mktemp/mktemp.c, the #ifdef __APPLE__ branch in if (tflag)). GNU mktemp -d uses TMPDIR. So on a Mac nothing was swapped, the install succeeded, and the test failed on returncode. Reproduced on Linux with a mock that behaves like Apple's mktemp -d: the round-3 hook gives exit 0 and the original Runtime installed.

Now the hook swaps the exact path curl wrote (the curl mock logs it), once, and logs the swap (hasher, path, SHA-256 before and after). The test asserts the swap happened before it asserts the refusal, so it cannot pass or fail without a swap. sha256sum and shasum -a 256 are both mocked. TMPDIR is a private 0700 folder the test made.

Round 5: the Linux case assumed GNU mktemp

Review (round 4): "the swapped-Runtime test's Linux subcase assumes GNU mktemp, so it fails on every Mac host (install-bootstrap-test.py:1112)". Confirmed. The Darwin cases mock Apple's mktemp (mock_apple_mktemp), but the Linux case used the host's own mktemp and then required the scratch folder to be under the fixture TMPDIR (:1111-1112). On a Mac host that mktemp is Apple's, which ignores TMPDIR.

da63c235 adds mock_gnu_mktemp (install-bootstrap-test.py:826): mktemp -d with no template makes ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX; every other form goes to the host mktemp unchanged. It uses only a template ending in X, which GNU and BSD mktemp both accept. The Linux case uses it (:1117), so each of the three cases now mocks mktemp and none depends on the host.

Proof without a Mac: a stub mktemp first on PATH that behaves like Apple's (only -d -q -t -u; --tmpdir and -p refused with illegal option; no template and no -t uses a per-user folder, not TMPDIR; a template must end in X).

• Before (9c7ebae6), with the stub: the Linux case fails at the reviewer's line:

  File "scripts/install-bootstrap-test.py", line 1112, in test_runtime_swapped_after_its_checksum_check_is_not_run_or_installed
  AssertionError: PosixPath('/tmp/.../bsdmk/user-temp') != PosixPath('/home/user/wt/rt-398/target/installer-sand...tmp')
  FAILED (failures=1)
  

  The whole file with the stub at 32f4abfd: Ran 98 tests ... FAILED (failures=1, skipped=4), and that one subcase is the only failure, so no other test depends on GNU mktemp.
• After (da63c235): that test OK with the stub and with the host's GNU mktemp; the whole file Ran 98 tests ... OK (skipped=4) both ways.

No real Mac ran this. No CI job runs install-bootstrap-test.py on macOS: it runs only in source-gate (ubuntu-24.04) through scripts/test-source-gate.sh release → release-platform-input-test.py (InstallerAdmissionTest). The macOS jobs (gateway-smoke-macos-intel, source-home-macos) do not run it. So CI on this head proves the Linux path only.

Decision: Intel Mac message

Decision 4: the plain stop Intel Mac is not supported yet., with no pointer to the developer source-home build and no sentence before it. The launcher (Elacity/elastos-launcher) has its own Intel stop text (src/main/targets/runtimeSupport.ts:4-5); this PR does not change the launcher.

Tests

On 112e168f (Linux):

$ python3 scripts/install-bootstrap-test.py
test_held_runtime_refuses_any_change_to_the_held_file_or_its_path ... ok
test_runtime_swapped_after_its_checksum_check_is_not_run_or_installed ... ok
test_staged_runtime_swapped_between_its_hash_and_its_run_is_refused ... ok
test_staged_runtime_swapped_after_its_last_check_still_runs_the_checked_bytes ... ok
test_release_head_swapped_after_its_signature_check_is_refused ... ok
test_publisher_pin_is_the_trust_root_not_a_second_read ... ok
Ran 98 tests in 70.603s
OK (skipped=4)

$ python3 scripts/install-bootstrap-test.py --bash <bash 3.2.57 build>
Ran 98 tests in 68.766s
OK (skipped=4)

$ python3 scripts/gateway-healthz-smoke-test.py
Ran 26 tests in 48.737s
OK (skipped=3)

git diff --check clean. A real elastos ELF (debug build) starts through /proc/self/fd/9 with exec -a and prints its version.

On 32f4abfd (the base merge): install-bootstrap-test.py OK (skipped=4); gateway-healthz-smoke-test.py OK (skipped=3).

On da63c235: install-bootstrap-test.py 98 OK (skipped=4) with the host mktemp and with the Apple-like stub; release-platform-input-test.py 164 OK and release-signer-test.py 87 OK (both under env -i PATH=... HOME=... python3 -I -S; in a shell with TLS proxy variables the signer refuses them, as #397 notes); gateway-healthz-smoke-test.py 26 OK (3 skipped); ci-release-policy-test.py 103 OK; package-release-binaries-test.py 9 OK; git diff --check, public-copy-entropy-check pass.

