--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Commit bc926c5f93e770f79a45dde73770cf63603d043f
Parents : 6877031
Author : Ivan <ivan@quad4.io>
Signature : Invalid signer <e46112d44649266d71fe2193e00a4710>, author is <ivan@quad4.io>
Date : 2026-07-16T06:45:59-05:00
chore: update verification scripts and Taskfile descriptions to support non-blocking warnings and strict failure mode
Changes
6 files changed, 88 insertions(+), 23 deletions(-)
Diff
diff --git a/.github/actions/setup-dev-environment/action.yml b/.github/actions/setup-dev-environment/action.yml
index 69ac8033..e67b0881 100644
--- a/.github/actions/setup-dev-environment/action.yml
+++ b/.github/actions/setup-dev-environment/action.yml
@@ -32,17 +32,51 @@ inputs:
runs:
using: composite
steps:
- # Verify before dependency installs that may rewrite tracked files.
+ # Best-effort integrity check before dependency installs that may rewrite tracked files.
+ # Tree verify warns by default and does not fail the job.
- name: Ensure rnid for tree verify
if: inputs.skip_tree_verify != 'true'
shell: bash
run: |
- set -euo pipefail
+ set -u
if command -v rnid >/dev/null 2>&1; then
exit 0
fi
- python3 -m pip install --user 'rns>=1.3.8'
- echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+ if [ -x .venv/bin/rnid ]; then
+ exit 0
+ fi
+ echo "Installing rns tools for tree verify (best effort)"
+ py=python3
+ if command -v python >/dev/null 2>&1; then
+ py=python
+ fi
+ if "$py" -m pip install --user 'rns>=1.3.8' 2>/dev/null; then
+ :
+ elif "$py" -m pip install --user --break-system-packages 'rns>=1.3.8' 2>/dev/null; then
+ :
+ else
+ echo "WARNING: could not install rnid via pip (tree verify may be skipped)" >&2
+ exit 0
+ fi
+ # Unix user scripts
+ if [ -d "$HOME/.local/bin" ]; then
+ echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+ fi
+ # Windows user Scripts (GitHub-hosted runners)
+ if [ -n "${APPDATA:-}" ]; then
+ for scripts_dir in "$APPDATA"/Python/Python*/Scripts; do
+ if [ -d "$scripts_dir" ]; then
+ echo "$scripts_dir" >> "$GITHUB_PATH"
+ fi
+ done
+ fi
+ if [ -n "${LOCALAPPDATA:-}" ]; then
+ for scripts_dir in "$LOCALAPPDATA"/Programs/Python/Python*/Scripts; do
+ if [ -d "$scripts_dir" ]; then
+ echo "$scripts_dir" >> "$GITHUB_PATH"
+ fi
+ done
+ fi
- name: Verify tree RSM
if: inputs.skip_tree_verify != 'true'
diff --git a/.github/actions/verify-workspace-clean/action.yml b/.github/actions/verify-workspace-clean/action.yml
index 68953cc3..9a7ce7ad 100644
--- a/.github/actions/verify-workspace-clean/action.yml
+++ b/.github/actions/verify-workspace-clean/action.yml
@@ -1,5 +1,5 @@
name: Verify workspace clean
-description: Recheck byte-level tree inventory and reject unexpected runner mutations
+description: Recheck byte-level tree inventory (warn by default, non-blocking)
runs:
using: composite
steps:
diff --git a/Taskfile.yml b/Taskfile.yml
index 0eff1583..2c685248 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -623,7 +623,7 @@ tasks:
- sh scripts/ci/sign-tree-rsm.sh
tree-rsm-verify:
- desc: Verify meshchatx.rsm signature and byte-level file hashes
+ desc: Verify meshchatx.rsm signature and hashes (warn by default, RNS_TREE_VERIFY_STRICT=1 to fail)
cmds:
- sh scripts/ci/verify-tree-rsm.sh
@@ -633,7 +633,7 @@ tasks:
- sh scripts/ci/install-git-hooks.sh
tree-workspace-clean:
- desc: Recheck inventory and fail on unexpected workspace changes
+ desc: Recheck inventory (warn by default, RNS_TREE_VERIFY_STRICT=1 to fail)
cmds:
- sh scripts/ci/verify-workspace-clean.sh "${RNS_INVENTORY_OUT:-/tmp/meshchatx-tree-inventory.txt}"
diff --git a/meshchatx.rsm b/meshchatx.rsm
index 91ff3a24..656671c2 100644
Binary files a/meshchatx.rsm and b/meshchatx.rsm differ
diff --git a/scripts/ci/verify-tree-rsm.sh b/scripts/ci/verify-tree-rsm.sh
index 01774c80..5baa3a27 100755
--- a/scripts/ci/verify-tree-rsm.sh
+++ b/scripts/ci/verify-tree-rsm.sh
@@ -1,10 +1,15 @@
#!/bin/sh
# Verify meshchatx.rsm signature and byte-level file hashes.
#
+# By default mismatches print warnings and exit 0 so CI is not blocked when
+# the signed inventory lags dependency or license refreshes.
+# Set RNS_TREE_VERIFY_STRICT=1 to exit non-zero on failure.
