commit 0bd65c26d9b8dfc87fb9969ceae5efdc5e7b3922
parent f130c58e5121f3834c72ffe33510c8401dc538ed
Author: Ryan Sepassi <rsepassi@gmail.com>
Date: Thu, 16 Jul 2026 11:02:40 -0700
dist: reject copied nonrelease key material
Diffstat:
6 files changed, 63 insertions(+), 14 deletions(-)
diff --git a/doc/RELEASE_AUDIT_2026_6_0.md b/doc/RELEASE_AUDIT_2026_6_0.md
@@ -488,8 +488,8 @@ Implementation checkpoint (updated 2026-07-16):
| KIT-P0-002 | **Complete** | `test-driver-native-macos-sdk`: 35 pass, 0 fail across aarch64/x86-64 compile and execution plus cc/check/cpp/build-*; precedence/ld/no-xcrun cases pass |
| KIT-P1-013 | **Complete** | POSIX move fails before repair and compiles/runs after `install --force`; Windows hardlink move/repair VM: rc 0 |
| KIT-P1-011 | **Complete** | `test-driver-pkg`: 194 pass, 0 fail |
-| KIT-P2-007 | **Complete** | `test-selfdist`: 101 pass, 0 fail; release/dist configuration and test-anchor gates pass |
-| KIT-P1-012 | **Complete** | authenticated updater result cases included in `test-selfdist`: 101 pass, 0 fail |
+| KIT-P2-007 | **Complete** | `test-selfdist`: 105 pass, 0 fail; release/dist gates reject the test key by Minisign material even after copy/comment changes |
+| KIT-P1-012 | **Complete** | authenticated updater result cases included in `test-selfdist`: 105 pass, 0 fail |
| KIT-P1-001 | **Complete** | `target_test`: 177 checks, 0 failures; `test-driver-targets`: 61 pass, 0 fail |
| KIT-P0-004 | **Complete** | public ELF/Mach-O/COFF input matrix: 60 checks, 0 failures; driver authority/inference/archive suite: 15 pass, 0 fail |
| KIT-P1-002 | **Complete** | NDK r27d NativeActivity preprocess/compile/shared-link at API 21 and 35: 3 pass, 0 fail |
diff --git a/mk/dist.mk b/mk/dist.mk
@@ -18,8 +18,10 @@ ifeq ($(strip $(KIT_SIGN_KEY)),)
$(error dist requires KIT_SIGN_KEY (production Minisign secret key file))
endif
ifneq ($(KIT_RELEASE_ALLOW_TEST_KEY),1)
-ifeq ($(realpath $(KIT_SIGN_KEY)),$(realpath test/dist/keys/nonrelease.key))
-$(error dist refuses the in-tree NON-RELEASE test signing key)
+DIST_TEST_KEY_MATERIAL := $(strip $(shell sh scripts/minisign_key_material.sh test/dist/keys/nonrelease.key 2>/dev/null))
+DIST_SIGN_KEY_MATERIAL := $(strip $(shell sh scripts/minisign_key_material.sh "$(KIT_SIGN_KEY)" 2>/dev/null))
+ifeq ($(DIST_SIGN_KEY_MATERIAL),$(DIST_TEST_KEY_MATERIAL))
+$(error dist refuses the repository NON-RELEASE test signing key)
endif
endif
endif
diff --git a/mk/flags.mk b/mk/flags.mk
@@ -164,7 +164,8 @@ ifeq ($(strip $(KIT_RELEASE_PUBKEYS)),)
$(error RELEASE=1 requires KIT_RELEASE_PUBKEYS (production Minisign public key file(s)))
endif
ifneq ($(KIT_RELEASE_ALLOW_TEST_KEY),1)
-KIT_RELEASE_TEST_ANCHOR := $(strip $(shell grep -l 'c1709dd2922282f6' $(KIT_RELEASE_PUBKEYS) 2>/dev/null))
+KIT_RELEASE_TEST_KEY_MATERIAL := $(strip $(shell sh scripts/minisign_key_material.sh test/dist/keys/nonrelease.pub 2>/dev/null))
+KIT_RELEASE_TEST_ANCHOR := $(strip $(foreach key,$(KIT_RELEASE_PUBKEYS),$(if $(filter $(KIT_RELEASE_TEST_KEY_MATERIAL),$(strip $(shell sh scripts/minisign_key_material.sh "$(key)" 2>/dev/null))),$(key))))
ifneq ($(KIT_RELEASE_TEST_ANCHOR),)
$(error RELEASE=1 refuses repository NON-RELEASE test anchor: $(KIT_RELEASE_TEST_ANCHOR))
endif
diff --git a/scripts/minisign_key_material.sh b/scripts/minisign_key_material.sh
@@ -0,0 +1,22 @@
+#!/bin/sh
+# Print the first Minisign key-material record, ignoring the mutable untrusted
+# comment. Works for both public and passwordless secret-key files.
