@ours.network/install 1.2.1-nightly.3 → 1.2.1-nightly.5

package/README.md

@@ -281,3 +281,17 @@ maintenance reads both formats. Format2 is not readable by older maintenance too
 so this change does not promise executable downgrade support. Restore validates the
 original archive records unchanged, then writes markers for the active target runtime.
 Mixed/incomplete context and component record sets are refused before activation.
+
+### Retrying a Docker installation after a source-policy permission failure
+
+Setup verifies the selected Docker image before reusing it, including when the image
+already exists. If an older installer left a root-owned, mode-0600
+`/opt/ours/sources.json`, setup repairs only that image file's permissions and
+continues. The selected package bytes, build provenance, image execution settings,
+credentials and stored data are retained. The old materialized Dockerfile's known
+COPY instruction is also corrected for future builds. No manual image or volume
+deletion is required; repeat the original setup with the updated installer.
+
+The repair runs isolated verification containers without state mounts or network
+access. Other image verification failures stop setup without replacing the image.
+An interrupted repair can be retried, including after the image tag was replaced.

package/assets/Dockerfile

@@ -3,7 +3,9 @@ FROM node:24 AS toolchain
 RUN apt-get update && apt-get install -y --no-install-recommends build-essential python3 ca-certificates git && rm -rf /var/lib/apt/lists/*
 FROM toolchain AS build
 WORKDIR /opt/ours
-COPY sources.json /opt/ours/sources.json
+# The host selection is private (0600); this non-secret image policy must be
+# readable by arbitrary runtime UIDs while remaining root-owned and non-writable.
+COPY --chmod=644 sources.json /opt/ours/sources.json
 COPY scripts/build/*.mjs /build-scripts/
 COPY scripts/maintenance/build-context.mjs scripts/maintenance/provenance-compare.mjs scripts/maintenance/release-graph.mjs /maintenance/
 RUN --mount=type=secret,id=github_token --mount=type=cache,id=ours-dist-2-npm,target=/root/.npm,sharing=locked node /build-scripts/build.mjs

package/assets/release.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "channel": "nightly",
-  "installerVersion": "1.2.1-nightly.3",
+  "installerVersion": "1.2.1-nightly.5",
   "packages": {
     "@ours.network/sdk": {
       "version": "3.8.1-nightly.3",

package/assets/sources.json

@@ -2,7 +2,7 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.3",
+    "installerVersion": "1.2.1-nightly.5",
     "packages": {
       "@ours.network/sdk": {
         "version": "3.8.1-nightly.3",

