[SashaMIT]

Refs #434

Stack: this PR -> #398 -> #397 -> #395 -> #394. Base is cursor/intel-install-gate-1297 (#398 head da63c235). Head: 4f501ef0, which merges #398 at da63c235 (no conflicts; scripts/install-bootstrap-test.py auto-merged). It brings #398's da63c235: the swapped-Runtime test's Linux case mocks a GNU-like mktemp instead of using the host's (see "Mac hosts" below), and, through #397 and #395, #394's 13cdcad0 (the launcher contract states that the host lock proves possession, not that the holder is the gateway) and #395's 630efc6d (the default-command smoke test no longer depends on port 8090). The earlier merge a143e145 brought #398 at 32f4abfd with #394's 4bb19dcf (one-step lock proof 85f3142e; the subordinate lane and ELASTOS_GATEWAY_HOST_LOCK_FD eed83a72; a held lock with an unreadable record counts as held 4bb19dcf). The merges do not change this PR's diff against #398.

For 0.8.1. 0.8.0 ships the stamped installer unchanged.
Needs Irzhy's security sign-off.

Decision (Anders on #398):

Answer to the trust-root question (comment 6233893115): (a), in 0.8.1, tracked in #434. Remove the ELASTOS_MAINTAINER_DID environment and --maintainer-did override from the stamped installer. The out-of-band check stays as documented: compare the installer's printed Maintainer DID: with the DID in the README. 0.8.0 ships the stamped installer unchanged; the signed release.json binds its bytes. Irzhy has the security sign-off on the change itself.

Decision (Sasha, round 5): keep accepting the same built-in DID; refuse any different one; no launcher change. Checked against the code on 4f501ef0, no code change was needed:

• Same DID accepted: install.sh:180 lets an empty request or one equal to the stamp through, and install.sh:182 always sets MAINTAINER_DID="$stamp", so the requested value never becomes the trust root. Test: test_rendered_installer_accepts_a_request_for_its_own_did (the same DID from the environment, the flag, or both; the run reaches the artifact request and prints Maintainer DID: <stamp>).
• Any different DID refused: install.sh:180 stops with MAINTAINER_DID_BUILT_IN (install.sh:166) before any download; the check runs at install.sh:1306, right after argument parsing. Test: test_rendered_installer_refuses_another_did_from_environment_or_flag_before_any_download (9 cases: a different DID from the environment, from the flag, or from either while the other has the same DID; the placeholder as environment or flag; MAINTAINER_DID_STAMP set in the environment; control text; --uninstall; each exits 1 with no request and HOME unchanged).
• No launcher change: the launcher passes --maintainer-did <pinned DID> to the pinned stamped installer (elastos-launcher src/main/targets/runtimeInstall.ts:314), which is the same DID, so the first case covers it.

What changed

a24df995 fix: a stamped installer keeps its built-in maintainer DID

• scripts/install.sh:49 MAINTAINER_DID_STAMP="__MAINTAINER_DID__" replaces MAINTAINER_DID="${ELASTOS_MAINTAINER_DID:-__MAINTAINER_DID__}". The stamp line reads no environment.
• scripts/install.sh:173-183 select_maintainer_did STAMP ENV FLAG. It decides "stamped" only from the baked value: it compares it with the split placeholder "__MAINTAINER""_DID__", which render_installer (scripts/release-signer.py:790-801) does not replace. A user can not set the stamp. In a stamped installer, a different DID from the environment or the flag stops the run with MAINTAINER_DID_BUILT_IN (install.sh:166). That message says the DID is built in, that nothing was downloaded or changed, what to remove, and to compare the Maintainer DID: line with the README. The unstamped template still uses the flag, then the environment. The repo smokes (home-demo-local.sh, home-frontdoor-smoke.sh, local-carrier-chat-smoke.sh, local-identity-profile-smoke.sh) and the tests use that template.
• install.sh:1291 the flag now only records the request. install.sh:1306 calls the check right after argument parsing. That is before --uninstall, platform detection and any download.
• Same DID is accepted, and nothing changes. This is now Sasha's decision (above). An equal value never becomes the trust root: MAINTAINER_DID is always the stamp (install.sh:182).
• --help (install.sh:123-126) and the header (install.sh:10-18) now say that only the repository copy accepts the flag and the environment.
• scripts/update-hop-compare.py:643-652 cli_installer_metadata now reads the new stamp line. It still reads the environment-default line of older frozen installers (such as 0.8.0), and it still requires exactly one match.
• Tests: see below.

