I2165 — A released archive carries a provenance attestation the installer can check
Attest each release archive in the publish job, verify the attestation in install.sh when the tooling is present, and state in docs/DISTRIBUTION.md what each install path verifies.
DONE wave 0 · p1 · implementation profile · parallel safe
Objective
Attest each release archive in the publish job, verify the attestation in install.sh when the tooling is present, and state in docs/DISTRIBUTION.md what each install path verifies.
Why
Artifacts are checksummed, not signed: per-artifact sha256 and size sit in releases/<tag>.json and latest.json and are checked by verify_checksum in site/static/install.sh:478 (called at :706); SHA256SUMS is uploaded to the GitHub release (.github/workflows/release.yml). There is no signature, attestation or Sigstore, and docs/DISTRIBUTION.md:151-153 records that as deferred on purpose. A checksum fetched from the same origin as the archive proves integrity in transit, not provenance. The pack's premise that releases are signed is false, as is its premise that majordomus update is a self-updater: it regenerates provider projections (lib/update.sh:4), and there is no self-update command (docs/DISTRIBUTION.md:416-439). Lowest priority because the deferral is a recorded decision. Baseline audit of 2026-10-09 at master 1fb8d6be44, failure gap 12 and premises 1-2.
Current state
install.sh verifies a checksum served beside the archive; provenance is not verifiable.
Desired state
The publish job attests each archive with GitHub artifact attestations; install.sh verifies the attestation when the gh tool is present and says which it verified, provenance or checksum only; docs/DISTRIBUTION.md states it.
Scope
- .github/workflows/release.yml
- site/static/install.sh
- docs/DISTRIBUTION.md
- test/cases/85_installer.sh
Dependencies
None. This issue is a root of the graph.
What waits on this
Acceptance criteria
- Each archive of a release carries an attestation that gh attestation verify accepts for this repository
- install.sh reports whether it verified provenance or only the checksum
- docs/DISTRIBUTION.md names what each installation path verifies
Validation
- bin/majordomus plan validate
- MJ_TEST_JOBS=4 bash test/run.sh 85_installer
Evidence required
- attested_release
- installer_reports_verification_case
Evidence
| covers | type | command | result | at commit |
|---|---|---|---|---|
| installer_reports_verification_case | test | MJ_TEST_JOBS=2 bash test/run.sh 85_installer | tests: 1 passed, 0 failed, 0 skipped (run 2026-10-14 between 07:40Z and 07:58Z on master ce5959db59) | ce5959d |
| attested_release | ci | release workflow for v0.24.1 concluded success 2026-10-14; each smoke job concluded success; the smoke job verifies the provenance attestation (release.yml, smoke, permissions attestations: read) | ce5959d |
Timeline
- started
- 2026-10-14T08:02:21Z
- verified
- —
- completed
- 2026-10-14T08:02:30Z
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I2165.yaml. Read it back with majordomus plan show I2165.