Skip to content

update: admit every component before replacing anything; repair invalid versions (#156) - #248

Merged
andersalm merged 6 commits into
developfrom
fix/156-component-admission
Oct 6, 2026
Merged

andersalm merged 6 commits into
developfrom
fix/156-component-admission

Conversation

@andersalm

Copy link
Copy Markdown
Contributor

Part of #89, closes the #156 Done means. Stacked on #246; retarget to develop after #246 merges. Supersedes draft #160.

  • Before any support download or replacement, Runtime admits the signed components.json for the platform: valid checksums and release strategies only, one rule shared with publication.
  • An invalid installed version is refused with a repair hint; local elastos update --force repairs it through a verified signed release; System stays strict.
  • install.sh validates the signed version syntax like check-versioning.sh (parity test).

Net +505 lines incl. tests. Local, outside the sandbox: update:: 50, installed_release 13, release_publication 24, home_update:: 16, install-bootstrap-test.py OK. Written by a Codex session; Claude review.

…id versions

Runtime now admits the verified components.json for the selected platform
before any support download or installation change: every applicable
external component needs a valid SHA-256/SHA-512 checksum and a release
installation strategy, using the same rule as publication. An invalid
installed version is refused with a repair hint, and a local
'elastos update --force' repairs it through a verified signed release;
System check/apply stays strict. install.sh checks the signed version
syntax like check-versioning.sh, with a parity test. (#156)

Written by a Codex session (gpt-6.1-sol).
…, tighten versions

Review fixes for #156: the repair hint's 'elastos update --force' now
exists (CLI only; System stays strict); the linux-arm64 vmlinux entry that
copied the host's /boot/Image is removed, so Jetson releases pass strict
admission and setup reports the VM kernel as unavailable there; the
installer and check-versioning.sh refuse empty build-metadata identifiers.

Written by a Codex session (gpt-6.1-sol).
Review fix: --force no longer skips the downgrade check. It relaxes only
the invalid-installed-version gate and compares the candidate with the
verified installed signed head, refusing anything older. Rollback and
reinstall stay behind an explicit --rollback-to <CID>. System never
repairs.

Written by a Codex session (gpt-6.1-sol).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant