@caelo-cms/provisioning 0.10.47 → 0.10.48

package/src/agent/apply.test.ts

@@ -0,0 +1,185 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The target release's half of a self-hosted update (agent/apply.ts): the
+ * upgrade's progress becomes the request's timeline, its result the
+ * request's end state, and only a successful install re-pins the agent.
+ */
+
+import { describe, expect, it } from "bun:test";
+import type { SelfHostedUpgradeResult, UpgradeLog } from "../self-hosted-upgrade.js";
+import type { UpdateEnd, UpdateQueue } from "../upgrader-job.js";
+import { type AgentApplyDeps, applyAgentUpdate, endForResult } from "./apply.js";
+
+const REQUEST = {
+  id: "22222222-2222-4222-8222-222222222222",
+  targetVersion: "0.11.0",
+  trigger: "manual" as const,
+};
+
+function setup(
+  upgrade: (log: UpgradeLog) => Promise<SelfHostedUpgradeResult>,
+  over: Partial<AgentApplyDeps> = {},
+) {
+  const events: { phase: string; level: string; message: string }[] = [];
+  const ends: UpdateEnd[] = [];
+  let pins = 0;
+  const queue: UpdateQueue = {
+    claim: async () => null,
+    event: async (_id, phase, level, message) => {
+      events.push({ phase, level, message });
+    },
+    record: async () => {},
+    finish: async (_id, end) => {
+      ends.push(end);
+      return true;
+    },
+  };
+  const deps: AgentApplyDeps = {
+    queue,
+    request: REQUEST,
+    agentVersion: "0.11.0",
+    upgrade,
+    selfUpdate: async () => {
+      pins += 1;
+      return { ok: true };
+    },
+    log: () => {},
+    sleep: async () => {},
+    ...over,
+  };
+  return { deps, events, ends, pins: () => pins };
+}
+
+/** An upgrade that narrates like upgradeSelfHosted does. */
+const narrated =
+  (result: SelfHostedUpgradeResult) =>
+  async (log: UpgradeLog): Promise<SelfHostedUpgradeResult> => {
+    log.phase?.("verify");
+    log.info("Verifying the signature of admin");
+    log.phase?.("backup");
+    log.step("Backing up the databases (pg_dump)");
+    log.phase?.("migrations");
+    log.step("Running database migrations with the new admin image");
+    log.phase?.("roll");
+    log.step("Restarting admin on sha256:aaaa");
+    if (!result.ok) {
+      log.phase?.("rollback");
+      log.warn("Rolling back to the previous images");
+    } else {
+      log.phase?.("record");
+    }
+    return result;
+  };
+
+describe("applyAgentUpdate", () => {
+  it("narrates the upgrade into the timeline, records success, re-pins the agent", async () => {
+    const { deps, events, ends, pins } = setup(
+      narrated({ ok: true, status: "upgraded", version: "0.11.0" }),
+    );
+    expect(await applyAgentUpdate(deps)).toEqual({ exitCode: 0 });
+    expect([...new Set(events.map((e) => e.phase))]).toEqual([
+      "start",
+      "verify",
+      "backup",
+      "migrations",
+      "roll",
+      "self-update",
+      "finish",
+    ]);
+    expect(ends).toEqual([
+      { status: "succeeded", reason: null, codes: [], pauseAutoUpdates: false },
+    ]);
+    expect(pins()).toBe(1);
+  });
+
+  it("ends a rolled-back upgrade as rolled_back and leaves the agent's pin", async () => {
+    const { deps, events, ends, pins } = setup(
+      narrated({
+        ok: false,
+        stage: "roll-admin",
+        error: "health check did not pass",
+        previousRunning: true,
+      }),
+    );
+    expect(await applyAgentUpdate(deps)).toEqual({ exitCode: 1 });
+    expect(ends[0]).toMatchObject({ status: "rolled_back", codes: ["roll-admin"] });
+    expect(ends[0]?.reason).toContain("previous release serves again");
+    expect(events.some((e) => e.phase === "rollback")).toBe(true);
+    expect(pins()).toBe(0);
+  });
+
+  it("refuses to act as another release than the target", async () => {
+    let ran = false;
+    const { deps, ends } = setup(
+      async () => {
+        ran = true;
+        return { ok: true, status: "upgraded", version: "0.11.0" };
+      },
+      { agentVersion: "0.10.47" },
+    );
+    expect(await applyAgentUpdate(deps)).toEqual({ exitCode: 1 });
+    expect(ran).toBe(false);
+    expect(ends[0]).toMatchObject({ status: "failed", codes: ["apply"] });
+  });
+
+  it("turns a thrown upgrade into a failed request", async () => {
+    const { deps, ends } = setup(async () => {
+      throw new Error("ENOSPC");
+    });
+    expect(await applyAgentUpdate(deps)).toEqual({ exitCode: 1 });
+    expect(ends[0]).toMatchObject({ status: "failed", codes: ["internal"] });
+    expect(ends[0]?.reason).toContain("ENOSPC");
+  });
+
+  it("still succeeds when the agent cannot re-pin itself, with a warning", async () => {
+    const { deps, events, ends } = setup(
+      narrated({ ok: true, status: "upgraded", version: "0.11.0" }),
+      { selfUpdate: async () => ({ ok: false, error: "read-only home" }) },
+    );
+    expect(await applyAgentUpdate(deps)).toEqual({ exitCode: 0 });
+    expect(ends[0]?.status).toBe("succeeded");
+    expect(events.find((e) => e.phase === "self-update")).toMatchObject({ level: "warn" });
+  });
+});
+
+describe("endForResult", () => {
+  it.each([
+    [
+      "verify failure",
+      { ok: false, stage: "verify", error: "cosign", previousRunning: true } as const,
+      "failed",
+      "verify",
+    ],
+    [
+      "migration failure",
+      { ok: false, stage: "migrate", error: "x", previousRunning: true } as const,
+      "failed",
+      "migrate",
+    ],
+    [
+      "gateway rolled back",
+      { ok: false, stage: "roll-gateway", error: "x", previousRunning: true } as const,
+      "rolled_back",
+      "roll-gateway",
+    ],
+    [
+      "rollback failed",
+      { ok: false, stage: "roll-admin", error: "x", previousRunning: false } as const,
+      "failed",
+      "rollback",
+    ],
+  ])("%s", (_name, result, status, code) => {
+    const end = endForResult(result, "auto");
+    expect(end.status).toBe(status as UpdateEnd["status"]);
+    expect(end.codes).toEqual([code]);
+    expect(end.pauseAutoUpdates).toBe(true);
+  });
+
+  it("does not pause automatic installs after a manual failure", () => {
+    expect(
+      endForResult({ ok: false, stage: "pull", error: "x", previousRunning: true }, "manual")
+        .pauseAutoUpdates,
+    ).toBe(false);
+  });
+});

package/src/agent/apply.ts

@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * `agent apply` — the target release's half of a self-hosted update (#696
+ * Phase 4c). The polling agent (agent/run.ts) claimed the request, verified
+ * the release's signed manifest and ran the refusal checks; it then starts
+ * THIS release's CLI, which performs the upgrade exactly like a hand-run
+ * `cms-provision upgrade` (self-hosted-upgrade.ts: verified digests, pg_dump
+ * backup, pull, migrations with the new admin image, health-checked roll,
+ * rollback) — narrated into the request's timeline — records how it ended,
+ * and re-pins the agent's systemd service to this release.
+ *
+ * It is never started by hand: it acts on a request the parent already
+ * claimed and holds the install's upgrade lock for.
+ */
+
+import type { PlatformUpdateTrigger } from "@caelo-cms/shared";
+import type { SelfHostedUpgradeResult, UpgradeLog } from "../self-hosted-upgrade.js";
+import { recordUpdateEnd, type UpdateEnd, type UpdateQueue } from "../upgrader-job.js";
+import { eventReporter, type JobLog } from "../upgrader-reporter.js";
+
+export interface AgentApplyDeps {
+  readonly queue: UpdateQueue;
+  readonly request: {
+    readonly id: string;
+    readonly targetVersion: string;
+    readonly trigger: PlatformUpdateTrigger;
+  };
+  /** This CLI's own release; must be the target. */
+  readonly agentVersion: string;
+  /** upgradeSelfHosted for the target, with the manifest's digests. */
+  readonly upgrade: (log: UpgradeLog) => Promise<SelfHostedUpgradeResult>;
+  /** Re-pin the agent's service to this release (agent/systemd.ts). */
+  readonly selfUpdate: () => Promise<{ ok: true } | { ok: false; error: string }>;
+  readonly log: JobLog;
+  readonly sleep?: (ms: number) => Promise<void>;
+}
+
+/** The request's end state for an upgrade result. */
+export function endForResult(
+  result: SelfHostedUpgradeResult,
+  trigger: PlatformUpdateTrigger,
+): UpdateEnd {
+  if (result.ok) return { status: "succeeded", reason: null, codes: [], pauseAutoUpdates: false };
+  const rolled = result.stage === "roll-admin" || result.stage === "roll-gateway";
+  const status = rolled && result.previousRunning ? "rolled_back" : "failed";
+  const lead =
+    status === "rolled_back"
+      ? "The new release did not pass its health check, so the previous release serves again."
