--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Commit fe3c9cfd8b9555eabcf5dc4d83f07b0d2656c6ff
Parents : d592b86
Author : Ivan <ivan@quad4.io>
Signature : Invalid signer <e46112d44649266d71fe2193e00a4710>, author is <ivan@quad4.io>
Date : 2026-07-16T17:45:04-05:00
fix: ensure SLSA provenance jobs compile the generator from source to prevent missing binary errors
Changes
6 files changed, 22 insertions(+), 14 deletions(-)
Diff
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 91094bda..b0fc1468 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,6 +18,10 @@ updates:
schedule:
interval: weekly
open-pull-requests-limit: 10
+ # Keep slsa-github-generator on a release tag (@vX.Y.Z). Dependabot SHA
+ # pins break its prebuilt download path unless compile-generator is true.
+ ignore:
+ - dependency-name: "slsa-framework/slsa-github-generator"
groups:
actions:
patterns:
@@ -27,4 +31,3 @@ updates:
- sigstore/*
- pypa/*
- benchmark-action/*
- - slsa-framework/*
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 9cc14d5d..8dd97f73 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -12,12 +12,12 @@
# actions/cache@v4.2.0 1bd1e32a3bdc45362d1e726936510720a7c30a57
# actions/setup-java@v4.7.1 c5195efecf7bdfc987ee8bae7a71cb8b11521c00
#
-# SLSA generator: must be referenced by tag (@vX.Y.Z), not by commit SHA.
-# slsa-verifier can only confirm the reusable workflow ran from a trusted
-# release ref when called this way; a SHA pin makes the generator's own
-# builder-fetch step fail with "Invalid ref: <sha>. Expected ref of the
-# form refs/tags/vX.Y.Z". See slsa-github-generator README "Referencing
-# SLSA builders and generators".
+# SLSA generator: pin by tag (@vX.Y.Z), not by commit SHA.
+# Prefer compile-generator: true. builder-fetch.sh only downloads prebuilts
+# when BUILDER_REF is refs/tags/vX.Y.Z. GitHub OIDC often reports a bare SHA
+# even for tag-pinned callers, so Generate builder fails quietly and attest
+# then exits 127 (slsa-generator-generic-linux-amd64 missing). Compiling from
+# source skips that download path. Upstream: slsa-github-generator#4216 #4503.
# slsa-framework/slsa-github-generator/generator_generic_slsa3.yml@v2.1.0
# (tag v2.1.0 = f7dd8c54c2067bafc12ca7a55595d5ee9b75204a)
@@ -473,6 +473,7 @@ jobs:
with:
base64-subjects: ${{ needs.collect-linux-slsa-subjects.outputs.hashes }}
upload-assets: false
+ compile-generator: true
provenance-name: meshchatx-linux-${{ github.ref_name }}.intoto.jsonl
slsa-provenance-desktop:
@@ -491,6 +492,7 @@ jobs:
with:
base64-subjects: ${{ needs.collect-desktop-slsa-subjects.outputs.hashes }}
upload-assets: false
+ compile-generator: true
provenance-name: meshchatx-desktop-${{ github.ref_name }}.intoto.jsonl
collect-android-flatpak-slsa-subjects:
@@ -540,6 +542,7 @@ jobs:
with:
base64-subjects: ${{ needs.collect-android-flatpak-slsa-subjects.outputs.hashes }}
upload-assets: false
+ compile-generator: true
provenance-name: meshchatx-android-flatpak-${{ github.ref_name }}.intoto.jsonl
draft-github-release:
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index 0dd113b0..099ebb9c 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -16,12 +16,12 @@
# actions/upload-artifact@v5.0.0 330a01c490aca151604b8cf639adc76d48f6c5d4
# actions/download-artifact@v5.0.0 634f93cb2916e3fdff6788551b99b062d0335ce0
#
-# SLSA generator: must be referenced by tag (@vX.Y.Z), not by commit SHA.
-# slsa-verifier can only confirm the reusable workflow ran from a trusted
-# release ref when called this way; a SHA pin makes the generator's own
-# builder-fetch step fail with "Invalid ref: <sha>. Expected ref of the
-# form refs/tags/vX.Y.Z". See slsa-github-generator README "Referencing
-# SLSA builders and generators".
+# SLSA generator: pin by tag (@vX.Y.Z), not by commit SHA.