75b09d4c docs: README.md "Install from the publisher" says the published installer has the DID built in and refuses a different one before any download, so comparing the Maintainer DID: line is the check. docs/INSTALL.md "Compare and change the release signer" points to the README and does not copy it. The pinned DID and the release keys are unchanged.

Tests

The new tests render the real scripts/install.sh with release-signer.py's render_installer and a test DID (install-bootstrap-test.py:95 rendered_installer, :713 use_rendered_installer):

• test_rendered_installer_installs_with_its_built_in_did_and_no_trust_flags: full --install-only with no trust flags. sources.json pins the stamped DID.
• test_rendered_installer_refuses_another_did_from_environment_or_flag_before_any_download: 9 cases. A different DID from the environment, from the flag, or from either one while the other has the same DID. The placeholder string given as the environment value or as the flag. MAINTAINER_DID_STAMP=<placeholder> set in the environment. Control text. --uninstall. Each case exits 1 with no request, no download, HOME byte-identical, no Runtime call, and no Maintainer DID: line. The other DID is never echoed.
• test_rendered_installer_accepts_a_request_for_its_own_did: the same DID from the environment, the flag, or both.
• test_unstamped_template_takes_its_did_from_the_flag_then_the_environment: the template still accepts both, the flag comes first, and with neither it gives the "not set" refusal.
• release-signer-test.py test_rendered_public_installer_keeps_the_did_stamp_free_of_the_environment: in the rendered installer the DID appears once, on the stamp line. The split placeholder survives. There is no ELASTOS_MAINTAINER_DID:-did:key default.
• update-hop-compare-test.py test_stamped_real_installer_defaults_are_read_without_execution: now also checks the legacy frozen installer form.

Negative: I replaced install.sh:179-182, the stamped branch of select_maintainer_did, with the old override MAINTAINER_DID="${from_flag:-${from_env:-$stamp}}". All 9 refusal subtests fail. For example, Lists differ: ['https://test.invalid/release-head.json'] != [], and a full install ran with the flag-supplied DID. The whole install.sh from 112e168f fails the same 9. With the fix, all pass.

Run locally (env -i PATH=/usr/local/bin:/usr/bin:/bin HOME=$HOME python3 -I -S): install-bootstrap-test 102 OK (4 skipped), release-platform-input-test 164 OK, release-signer-test 88 OK, gateway-healthz-smoke-test 26 OK (3 skipped), git diff --check, public-copy-entropy-check. update-hop-compare-test: 126 OK and 1 error, test_localhost_metadata_archive_refuses_traversal_links_modes_and_incomplete_entries (fileobj not provided, local Python 3.13 tarfile). The same error happens on 112e168f without this change.

On a143e145: install-bootstrap-test OK (4 skipped), release-signer-test OK.

On 4f501ef0: install-bootstrap-test Ran 102 tests ... OK (skipped=4) with the host's GNU mktemp and with an Apple-like mktemp stub first on PATH; the four DID tests above pass; release-platform-input-test 164 OK and release-signer-test 88 OK (clean env -i ... python3 -I -S); update-hop-compare-test 127 run, the same one fileobj not provided error as before; git diff --check clean.

Mac hosts (round 4 review: the swapped-Runtime test's Linux case assumes GNU mktemp)

On this branch the same test is at install-bootstrap-test.py:1213 (before the merge). It is one test, shared with #398, not a separate copy; the merge of #398's da63c235 fixed it here. Proof without a Mac, with an Apple-like mktemp stub first on PATH (no long options or -p; no template and no -t uses a per-user folder, not TMPDIR): the test file of a143e145 fails File "scripts/install-bootstrap-test.py", line 1213 ... AssertionError: PosixPath('.../user-temp') != PosixPath('.../installer-sand...tmp'); on 4f501ef0 it passes, and the whole file is OK (skipped=4). No real Mac ran it, and no CI job runs install-bootstrap-test.py on macOS (it runs only in source-gate on ubuntu-24.04, through release-platform-input-test.py).