+      : result.previousRunning
+        ? "Nothing was changed; the previous release keeps serving."
+        : "The update stopped half-way and the previous release did not come back healthy — check `docker compose ps` on the server.";
+  return {
+    status,
+    reason: `${lead}\n${result.error}`.slice(0, 4000),
+    codes: [rolled && !result.previousRunning ? "rollback" : result.stage],
+    pauseAutoUpdates: trigger === "auto",
+  };
+}
+
+/** Run the upgrade for the claimed request. Never throws. */
+export async function applyAgentUpdate(deps: AgentApplyDeps): Promise<{ exitCode: number }> {
+  const { queue, request, log } = deps;
+  const r = eventReporter(
+    (phase, level, message) => queue.event(request.id, phase, level, message),
+    log,
+    request.id,
+  );
+  const finish = async (end: UpdateEnd): Promise<{ exitCode: number }> => {
+    r.phase("finish");
+    if (end.status === "succeeded") r.success(`Caelo ${request.targetVersion} is installed.`);
+    else r.error(end.reason ?? end.status);
+    await r.flush();
+    const recorded = await recordUpdateEnd(queue, request.id, end, log, deps.sleep);
+    return { exitCode: recorded && end.status === "succeeded" ? 0 : 1 };
+  };
+
+  if (deps.agentVersion !== request.targetVersion) {
+    return finish({
+      status: "failed",
+      reason: `Nothing was changed: the installer of Caelo ${deps.agentVersion} was started for ${request.targetVersion}.`,
+      codes: ["apply"],
+      pauseAutoUpdates: request.trigger === "auto",
+    });
+  }
+  let result: SelfHostedUpgradeResult;
+  try {
+    r.phase("start");
+    r.info(`The Caelo ${request.targetVersion} installer took over.`);
+    result = await deps.upgrade({
+      step: (m) => {
+        r.step(m);
+      },
+      info: (m) => r.info(m),
+      warn: (m) => r.warn(m),
+      error: (m) => r.error(m),
+      phase: (p) => r.phase(p),
+    });
+  } catch (e) {
+    return finish({
+      status: "failed",
+      reason: `The installer stopped unexpectedly: ${e instanceof Error ? e.message : String(e)}. Check \`docker compose ps\` on the server.`,
+      codes: ["internal"],
+      pauseAutoUpdates: request.trigger === "auto",
+    });
+  }
+  if (result.ok) {
+    if (result.status === "already-current") {
+      r.info(`Caelo ${result.version} was already installed; the containers are healthy.`);
+    }
+    r.phase("self-update");
+    const pinned = await deps.selfUpdate().catch((e: unknown) => ({
+      ok: false as const,
+      error: e instanceof Error ? e.message : String(e),
+    }));
+    if (pinned.ok) r.info(`The update agent itself now runs ${request.targetVersion}.`);
+    else {
+      r.warn(
+        `The update agent could not update itself (${pinned.error}); it keeps working with its current version.`,
+      );
+    }
+  }
+  return finish(endForResult(result, request.trigger));
+}

package/src/agent/cli-provenance.test.ts

@@ -0,0 +1,159 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The target release's CLI is installed and verified before the agent runs
+ * it (#721 maintainer decision): npm signatures + Sigstore provenance from
+ * caelo-cms/caelo-cms at the release tag. Every reject path is a structured
+ * error; nothing falls back to an unverified run.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { CommandResult, HostRunner } from "../self-hosted-release.js";
+import { installVerifiedCli, provenanceProblem, SOURCE_REPOSITORY } from "./cli-provenance.js";
+
+const V = "0.11.0";
+
+/** An npm attestations response whose SLSA statement says `workflow` built `name@version`. */
+function attestation(
+  name: string,
+  version: string,
+  workflow: { repository: string; ref: string },
+): Response {
+  const statement = {
+    subject: [{ name: `pkg:npm/${name.replaceAll("@", "%40")}@${version}` }],
+    predicate: { buildDefinition: { externalParameters: { workflow } } },
+  };
+  return Response.json({
+    attestations: [
+      {
+        predicateType: "https://slsa.dev/provenance/v1",
+        bundle: {
+          dsseEnvelope: { payload: Buffer.from(JSON.stringify(statement)).toString("base64") },
+        },
+      },
+    ],
+  });
+}
+
+const genuine = (async (url: string | URL | Request) => {