The tamper tests:

• test_runtime_swapped_after_its_checksum_check_is_not_run_or_installed: the download is rewritten right after its SHA-256 passed. Three cases: Linux with sha256sum and a GNU-like mktemp mock; Darwin (uname mock, arm64) with Apple's mktemp -d layout and TMPDIR behind a symlink (like /tmp → /private/tmp); the same with no sha256sum on PATH, so shasum is used.
• test_staged_runtime_swapped_between_its_hash_and_its_run_is_refused: the staged Runtime is replaced at its path, or rewritten in place with its mode put back, right after held_runtime hash. Linux and Darwin layouts. Refused before anything runs.
• test_staged_runtime_swapped_after_its_last_check_still_runs_the_checked_bytes (Linux only, skipped where /proc/self/fd is missing): the path is replaced after the last check. The checked bytes run, the replacement never runs, and the writer refuses the replaced candidate, as Runtime's writer does.
• test_held_runtime_refuses_any_change_to_the_held_file_or_its_path: path renamed over, removed, made a symlink, file written in place, made writable, given a second link.

Negative checks (the lines reverted, then restored):

• held_runtime check made a no-op: the staged-swap test fails 4 of 4 (AssertionError: True is not false on swapped-ran: the swapped Runtime ran), and the unit test fails 6 of 6 (0 != 12).
• HELD_RUNTIME=/proc/self/fd/9 removed (path exec, as on macOS): the after-the-last-check test fails (True is not false: the swapped Runtime ran). This is the macOS window that remains.
• Round-3 install.sh (29733e73, hash by path then run by path): the staged-swap test fails 4 of 4 (True is not false).
• Round-3 staged re-hash removed (29733e73 install.sh:1469-1471) with the new download-swap test: fails 3 of 3 (True is not false), after the swap assertions passed.
• Earlier rounds (unchanged): the three sys.exit(3) SHA-256 comparisons removed → test_release_head_swapped_after_its_signature_check_is_refused exits 0; pin set back to d["signer_did"] → test_publisher_pin_is_the_trust_root_not_a_second_read fails.

CI

• This PR is stacked on Name the Intel Mac release package darwin-amd64 #397, so its CI tests it merged into Name the Intel Mac release package darwin-amd64 #397's branch, not develop. develop's own Home link test failure (403 vs 200, fixed in develop by bfefe92) did not apply to this PR.
• For 29733e73 (run 39038170012): source-gate, cargo-audit, release-upstream-paths and gateway-smoke-macos-intel passed; the other jobs were still queued when 112e168f was pushed. No job failed. CI runs install-bootstrap-test.py on Linux only (source-gate through release-platform-input-test.py).

Principles check

• Fail closed: an x86_64 Mac without the kernel's 1 stops before any download. A staged Runtime that changed after its check does not run.
• Signed trust chain: every read after a check uses the checked bytes; the pin is the trust root; the program that runs as the writer is the held, hashed file.
• Plain language: the Intel stop is one sentence. The change message says what happened and the next step.

Gaps, not fixed here:

• Another process of the same user can always win: it can rewrite the held file in place after the last check (Linux), swap the path between the last check and exec (macOS), or edit the installed Runtime later. No installer can stop a process with the user's own rights. Other users cannot write the staged file or its 0700 folder.
• The download folder is still mktemp -d (TMPDIR on Linux, the per-user folder on macOS). A swap there is refused, not prevented.
• The install directory's parent folders are not checked (the data directory's are). A parent swapped before a run is refused by the path check; after the last check, Linux still runs the held file and macOS has the window above.
• The maintainer DID can be overridden by env or flag (install.sh:45, :1265-1267). The team decided this in Follow-ups from Sasha's 0.8.0 pre-release review (#375) #434 for 0.8.1; Stamped installer: no environment or flag override of the maintainer DID #435 (stacked on this PR) makes the stamped installer refuse a different DID. Unchanged here.
• Not run on a real Mac. The Darwin cases fake uname, Apple's mktemp -d layout and a PATH without sha256sum on Linux, and the round-5 check used an Apple-like mktemp stub on Linux. The path-exec branch that macOS takes was run on Linux only by forcing it (the second revert check): the staged-swap test passes on it, the after-the-last-check test fails as expected. Not tested on a real Rosetta Terminal or a real Intel Mac. No CI job runs this suite on macOS.

No grade here is a merge approval.

Team issues to open

1. Signed Intel artifact and journey. Title: Signed x86_64-darwin artifact, darwin-amd64 payloads, and Home journey.
2. Adversarial review of the head CID and the check-then-use binding. An independent review on the exact SHA.
3. Maintainer DID override (asked on this PR; decided in Follow-ups from Sasha's 0.8.0 pre-release review (#375) #434, implemented in Stamped installer: no environment or flag override of the maintainer DID #435).
4. Launcher wording. Optional: make the launcher's Intel stop use the same words as docs/MAC.md#intel-mac.
5. Installer tests on macOS CI. Optional: run scripts/install-bootstrap-test.py in a macOS job, so a host-specific assumption like this one is caught by CI.

[SashaMIT]

@andersalm @SashaMIT a team question on the installer trust root (signing keys, so I am not changing it without your answer).

