@supacloud/admin 0.7.10 → 0.7.12

package/README.md

@@ -49,11 +49,13 @@ Local artifact transport downloads exact releases directly on the Admin host,
 verifies their signed release manifests, checksums, sizes, provenance, source
 commit, and architecture, then transfers them through an atomic SFTP staging
 directory. The server takes root ownership, repeats offline verification, and
-runs the uploaded target Management binary without GitHub egress or a
-third-party proxy. The server reuses an installed `gh` only when it supports all
-required strict attestation flags. Otherwise Admin transfers a pinned temporary
-Linux `gh` verifier that is removed with the staging directory and never
-replaces `/usr/local/bin/gh`.
+runs the uploaded target Management binary without GitHub or Sigstore TUF
+egress or a third-party proxy. Admin and Management use the same reviewed,
+digest-pinned Sigstore Public Good trusted root via `--custom-trusted-root`, so
+the offline handoff does not depend on a pre-populated TUF cache. The server
+reuses an installed `gh` only when it supports all required strict attestation
+flags. Otherwise Admin transfers a pinned temporary Linux `gh` verifier that is
+removed with the staging directory and never replaces `/usr/local/bin/gh`.
 
 The command supports direct root SSH and passwordless `sudo -n`. The transaction
 runs in a uniquely named transient systemd unit with protected atomic status

package/dist/index.js

@@ -25703,7 +25703,7 @@ class HttpTransport {
 
 // src/shared/tools/ssh-tools.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { dirname } from "node:path";
+import { basename as basename3, dirname, join as join2 } from "node:path";
 
 // src/shared/releases/local-upgrade-transfer.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
@@ -25735,10 +25735,10 @@ function quoteShell(shellText) {
 
 // src/shared/releases/local-upgrade-bundle.ts
 import { spawn } from "node:child_process";
-import { createHash, randomUUID as randomUUID2 } from "node:crypto";
-import { accessSync, chmodSync, constants as fsConstants, createWriteStream, mkdirSync, mkdtempSync, readFileSync as readFileSync3, rmSync, statSync, writeFileSync } from "node:fs";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { accessSync, chmodSync as chmodSync2, constants as fsConstants, createWriteStream, lstatSync, mkdirSync, mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, readdirSync, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { get } from "node:https";
-import { tmpdir } from "node:os";
+import { tmpdir as tmpdir2 } from "node:os";
 import { basename, delimiter, join } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { Transform as Transform2 } from "node:stream";
@@ -25905,6 +25905,97 @@ function parseReleaseChecksums(text, manifest) {
   return checksums;
 }
 
+// ../management-api/src/sigstore-trusted-root.ts
+import { createHash } from "node:crypto";
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+// ../management-api/src/assets/sigstore-public-good-trusted-root.jsonl
+var sigstore_public_good_trusted_root_default = '{"mediaType":"application/vnd.dev.sigstore.trustedroot+json;version=0.1","tlogs":[{"baseUrl":"https://rekor.sigstore.dev","hashAlgorithm":"SHA2_256","publicKey":{"rawBytes":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==","keyDetails":"PKIX_ECDSA_P256_SHA_256","validFor":{"start":"2021-01-12T11:53:27Z"}},"logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}},{"baseUrl":"https://log2025-1.rekor.sigstore.dev","hashAlgorithm":"SHA2_256","publicKey":{"rawBytes":"MCowBQYDK2VwAyEAt8rlp1knGwjfbcXAYPYAkn0XiLz1x8O4t0YkEhie244=","keyDetails":"PKIX_ED25519","validFor":{"start":"2025-09-23T00:00:00Z"}},"logId":{"keyId":"zxGZFVvd0FEmjR8WrFwMdcAJ9vtaY/QXf44Y1wUeP6A="}}],"certificateAuthorities":[{"subject":{"organization":"sigstore.dev","commonName":"sigstore"},"uri":"https://fulcio.sigstore.dev","certChain":{"certificates":[{"rawBytes":"MIIB+DCCAX6gAwIBAgITNVkDZoCiofPDsy7dfm6geLbuhzAKBggqhkjOPQQDAzAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIxMDMwNzAzMjAyOVoXDTMxMDIyMzAzMjAyOVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABLSyA7Ii5k+pNO8ZEWY0ylemWDowOkNa3kL+GZE5Z5GWehL9/A9bRNA3RbrsZ5i0JcastaRL7Sp5fp/jD5dxqc/UdTVnlvS16an+2Yfswe/QuLolRUCrcOE2+2iA5+tzd6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFMjFHQBBmiQpMlEk6w2uSu1KBtPsMB8GA1UdIwQYMBaAFMjFHQBBmiQpMlEk6w2uSu1KBtPsMAoGCCqGSM49BAMDA2gAMGUCMH8liWJfMui6vXXBhjDgY4MwslmN/TJxVe/83WrFomwmNf056y1X48F9c4m3a3ozXAIxAKjRay5/aj/jsKKGIkmQatjI8uupHr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ=="}]},"validFor":{"start":"2021-03-07T03:20:29Z","end":"2022-12-31T23:59:59.999Z"}},{"subject":{"organization":"sigstore.dev","commonName":"sigstore"},"uri":"https://fulcio.sigstore.dev","certChain":{"certificates":[{"rawBytes":"MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow="},{"rawBytes":"MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"}]},"validFor":{"start":"2022-04-13T20:06:15Z"}}],"ctlogs":[{"baseUrl":"https://ctfe.sigstore.dev/test","hashAlgorithm":"SHA2_256","publicKey":{"rawBytes":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbfwR+RJudXscgRBRpKX1XFDy3PyudDxz/SfnRi1fT8ekpfBd2O1uoz7jr3Z8nKzxA69EUQ+eFCFI3zeubPWU7w==","keyDetails":"PKIX_ECDSA_P256_SHA_256","validFor":{"start":"2021-03-14T00:00:00Z","end":"2022-10-31T23:59:59.999Z"}},"logId":{"keyId":"CGCS8ChS/2hF0dFrJ4ScRWcYrBY9wzjSbea8IgY2b3I="}},{"baseUrl":"https://ctfe.sigstore.dev/2022","hashAlgorithm":"SHA2_256","publicKey":{"rawBytes":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiPSlFi0CmFTfEjCUqF9HuCEcYXNKAaYalIJmBZ8yyezPjTqhxrKBpMnaocVtLJBI1eM3uXnQzQGAJdJ4gs9Fyw==","keyDetails":"PKIX_ECDSA_P256_SHA_256","validFor":{"start":"2022-10-20T00:00:00Z"}},"logId":{"keyId":"3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4="}}],"timestampAuthorities":[{"subject":{"organization":"sigstore.dev","commonName":"sigstore-tsa-selfsigned"},"uri":"https://timestamp.sigstore.dev/api/v1/timestamp","certChain":{"certificates":[{"rawBytes":"MIICEDCCAZagAwIBAgIUOhNULwyQYe68wUMvy4qOiyojiwwwCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMC4xFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE4ra2Z8hKNig2T9kFjCAToGG30jky+WQv3BzL+mKvh1SKNR/UwuwsfNCg4sryoYAd8E6isovVA3M4aoNdm9QDi50Z8nTEyvqgfDPtTIwXItfiW/AFf1V7uwkbkAoj0xxco2owaDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFIn9eUOHz9BlRsMCRscsc1t9tOsDMB8GA1UdIwQYMBaAFJjsAe9/u1H/1JUeb4qImFMHic6/MBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMAoGCCqGSM49BAMDA2gAMGUCMDtpsV/6KaO0qyF/UMsX2aSUXKQFdoGTptQGc0ftq1csulHPGG6dsmyMNd3JB+G3EQIxAOajvBcjpJmKb4Nv+2Taoj8Uc5+b6ih6FXCCKraSqupe07zqswMcXJTe1cExvHvvlw=="},{"rawBytes":"MIIB9zCCAXygAwIBAgIUV7f0GLDOoEzIh8LXSW80OJiUp14wCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQUQNtfRT/ou3YATa6wB/kKTe70cfJwyRIBovMnt8RcJph/COE82uyS6FmppLLL1VBPGcPfpQPYJNXzWwi8icwhKQ6W/Qe2h3oebBb2FHpwNJDqo+TMaC/tdfkv/ElJB72jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSY7AHvf7tR/9SVHm+KiJhTB4nOvzAKBggqhkjOPQQDAwNpADBmAjEAwGEGrfGZR1cen1R8/DTVMI943LssZmJRtDp/i7SfGHmGRP6gRbuj9vOK3b67Z0QQAjEAuT2H673LQEaHTcyQSZrkp4mX7WwkmF+sVbkYY5mXN+RMH13KUEHHOqASaemYWK/E"}]},"validFor":{"start":"2025-07-04T00:00:00Z"}}]}\n';
+
+// ../management-api/src/sigstore-trusted-root.ts
+var SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME = "trusted_root.jsonl";
+var SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SHA256 = "3c2cc7f357dc064ec527fdcd78da6e9245c21a381e1abaa0f2b62b186bcac1a1";
+var SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SIZE = 5748;
+function sha256(text) {
+  return createHash("sha256").update(text).digest("hex");
+}
+function validateEmbeddedTrustedRoot(jsonl) {
+  if (Buffer.byteLength(jsonl) !== SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SIZE || sha256(jsonl) !== SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SHA256) {
+    throw new Error("Embedded Sigstore Public Good trusted root does not match its pinned digest");
+  }
+  if (!jsonl.endsWith(`
+`) || jsonl.slice(0, -1).includes(`
+`)) {
+    throw new Error("Embedded Sigstore Public Good trusted root must be compact JSONL");
+  }
+  let trustedRoot;
+  try {
+    trustedRoot = JSON.parse(jsonl);
+  } catch {
+    throw new Error("Embedded Sigstore Public Good trusted root is not valid JSON");
+  }
+  if (!trustedRoot || typeof trustedRoot !== "object" || Array.isArray(trustedRoot) || `${JSON.stringify(trustedRoot)}
+` !== jsonl) {
+    throw new Error("Embedded Sigstore Public Good trusted root is not canonical compact JSONL");
+  }
+  return jsonl;
+}