+  const m = /attestations\/(.+)@([^@]+)$/.exec(decodeURIComponent(String(url)));
+  return attestation(m?.[1] ?? "", m?.[2] ?? "", {
+    repository: SOURCE_REPOSITORY,
+    ref: `refs/tags/v${m?.[2]}`,
+  });
+}) as typeof fetch;
+
+type Rule = (line: string) => Partial<CommandResult> | undefined;
+
+/** npm fake: `install` writes the packages at `installed` versions. */
+function npm(dir: string, rules: Rule[] = [], installed = V): HostRunner & { calls: string[] } {
+  const calls: string[] = [];
+  return {
+    calls,
+    async run(argv) {
+      const line = argv.join(" ");
+      calls.push(line);
+      const hit = rules.map((r) => r(line)).find((r) => r !== undefined);
+      if (hit) return { exitCode: 0, stdout: "", stderr: "", ...hit };
+      if (argv[1] === "install") {
+        for (const name of ["@caelo-cms/provisioning", "@caelo-cms/shared"]) {
+          const pkg = join(dir, "node_modules", name);
+          mkdirSync(pkg, { recursive: true });
+          writeFileSync(join(pkg, "package.json"), JSON.stringify({ name, version: installed }));
+        }
+      }
+      return { exitCode: 0, stdout: "", stderr: "" };
+    },
+  };
+}
+
+describe("installVerifiedCli", () => {
+  let root: string;
+  let dir: string;
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "caelo-cli-"));
+    dir = join(root, `caelo-${V}`);
+  });
+  afterEach(() => rmSync(root, { recursive: true, force: true }));
+
+  it("installs exactly the release with scripts off, audits it, and returns its CLI", async () => {
+    const runner = npm(dir);
+    const r = await installVerifiedCli(V, dir, { runner, fetchImpl: genuine });
+    expect(r).toEqual({
+      ok: true,
+      dir,
+      cliPath: join(dir, "node_modules", "@caelo-cms", "provisioning", "dist", "cli.js"),
+    });
+    expect(runner.calls).toEqual([
+      "npm --version",
+      `npm install --prefix ${dir} --ignore-scripts --no-audit --no-fund --loglevel=error`,
+      `npm audit signatures --prefix ${dir}`,
+    ]);
+  });
+
+  it.each([
+    [
+      "no npm",
+      [(l: string) => (l === "npm --version" ? { exitCode: 127 } : undefined)],
+      genuine,
+      V,
+      "npm-missing",
+    ],
+    [
+      "registry signatures rejected",
+      [
+        (l: string) =>
+          l.startsWith("npm audit") ? { exitCode: 1, stderr: "1 invalid signature" } : undefined,
+      ],
+      genuine,
+      V,
+      "audit-signatures",
+    ],
+    ["another version installed", [], genuine, "0.11.1", "version"],
+    [
+      "built from a fork",
+      [],
+      (async () =>
+        attestation("@caelo-cms/provisioning", V, {
+          repository: "https://github.com/evil/caelo-cms",
+          ref: `refs/tags/v${V}`,
+        })) as unknown as typeof fetch,
+      V,
+      "provenance",
+    ],
+    [
+      "built from a branch, not the release tag",
+      [],
+      (async () =>
+        attestation("@caelo-cms/provisioning", V, {
+          repository: SOURCE_REPOSITORY,
+          ref: "refs/heads/main",
+        })) as unknown as typeof fetch,
+      V,
+      "provenance",
+    ],
+    [
+      "no attestation at all",
+      [],
+      (async () => new Response("not found", { status: 404 })) as unknown as typeof fetch,
+      V,
+      "provenance",
+    ],
+  ] as const)("rejects: %s", async (_name, rules, fetchImpl, installed, code) => {
+    const r = await installVerifiedCli(V, dir, {
+      runner: npm(dir, [...rules], installed),
+      fetchImpl,
+    });
+    expect(r.ok).toBe(false);
+    expect(r.ok ? null : r.error.code).toBe(code);
+  });
+});
+
+describe("provenanceProblem", () => {
+  it("accepts the release workflow's build of that exact version", async () => {
+    expect(await provenanceProblem("@caelo-cms/shared", V, genuine)).toBeNull();
+  });
+});

package/src/agent/cli-provenance.ts

@@ -0,0 +1,191 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The target release's provisioning CLI, installed and VERIFIED before the
+ * update agent runs it (#696 Phase 4c, maintainer decision on #721). The
+ * signed release manifest proves a release exists and is installable; this
+ * proves the code that installs it is that release's: the same checks the
+ * Cloud Shell runner (`run.sh` in caelo-cms/install) makes.