Issue. scripts/install.sh:45 reads MAINTAINER_DID="${ELASTOS_MAINTAINER_DID:-__MAINTAINER_DID__}", and --maintainer-did (install.sh:1213-1215) replaces it too. The env var wins even over the DID the release signer stamps into the published installer. Whoever controls the environment or the command line of the install (a copied "install" command with ELASTOS_MAINTAINER_DID=... bash, a wrapper script, a hostile launcher or shell profile) replaces the trust root. The installer then accepts a release signed by that key and pins it in sources.json as the publisher, so later elastos update runs trust it too.

Who uses the override today. Only repo test and demo paths: scripts/install-bootstrap-test.py (passes --maintainer-did), home-frontdoor-smoke.sh, home-demo-local.sh, local-carrier-chat-smoke.sh, local-identity-profile-smoke.sh (all set ELASTOS_MAINTAINER_DID). update-hop-compare.py already refuses a frozen installer run when the env var is set. A fork with its own key would stamp its own installer through the signer, so it would not need the override.

Options.

• (a) Remove the override. A stamped installer uses only its stamp; an unstamped one (repo checkout) stops. Tests and smokes stamp a copy of the script, as install-bootstrap-test.py already does for the source ticket.
• (b) Allow it only in an unstamped installer (the placeholder is still there), or only with an explicit flag such as --untrusted-maintainer-did, which prints a loud warning and never pins that key in sources.json.
• (c) Keep it as it is.

Recommendation: (a). The published installer has exactly one trust root, and test paths stamp a copy. (b) with "unstamped only" is the fallback if a smoke really needs the env var.

No code changes on this until you answer.

---

Generated by Claude Code

[SashaMIT]

51404a76: Intel stop is now exactly "Intel Mac is not supported yet." (one variable); a Rosetta Terminal on Apple silicon (sysctl.proc_translated/hw.optional.arm64 = 1) installs the aarch64-darwin build, anything else stops before any download.
Every read after a check now must see the checked SHA-256, the pin is MAINTAINER_DID (not re-read from the file), and the staged Runtime is hashed again before it runs.
Proof: install-bootstrap-test.py test_rosetta_shell_*, test_intel_mac_*, test_runtime_swapped_after_its_checksum_check_is_not_run_or_installed, test_release_head_swapped_after_its_signature_check_is_refused, test_publisher_pin_is_the_trust_root_not_a_second_read (all fail on b60b6f0a).

---

Generated by Claude Code

[SashaMIT]

Round 3 review: blocked (C). Removing the maintainer-key override is a team decision.
The macOS swapped-Runtime negative test fails locally; make its temp folder explicit and prove the swap.
Hardening: run the staged installer from one held file, not by path twice.

[andersalm]

Answer to the trust-root question (comment 6233893115): (a), in 0.8.1, tracked in #434. Remove the ELASTOS_MAINTAINER_DID environment and --maintainer-did override from the stamped installer. The out-of-band check stays as documented: compare the installer's printed Maintainer DID: with the DID in the README. 0.8.0 ships the stamped installer unchanged; the signed release.json binds its bytes. Irzhy has the security sign-off on the change itself.

[SashaMIT]

f8defe86: the Mac failure was Apple's mktemp -d ignoring TMPDIR, so the old hook never swapped. The hook now swaps the exact path curl wrote and the test asserts the swap first (Darwin layout, shasum, symlinked TMPDIR cases).
112e168f: the staged Runtime is held open on fd 9, hashed from that fd, checked before each run, and on Linux started from /proc/self/fd/9. Proof: test_staged_runtime_swapped_between_its_hash_and_its_run_is_refused and ..._after_its_last_check_still_runs_the_checked_bytes fail on 29733e73.
The maintainer DID override is unchanged; it is still waiting on the team.

---

Generated by Claude Code

[SashaMIT]

Trust-root decision (#434) is now draft #435, stacked on this PR, for 0.8.1. A stamped installer refuses a different DID from ELASTOS_MAINTAINER_DID or --maintainer-did before any download. The same DID is accepted, because the launcher passes it.
Proof: install-bootstrap-test.py test_rendered_installer_refuses_another_did_from_environment_or_flag_before_any_download runs on the real installer as render_installer renders it, and it fails when the guard is reverted. Needs Irzhy's sign-off.

---

Generated by Claude Code

[SashaMIT]

Round 4 at 32f4abf: B. Held-file exec and verified-byte binding proven; tampers caught.
Fix: the swapped-Runtime test's Linux subcase assumes GNU mktemp, so it fails on every Mac host (install-bootstrap-test.py:1112).

[SashaMIT]

da63c235: the swapped-Runtime test's Linux case now mocks a GNU-like mktemp (mock_gnu_mktemp), so it no longer uses the host's. With an Apple-like mktemp stub on PATH it failed before at install-bootstrap-test.py:1112 and the full suite now gives Ran 98 tests ... OK (skipped=4) with the stub and with GNU mktemp.
Not run on a real Mac: no CI job runs this suite on macOS (only source-gate, Linux).

---

Generated by Claude Code

[SashaMIT]

Round 5 at da63c23: PASS (A); independent review PASS. macOS installer suite passed twice (98 pass, 5 skip); swapped-Runtime tamper fails as intended.