+var SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_JSONL = validateEmbeddedTrustedRoot(sigstore_public_good_trusted_root_default);
+function createSigstoreVerificationDirectory() {
+  const directory = mkdtempSync(path.join(tmpdir(), "supacloud-sigstore-"));
+  try {
+    chmodSync(directory, 448);
+    const trustedRootPath = path.join(directory, SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME);
+    writeFileSync(trustedRootPath, SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_JSONL, {
+      flag: "wx",
+      mode: 384
+    });
+    chmodSync(trustedRootPath, 384);
+    return { directory, trustedRootPath };
+  } catch (operationError) {
+    try {
+      rmSync(directory, { recursive: true });
+    } catch (cleanupError) {
+      throw new AggregateError([operationError, cleanupError], "Sigstore trusted root creation failed and temporary directory cleanup did not complete");
+    }
+    throw operationError;
+  }
+}
+function throwVerificationDirectoryOutcome(outcome) {
+  if (outcome.operationFailed && outcome.cleanupFailed) {
+    throw new AggregateError([outcome.operationError, outcome.cleanupError], "Sigstore verification failed and temporary trusted root cleanup did not complete");
+  }
+  if (outcome.operationFailed)
+    throw outcome.operationError;
+  if (outcome.cleanupFailed) {
+    throw new AggregateError([outcome.cleanupError], "Temporary Sigstore trusted root cleanup did not complete");
+  }
+}
+async function withSigstoreVerificationDirectory(operation) {
+  const resources = createSigstoreVerificationDirectory();
+  let operationOutput;
+  let operationFailed = false;
+  let operationError;
+  try {
+    operationOutput = await operation(resources);
+  } catch (error) {
+    operationFailed = true;
+    operationError = error;
+  }
+  let cleanupFailed = false;
+  let cleanupError;
+  try {
+    rmSync(resources.directory, { recursive: true });
+  } catch (error) {
+    cleanupFailed = true;
+    cleanupError = error;
+  }
+  throwVerificationDirectoryOutcome({ operationFailed, operationError, cleanupFailed, cleanupError });
+  return operationOutput;
+}
+
 // src/shared/releases/local-upgrade-bundle.ts
 var RELEASES_API = `https://api.github.com/repos/${RELEASE_REPOSITORY}/releases`;
 var ATTESTATIONS_API = `https://api.github.com/repos/${RELEASE_REPOSITORY}/attestations`;
@@ -25938,7 +26029,8 @@ var STRICT_GITHUB_CAPABILITY_FLAGS = [
   "--signer-workflow",
   "--source-ref",
   "--source-digest",
-  "--deny-self-hosted-runners"
+  "--deny-self-hosted-runners",
+  "--custom-trusted-root"
 ];
 
 class RetryableDownloadError extends Error {
@@ -25953,7 +26045,56 @@ function githubCliArchiveIdentity(architecture) {
   };
 }
 function sha256File(filePath) {
-  return createHash("sha256").update(readFileSync3(filePath)).digest("hex");
+  return createHash2("sha256").update(readFileSync3(filePath)).digest("hex");
+}
+function effectiveLocalOwner() {
+  if (process.platform === "win32")
+    return;
+  const uid = process.geteuid?.() ?? process.getuid?.();
+  const gid = process.getegid?.() ?? process.getgid?.();
+  if (uid === undefined || gid === undefined) {
+    throw new Error("Local artifact transport requires POSIX ownership checks");
+  }
+  return { uid, gid };
+}
+function assertLocalOwner(uid, gid, label) {
+  const owner = effectiveLocalOwner();
+  if (!owner)
+    return;
+  if (uid !== owner.uid || gid !== owner.gid) {
+    throw new Error(`${label} must be owned by the current effective user`);
+  }
+}
+function assertLocalTrustedRootDirectory(directory) {
+  const directoryStats = lstatSync(directory);
+  if (!directoryStats.isDirectory() || directoryStats.isSymbolicLink()) {
+    throw new Error("Local trusted-root directory must be a directory without links");
+  }
+  assertPrivateLocalDirectoryMode(directoryStats.mode, "Local trusted-root directory");
+  assertLocalOwner(directoryStats.uid, directoryStats.gid, "Local trusted-root directory");
+  const entries = readdirSync(directory);
+  if (entries.length !== 1 || entries[0] !== SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME) {
+    throw new Error("Local trusted-root directory does not match its strict file allowlist");
+  }
+  const trustedRootPath = join(directory, SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME);
+  assertLocalTrustedRootFile(trustedRootPath);
+  return trustedRootPath;
+}
+function assertPrivateLocalDirectoryMode(mode, label) {
+  if (process.platform !== "win32" && (mode & 4095) !== 448) {
+    throw new Error(`${label} must use exact mode 0700 without special permission bits`);
+  }
+}
+function assertLocalTrustedRootFile(trustedRootPath) {
+  const stats = lstatSync(trustedRootPath);
+  if (!stats.isFile() || stats.isSymbolicLink() || stats.nlink !== 1) {
+    throw new Error("Local trusted root must be a direct regular file without links");
+  }
+  assertPrivateLocalFileMode(stats.mode, "Local trusted root");
+  assertLocalOwner(stats.uid, stats.gid, "Local trusted root");
+  if (stats.size !== SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SIZE || sha256File(trustedRootPath) !== SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SHA256) {
+    throw new Error("Local trusted root does not match its pinned size and digest");
+  }
 }
 function assertPrivateLocalFileMode(mode, label) {
   if (process.platform !== "win32" && (mode & 4095) !== 384) {
@@ -26055,10 +26196,10 @@ async function downloadDirect(url, destination, maxBytes) {
   const deadline = Date.now() + DOWNLOAD_TIMEOUT_MS;
   const retryFailures = [];
   for (let attempt = 1;attempt <= 3; attempt += 1) {
-    rmSync(destination, { force: true });
+    rmSync2(destination, { force: true });
     try {
       await downloadHttpsResponse({ url: parsed, destination, maxBytes, redirects: 0, deadline });
-      chmodSync(destination, 384);
+      chmodSync2(destination, 384);
       return;
     } catch (error) {
       if (!downloadCanRetry(error))
@@ -26214,13 +26355,13 @@ async function assertLocalGithubVerifier() {
     throw new Error("Local artifact transport requires a current gh attestation verifier");
   }
 }
-async function verifyManifestAttestation(manifestPath, bundlePath, manifest) {
-  const verification = await runGithubCli([
+function githubAttestationVerificationArguments(request) {
+  return [
     "attestation",
     "verify",
-    manifestPath,
+    request.artifactPath,
     "--bundle",
-    bundlePath,
+    request.bundlePath,
     "--repo",
     RELEASE_REPOSITORY,
     "--signer-workflow",
@@ -26228,9 +26369,14 @@ async function verifyManifestAttestation(manifestPath, bundlePath, manifest) {
     "--source-ref",
     RELEASE_SOURCE_REF,
     "--source-digest",
-    manifest.source.commit,
-    "--deny-self-hosted-runners"
-  ], GH_VERIFICATION_TIMEOUT_MS);
+    request.manifest.source.commit,
+    "--deny-self-hosted-runners",
+    "--custom-trusted-root",
+    request.trustedRootPath
+  ];
+}
+async function verifyManifestAttestation(request) {
+  const verification = await runGithubCli(githubAttestationVerificationArguments(request), GH_VERIFICATION_TIMEOUT_MS);
   if (verification.exitCode !== 0) {
     throw new Error(`gh attestation verify failed: ${verification.stderr.trim().slice(-1000) || verification.exitCode}`);
   }
@@ -26261,7 +26407,7 @@ async function downloadReleaseMetadata(component, version, directory) {
     await downloadDirect(`${RELEASES_API}/tags/${expectedTag}`, metadataPath, RELEASE_BUNDLE_SIZE_LIMITS.manifest);
     return parseGithubReleaseMetadata(parseJsonFile(metadataPath, "GitHub release metadata"), expectedTag);
   } finally {
-    rmSync(metadataPath, { force: true });
+    rmSync2(metadataPath, { force: true });
   }
 }
 async function downloadManifestAttestation(manifestPath, destination) {
@@ -26269,10 +26415,10 @@ async function downloadManifestAttestation(manifestPath, destination) {
   try {
     await downloadDirect(`${ATTESTATIONS_API}/sha256:${sha256File(manifestPath)}`, responsePath, RELEASE_BUNDLE_SIZE_LIMITS.attestation);
     const bundles = serializeAttestationBundles(parseJsonFile(responsePath, "GitHub attestation response"));
-    writeFileSync(destination, bundles, { mode: 384, flag: "wx" });
-    chmodSync(destination, 384);
+    writeFileSync2(destination, bundles, { mode: 384, flag: "wx" });
+    chmodSync2(destination, 384);
   } finally {
-    rmSync(responsePath, { force: true });
+    rmSync2(responsePath, { force: true });
   }
 }
 async function downloadComponent(request) {
@@ -26282,7 +26428,12 @@ async function downloadComponent(request) {