+# Prefer compile-generator: true. builder-fetch.sh only downloads prebuilts
+# when BUILDER_REF is refs/tags/vX.Y.Z. GitHub OIDC often reports a bare SHA
+# even for tag-pinned callers, so Generate builder fails quietly and attest
+# then exits 127 (slsa-generator-generic-linux-amd64 missing). Compiling from
+# source skips that download path. Upstream: slsa-github-generator#4216 #4503.
# slsa-framework/slsa-github-generator/generator_generic_slsa3.yml@v2.1.0
# (tag v2.1.0 = f7dd8c54c2067bafc12ca7a55595d5ee9b75204a)
#
@@ -175,6 +175,7 @@ jobs:
with:
base64-subjects: ${{ needs.build.outputs.hashes }}
upload-assets: false
+ compile-generator: true
provenance-name: meshchatx-pypi-${{ github.ref_name }}.intoto.jsonl
publish-to-pypi:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 19213449..7da0c226 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -36,6 +36,7 @@ All notable changes to this project will be documented in this file.
### Fixed
+- SLSA provenance jobs compile the generic generator from source so attest no longer fails with a missing slsa-generator-generic-linux-amd64 binary
- Android: lxmfy packaging, flock soft-lock, splash/logo clipping, emulator smoke, Landlock skipped on Android
- Android RNode BLE/USB via Chaquopy
- Startup check and disable unsupported interfaces
diff --git a/SECURITY.md b/SECURITY.md
index 85192386..e9163f66 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -80,6 +80,6 @@ Skip one commit with `SKIP_TREE_RSM_HOOK=1`.
- **CI:** Automated pipelines (hosted on GitHub Actions) run dependency and configuration scanning (including **Trivy** and **pip-audit** on relevant paths), build checks, and security-relevant automated tests (authentication, path safety on dangerous operations, schema upgrades, backup/restore, rate limiting and access logging, and related areas). SRI integrity tests verify that external WASM/JS files match their declared hashes without regenerating the integrity manifests. CI will fail if you update these files without regenerating the integrity manifests.
- **Action pinning:** Third-party GitHub Actions are referenced with **pinned commit SHAs** in workflow definitions to reduce unexpected upgrades.
-- **Releases:** Tagged release artifacts for Linux, Windows, and macOS are produced in CI; when the pipeline also produces Android APK and/or Flatpak bundles for the tag, those binaries are included in a separate **SLSA** attestation (`meshchatx-android-flatpak-<tag>.intoto.jsonl`). **SLSA Build Level 3–style provenance** for those subjects is generated via the **generic** SLSA GitHub generator (`generator_generic_slsa3.yml` at release **v2.1.0**), which satisfies the **isolated builder and signed provenance** expectations for that tier; **distribution** (draft releases, mirrors) and **consumer verification** remain your operational controls, as described in upstream SLSA documentation.
+- **Releases:** Tagged release artifacts for Linux, Windows, and macOS are produced in CI; when the pipeline also produces Android APK and/or Flatpak bundles for the tag, those binaries are included in a separate **SLSA** attestation (`meshchatx-android-flatpak-<tag>.intoto.jsonl`). **SLSA Build Level 3–style provenance** for those subjects is generated via the **generic** SLSA GitHub generator (`generator_generic_slsa3.yml` at release **v2.1.0**, with `compile-generator: true` so the builder is compiled from that tag rather than downloaded), which satisfies the **isolated builder and signed provenance** expectations for that tier; **distribution** (draft releases, mirrors) and **consumer verification** remain your operational controls, as described in upstream SLSA documentation.
- **Transparency logs:** Many Sigstore flows write to the **public Rekor** log (`https://rekor.sigstore.dev` by default). **Repository-key** `*.cosign.bundle` files next to release artifacts are built **without** a Rekor entry; with **Cosign v3+**, verify them against `cosign.pub` using `cosign verify-blob-attestation` and `--insecure-ignore-tlog=true` (signature and predicate are still checked against the public key). Private-repo or air-gapped policies may require different Sigstore settings; operators should align `COSIGN_REKOR_URL` and related variables with their own governance.
- **Cosign public key:** When repository key-based signing is used, the **public** key is published in-repo as `cosign.pub` so verifiers do not need a separate out-of-band key hunt. **Key rotation:** replace the GitHub secret holding the private key and update `cosign.pub` in the repository; older releases remain verifiable with the key that was current at build time.
diff --git a/meshchatx.rsm b/meshchatx.rsm
index e069dfdf..66866605 100644
Binary files a/meshchatx.rsm and b/meshchatx.rsm differ
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────