+ *
+ *   1. `npm install` of exactly `@caelo-cms/provisioning@<v>` (with
+ *      `@caelo-cms/shared` pinned to the same version, lifecycle scripts
+ *      off) into a private folder under `.caelo/agent/cli/`;
+ *   2. `npm audit signatures` — the registry signatures and Sigstore
+ *      provenance attestations of every installed package;
+ *   3. both Caelo packages are the asked-for version, and their SLSA
+ *      provenance names caelo-cms/caelo-cms at `refs/tags/v<v>`.
+ *
+ * Any failure is a structured {@link CliProvenanceError}; there is no
+ * fallback to an unverified `bunx` run.
+ */
+
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import type { HostRunner } from "../self-hosted-release.js";
+
+/** Where Caelo's packages are built (the provenance's workflow repository). */
+export const SOURCE_REPOSITORY = "https://github.com/caelo-cms/caelo-cms";
+
+/** The Caelo packages the CLI runs; both must carry the release's provenance. */
+export const CAELO_CLI_PACKAGES = ["@caelo-cms/provisioning", "@caelo-cms/shared"] as const;
+
+/** Why the CLI of a release was not trusted. */
+export interface CliProvenanceError {
+  readonly code: "npm-missing" | "npm-install" | "audit-signatures" | "version" | "provenance";
+  readonly message: string;
+}
+
+export type VerifiedCli =
+  | { readonly ok: true; readonly cliPath: string; readonly dir: string }
+  | { readonly ok: false; readonly error: CliProvenanceError };
+
+/** `.caelo/agent/cli/` — the verified CLI installs, one folder per release. */
+export function verifiedCliRoot(caeloDir: string): string {
+  return join(caeloDir, "agent", "cli");
+}
+
+/** The folder of release `version`'s verified CLI. */
+export function verifiedCliDir(caeloDir: string, version: string): string {
+  return join(verifiedCliRoot(caeloDir), `caelo-${version}`);
+}
+
+/** The CLI entry point inside {@link verifiedCliDir}. */
+export function verifiedCliPath(dir: string): string {
+  return join(dir, "node_modules", "@caelo-cms", "provisioning", "dist", "cli.js");
+}
+
+const fail = (code: CliProvenanceError["code"], message: string): VerifiedCli => ({
+  ok: false,
+  error: { code, message },
+});
+
+const tail = (s: string) => s.trim().split("\n").slice(-6).join("\n").slice(0, 800);
+
+/**
+ * Check one package's npm provenance attestation: SLSA v1, built from
+ * {@link SOURCE_REPOSITORY} at `refs/tags/v<version>`, for this exact
+ * package version.