CI

• This PR is stacked on Stop Intel Mac before release lookup and pin the verified head CID #398, so its CI tests it merged into Stop Intel Mac before release lookup and pin the verified head CID #398's branch, not develop. develop's own Home link test failure (403 vs 200, fixed in develop by bfefe92) did not apply to this PR.
• Run 39092040385 (on 4f501ef0): attempt 1 failed source-home-linux (ubuntu-24.04) at installed Marketplace Get and Assistant reply (Installed journeys in source-home-linux (ubuntu-24.04) fail intermittently, on develop too #433). Attempt 2 was a failed-jobs re-run, more than a day later, that failed at download pinned AMD64 engine input with Artifact not found for name: llama-amd64-bundle. The bundle is uploaded with retention-days: 1 and that job was not re-run, so the journeys never ran (installed journey acceptance is incomplete). This was not a code failure. The branch is current with Stop Intel Mac before release lookup and pin the verified head CID #398, so a merge would not change it; it needs "Re-run all jobs".

Gaps

• Other stamps can still be replaced from the environment in a stamped installer: ELASTOS_PUBLISHER_GATEWAY, ELASTOS_SOURCE_CONNECT_TICKET / ELASTOS_PUBLISHER_NODE_ID (as a complete pair), ELASTOS_IPNS_NAME, ELASTOS_HEAD_CID. The DID signature stays the trust root. Whether those overrides should also go is not in Follow-ups from Sasha's 0.8.0 pre-release review (#375) #434's decision.
• The out-of-band check is still a person comparing a printed line with the README. That is as decided.
• Docs describe this tree. Until the 0.8.1 installer is published, the live installer still accepts the override.
• No real Mac run. The change is plain bash with no platform branch.

---

Generated by Claude Code

[SashaMIT]

CI on a143e14: source-home-linux (ubuntu-24.04) failed in the model-repair journey (run 39049411613, job 117479780091) with stage=model_stop_get_different code=assertion_failed check=stop_real_stream. This PR changes only scripts/install.sh's maintainer-DID selection, its tests and its docs. The journey installs from source and never uses the stamped-installer path. The failure is the same x86 ubuntu-24.04 installed-journey problem tracked in #433. No fix exists yet. I can't re-run it from here (403), so it needs one re-run.

---

Generated by Claude Code

[SashaMIT]

Round 4 at a143e14: B. Stamped DID guard proven: a different DID stops before download; 9 negatives fail without it.
Inherits the #398 macOS test fix. Red job is #433.
Decision (Sash): keep accepting the same built-in DID; refuse any different one.

[SashaMIT]

CI on 4f501ef (run 39092040385): only source-home-linux (ubuntu-24.04) failed (job 117599986422, "finite installed UI journey failed"). That is the #433 x86 finite-journey failure develop 9be009b also had. This PR changes only the installer's DID check. #395 ac97a4a, with the same #394 code, passed this job. Every other real job passed. No fix exists yet, and I can't re-run (403).

---

Generated by Claude Code

[SashaMIT]

Round 5 at 4f501ef: PASS (A); independent review PASS. macOS installer suite passed twice (102 pass, 5 skip); only an empty or the same DID is accepted.

[SashaMIT]

Run 39092040385 attempt 2 (job 117938053446) failed before any journey ran. download pinned AMD64 engine input reports Artifact not found for name: llama-amd64-bundle: engine-llama-amd64 uploaded it on 18 Oct at 05:51 with retention-days: 1, and a "re-run failed jobs" on 19 Oct at 07:21 reuses that job without rebuilding the bundle. "acceptance is incomplete" follows from that. Attempt 1 failed differently (#433, installed Marketplace Get and Assistant reply).
This is not a code failure. The branch is current with #398 (da63c23), so a develop merge would not change it. It needs Re-run all jobs; re-running only the failed jobs will hit the expired artifact again.

---

Generated by Claude Code