package/lib/docker-runtime-repair.mjs

@@ -0,0 +1,105 @@
+/** Qualify cached images before reuse; repair only the known root-owned 0600 policy. */
+import { lstatSync, readFileSync, writeFileSync, mkdtempSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+import { atomicWriteConfig } from './config.mjs';
+
+const policyPath = '/opt/ours/sources.json';
+const digest = bytes => createHash('sha256').update(bytes).digest('hex');
+const fail = message => { throw new Error(`Docker runtime verification refused: ${message}`); };
+const imageId = value => /^sha256:[0-9a-f]{64}$/.test(value ?? '');
+
+export function refreshDockerPolicyCopy(record) {
+  const path = join(record.workDir, 'Dockerfile'), stat = lstatSync(path);
+  if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid() || (stat.mode & 0o7022)) fail('Unsafe retained Dockerfile');
+  const text = readFileSync(path, 'utf8');
+  // Upgrade precisely the formerly shipped instruction; preserve all other assets.
+  const oldLine = /^COPY sources\.json \/opt\/ours\/sources\.json$/m;
+  if (oldLine.test(text)) atomicWriteConfig(path, text.replace(oldLine, 'COPY --chmod=644 sources.json /opt/ours/sources.json'));
+}
+
+const probeScript = `
+const fs = require('node:fs'), crypto = require('node:crypto');
+(async () => {
+  const path = '${policyPath}', s = fs.lstatSync(path);
+  if (!s.isFile() || s.nlink !== 1 || s.uid !== 0 || s.gid !== 0 || ![0o600, 0o644].includes(s.mode & 0o7777)) throw new Error('Unsupported policy ownership/type/mode');
+  let bytes;
+  try { bytes = fs.readFileSync(path); }
+  catch (error) { if (process.getuid() !== 0 && error.code === 'EACCES') { process.exitCode = 74; return; } throw error; }
+  const graph = await import('/opt/ours/maintenance/release-graph.mjs');
+  graph.verifyRuntimeRelease('/opt/ours');
+  const hash = bytes => crypto.createHash('sha256').update(bytes).digest('hex');
+  const records = {};
+  for (const name of ['package.json', 'package-lock.json', 'dependency-tree.json', 'build-context.json']) {
+    const file = '/opt/ours/' + name, stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.nlink !== 1) throw new Error('Unsupported build record');
+    records[name] = hash(fs.readFileSync(file));
+  }
+  console.log(JSON.stringify({ uid: s.uid, gid: s.gid, regular: true, links: s.nlink, mode: s.mode & 0o7777, policyHash: hash(bytes), records }));
+})().catch(error => { console.error(error.message); process.exitCode = 1; });
+`;
+
+export async function qualifyDockerRuntime(record, effects) {
+  if (!/^ours-[a-z0-9-]+$/.test(record.project ?? '')) fail('unexpected installation project');
+  const uid = record.uid ?? 1000, gid = record.gid ?? 1000;
+  if (![uid, gid].every(n => Number.isInteger(n) && n > 0)) fail('non-root runtime UID/GID required');
+  const tag = `${record.project}:runtime`;
+  const inspect = async target => {
+    const { stdout } = await effects.run('docker', ['image', 'inspect', target], { timeout: 60000 });
+    const [value] = JSON.parse(stdout);
+    if (!imageId(value?.Id) || !Array.isArray(value.RootFS?.Layers) || value.Config?.Labels?.['network.ours.build-context'] !== '1') fail('image lacks recognized build metadata');
+    return value;
+  };
+  const probe = async (id, user) => {
+    const name = `ours-runtime-probe-${randomUUID()}`;
+    try {
+      const result = await effects.run('docker', ['run', '--rm', '--name', name, '--read-only', '--network', 'none', '--cap-drop', 'ALL',
+        '--security-opt', 'no-new-privileges:true', '--pids-limit', '64', '--memory', '256m', '--user', user, '--entrypoint', 'node', id, '-e', probeScript],
+      { allowCodes: [1, 74], timeout: 60000 });
+      return { code: result.code, report: result.code === 0 ? JSON.parse(result.stdout) : null };
+    } catch (error) {
+      // A killed Docker client can leave its own bounded probe container behind.
+      try { await effects.run('docker', ['rm', '-f', name], { allowCodes: [1], timeout: 10000 }); } catch {}
+      throw error;
+    }
+  };
+  const policy = readFileSync(record.sourcesPath), expectedHash = digest(policy);
+  const check = (report, mode) => {
+    if (!report || report.mode !== mode || report.uid !== 0 || report.gid !== 0 || !report.regular || report.links !== 1 || report.policyHash !== expectedHash) fail('image policy differs from retained selection or expected permissions');
+  };
+  const original = await inspect(tag);
+  const ordinary = await probe(original.Id, `${uid}:${gid}`);
+  if (ordinary.code === 0) { check(ordinary.report, 0o644); return; }
+  if (ordinary.code !== 74) fail('cached image is unusable; automatic repair only supports the known source-policy permission defect');
+  const privileged = await probe(original.Id, '0:0');
+  if (privileged.code !== 0) fail('original release graph could not be verified');
+  check(privileged.report, 0o600);
+  effects.out?.('Repairing cached Docker image permissions; keeping the selected packages and stored data.');
+  const directory = mkdtempSync(join(record.root, '.image-permissions-'));
+  const name = `ours-permission-repair-${randomUUID()}`, baseTag = `${name}:base`, candidateTag = `${name}:candidate`;
+  try {
+    // Unique local alias transports the immutable ID into BuildKit. The resulting
+    // layer ancestry and complete execution config are checked before publication.
+    await effects.run('docker', ['image', 'tag', original.Id, baseTag]);
+    if ((await inspect(baseTag)).Id !== original.Id) fail('repair base image changed');
+    writeFileSync(join(directory, 'sources.json'), policy, { mode: 0o600, flag: 'wx' });
+    writeFileSync(join(directory, 'Dockerfile'), `FROM ${baseTag}\nCOPY --chmod=644 sources.json ${policyPath}\n`, { mode: 0o600, flag: 'wx' });
+    await effects.run('docker', ['build', '--network=none', '--pull=false', '--tag', candidateTag, directory], { stream: true, timeout: 120000 });
+    const candidate = await inspect(candidateTag);
+    if (!isDeepStrictEqual(candidate.Config, original.Config) || !isDeepStrictEqual(candidate.RootFS.Layers.slice(0, original.RootFS.Layers.length), original.RootFS.Layers)
+        || candidate.RootFS.Layers.length !== original.RootFS.Layers.length + 1) fail('repair changed image execution settings or ancestry');
+    const verified = await probe(candidate.Id, `${uid}:${gid}`);
+    if (verified.code !== 0) fail('repaired image did not pass runtime verification');
+    check(verified.report, 0o644);
+    if (!isDeepStrictEqual(verified.report.records, privileged.report.records)) fail('repair changed build provenance');
+    if ((await inspect(tag)).Id !== original.Id) fail('selected image changed during repair; retry setup');
+    await effects.run('docker', ['image', 'tag', candidate.Id, tag]);
+    effects.out?.('Cached Docker image repaired and verified; continuing setup.');
+  } finally {
+    for (const temporary of [candidateTag, baseTag]) {
+      try { await effects.run('docker', ['image', 'rm', temporary], { allowCodes: [1], timeout: 10000 }); } catch {}
+    }
+    rmSync(directory, { recursive: true, force: true });
+  }
+}

