diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a1e6204..fa415e5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -233,15 +233,12 @@ jobs: signer-image: needs: validate - if: startsWith(github.ref, 'refs/tags/v') + if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' name: signer image matches its recorded hashes - runs-on: ubuntu-24.04 + runs-on: ubuntu-24.04-arm + timeout-minutes: 180 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Allow the arm64 canonical image to run here - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - with: - platforms: arm64 - name: Fetch the crate sources named by Cargo.lock working-directory: signing-core run: cargo fetch --locked diff --git a/CHANGELOG.md b/CHANGELOG.md index d476f35..b962522 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,13 @@ Security fixes say what an affected version does wrong, not just that something was fixed. A release note that says "various improvements" is a release note that keeps people on a broken version. +## v0.1.6 — 2026-10-26 + +- Carries forward the v0.1.5 evaluation candidate, which was not published + after its emulated ARM signer-image check reached GitHub's six-hour limit. +- Runs the unchanged two-build signer-image reproducibility gate on a native + ARM64 runner and exercises that gate during manual branch rehearsals. + ## v0.1.5 — 2026-10-26 ### Added diff --git a/README.md b/README.md index bb6f2a4..7c13042 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ choosing a version. The desktop reviewer does not need keys and does not sign transactions. It is a second opinion, not a trusted display: a compromised computer can alter what you see. Compare the recomputed hash with the signing device and follow your existing approval procedure. A successful decode is not a safety assessment of the destination contract. -The dedicated signer and seL4 platform are experimental and have been tested in emulation, not on production hardware. The v0.1.5 release is configured as an unsigned evaluation prerelease. A tag fails unless the repository explicitly selects either a signed stable release or an unsigned evaluation prerelease; signed mode requires macOS and Windows signing checks to pass. The [release-signing record](docs/15-release-signing.md) names the modes, credentials and platform guarantees. The [verification record](docs/03-verification-status.md) distinguishes the reported human review from later AI-assisted checks and records the outstanding review and hardware work. +The dedicated signer and seL4 platform are experimental and have been tested in emulation, not on production hardware. The v0.1.6 release is configured as an unsigned evaluation prerelease. A tag fails unless the repository explicitly selects either a signed stable release or an unsigned evaluation prerelease; signed mode requires macOS and Windows signing checks to pass. The [release-signing record](docs/15-release-signing.md) names the modes, credentials and platform guarantees. The [verification record](docs/03-verification-status.md) distinguishes the reported human review from later AI-assisted checks and records the outstanding review and hardware work. The repository also contains an iOS and Android client backed by the same Rust review API. It is source for an evaluation build, not a published App Store or Play Store release; clean native CI and device testing remain release gates. diff --git a/desktop/README.md b/desktop/README.md index afb9e53..6f10f62 100644 --- a/desktop/README.md +++ b/desktop/README.md @@ -37,7 +37,7 @@ signs. ## Signing and notarisation -The v0.1.5 application is not publisher-signed or notarized, so macOS and +The v0.1.6 application is not publisher-signed or notarized, so macOS and Windows warn that it comes from an unidentified developer. The macOS linker may add an identity-free ad-hoc signature; that is not a Developer ID signature. Until a signed release replaces it, the honest check is the hash of what you diff --git a/desktop/package-lock.json b/desktop/package-lock.json index c3640f0..c5c6c93 100644 --- a/desktop/package-lock.json +++ b/desktop/package-lock.json @@ -1,12 +1,12 @@ { "name": "clearsign-desktop", - "version": "0.1.5", + "version": "0.1.6", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "clearsign-desktop", - "version": "0.1.5", + "version": "0.1.6", "devDependencies": { "@tauri-apps/cli": "^2" } diff --git a/desktop/package.json b/desktop/package.json index ec14dfa..642d2c6 100644 --- a/desktop/package.json +++ b/desktop/package.json @@ -1,7 +1,7 @@ { "name": "clearsign-desktop", "private": true, - "version": "0.1.5", + "version": "0.1.6", "description": "ClearSign — see what a transaction really does before you approve it.", "scripts": { "dev": "tauri dev", diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index b813275..a7738ef 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -344,7 +344,7 @@ dependencies = [ [[package]] name = "clearsign" -version = "0.1.5" +version = "0.1.6" dependencies = [ "crypto-bigint", "k256", @@ -353,7 +353,7 @@ dependencies = [ [[package]] name = "clearsign-api" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign", "clearsign-safe-json", @@ -363,7 +363,7 @@ dependencies = [ [[package]] name = "clearsign-desktop" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign-api", "serde", @@ -374,7 +374,7 @@ dependencies = [ [[package]] name = "clearsign-safe-json" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign", "serde", diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index e572020..33a66b0 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "clearsign-desktop" description = "ClearSign — see what a transaction really does before you approve it." -version = "0.1.5" +version = "0.1.6" edition = "2024" rust-version = "1.87" license = "MIT OR Apache-2.0" diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json index fa4cc70..5554b50 100644 --- a/desktop/src-tauri/tauri.conf.json +++ b/desktop/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "ClearSign", - "version": "0.1.5", + "version": "0.1.6", "identifier": "com.anticsdecoded.clearsign", "build": { "frontendDist": "../src" diff --git a/docs/07-timeline.md b/docs/07-timeline.md index 4f14302..f5ed9fa 100644 --- a/docs/07-timeline.md +++ b/docs/07-timeline.md @@ -16,7 +16,7 @@ from what comparable projects actually took, not from optimism. |---|---| | The reviewer | Works. 314 tests, nine fuzz targets, reproducible builds, one external audit with all ten findings fixed | | The command-line tool | Works. Reads Safe's own JSON, catches the Bybit transaction, and agreed with Safe's service and alloy on 10,851 of 10,851 sampled Safe transaction hashes across 27 chains | -| The desktop application | Builds, installs and runs on macOS, Windows and Linux in CI. v0.1.5 is configured as an unsigned evaluation prerelease; stable signing credentials are not provisioned | +| The desktop application | Builds, installs and runs on macOS, Windows and Linux in CI. v0.1.6 is configured as an unsigned evaluation prerelease; stable signing credentials are not provisioned | | The compartment prototype | Runs on seL4 in an emulator: untrusted Linux, no shell, signer owns the console | | Users | **None.** This is the number that matters | diff --git a/docs/15-release-signing.md b/docs/15-release-signing.md index 4d6f939..10ec6f5 100644 --- a/docs/15-release-signing.md +++ b/docs/15-release-signing.md @@ -4,7 +4,7 @@ This document describes the repository's release controls. It does not claim that already-published downloads were retroactively signed. ClearSign v0.1.2 is unsigned. The protected v0.1.3 tag produced no release because its macOS evaluation gate rejected an identity-free ad-hoc linker signature. v0.1.4 was -published as an unsigned evaluation release, and v0.1.5 is configured the same +published as an unsigned evaluation release, and v0.1.6 is configured the same way. Every future release tag requires an explicit mode; an unset or unknown mode fails before packaging begins. diff --git a/mobile/app.json b/mobile/app.json index 471ebca..de3315f 100644 --- a/mobile/app.json +++ b/mobile/app.json @@ -2,7 +2,7 @@ "expo": { "name": "ClearSign", "slug": "clearsign", - "version": "0.1.5", + "version": "0.1.6", "scheme": "clearsign", "icon": "./assets/icon.png", "userInterfaceStyle": "automatic", diff --git a/mobile/package-lock.json b/mobile/package-lock.json index 6d4d161..ff76d44 100644 --- a/mobile/package-lock.json +++ b/mobile/package-lock.json @@ -1,12 +1,12 @@ { "name": "clearsign-mobile", - "version": "0.1.5", + "version": "0.1.6", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "clearsign-mobile", - "version": "0.1.5", + "version": "0.1.6", "dependencies": { "@expo/vector-icons": "^15.0.2", "expo": "~58.0.19", diff --git a/mobile/package.json b/mobile/package.json index bd16bf1..259ec63 100644 --- a/mobile/package.json +++ b/mobile/package.json @@ -1,6 +1,6 @@ { "name": "clearsign-mobile", - "version": "0.1.5", + "version": "0.1.6", "main": "expo-router/entry", "dependencies": { "@expo/vector-icons": "^15.0.2", diff --git a/mobile/src/app/scope.tsx b/mobile/src/app/scope.tsx index 2c7432f..3c2e34c 100644 --- a/mobile/src/app/scope.tsx +++ b/mobile/src/app/scope.tsx @@ -49,7 +49,7 @@ export default function ScopeScreen() { ))} - Mobile evaluation build 0.1.5 · Review API v1 + Mobile evaluation build 0.1.6 · Review API v1 diff --git a/platform/signer-image/EXPECTED-HASHES.txt b/platform/signer-image/EXPECTED-HASHES.txt index ccb3915..2294a2e 100644 --- a/platform/signer-image/EXPECTED-HASHES.txt +++ b/platform/signer-image/EXPECTED-HASHES.txt @@ -7,4 +7,4 @@ # binary recorded in signing-core/EXPECTED-HASHES.txt, and the build refuses to # package any other. 2aa6a4b8a0bedd695c4d331f7c824c96433290598869ec9a91720dd065c11a13 Image -f336e6b17063e5bcc6bae752d25ec09454594cc78db8aa0a6b4ca89077ac9b1f initramfs.cpio.gz +2318f9e70a113b06c03e0c6b96578b6e4d8208ffc00ead718acee4e0142212d0 initramfs.cpio.gz diff --git a/platform/signer-image/build.sh b/platform/signer-image/build.sh index 8ad060b..26516f7 100755 --- a/platform/signer-image/build.sh +++ b/platform/signer-image/build.sh @@ -55,8 +55,8 @@ cat > "$SRC/build-signer-image.sh" <<'IN' #!/usr/bin/env bash set -euo pipefail export DEBIAN_FRONTEND=noninteractive -apt-get update -qq >/dev/null -apt-get install -y -qq --no-install-recommends build-essential bc bison flex libssl-dev \ +apt-get -o Acquire::Retries=5 update -qq >/dev/null +apt-get -o Acquire::Retries=5 install -y -qq --no-install-recommends build-essential bc bison flex libssl-dev \ libelf-dev xz-utils cpio python3 binutils >/dev/null KV="$1" export KBUILD_BUILD_TIMESTAMP="1970-01-01" KBUILD_BUILD_USER="builder" KBUILD_BUILD_HOST="osproject" diff --git a/signing-core/Cargo.lock b/signing-core/Cargo.lock index c8e3ce0..2553c1a 100644 --- a/signing-core/Cargo.lock +++ b/signing-core/Cargo.lock @@ -572,14 +572,14 @@ checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56" [[package]] name = "authority" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign", ] [[package]] name = "authority-agent" -version = "0.1.5" +version = "0.1.6" dependencies = [ "authority", "clearsign", @@ -876,7 +876,7 @@ dependencies = [ [[package]] name = "clearsign" -version = "0.1.5" +version = "0.1.6" dependencies = [ "crypto-bigint 0.7.7", "k256 0.14.0", @@ -885,7 +885,7 @@ dependencies = [ [[package]] name = "clearsign-api" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign", "clearsign-safe-json", @@ -895,7 +895,7 @@ dependencies = [ [[package]] name = "clearsign-cli" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign", "clearsign-keys", @@ -908,7 +908,7 @@ dependencies = [ [[package]] name = "clearsign-device" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign", "clearsign-keys", @@ -919,7 +919,7 @@ dependencies = [ [[package]] name = "clearsign-difftest" -version = "0.1.5" +version = "0.1.6" dependencies = [ "alloy-consensus", "alloy-dyn-abi", @@ -935,7 +935,7 @@ dependencies = [ [[package]] name = "clearsign-ffi" -version = "0.1.5" +version = "0.1.6" dependencies = [ "authority", "clearsign", @@ -943,7 +943,7 @@ dependencies = [ [[package]] name = "clearsign-keys" -version = "0.1.5" +version = "0.1.6" dependencies = [ "bip32", "bip39", @@ -956,7 +956,7 @@ dependencies = [ [[package]] name = "clearsign-native" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign-api", "jni", @@ -965,7 +965,7 @@ dependencies = [ [[package]] name = "clearsign-qr" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign", "sha2 0.10.9", @@ -973,7 +973,7 @@ dependencies = [ [[package]] name = "clearsign-safe-json" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign", "serde", @@ -982,7 +982,7 @@ dependencies = [ [[package]] name = "clearsign-wasm" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign-api", "serde_json", diff --git a/signing-core/Cargo.toml b/signing-core/Cargo.toml index 2fffbad..4a0309e 100644 --- a/signing-core/Cargo.toml +++ b/signing-core/Cargo.toml @@ -17,7 +17,7 @@ members = [ ] [workspace.package] -version = "0.1.5" +version = "0.1.6" edition = "2024" rust-version = "1.87" license = "MIT OR Apache-2.0" diff --git a/signing-core/EXPECTED-HASHES.txt b/signing-core/EXPECTED-HASHES.txt index 6dd4c7f..da59106 100644 --- a/signing-core/EXPECTED-HASHES.txt +++ b/signing-core/EXPECTED-HASHES.txt @@ -7,5 +7,5 @@ # reproducible in practice rather than sealed. # Anything built elsewhere, including on the maintainer's own machine, may # differ: rustc does not promise identical output across compiler hosts. -6565e34e1863dd284ed70b96ded1ab1423532c3c74fd8771f83717b8da58b7b7 clearsign -20737e7b6d07879212a019f39f39238c6d9d139ba624ca1c3e2ce7bd095781af clearsign-device +8e0f7727b90f45ddf82fbcf5c04f80706a18e7c4949966123a7404525bcd5bdb clearsign +9f00f56f9e67fa27733c71493b9525fcfa33ffe438608cc4a024bf9c2a08d124 clearsign-device diff --git a/signing-core/bench/Cargo.lock b/signing-core/bench/Cargo.lock index c246676..c924844 100644 --- a/signing-core/bench/Cargo.lock +++ b/signing-core/bench/Cargo.lock @@ -865,7 +865,7 @@ dependencies = [ [[package]] name = "clearsign" -version = "0.1.5" +version = "0.1.6" dependencies = [ "crypto-bigint 0.7.8", "k256 0.14.0", @@ -890,7 +890,7 @@ dependencies = [ [[package]] name = "clearsign-safe-json" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign", "serde", diff --git a/signing-core/fuzz/Cargo.lock b/signing-core/fuzz/Cargo.lock index 0bc7ccc..c4dc4fd 100644 --- a/signing-core/fuzz/Cargo.lock +++ b/signing-core/fuzz/Cargo.lock @@ -10,7 +10,7 @@ checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed" [[package]] name = "authority" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign", ] @@ -65,7 +65,7 @@ checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600" [[package]] name = "clearsign" -version = "0.1.5" +version = "0.1.6" dependencies = [ "crypto-bigint", "k256", @@ -85,7 +85,7 @@ dependencies = [ [[package]] name = "clearsign-qr" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign", "sha2 0.10.9", @@ -93,7 +93,7 @@ dependencies = [ [[package]] name = "clearsign-safe-json" -version = "0.1.5" +version = "0.1.6" dependencies = [ "clearsign", "serde", diff --git a/signing-core/scripts/in-canonical-container.sh b/signing-core/scripts/in-canonical-container.sh index a2d6b77..1f9eafd 100755 --- a/signing-core/scripts/in-canonical-container.sh +++ b/signing-core/scripts/in-canonical-container.sh @@ -9,14 +9,18 @@ # obvious next step and is not done yet. set -euo pipefail export DEBIAN_FRONTEND=noninteractive -apt-get update -qq >/dev/null 2>&1 -apt-get install -y -qq --no-install-recommends curl ca-certificates gcc libc6-dev locales >/dev/null 2>&1 +apt-get -o Acquire::Retries=5 update -qq >/dev/null 2>&1 +apt-get -o Acquire::Retries=5 install -y -qq --no-install-recommends curl ca-certificates gcc libc6-dev locales >/dev/null 2>&1 TOOLCHAIN="$1"; TARGET="$2"; shift 2 export TZ="${BUILD_TZ:-UTC}" LANG="${BUILD_LOCALE:-C.UTF-8}" LC_ALL="${BUILD_LOCALE:-C.UTF-8}" umask "${BUILD_UMASK:-022}" export RUSTUP_HOME=/opt/rustup CARGO_HOME=/opt/cargo -curl -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --profile minimal \ +RUSTUP_INSTALLER="$(mktemp)" +trap 'rm -f "$RUSTUP_INSTALLER"' EXIT +curl -sSfL --retry 5 --retry-all-errors --retry-delay 2 \ + --connect-timeout 20 --max-time 300 https://sh.rustup.rs -o "$RUSTUP_INSTALLER" +sh "$RUSTUP_INSTALLER" -y --no-modify-path --profile minimal \ --default-toolchain "$TOOLCHAIN" --target "$TARGET" >/dev/null export PATH="/opt/cargo/bin:$PATH"