+ *
+ * @returns null when it checks out, else why not
+ */
+export async function provenanceProblem(
+  name: string,
+  version: string,
+  fetchImpl: typeof fetch = fetch,
+): Promise<string | null> {
+  const url = `https://registry.npmjs.org/-/npm/v1/attestations/${encodeURIComponent(name)}@${version}`;
+  let body: { attestations?: { predicateType?: string; bundle?: unknown }[] };
+  try {
+    const res = await fetchImpl(url);
+    if (!res.ok)
+      return `${name}@${version}: no provenance attestation (${url}: HTTP ${res.status})`;
+    body = (await res.json()) as typeof body;
+  } catch (e) {
+    return `${name}@${version}: the attestations could not be fetched (${e instanceof Error ? e.message : String(e)})`;
+  }
+  const slsa = body.attestations?.find((a) => a.predicateType === "https://slsa.dev/provenance/v1");
+  const payload = (slsa?.bundle as { dsseEnvelope?: { payload?: string } } | undefined)
+    ?.dsseEnvelope?.payload;
+  if (!payload) return `${name}@${version}: no SLSA provenance`;
+  let statement: {
+    subject?: { name?: string }[];
+    predicate?: {
+      buildDefinition?: {
+        externalParameters?: { workflow?: { repository?: string; ref?: string } };
+      };
+    };
+  };
+  try {
+    statement = JSON.parse(Buffer.from(payload, "base64").toString("utf8"));
+  } catch {
+    return `${name}@${version}: the provenance statement is not JSON`;
+  }
+  const workflow = statement.predicate?.buildDefinition?.externalParameters?.workflow ?? {};
+  const subjects = (statement.subject ?? []).map((s) => s.name);
+  const wantSubject = `pkg:npm/${name.replaceAll("@", "%40")}@${version}`;
+  if (
+    workflow.repository !== SOURCE_REPOSITORY ||
+    workflow.ref !== `refs/tags/v${version}` ||
+    !subjects.includes(wantSubject)
+  ) {
+    return `${name}@${version} was not built by ${SOURCE_REPOSITORY} at refs/tags/v${version} (provenance: ${workflow.repository ?? "?"} ${workflow.ref ?? "?"}, ${subjects.join(",")})`;
+  }
+  return null;
+}
+
+/**
+ * Install release `version`'s CLI into `dir` (replacing what is there) and
+ * verify it. Nothing in it runs before the checks passed: npm's lifecycle
+ * scripts are off.
+ */
+export async function installVerifiedCli(
+  version: string,
+  dir: string,
+  deps: { readonly runner: HostRunner; readonly fetchImpl?: typeof fetch },
+): Promise<VerifiedCli> {
+  const probe = await deps.runner.run(["npm", "--version"]);
+  if (probe.exitCode !== 0) {
+    return fail(
+      "npm-missing",
+      "npm is not installed on the server (or not on the agent's PATH); the update agent needs it to verify the provenance of the Caelo release it installs. Install Node.js + npm, then run `agent install` again.",
+    );
+  }
+  rmSync(dir, { recursive: true, force: true });
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  // Exact versions for both Caelo packages: provisioning depends on
+  // ^<version> of shared, which could otherwise resolve to a newer one.
+  writeFileSync(
+    join(dir, "package.json"),
+    JSON.stringify(
+      {
+        name: "caelo-agent-cli",
+        private: true,
+        dependencies: { "@caelo-cms/provisioning": version },
+        overrides: { "@caelo-cms/shared": version },
+      },
+      null,
+      2,
+    ),
+  );
+  const install = await deps.runner.run([
+    "npm",
+    "install",
+    "--prefix",
+    dir,
+    "--ignore-scripts",
+    "--no-audit",
+    "--no-fund",
+    "--loglevel=error",
+  ]);
+  if (install.exitCode !== 0) {
+    return fail(
+      "npm-install",
+      `npm could not install @caelo-cms/provisioning@${version}: ${tail(install.stderr || install.stdout)}`,
+    );
+  }
+  const audit = await deps.runner.run(["npm", "audit", "signatures", "--prefix", dir]);
+  if (audit.exitCode !== 0) {
+    return fail(
+      "audit-signatures",
+      `npm audit signatures rejected the packages of Caelo ${version}: ${tail(audit.stderr || audit.stdout)}`,
+    );
+  }
+  for (const name of CAELO_CLI_PACKAGES) {
+    let installed: string | undefined;
+    try {
+      installed = (
+        JSON.parse(readFileSync(join(dir, "node_modules", name, "package.json"), "utf8")) as {
+          version?: string;
+        }
+      ).version;
+    } catch {
+      installed = undefined;
+    }
+    if (installed !== version) {
+      return fail("version", `${name}: installed ${installed ?? "nothing"}, expected ${version}`);
+    }
+    const problem = await provenanceProblem(name, version, deps.fetchImpl);
+    if (problem) return fail("provenance", problem);
+  }
+  return { ok: true, cliPath: verifiedCliPath(dir), dir };
+}