+
+set -eu
+
+[ "$#" -eq 1 ] || {
+ printf 'usage: minisign_key_material.sh KEY\n' >&2
+ exit 2
+}
+
+LC_ALL=C awk '
+ /^untrusted comment:/ { next }
+ /^[[:space:]]*$/ { next }
+ {
+ gsub(/[[:space:]]/, "")
+ print
+ found = 1
+ exit
+ }
+ END { if (!found) exit 1 }
+' "$1"
diff --git a/scripts/release.sh b/scripts/release.sh
@@ -71,12 +71,6 @@ HOSTED="$ROOT/scripts/hosted.sh"
die() { printf 'release: %s\n' "$*" >&2; exit 1; }
log() { printf 'release: %s\n' "$*" >&2; }
-canon_path() {
- local dir base
- dir="$(dirname "$1")"
- base="$(basename "$1")"
- (cd "$dir" 2>/dev/null && printf '%s/%s\n' "$(pwd -P)" "$base")
-}
# ---- preconditions ---------------------------------------------------------
# A real signing key is mandatory; releasing with the test key is never valid.
@@ -92,9 +86,18 @@ done
[ -n "${KIT_UPDATE_INDEX_URL:-}" ] || die \
"KIT_UPDATE_INDEX_URL is unset — provide the production stable channel URL"
TEST_SIGN_KEY="$ROOT/test/dist/keys/nonrelease.key"
-if [ "${KIT_RELEASE_ALLOW_TEST_KEY:-0}" != 1 ] &&
- [ "$(canon_path "$KIT_SIGN_KEY")" = "$(canon_path "$TEST_SIGN_KEY")" ]; then
- die "KIT_SIGN_KEY points at the in-tree NON-RELEASE test key; set KIT_SIGN_KEY to the real release key"
+TEST_PUBKEY="$ROOT/test/dist/keys/nonrelease.pub"
+TEST_SIGN_MATERIAL="$(sh "$ROOT/scripts/minisign_key_material.sh" "$TEST_SIGN_KEY")"
+TEST_PUB_MATERIAL="$(sh "$ROOT/scripts/minisign_key_material.sh" "$TEST_PUBKEY")"
+if [ "${KIT_RELEASE_ALLOW_TEST_KEY:-0}" != 1 ]; then
+ [ "$(sh "$ROOT/scripts/minisign_key_material.sh" "$KIT_SIGN_KEY")" != \
+ "$TEST_SIGN_MATERIAL" ] ||
+ die "KIT_SIGN_KEY contains the repository NON-RELEASE test key; set KIT_SIGN_KEY to the real release key"
+ for release_pubkey in $KIT_RELEASE_PUBKEYS; do
+ [ "$(sh "$ROOT/scripts/minisign_key_material.sh" "$release_pubkey")" != \
+ "$TEST_PUB_MATERIAL" ] ||
+ die "KIT_RELEASE_PUBKEYS contains the repository NON-RELEASE test anchor: $release_pubkey"
+ done
fi
[ -f "$ROOT/VERSION" ] || die "no VERSION file at repo root"
diff --git a/test/dist/run.sh b/test/dist/run.sh
@@ -45,6 +45,13 @@ run_fail "release-config-missing-fails" make -n -C "$repo_root" RELEASE=1 bin
run_fail "release-config-test-anchor-fails" make -n -C "$repo_root" \
RELEASE=1 KIT_UPDATE_INDEX_URL=https://updates.example/stable.index \
KIT_RELEASE_PUBKEYS="$PUBKEY" bin
+{
+ printf '%s\n' 'untrusted comment: renamed release-looking public key'
+ sed -n '2,$p' "$PUBKEY"
+} > "$work/copied-nonrelease.pub"
+run_fail "release-config-copied-test-anchor-fails" make -n -C "$repo_root" \
+ RELEASE=1 KIT_UPDATE_INDEX_URL=https://updates.example/stable.index \
+ KIT_RELEASE_PUBKEYS="$work/copied-nonrelease.pub" bin
run_ok "release-config-keygen" "$KIT" pkg keygen -o "$work/release-config"
run_ok "release-config-production-shape" make -n -C "$repo_root" RELEASE=1 \
KIT_UPDATE_INDEX_URL=https://updates.example/stable.index \
@@ -61,6 +68,20 @@ run_fail "release-dist-test-key-rejected" make -C "$repo_root" dist \
KIT_SIGN_KEY="$SECKEY" \
KIT_UPDATE_INDEX_URL=https://updates.example/stable.index \
KIT_RELEASE_PUBKEYS="$PUBKEY"
+{
+ printf '%s\n' 'untrusted comment: renamed release-looking secret key'
+ sed -n '2,$p' "$SECKEY"
+} > "$work/copied-nonrelease.key"
+run_fail "release-dist-copied-test-key-rejected" make -n -C "$repo_root" dist \
+ KIT_SIGN_KEY="$work/copied-nonrelease.key" \
+ KIT_UPDATE_INDEX_URL=https://updates.example/stable.index \
+ KIT_RELEASE_PUBKEYS="$work/release-config.pub"
+run_fail "release-script-copied-test-key-rejected" env \
+ KIT_SIGN_KEY="$work/copied-nonrelease.key" \
+ KIT_UPDATE_INDEX_URL=https://updates.example/stable.index \
+ KIT_RELEASE_PUBKEYS="$work/release-config.pub" \
+ KIT_RELEASE_ALLOW_DIRTY=1 KIT_RELEASE_TARGETS=macos-aa64 \
+ "$repo_root/scripts/release.sh"
run_ok "release-dist-explicit-test-shape" make -n -C "$repo_root" dist \
KIT_SIGN_KEY="$SECKEY" KIT_RELEASE_ALLOW_TEST_KEY=1 \
KIT_UPDATE_INDEX_URL=https://updates.example/stable.index \