   await downloadDirect(releaseAssetUrl(release, RELEASE_MANIFEST_NAME), manifestPath, RELEASE_BUNDLE_SIZE_LIMITS.manifest);
   const manifest = parseReleaseManifest(readFileSync3(manifestPath, "utf8"), request);
   await downloadManifestAttestation(manifestPath, attestationPath);
-  await verifyManifestAttestation(manifestPath, attestationPath, manifest);
+  await verifyManifestAttestation({
+    artifactPath: manifestPath,
+    bundlePath: attestationPath,
+    manifest,
+    trustedRootPath: request.trustedRootPath
+  });
   const checksumsPath = directChildPath(request.destination, RELEASE_CHECKSUMS_NAME);
   await downloadDirect(releaseAssetUrl(release, RELEASE_CHECKSUMS_NAME), checksumsPath, RELEASE_BUNDLE_SIZE_LIMITS.checksums);
   assertSignedArtifact(checksumsPath, manifest);
@@ -26305,7 +26456,7 @@ async function downloadPinnedGithubCli(directory, architecture) {
   return localUpgradeFile(archivePath, `verifier/${identity.archiveName}`);
 }
 function cleanupLocalUpgradeBundle(bundle) {
-  rmSync(bundle.directory, { recursive: true, force: true });
+  rmSync2(bundle.directory, { recursive: true, force: true });
 }
 function assertLocalUpgradeBundleSize(files) {
   const totalBytes = files.reduce((sum, file) => sum + file.size, 0);
@@ -26342,15 +26493,15 @@ async function settleLocalBundleDownloads(downloads) {
   ];
 }
 function createLocalBundleLayout(request) {
-  const directory = mkdtempSync(join(tmpdir(), "supacloud-admin-upgrade-"));
-  chmodSync(directory, 448);
+  const directory = mkdtempSync2(join(tmpdir2(), "supacloud-admin-upgrade-"));
+  chmodSync2(directory, 448);
   const bundleDirectory = join(directory, "bundle");
   const managementDirectory = join(bundleDirectory, "management-api");
   const edgeDirectory = join(bundleDirectory, "edge-runtime");
   const verifierDirectory = join(directory, "verifier");
   for (const createdDirectory of [bundleDirectory, managementDirectory, edgeDirectory, verifierDirectory]) {
     mkdirSync(createdDirectory, { recursive: true, mode: 448 });
-    chmodSync(createdDirectory, 448);
+    chmodSync2(createdDirectory, 448);
   }
   return {
     directory,
@@ -26361,20 +26512,22 @@ function createLocalBundleLayout(request) {
     edgeRuntimeBinaryName: `supacloud-edge-runtime-linux-${request.architecture}`
   };
 }
-async function downloadLocalBundle(request, layout) {
+async function downloadLocalBundle(request, layout, trustedRootPath) {
   const { managementBinaryName, edgeRuntimeBinaryName } = layout;
   const [managementFiles, edgeFiles, verifierArchive] = await settleLocalBundleDownloads([
     downloadComponent({
       component: "management-api",
       version: request.managementVersion,
       assetNames: [managementBinaryName, "web-console-build.tar.gz"],
-      destination: layout.managementDirectory
+      destination: layout.managementDirectory,
+      trustedRootPath
     }),
     downloadComponent({
       component: "edge-runtime",
       version: request.edgeRuntimeVersion,
       assetNames: [edgeRuntimeBinaryName],
-      destination: layout.edgeDirectory
+      destination: layout.edgeDirectory,
+      trustedRootPath
     }),
     request.verifierProvisioning === "bundled" ? downloadPinnedGithubCli(layout.verifierDirectory, request.architecture) : Promise.resolve(null)
   ]);
@@ -26388,9 +26541,16 @@ async function prepareLocalUpgradeBundle(request) {
   await assertLocalGithubVerifier();
   const layout = createLocalBundleLayout(request);
   try {
-    return await downloadLocalBundle(request, layout);
+    return await withSigstoreVerificationDirectory(async (verificationDirectory) => {
+      const trustedRootPath = assertLocalTrustedRootDirectory(verificationDirectory.directory);
+      return await downloadLocalBundle(request, layout, trustedRootPath);
+    });
   } catch (error) {
-    rmSync(layout.directory, { recursive: true, force: true });
+    try {
+      rmSync2(layout.directory, { recursive: true, force: true });
+    } catch (cleanupError) {
+      throw new AggregateError([error, cleanupError], "Local bundle preparation failed and cleanup did not complete");
+    }
     throw error;
   }
 }
@@ -26400,6 +26560,7 @@ var REMOTE_STAGE_ROOT = "/var/lib/supacloud/upgrade-staging";
 var REMOTE_RUN_ROOT = "/var/lib/supacloud/upgrade-runs";
 var REMOTE_LOG_ROOT = "/var/log/supacloud";
 var REMOTE_UPLOAD_ROOT = "/var/tmp";
+var REMOTE_COMMAND_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var POLL_INTERVAL_MS = 2000;
 var STATE_READ_ATTEMPTS = 3;
 var REMOTE_STATE_READ_TIMEOUT_MS = 15000;
@@ -26458,11 +26619,12 @@ function buildRemotePreflightScript() {
   const capabilityFlags = STRICT_GITHUB_CAPABILITY_FLAGS.join(" ");
   return [
     "set -euo pipefail",
-    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+    `PATH=${REMOTE_COMMAND_PATH}`,
     "export PATH",
     trustedInstalledGithubFunction(),
     "test -d /run/systemd/system || { echo 'systemd is not the active init system' >&2; exit 1; }",
-    'for tool in systemctl systemd-run sha256sum stat realpath tar file find sort awk grep timeout flock; do command -v "$tool" >/dev/null 2>&1 || { echo "Required local-upgrade tool is missing: $tool" >&2; exit 127; }; done',
+    'for tool in systemctl systemd-run sha256sum stat realpath tar file find sort awk grep tail timeout flock; do command -v "$tool" >/dev/null 2>&1 || { echo "Required local-upgrade tool is missing: $tool" >&2; exit 127; }; done',
+    "tail -n 0 -- /dev/null >/dev/null 2>&1 || { echo 'A tail implementation with -n and -- support is required' >&2; exit 1; }",
     "systemd-run --help | grep -Eq -- '(^|[[:space:]])--collect([=[:space:]]|$)' || { echo 'systemd-run --collect is required' >&2; exit 1; }",
     "test -d /run/lock || { echo '/run/lock is unavailable' >&2; exit 1; }",
     "test -d /var/lib/supacloud || { echo '/var/lib/supacloud is unavailable' >&2; exit 1; }",
@@ -26586,7 +26748,7 @@ function upgradeScriptSetup(paths) {
     "#!/usr/bin/env bash",
     "set -euo pipefail",
     "umask 077",
-    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+    `PATH=${REMOTE_COMMAND_PATH}`,
     "export PATH",
     `STAGE=${quoteShell2(paths.stage)}`,
     `STATUS=${quoteShell2(paths.status)}`,
@@ -26604,7 +26766,7 @@ function upgradeScriptSetup(paths) {
     "write_status RUNNING",
     buildUpgradeLockScript(SUPACLOUD_UPGRADE_LOCK_PATH),
     `while IFS='=' read -r variable _; do case "$variable" in *PROXY*|*Proxy*|*proxy*) unset "$variable" ;; esac; done < <(env)`,
-    "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW NODE_USE_ENV_PROXY"
+    "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW SUPACLOUD_ATTESTATION_TRUSTED_ROOT NODE_USE_ENV_PROXY"
   ];
 }
 function upgradeScriptFilesystemChecks(bundle) {
@@ -26889,9 +27051,11 @@ async function observeRemoteState(ssh, paths, observation) {
 }
 async function remoteLogTail(ssh, paths) {
   const script = [
+    `PATH=${REMOTE_COMMAND_PATH}`,
+    "export PATH",
     `LOG=${quoteShell2(paths.log)}`,
     `test -f "$LOG" && test ! -L "$LOG" || { echo 'Remote upgrade log is not a regular file' >&2; exit 1; }`,
-    'tail -80 -- "$LOG"'
+    'tail -n 80 -- "$LOG"'
   ].join(`
 `);
   const output = await ssh.exec(rootCommand(script), 15000);
@@ -27102,493 +27266,7 @@ async function executeLocalUpgradeTransfer(ssh, request) {
 }
 
 // ../../scripts/lib/release_assets.sh
-var release_assets_default = `#!/usr/bin/env bash
-
-SUPACLOUD_GITHUB_REPOSITORY="\${SUPACLOUD_GITHUB_REPOSITORY:-zuohuadong/supacloud}"
-SUPACLOUD_RELEASES_API="\${SUPACLOUD_RELEASES_API:-https://api.github.com/repos/\${SUPACLOUD_GITHUB_REPOSITORY}/releases}"
-SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW="\${SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW:-\${SUPACLOUD_GITHUB_REPOSITORY}/.github/workflows/release-please.yml}"
-SUPACLOUD_GH_VERSION="\${SUPACLOUD_GH_VERSION:-2.96.0}"
-SUPACLOUD_GH_MIN_VERSION="\${SUPACLOUD_GH_MIN_VERSION:-2.68.0}"
-SUPACLOUD_GH_AMD64_SHA256="\${SUPACLOUD_GH_AMD64_SHA256:-83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60}"
-SUPACLOUD_GH_ARM64_SHA256="\${SUPACLOUD_GH_ARM64_SHA256:-06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909}"
-
-supacloud_curl_release_json() {
-    local url="$1"
-    local output="$2"
-    curl -fsSL --proto '=https' --proto-redir '=https' \\
-        --retry 1 --retry-delay 2 --retry-max-time 60 \\
-        --connect-timeout 15 --max-time 30 --speed-limit 128 --speed-time 10 \\
-        -o "$output" "$url"
-}
-
-supacloud_curl_release_asset() {
-    local url="$1"
-    local output="$2"
-    curl -fL --proto '=https' --proto-redir '=https' \\
-        --retry 1 --retry-delay 2 --retry-max-time 180 \\