package/lib/effects.mjs

@@ -23,6 +23,7 @@ import { createServerOnboarding } from './server-onboarding.mjs';
 import { atomicWriteConfig, snapshotConfig, restoreConfig } from './config.mjs';
 import { select as selectOnTty, multiselect as multiselectOnTty, askLine as askLineOnTty } from './prompt.mjs';
 import { classifyHarnessProbe } from './logic.mjs';
+import { qualifyDockerRuntime, refreshDockerPolicyCopy } from './docker-runtime-repair.mjs';
 import { classifyStateDir } from './detect.mjs';
 import { BASE_RECORDS, CONTEXT, readBuildRecords, equalBuildRecords, initializeBuildMarker } from '../assets/scripts/maintenance/build-context.mjs';
 import { releaseBinding, verifyReleaseGraph, verifyRuntimeRelease } from '../assets/scripts/maintenance/release-graph.mjs';
@@ -399,7 +400,7 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
     // invocation only and never to the installer's own process: a state
     // directory selected by one run must not leak into anything the operator
     // starts afterwards.
-    run: async (cmd, args, { env: extraEnv = null, stream = false, cwd, sensitive = false, allowCodes = [] } = {}) => {
+    run: async (cmd, args, { env: extraEnv = null, stream = false, cwd, sensitive = false, allowCodes = [], timeout } = {}) => {
       // Always built from this layer's OWN env rather than left to spawnSync's
       // implicit inheritance, so what a child receives is a property of the
       // effects object a caller constructed and not of whatever ambient shell
@@ -410,6 +411,7 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
       const executable = cmd === 'npm' ? npmBin : cmd;
       const r = spawnSync(executable, args, {
         cwd,
+        timeout,
         encoding: 'utf8',
         stdio: [...(stream ? ['ignore', 'inherit', 'inherit'] : ['ignore', 'pipe', 'pipe']), ...(installationLockFd === null ? [] : [installationLockFd])],
         env: childEnv,
@@ -704,6 +706,7 @@ export function networkEffects(effects) {
       else if (!readFileSync(record.sourcesPath).equals(bytes)) throw new Error('Migration source selection changed');
       if (!retainConfig) writePrivateNew(record.configPath, JSON.stringify({ stateDir: record.mode === 'docker' ? '/var/lib/ours' : installationPaths(record).daemon, port: record.port, apiVisibility: 'owner' }, null, 2) + '\n');
     },
+    async qualifyDockerRuntime(record) { return qualifyDockerRuntime(record, effects); },
     async prepareInstallation(record, { runtimeOnly = false } = {}) {
       let copied = false;
       if (!existsSync(record.workDir)) {
@@ -717,11 +720,13 @@ export function networkEffects(effects) {
       if (!existsSync(materialized)) writePrivateNew(materialized, retained);
       else if (!readFileSync(materialized).equals(retained)) throw new Error('Materialized sources differ from retained selection');
       if (record.mode === 'docker') {
+        refreshDockerPolicyCopy(record);
         // The installer owns these dependencies in both installation modes.
         const { dependencies } = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
         writeFileSync(join(record.workDir, 'scripts/maintenance/package.json'), JSON.stringify({ private: true, type: 'module', dependencies }, null, 2) + '\n', { mode: 0o600 });
         const image = await effects.run('docker', ['image', 'inspect', `${record.project}:runtime`], { allowCodes: [1] });
         if (image.code !== 0) await compose(record, ['build', 'daemon'], { stream: true, env: { BUILDKIT_PROGRESS: 'plain' } });
+        await effects.qualifyDockerRuntime(record);
         if (runtimeOnly) return;
         await compose(record, ['run', '--rm', '--no-deps', '-T', 'prepare', 'prepare']);
       } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "1.2.1-nightly.3",
+  "version": "1.2.1-nightly.5",
   "private": false,
   "description": "The all-in-one ours.network installer: one shared daemon, MCP, cowork, Telegram, Fleet initialization, harness plugins, Human identity, progress UI, and guided next steps.",
   "type": "module",