+#
# Env:
# RNS_REQUIRED_SIGNER identity hash (default: e46112d44649266d71fe2193e00a4710)
# RNS_RSM_PATH path to .rsm (default: meshchatx.rsm)
# RNS_INVENTORY_OUT if set, write extracted inventory here (for end-of-job recheck)
+# RNS_TREE_VERIFY_STRICT if 1, fail the process on verify errors
#
# Usage:
# sh scripts/ci/verify-tree-rsm.sh
@@ -16,6 +21,17 @@ cd "$ROOT"
SIGNER="${RNS_REQUIRED_SIGNER:-e46112d44649266d71fe2193e00a4710}"
RSM_PATH="${RNS_RSM_PATH:-$ROOT/meshchatx.rsm}"
HEADER="# meshchatx tree manifest v1"
+STRICT="${RNS_TREE_VERIFY_STRICT:-0}"
+
+warn_or_fail() {
+ msg="$1"
+ if [ "$STRICT" = "1" ]; then
+ echo "verify-tree-rsm.sh: $msg" >&2
+ exit 1
+ fi
+ echo "verify-tree-rsm.sh: WARNING: $msg (non-blocking)" >&2
+ exit 0
+}
run_rnid() {
if command -v rnid >/dev/null 2>&1; then
@@ -31,8 +47,7 @@ run_rnid() {
}
if [ ! -f "$RSM_PATH" ]; then
- echo "verify-tree-rsm.sh: missing $RSM_PATH" >&2
- exit 1
+ warn_or_fail "missing $RSM_PATH"
fi
INV="$(mktemp "${TMPDIR:-/tmp}/tree-inv-verify.XXXXXX")"
@@ -40,20 +55,20 @@ RAW="$(mktemp "${TMPDIR:-/tmp}/tree-rsm-raw.XXXXXX")"
trap 'rm -f "$INV" "$RAW"' EXIT INT
if ! run_rnid -i "$SIGNER" -V "$RSM_PATH" >"$RAW" 2>/dev/null; then
- echo "verify-tree-rsm.sh: RSM signature verification failed" >&2
- exit 1
+ warn_or_fail "RSM signature verification failed"
fi
# Keep only the embedded inventory (starts at the manifest header line).
awk -v h="$HEADER" 'BEGIN{p=0} $0==h{p=1} p{print}' "$RAW" >"$INV"
if [ ! -s "$INV" ]; then
- echo "verify-tree-rsm.sh: could not extract inventory from RSM" >&2
- exit 1
+ warn_or_fail "could not extract inventory from RSM"
fi
if [ -n "${RNS_INVENTORY_OUT:-}" ]; then
cp "$INV" "$RNS_INVENTORY_OUT"
fi
-sh "$ROOT/scripts/ci/tree-manifest.sh" verify-tracked "$INV"
+if ! sh "$ROOT/scripts/ci/tree-manifest.sh" verify-tracked "$INV"; then
+ warn_or_fail "tree inventory hash check failed"
+fi
echo "verify-tree-rsm.sh: OK (signer $SIGNER)"
diff --git a/scripts/ci/verify-workspace-clean.sh b/scripts/ci/verify-workspace-clean.sh
index 73e80254..093fa0ef 100755
--- a/scripts/ci/verify-workspace-clean.sh
+++ b/scripts/ci/verify-workspace-clean.sh
@@ -1,24 +1,41 @@
#!/bin/sh
-# Fail if tracked file bytes changed vs a saved inventory, or unexpected
-# untracked files appeared (GitHub runner mutation check).
+# Recheck byte-level tree inventory and report unexpected runner mutations.
+#
+# By default mismatches print warnings and exit 0 so CI is not blocked when
+# signed inventories lag license refreshes or ephemeral runner dirt appears.
+# Set RNS_TREE_VERIFY_STRICT=1 to exit non-zero on failure.
#
# Usage:
# verify-workspace-clean.sh <inventory-file>
#
# Env:
# RNS_CLEAN_ALLOW space-separated path prefixes always ignored (optional)
+# RNS_TREE_VERIFY_STRICT if 1, fail the process on verify errors
set -eu
ROOT="$(CDPATH= cd -- "$(dirname "$0")/../.." && pwd)"
cd "$ROOT"
-INV="${1:?inventory file}"
-if [ ! -f "$INV" ]; then
- echo "verify-workspace-clean.sh: missing inventory: $INV" >&2
- exit 1
+STRICT="${RNS_TREE_VERIFY_STRICT:-0}"
+
+warn_or_fail() {
+ msg="$1"
+ if [ "$STRICT" = "1" ]; then
+ echo "verify-workspace-clean.sh: $msg" >&2
+ exit 1
+ fi
+ echo "verify-workspace-clean.sh: WARNING: $msg (non-blocking)" >&2
+ exit 0
+}
+
+INV="${1:-}"
+if [ -z "$INV" ] || [ ! -f "$INV" ]; then
+ warn_or_fail "missing inventory: ${INV:-<unset>} (tree verify may have been skipped)"
fi
-sh "$ROOT/scripts/ci/tree-manifest.sh" verify "$INV"
+if ! sh "$ROOT/scripts/ci/tree-manifest.sh" verify "$INV"; then
+ warn_or_fail "tree inventory hash check failed"
+fi
# Default ephemeral prefixes created by CI / local builds
ALLOW="node_modules/ .pnpm-store/ .venv/ .venv-x64/ dist/ build/ electron/build/ meshchatx/public/ python-dist/ playwright-report/ mutants/ coverage/ .flatpak-builder/ parts/ prime/ stage/ android/.gradle/ android/app/build/ android/build/ android/vendor/ .cache/ __pycache__/ .pytest_cache/ vendor/offline/"
@@ -74,7 +91,6 @@ while IFS= read -r line; do
done <"$tmp"
if [ "$fail" -ne 0 ]; then
- echo "verify-workspace-clean.sh: workspace not clean" >&2
- exit 1
+ warn_or_fail "workspace not clean"
fi
echo "verify-workspace-clean.sh: OK"
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────