-        --connect-timeout 15 --max-time 90 --speed-limit 128 --speed-time 60 \\
-        -o "$output" "$url"
-}
-
-supacloud_component_tag() {
-    local component="$1"
-    local version="$2"
-    case "$version" in
-        "\${component}-v"*) printf '%s' "$version" ;;
-        v*) printf '%s-%s' "$component" "$version" ;;
-        *) printf '%s-v%s' "$component" "$version" ;;
-    esac
-}
-
-supacloud_select_release() {
-    local component="$1"
-    shift
-    local required_assets_json
-    [[ $# -gt 0 ]] || {
-        echo "at least one required release asset must be specified" >&2
-        return 1
-    }
-    required_assets_json=$(printf '%s\\n' "$@" | jq -Rsc 'split("\\n")[:-1]')
-    jq -ce --arg prefix "\${component}-v" --argjson required "$required_assets_json" '
-        map(select(
-            (.draft | not)
-            and (.prerelease | not)
-            and (.tag_name | startswith($prefix))
-            and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))
-            and any(.assets[]?; .name == "SHA256SUMS")
-        ))
-        | first
-        // error("no matching component release contains all required assets and SHA256SUMS")
-    '
-}
-
-supacloud_fetch_component_release() {
-    local component="$1"
-    local version="\${2:-latest}"
-    shift 2
-    local required_assets=("$@")
-    local required_assets_json
-    local response
-    [[ \${#required_assets[@]} -gt 0 ]] || {
-        echo "at least one required release asset must be specified" >&2
-        return 1
-    }
-    required_assets_json=$(printf '%s\\n' "\${required_assets[@]}" | jq -Rsc 'split("\\n")[:-1]')
-
-    if [[ -n "$version" && "$version" != "latest" ]]; then
-        local tag
-        tag=$(supacloud_component_tag "$component" "$version")
-        response=$(supacloud_fetch_release_json "\${SUPACLOUD_RELEASES_API}/tags/\${tag}") || return 1
-        jq -ce --argjson required "$required_assets_json" '
-            select(
-                (.draft | not)
-                and (.prerelease | not)
-                and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))
-                and any(.assets[]?; .name == "SHA256SUMS")
-            )
-            // error("release does not contain all required assets and SHA256SUMS")
-        ' <<< "$response"
-        return
-    fi
-
-    response=$(supacloud_fetch_release_json "\${SUPACLOUD_RELEASES_API}?per_page=100") || return 1
-    supacloud_select_release "$component" "\${required_assets[@]}" <<< "$response"
-}
-
-supacloud_fetch_release_json() (
-    local url="$1"
-    local response_file
-    response_file=$(mktemp) || return 1
-    trap 'rm -f "$response_file"' EXIT
-    trap 'trap - EXIT HUP INT TERM; rm -f "$response_file"; exit 1' HUP INT TERM
-    supacloud_download_release_metadata_url "$url" "$response_file" || return 1
-    cat "$response_file"
-)
-
-supacloud_release_asset_url() {
-    local release_json="$1"
-    local asset_name="$2"
-    jq -er --arg asset "$asset_name" '
-        first(.assets[]? | select(.name == $asset) | .browser_download_url)
-        // error("release asset URL is missing")
-    ' <<< "$release_json"
-}
-
-supacloud_download_url() {
-    local url="$1"
-    local output="$2"
-    local proxy="\${SUPACLOUD_GITHUB_PROXY:-\${GH_PROXY:-}}"
-
-    if supacloud_curl_release_asset "$url" "$output"; then
-        return 0
-    fi
-    if [[ -n "$proxy" ]]; then
-        supacloud_curl_release_asset "\${proxy%/}/\${url}" "$output"
-        return
-    fi
-    return 1
-}
-
-supacloud_download_release_metadata_url() {
-    local url="$1"
-    local output="$2"
-    local proxy="\${SUPACLOUD_GITHUB_PROXY:-\${GH_PROXY:-}}"
-
-    if supacloud_curl_release_json "$url" "$output"; then
-        return 0
-    fi
-    if [[ -n "$proxy" ]]; then
-        supacloud_curl_release_json "\${proxy%/}/\${url}" "$output"
-        return
-    fi
-    return 1
-}
-
-supacloud_verify_checksum() {
-    local artifact_file="$1"
-    local asset_name="$2"
-    local checksum_file="$3"
-    local expected
-    expected=$(awk -v asset="$asset_name" '$2 == asset || $2 == "*" asset { print $1; exit }' "$checksum_file")
-    if [[ ! "$expected" =~ ^[0-9a-fA-F]{64}$ ]]; then
-        echo "SHA256SUMS does not contain a valid checksum for \${asset_name}" >&2
-        return 1
-    fi
-
-    local actual
-    actual=$(sha256sum "$artifact_file" | awk '{print $1}')
-    actual=$(printf '%s' "$actual" | tr '[:upper:]' '[:lower:]')
-    expected=$(printf '%s' "$expected" | tr '[:upper:]' '[:lower:]')
-    if [[ "$actual" != "$expected" ]]; then
-        echo "SHA256 mismatch for \${asset_name}" >&2
-        return 1
-    fi
-}
-
-supacloud_validate_binary() {
-    local artifact_file="$1"
-    local asset_name="$2"
-    local description
-    description=$(file -b "$artifact_file")
-    if [[ "$description" != *ELF* ]]; then
-        echo "\${asset_name} is not an ELF binary: \${description}" >&2
-        return 1
-    fi
-
-    case "$asset_name" in
-        *amd64)
-            [[ "$description" == *x86-64* || "$description" == *x86_64* ]] || {
-                echo "\${asset_name} does not contain an x86-64 ELF binary" >&2
-                return 1
-            }
-            ;;
-        *arm64)
-            [[ "$description" == *aarch64* || "$description" == *ARM64* ]] || {
-                echo "\${asset_name} does not contain an arm64 ELF binary" >&2
-                return 1
-            }
-            ;;
-    esac
-}
-
-supacloud_install_pinned_tar_xz_binary() (
-    local archive="$1"
-    local member="$2"
-    local expected_sha256="$3"
-    local arch="$4"
-    local target="$5"
-    local actual_sha256 member_count member_details extract_dir candidate staged_target
-
-    actual_sha256=$(sha256sum "$archive" | awk '{print $1}')
-    actual_sha256=$(printf '%s' "$actual_sha256" | tr '[:upper:]' '[:lower:]')
-    expected_sha256=$(printf '%s' "$expected_sha256" | tr '[:upper:]' '[:lower:]')
-    if [[ ! "$expected_sha256" =~ ^[0-9a-f]{64}$ || "$actual_sha256" != "$expected_sha256" ]]; then
-        echo "SHA256 mismatch for pinned archive" >&2
-        return 1
-    fi
-
-    member_count=$(tar -tJf "$archive" | grep -Fxc "$member" || true)
-    if [[ "$member_count" != "1" ]]; then
-        echo "Pinned archive must contain the exact member once: $member" >&2
-        return 1
-    fi
-    member_details=$(tar -tvJf "$archive" "$member") || return 1
-    if [[ "\${member_details:0:1}" != "-" ]]; then
-        echo "Pinned archive member is not a regular file: $member" >&2
-        return 1
-    fi
-
-    extract_dir=$(mktemp -d)
-    trap 'rm -rf "$extract_dir"; [[ -z "\${staged_target:-}" ]] || rm -f "$staged_target"' EXIT
-    trap 'trap - EXIT HUP INT TERM; rm -rf "$extract_dir"; [[ -z "\${staged_target:-}" ]] || rm -f "$staged_target"; exit 1' HUP INT TERM
-    if ! tar --no-same-owner --no-same-permissions -xJf "$archive" -C "$extract_dir" "$member"; then
-        return 1
-    fi
-    candidate="\${extract_dir}/\${member}"
-    supacloud_validate_binary "$candidate" "pinned-linux-\${arch}" || return 1
-
-    mkdir -p "$(dirname "$target")"
-    staged_target=$(mktemp "\${target}.tmp.XXXXXX")
-    install -m 0755 "$candidate" "$staged_target"
-    mv -f "$staged_target" "$target"
-    staged_target=""
-)
-
-supacloud_version_at_least() {
-    local current="\${1#v}"
-    local required="\${2#v}"
-    local current_major=0 current_minor=0 current_patch=0
-    local required_major=0 required_minor=0 required_patch=0
-    [[ "$current" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1
-    [[ "$required" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1
-    IFS=. read -r current_major current_minor current_patch <<EOF
-\${current%%-*}
-EOF
-    IFS=. read -r required_major required_minor required_patch <<EOF
-\${required%%-*}
-EOF
-    current_major=\${current_major:-0}; current_minor=\${current_minor:-0}; current_patch=\${current_patch:-0}
-    required_major=\${required_major:-0}; required_minor=\${required_minor:-0}; required_patch=\${required_patch:-0}
-    if (( current_major != required_major )); then (( current_major > required_major )); return; fi
-    if (( current_minor != required_minor )); then (( current_minor > required_minor )); return; fi
-    (( current_patch >= required_patch ))
-}
-
-supacloud_gh_version() {
-    gh --version 2>/dev/null | awk 'NR == 1 && $1 == "gh" && $2 == "version" { print $3; exit }'
-}
-
-supacloud_install_gh_archive() {
-    local archive="$1"
-    local version="$2"
-    local arch="$3"
-    local expected_sha256="$4"
-    local target="$5"
-    local member="gh_\${version}_linux_\${arch}/bin/gh"
-    local actual_sha256 member_count member_details extracted_dir candidate version_output
-
-    actual_sha256=$(sha256sum "$archive" | awk '{print $1}')
-    if [[ "$actual_sha256" != "$expected_sha256" ]]; then
-        echo "GitHub CLI archive SHA256 mismatch" >&2
-        return 1
-    fi
-
-    member_count=$(tar -tzf "$archive" | grep -Fxc "$member" || true)
-    if [[ "$member_count" != "1" ]]; then
-        echo "GitHub CLI archive does not contain the exact expected member: $member" >&2
-        return 1
-    fi
-    member_details=$(tar -tvzf "$archive" "$member") || return 1
-    if [[ "\${member_details:0:1}" != "-" ]]; then
-        echo "GitHub CLI archive member is not a regular file: $member" >&2
-        return 1
-    fi
-
-    extracted_dir=$(mktemp -d)
-    candidate="\${extracted_dir}/\${member}"
-    if ! tar --no-same-owner --no-same-permissions -xzf "$archive" -C "$extracted_dir" "$member" \\
-        || ! supacloud_validate_binary "$candidate" "gh-linux-\${arch}"; then
-        rm -rf "$extracted_dir"
-        return 1
-    fi
-    chmod 0755 "$candidate"
-    version_output=$("$candidate" --version 2>/dev/null | head -1) || {
-        rm -rf "$extracted_dir"
-        echo "GitHub CLI bootstrap binary failed its version check" >&2
-        return 1
-    }
-    if [[ "$version_output" != "gh version \${version}"* ]]; then
-        rm -rf "$extracted_dir"
-        echo "GitHub CLI bootstrap version mismatch: \${version_output}" >&2
-        return 1
-    fi
-    mkdir -p "$(dirname "$target")"
-    install -m 0755 "$candidate" "$target"
-    rm -rf "$extracted_dir"
-}
-
-supacloud_install_pinned_gh() {
-    local target="\${1:-/usr/local/bin/gh}"
-    local machine arch expected_sha256 asset url archive
-    machine=$(uname -m)
-    case "$machine" in
-        x86_64|amd64)
-            arch="amd64"
-            expected_sha256="$SUPACLOUD_GH_AMD64_SHA256"
-            ;;
-        aarch64|arm64)
-            arch="arm64"
-            expected_sha256="$SUPACLOUD_GH_ARM64_SHA256"
-            ;;
-        *)
-            echo "Unsupported architecture for GitHub CLI bootstrap: $machine" >&2
-            return 1
-            ;;
-    esac
-    asset="gh_\${SUPACLOUD_GH_VERSION}_linux_\${arch}.tar.gz"
-    url="https://github.com/cli/cli/releases/download/v\${SUPACLOUD_GH_VERSION}/\${asset}"
-    archive=$(mktemp)
-    if ! supacloud_download_url "$url" "$archive" \\
-        || ! supacloud_install_gh_archive "$archive" "$SUPACLOUD_GH_VERSION" "$arch" "$expected_sha256" "$target"; then
-        rm -f "$archive"
-        return 1
-    fi
-    rm -f "$archive"
-}
-
-supacloud_validate_tar() {
-    local artifact_file="$1"
-    local entries
-    entries=$(tar -tzf "$artifact_file") || {
-        echo "Web Console archive is not a readable gzip tarball" >&2
-        return 1
-    }
-    if ! printf '%s\\n' "$entries" | awk '
-        /^\\// { exit 1 }
-        /(^|\\/)\\.\\.($|\\/)/ { exit 1 }
-    '; then
-        echo "Web Console archive contains an unsafe path" >&2
-        return 1
-    fi
-    if ! tar -tvzf "$artifact_file" | awk 'substr($1, 1, 1) != "-" && substr($1, 1, 1) != "d" { exit 1 }'; then
-        echo "Web Console archive contains links or special files" >&2
-        return 1
-    fi
-    printf '%s\\n' "$entries" | grep -Eq '(^|/)index\\.html$' || {
-        echo "Web Console archive is invalid or does not contain index.html" >&2
-        return 1
-    }
-}
-
-supacloud_record_integrity_mode() {
-    local mode="$1"
-    local record_file="\${SUPACLOUD_INTEGRITY_MODE_RECORD:-/var/lib/supacloud/artifact-integrity-mode}"
-    mkdir -p "$(dirname "$record_file")" 2>/dev/null || return 0
-    printf '%s\\n' "$mode" > "$record_file" 2>/dev/null || return 0
-    chmod 600 "$record_file" 2>/dev/null || true
-}
-
-supacloud_fetch_attestation_bundle() {
-    local artifact_file="$1"
-    local bundle_file="$2"
-    local digest response
-    digest=$(sha256sum "$artifact_file" | awk '{print $1}') || return 1
-    [[ "$digest" =~ ^[0-9a-fA-F]{64}$ ]] || {
-        echo "Unable to calculate the artifact digest for attestation lookup" >&2
-        return 1
-    }
-    digest=$(printf '%s' "$digest" | tr '[:upper:]' '[:lower:]')
-    response=$(supacloud_fetch_release_json \\
-        "https://api.github.com/repos/\${SUPACLOUD_GITHUB_REPOSITORY}/attestations/sha256:\${digest}") || {
-        echo "Unable to download the public GitHub artifact attestation bundle" >&2
-        return 1
-    }
-    if ! jq -ce '
-        .attestations
-        | if type != "array" or length == 0 or any(.[]; (.bundle | type) != "object")
-          then error("no valid attestation bundles returned")
-          else .[].bundle
-          end
-    ' <<< "$response" > "$bundle_file"; then
-        echo "GitHub artifact attestation response did not contain a valid bundle" >&2
-        return 1
-    fi
-}
-
-supacloud_verify_attestation() (
-    local artifact_file="$1"
-    if supacloud_attestation_verifier_available; then
-        local verification_output bundle_dir bundle_file
-        bundle_dir=$(mktemp -d "\${TMPDIR:-/tmp}/supacloud-attestation.XXXXXX") || return 1
-        trap 'rm -rf -- "$bundle_dir"' EXIT
-        trap 'trap - EXIT HUP INT TERM; rm -rf -- "$bundle_dir"; exit 1' HUP INT TERM
-        bundle_file="\${bundle_dir}/bundle.jsonl"
-        if ! supacloud_fetch_attestation_bundle "$artifact_file" "$bundle_file"; then
-            return 1
-        fi
-        if ! verification_output=$(gh attestation verify "$artifact_file" \\
-            --bundle "$bundle_file" \\
-            --repo "$SUPACLOUD_GITHUB_REPOSITORY" \\
-            --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" \\
-            --source-ref "refs/heads/main" \\
-            --deny-self-hosted-runners 2>&1); then
-            echo "GitHub artifact attestation verification failed: \${verification_output}" >&2
-            return 1
-        fi
-        supacloud_record_integrity_mode "github-attestation+same-release-sha256"
-        return
-    fi
-
-    if [[ "\${SUPACLOUD_ALLOW_UNVERIFIED_RELEASE:-false}" == "true" ]]; then
-        echo "BREAK-GLASS LIMITED INTEGRITY MODE: artifact attestation verification is unavailable; only the same-release SHA256 checksum was verified." >&2
-        supacloud_record_integrity_mode "break-glass:same-release-sha256-only"
-        return 0
-    fi
-
-    echo "Artifact attestation verification is required, but gh attestation verify is unavailable. Install GitHub CLI or explicitly set SUPACLOUD_ALLOW_UNVERIFIED_RELEASE=true for emergency break-glass use." >&2
-    return 1
-)
-
-supacloud_attestation_verifier_available() {
-    local version help
-    command -v gh >/dev/null 2>&1 || return 1
-    version=$(supacloud_gh_version)
-    [[ -n "$version" ]] || return 1
-    supacloud_version_at_least "$version" "$SUPACLOUD_GH_MIN_VERSION" || return 1
-    help=$(gh attestation verify --help 2>&1) || return 1
-    grep -Eq -- '(^|[[:space:]])--bundle([=[:space:]]|$)' <<< "$help" || return 1
-    grep -Eq -- '(^|[[:space:]])--signer-workflow([=[:space:]]|$)' <<< "$help" || return 1
-    grep -Eq -- '(^|[[:space:]])--source-ref([=[:space:]]|$)' <<< "$help" || return 1
-    grep -Eq -- '(^|[[:space:]])--deny-self-hosted-runners([=[:space:]]|$)' <<< "$help"
-}
-
-supacloud_download_release_asset() (
-    local release_json="$1"
-    local asset_name="$2"
-    local destination="$3"
-    local asset_kind="$4"
-    local asset_url checksum_url temporary_artifact temporary_checksums
-
-    asset_url=$(supacloud_release_asset_url "$release_json" "$asset_name") || return 1
-    checksum_url=$(supacloud_release_asset_url "$release_json" SHA256SUMS) || return 1
-    mkdir -p "$(dirname "$destination")"
-    temporary_artifact=$(mktemp "\${destination}.tmp.XXXXXX")
-    temporary_checksums=$(mktemp "\${destination}.SHA256SUMS.tmp.XXXXXX")
-    trap 'rm -f "\${temporary_artifact:-}" "\${temporary_checksums:-}"' EXIT
-    trap 'trap - EXIT HUP INT TERM; rm -f "\${temporary_artifact:-}" "\${temporary_checksums:-}"; exit 1' HUP INT TERM
-
-    if ! supacloud_download_url "$asset_url" "$temporary_artifact" \\
-        || ! supacloud_download_release_metadata_url "$checksum_url" "$temporary_checksums" \\
-        || ! supacloud_verify_checksum "$temporary_artifact" "$asset_name" "$temporary_checksums"; then
-        rm -f "$temporary_artifact" "$temporary_checksums"
-        return 1
-    fi
-
-    # Authenticate the digest before parsing archives or inspecting binaries.
-    if ! supacloud_verify_attestation "$temporary_artifact"; then
-        rm -f "$temporary_artifact" "$temporary_checksums"
-        return 1
-    fi
-
-    case "$asset_kind" in
-        binary) supacloud_validate_binary "$temporary_artifact" "$asset_name" ;;
-        tar) supacloud_validate_tar "$temporary_artifact" ;;
-        *)
-            echo "Unknown release asset kind: $asset_kind" >&2
-            rm -f "$temporary_artifact" "$temporary_checksums"
-            return 1
-            ;;
-    esac || {
-        rm -f "$temporary_artifact" "$temporary_checksums"
-        return 1
-    }
-
-    mv -f "$temporary_artifact" "$destination"
-    temporary_artifact=""
-    rm -f "$temporary_checksums"
-    temporary_checksums=""
-)
-`;
+var release_assets_default = '#!/usr/bin/env bash\n\nSUPACLOUD_GITHUB_REPOSITORY="${SUPACLOUD_GITHUB_REPOSITORY:-zuohuadong/supacloud}"\nSUPACLOUD_RELEASES_API="${SUPACLOUD_RELEASES_API:-https://api.github.com/repos/${SUPACLOUD_GITHUB_REPOSITORY}/releases}"\nSUPACLOUD_ATTESTATION_SIGNER_WORKFLOW="${SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW:-${SUPACLOUD_GITHUB_REPOSITORY}/.github/workflows/release-please.yml}"\nSUPACLOUD_GH_VERSION="${SUPACLOUD_GH_VERSION:-2.96.0}"\nSUPACLOUD_GH_MIN_VERSION="${SUPACLOUD_GH_MIN_VERSION:-2.68.0}"\nSUPACLOUD_GH_AMD64_SHA256="${SUPACLOUD_GH_AMD64_SHA256:-83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60}"\nSUPACLOUD_GH_ARM64_SHA256="${SUPACLOUD_GH_ARM64_SHA256:-06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909}"\nSUPACLOUD_RELEASE_ASSETS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"\nSUPACLOUD_ATTESTATION_TRUSTED_ROOT_DEFAULT="${SUPACLOUD_RELEASE_ASSETS_DIR}/../../packages/management-api/src/assets/sigstore-public-good-trusted-root.jsonl"\nreadonly SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SHA256="3c2cc7f357dc064ec527fdcd78da6e9245c21a381e1abaa0f2b62b186bcac1a1"\nreadonly SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SIZE="5748"\n\nsupacloud_curl_release_json() {\n    local url="$1"\n    local output="$2"\n    curl -fsSL --proto \'=https\' --proto-redir \'=https\' \\\n        --retry 1 --retry-delay 2 --retry-max-time 60 \\\n        --connect-timeout 15 --max-time 30 --speed-limit 128 --speed-time 10 \\\n        -o "$output" "$url"\n}\n\nsupacloud_curl_release_asset() {\n    local url="$1"\n    local output="$2"\n    curl -fL --proto \'=https\' --proto-redir \'=https\' \\\n        --retry 1 --retry-delay 2 --retry-max-time 180 \\\n        --connect-timeout 15 --max-time 90 --speed-limit 128 --speed-time 60 \\\n        -o "$output" "$url"\n}\n\nsupacloud_component_tag() {\n    local component="$1"\n    local version="$2"\n    case "$version" in\n        "${component}-v"*) printf \'%s\' "$version" ;;\n        v*) printf \'%s-%s\' "$component" "$version" ;;\n        *) printf \'%s-v%s\' "$component" "$version" ;;\n    esac\n}\n\nsupacloud_select_release() {\n    local component="$1"\n    shift\n    local required_assets_json\n    [[ $# -gt 0 ]] || {\n        echo "at least one required release asset must be specified" >&2\n        return 1\n    }\n    required_assets_json=$(printf \'%s\\n\' "$@" | jq -Rsc \'split("\\n")[:-1]\')\n    jq -ce --arg prefix "${component}-v" --argjson required "$required_assets_json" \'\n        map(select(\n            (.draft | not)\n            and (.prerelease | not)\n            and (.tag_name | startswith($prefix))\n            and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))\n            and any(.assets[]?; .name == "SHA256SUMS")\n        ))\n        | first\n        // error("no matching component release contains all required assets and SHA256SUMS")\n    \'\n}\n\nsupacloud_fetch_component_release() {\n    local component="$1"\n    local version="${2:-latest}"\n    shift 2\n    local required_assets=("$@")\n    local required_assets_json\n    local response\n    [[ ${#required_assets[@]} -gt 0 ]] || {\n        echo "at least one required release asset must be specified" >&2\n        return 1\n    }\n    required_assets_json=$(printf \'%s\\n\' "${required_assets[@]}" | jq -Rsc \'split("\\n")[:-1]\')\n\n    if [[ -n "$version" && "$version" != "latest" ]]; then\n        local tag\n        tag=$(supacloud_component_tag "$component" "$version")\n        response=$(supacloud_fetch_release_json "${SUPACLOUD_RELEASES_API}/tags/${tag}") || return 1\n        jq -ce --argjson required "$required_assets_json" \'\n            select(\n                (.draft | not)\n                and (.prerelease | not)\n                and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))\n                and any(.assets[]?; .name == "SHA256SUMS")\n            )\n            // error("release does not contain all required assets and SHA256SUMS")\n        \' <<< "$response"\n        return\n    fi\n\n    response=$(supacloud_fetch_release_json "${SUPACLOUD_RELEASES_API}?per_page=100") || return 1\n    supacloud_select_release "$component" "${required_assets[@]}" <<< "$response"\n}\n\nsupacloud_fetch_release_json() (\n    local url="$1"\n    local response_file\n    response_file=$(mktemp) || return 1\n    trap \'rm -f "$response_file"\' EXIT\n    trap \'trap - EXIT HUP INT TERM; rm -f "$response_file"; exit 1\' HUP INT TERM\n    supacloud_download_release_metadata_url "$url" "$response_file" || return 1\n    cat "$response_file"\n)\n\nsupacloud_release_asset_url() {\n    local release_json="$1"\n    local asset_name="$2"\n    jq -er --arg asset "$asset_name" \'\n        first(.assets[]? | select(.name == $asset) | .browser_download_url)\n        // error("release asset URL is missing")\n    \' <<< "$release_json"\n}\n\nsupacloud_download_url() {\n    local url="$1"\n    local output="$2"\n    local proxy="${SUPACLOUD_GITHUB_PROXY:-${GH_PROXY:-}}"\n\n    if supacloud_curl_release_asset "$url" "$output"; then\n        return 0\n    fi\n    if [[ -n "$proxy" ]]; then\n        supacloud_curl_release_asset "${proxy%/}/${url}" "$output"\n        return\n    fi\n    return 1\n}\n\nsupacloud_download_release_metadata_url() {\n    local url="$1"\n    local output="$2"\n    local proxy="${SUPACLOUD_GITHUB_PROXY:-${GH_PROXY:-}}"\n\n    if supacloud_curl_release_json "$url" "$output"; then\n        return 0\n    fi\n    if [[ -n "$proxy" ]]; then\n        supacloud_curl_release_json "${proxy%/}/${url}" "$output"\n        return\n    fi\n    return 1\n}\n\nsupacloud_verify_checksum() {\n    local artifact_file="$1"\n    local asset_name="$2"\n    local checksum_file="$3"\n    local expected\n    expected=$(awk -v asset="$asset_name" \'$2 == asset || $2 == "*" asset { print $1; exit }\' "$checksum_file")\n    if [[ ! "$expected" =~ ^[0-9a-fA-F]{64}$ ]]; then\n        echo "SHA256SUMS does not contain a valid checksum for ${asset_name}" >&2\n        return 1\n    fi\n\n    local actual\n    actual=$(sha256sum "$artifact_file" | awk \'{print $1}\')\n    actual=$(printf \'%s\' "$actual" | tr \'[:upper:]\' \'[:lower:]\')\n    expected=$(printf \'%s\' "$expected" | tr \'[:upper:]\' \'[:lower:]\')\n    if [[ "$actual" != "$expected" ]]; then\n        echo "SHA256 mismatch for ${asset_name}" >&2\n        return 1\n    fi\n}\n\nsupacloud_validate_binary() {\n    local artifact_file="$1"\n    local asset_name="$2"\n    local description\n    description=$(file -b "$artifact_file")\n    if [[ "$description" != *ELF* ]]; then\n        echo "${asset_name} is not an ELF binary: ${description}" >&2\n        return 1\n    fi\n\n    case "$asset_name" in\n        *amd64)\n            [[ "$description" == *x86-64* || "$description" == *x86_64* ]] || {\n                echo "${asset_name} does not contain an x86-64 ELF binary" >&2\n                return 1\n            }\n            ;;\n        *arm64)\n            [[ "$description" == *aarch64* || "$description" == *ARM64* ]] || {\n                echo "${asset_name} does not contain an arm64 ELF binary" >&2\n                return 1\n            }\n            ;;\n    esac\n}\n\nsupacloud_install_pinned_tar_xz_binary() (\n    local archive="$1"\n    local member="$2"\n    local expected_sha256="$3"\n    local arch="$4"\n    local target="$5"\n    local actual_sha256 member_count member_details extract_dir candidate staged_target\n\n    actual_sha256=$(sha256sum "$archive" | awk \'{print $1}\')\n    actual_sha256=$(printf \'%s\' "$actual_sha256" | tr \'[:upper:]\' \'[:lower:]\')\n    expected_sha256=$(printf \'%s\' "$expected_sha256" | tr \'[:upper:]\' \'[:lower:]\')\n    if [[ ! "$expected_sha256" =~ ^[0-9a-f]{64}$ || "$actual_sha256" != "$expected_sha256" ]]; then\n        echo "SHA256 mismatch for pinned archive" >&2\n        return 1\n    fi\n\n    member_count=$(tar -tJf "$archive" | grep -Fxc "$member" || true)\n    if [[ "$member_count" != "1" ]]; then\n        echo "Pinned archive must contain the exact member once: $member" >&2\n        return 1\n    fi\n    member_details=$(tar -tvJf "$archive" "$member") || return 1\n    if [[ "${member_details:0:1}" != "-" ]]; then\n        echo "Pinned archive member is not a regular file: $member" >&2\n        return 1\n    fi\n\n    extract_dir=$(mktemp -d)\n    trap \'rm -rf "$extract_dir"; [[ -z "${staged_target:-}" ]] || rm -f "$staged_target"\' EXIT\n    trap \'trap - EXIT HUP INT TERM; rm -rf "$extract_dir"; [[ -z "${staged_target:-}" ]] || rm -f "$staged_target"; exit 1\' HUP INT TERM\n    if ! tar --no-same-owner --no-same-permissions -xJf "$archive" -C "$extract_dir" "$member"; then\n        return 1\n    fi\n    candidate="${extract_dir}/${member}"\n    supacloud_validate_binary "$candidate" "pinned-linux-${arch}" || return 1\n\n    mkdir -p "$(dirname "$target")"\n    staged_target=$(mktemp "${target}.tmp.XXXXXX")\n    install -m 0755 "$candidate" "$staged_target"\n    mv -f "$staged_target" "$target"\n    staged_target=""\n)\n\nsupacloud_version_at_least() {\n    local current="${1#v}"\n    local required="${2#v}"\n    local current_major=0 current_minor=0 current_patch=0\n    local required_major=0 required_minor=0 required_patch=0\n    [[ "$current" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1\n    [[ "$required" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1\n    IFS=. read -r current_major current_minor current_patch <<EOF\n${current%%-*}\nEOF\n    IFS=. read -r required_major required_minor required_patch <<EOF\n${required%%-*}\nEOF\n    current_major=${current_major:-0}; current_minor=${current_minor:-0}; current_patch=${current_patch:-0}\n    required_major=${required_major:-0}; required_minor=${required_minor:-0}; required_patch=${required_patch:-0}\n    if (( current_major != required_major )); then (( current_major > required_major )); return; fi\n    if (( current_minor != required_minor )); then (( current_minor > required_minor )); return; fi\n    (( current_patch >= required_patch ))\n}\n\nsupacloud_gh_version() {\n    gh --version 2>/dev/null | awk \'NR == 1 && $1 == "gh" && $2 == "version" { print $3; exit }\'\n}\n\nsupacloud_install_gh_archive() {\n    local archive="$1"\n    local version="$2"\n    local arch="$3"\n    local expected_sha256="$4"\n    local target="$5"\n    local member="gh_${version}_linux_${arch}/bin/gh"\n    local actual_sha256 member_count member_details extracted_dir candidate version_output\n\n    actual_sha256=$(sha256sum "$archive" | awk \'{print $1}\')\n    if [[ "$actual_sha256" != "$expected_sha256" ]]; then\n        echo "GitHub CLI archive SHA256 mismatch" >&2\n        return 1\n    fi\n\n    member_count=$(tar -tzf "$archive" | grep -Fxc "$member" || true)\n    if [[ "$member_count" != "1" ]]; then\n        echo "GitHub CLI archive does not contain the exact expected member: $member" >&2\n        return 1\n    fi\n    member_details=$(tar -tvzf "$archive" "$member") || return 1\n    if [[ "${member_details:0:1}" != "-" ]]; then\n        echo "GitHub CLI archive member is not a regular file: $member" >&2\n        return 1\n    fi\n\n    extracted_dir=$(mktemp -d)\n    candidate="${extracted_dir}/${member}"\n    if ! tar --no-same-owner --no-same-permissions -xzf "$archive" -C "$extracted_dir" "$member" \\\n        || ! supacloud_validate_binary "$candidate" "gh-linux-${arch}"; then\n        rm -rf "$extracted_dir"\n        return 1\n    fi\n    chmod 0755 "$candidate"\n    version_output=$("$candidate" --version 2>/dev/null | head -1) || {\n        rm -rf "$extracted_dir"\n        echo "GitHub CLI bootstrap binary failed its version check" >&2\n        return 1\n    }\n    if [[ "$version_output" != "gh version ${version}"* ]]; then\n        rm -rf "$extracted_dir"\n        echo "GitHub CLI bootstrap version mismatch: ${version_output}" >&2\n        return 1\n    fi\n    mkdir -p "$(dirname "$target")"\n    install -m 0755 "$candidate" "$target"\n    rm -rf "$extracted_dir"\n}\n\nsupacloud_install_pinned_gh() {\n    local target="${1:-/usr/local/bin/gh}"\n    local machine arch expected_sha256 asset url archive\n    machine=$(uname -m)\n    case "$machine" in\n        x86_64|amd64)\n            arch="amd64"\n            expected_sha256="$SUPACLOUD_GH_AMD64_SHA256"\n            ;;\n        aarch64|arm64)\n            arch="arm64"\n            expected_sha256="$SUPACLOUD_GH_ARM64_SHA256"\n            ;;\n        *)\n            echo "Unsupported architecture for GitHub CLI bootstrap: $machine" >&2\n            return 1\n            ;;\n    esac\n    asset="gh_${SUPACLOUD_GH_VERSION}_linux_${arch}.tar.gz"\n    url="https://github.com/cli/cli/releases/download/v${SUPACLOUD_GH_VERSION}/${asset}"\n    archive=$(mktemp)\n    if ! supacloud_download_url "$url" "$archive" \\\n        || ! supacloud_install_gh_archive "$archive" "$SUPACLOUD_GH_VERSION" "$arch" "$expected_sha256" "$target"; then\n        rm -f "$archive"\n        return 1\n    fi\n    rm -f "$archive"\n}\n\nsupacloud_validate_tar() {\n    local artifact_file="$1"\n    local entries\n    entries=$(tar -tzf "$artifact_file") || {\n        echo "Web Console archive is not a readable gzip tarball" >&2\n        return 1\n    }\n    if ! printf \'%s\\n\' "$entries" | awk \'\n        /^\\// { exit 1 }\n        /(^|\\/)\\.\\.($|\\/)/ { exit 1 }\n    \'; then\n        echo "Web Console archive contains an unsafe path" >&2\n        return 1\n    fi\n    if ! tar -tvzf "$artifact_file" | awk \'substr($1, 1, 1) != "-" && substr($1, 1, 1) != "d" { exit 1 }\'; then\n        echo "Web Console archive contains links or special files" >&2\n        return 1\n    fi\n    printf \'%s\\n\' "$entries" | grep -Eq \'(^|/)index\\.html$\' || {\n        echo "Web Console archive is invalid or does not contain index.html" >&2\n        return 1\n    }\n}\n\nsupacloud_record_integrity_mode() {\n    local mode="$1"\n    local record_file="${SUPACLOUD_INTEGRITY_MODE_RECORD:-/var/lib/supacloud/artifact-integrity-mode}"\n    mkdir -p "$(dirname "$record_file")" 2>/dev/null || return 0\n    printf \'%s\\n\' "$mode" > "$record_file" 2>/dev/null || return 0\n    chmod 600 "$record_file" 2>/dev/null || true\n}\n\nsupacloud_fetch_attestation_bundle() {\n    local artifact_file="$1"\n    local bundle_file="$2"\n    local digest response\n    digest=$(sha256sum "$artifact_file" | awk \'{print $1}\') || return 1\n    [[ "$digest" =~ ^[0-9a-fA-F]{64}$ ]] || {\n        echo "Unable to calculate the artifact digest for attestation lookup" >&2\n        return 1\n    }\n    digest=$(printf \'%s\' "$digest" | tr \'[:upper:]\' \'[:lower:]\')\n    response=$(supacloud_fetch_release_json \\\n        "https://api.github.com/repos/${SUPACLOUD_GITHUB_REPOSITORY}/attestations/sha256:${digest}") || {\n        echo "Unable to download the public GitHub artifact attestation bundle" >&2\n        return 1\n    }\n    if ! jq -ce \'\n        .attestations\n        | if type != "array" or length == 0 or any(.[]; (.bundle | type) != "object")\n          then error("no valid attestation bundles returned")\n          else .[].bundle\n          end\n    \' <<< "$response" > "$bundle_file"; then\n        echo "GitHub artifact attestation response did not contain a valid bundle" >&2\n        return 1\n    fi\n}\n\nsupacloud_attestation_trusted_root_available() {\n    local trusted_root="${SUPACLOUD_ATTESTATION_TRUSTED_ROOT:-$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_DEFAULT}"\n    local actual_size actual_sha256\n    [[ "$trusted_root" == /* && -f "$trusted_root" && ! -L "$trusted_root" ]] || return 1\n    actual_size=$(wc -c < "$trusted_root" | tr -d \'[:space:]\') || return 1\n    [[ "$actual_size" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SIZE" ]] || return 1\n    actual_sha256=$(sha256sum "$trusted_root" | awk \'{print $1}\') || return 1\n    [[ "$actual_sha256" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SHA256" ]] || return 1\n    [[ "$(wc -l < "$trusted_root" | tr -d \'[:space:]\')" == "1" ]] || return 1\n    jq -e \'type == "object" and .mediaType == "application/vnd.dev.sigstore.trustedroot+json;version=0.1"\' \\\n        "$trusted_root" >/dev/null 2>&1\n}\n\nsupacloud_prepare_attestation_trusted_root() {\n    local destination="$1"\n    local trusted_root="${SUPACLOUD_ATTESTATION_TRUSTED_ROOT:-$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_DEFAULT}"\n    supacloud_attestation_trusted_root_available || {\n        echo "Pinned Sigstore Public Good trusted root is missing or invalid" >&2\n        return 1\n    }\n    jq -ce . "$trusted_root" > "$destination" || return 1\n    chmod 600 "$destination"\n    [[ "$(wc -c < "$destination" | tr -d \'[:space:]\')" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SIZE" ]] || return 1\n    [[ "$(sha256sum "$destination" | awk \'{print $1}\')" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SHA256" ]]\n}\n\nsupacloud_verify_attestation() (\n    local artifact_file="$1"\n    if supacloud_attestation_verifier_available; then\n        local verification_output bundle_dir bundle_file trusted_root_file\n        bundle_dir=$(mktemp -d "${TMPDIR:-/tmp}/supacloud-attestation.XXXXXX") || return 1\n        trap \'rm -rf -- "$bundle_dir"\' EXIT\n        trap \'trap - EXIT HUP INT TERM; rm -rf -- "$bundle_dir"; exit 1\' HUP INT TERM\n        bundle_file="${bundle_dir}/bundle.jsonl"\n        trusted_root_file="${bundle_dir}/trusted_root.jsonl"\n        if ! supacloud_fetch_attestation_bundle "$artifact_file" "$bundle_file"; then\n            return 1\n        fi\n        supacloud_prepare_attestation_trusted_root "$trusted_root_file" || return 1\n        if ! verification_output=$(gh attestation verify "$artifact_file" \\\n            --bundle "$bundle_file" \\\n            --custom-trusted-root "$trusted_root_file" \\\n            --repo "$SUPACLOUD_GITHUB_REPOSITORY" \\\n            --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" \\\n            --source-ref "refs/heads/main" \\\n            --deny-self-hosted-runners 2>&1); then\n            echo "GitHub artifact attestation verification failed: ${verification_output}" >&2\n            return 1\n        fi\n        supacloud_record_integrity_mode "github-attestation+same-release-sha256"\n        return\n    fi\n\n    if [[ "${SUPACLOUD_ALLOW_UNVERIFIED_RELEASE:-false}" == "true" ]]; then\n        echo "BREAK-GLASS LIMITED INTEGRITY MODE: artifact attestation verification is unavailable; only the same-release SHA256 checksum was verified." >&2\n        supacloud_record_integrity_mode "break-glass:same-release-sha256-only"\n        return 0\n    fi\n\n    echo "Artifact attestation verification is required, but gh attestation verify is unavailable. Install GitHub CLI or explicitly set SUPACLOUD_ALLOW_UNVERIFIED_RELEASE=true for emergency break-glass use." >&2\n    return 1\n)\n\nsupacloud_attestation_verifier_available() {\n    local version help\n    supacloud_attestation_trusted_root_available || return 1\n    command -v gh >/dev/null 2>&1 || return 1\n    version=$(supacloud_gh_version)\n    [[ -n "$version" ]] || return 1\n    supacloud_version_at_least "$version" "$SUPACLOUD_GH_MIN_VERSION" || return 1\n    help=$(gh attestation verify --help 2>&1) || return 1\n    grep -Eq -- \'(^|[[:space:]])--bundle([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--signer-workflow([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--source-ref([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--custom-trusted-root([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--deny-self-hosted-runners([=[:space:]]|$)\' <<< "$help"\n}\n\nsupacloud_download_release_asset() (\n    local release_json="$1"\n    local asset_name="$2"\n    local destination="$3"\n    local asset_kind="$4"\n    local asset_url checksum_url temporary_artifact temporary_checksums\n\n    asset_url=$(supacloud_release_asset_url "$release_json" "$asset_name") || return 1\n    checksum_url=$(supacloud_release_asset_url "$release_json" SHA256SUMS) || return 1\n    mkdir -p "$(dirname "$destination")"\n    temporary_artifact=$(mktemp "${destination}.tmp.XXXXXX")\n    temporary_checksums=$(mktemp "${destination}.SHA256SUMS.tmp.XXXXXX")\n    trap \'rm -f "${temporary_artifact:-}" "${temporary_checksums:-}"\' EXIT\n    trap \'trap - EXIT HUP INT TERM; rm -f "${temporary_artifact:-}" "${temporary_checksums:-}"; exit 1\' HUP INT TERM\n\n    if ! supacloud_download_url "$asset_url" "$temporary_artifact" \\\n        || ! supacloud_download_release_metadata_url "$checksum_url" "$temporary_checksums" \\\n        || ! supacloud_verify_checksum "$temporary_artifact" "$asset_name" "$temporary_checksums"; then\n        rm -f "$temporary_artifact" "$temporary_checksums"\n        return 1\n    fi\n\n    # Authenticate the digest before parsing archives or inspecting binaries.\n    if ! supacloud_verify_attestation "$temporary_artifact"; then\n        rm -f "$temporary_artifact" "$temporary_checksums"\n        return 1\n    fi\n\n    case "$asset_kind" in\n        binary) supacloud_validate_binary "$temporary_artifact" "$asset_name" ;;\n        tar) supacloud_validate_tar "$temporary_artifact" ;;\n        *)\n            echo "Unknown release asset kind: $asset_kind" >&2\n            rm -f "$temporary_artifact" "$temporary_checksums"\n            return 1\n            ;;\n    esac || {\n        rm -f "$temporary_artifact" "$temporary_checksums"\n        return 1\n    }\n\n    mv -f "$temporary_artifact" "$destination"\n    temporary_artifact=""\n    rm -f "$temporary_checksums"\n    temporary_checksums=""\n)\n';
 
 // src/shared/tools/ssh-tools.ts
 var SAFE_CONTAINER_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
@@ -27703,6 +27381,27 @@ function signalSafeCleanupTraps(cleanupCommand) {
     `trap ${quoteEnvValue(`trap - EXIT HUP INT TERM; ${cleanupCommand}; exit 1`)} HUP INT TERM`
   ];
 }
+function trustedRootPreflightCommands(helperPath) {
+  const helperDirectory = dirname(helperPath);
+  const trustedRootPath = join2(helperDirectory, SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME);
+  return [
+    `HELPER_DIRECTORY=${quoteEnvValue(helperDirectory)}`,
+    `TRUSTED_ROOT=${quoteEnvValue(trustedRootPath)}`,
+    `test -d "$HELPER_DIRECTORY" && test ! -L "$HELPER_DIRECTORY" || { echo 'Upgrade helper directory is not secure' >&2; exit 1; }`,
+    `test "$(stat -c '%a' "$HELPER_DIRECTORY")" = 700 || { echo 'Upgrade helper directory must use mode 0700' >&2; exit 1; }`,
+    `EXPECTED_HELPER_ENTRIES=$(printf '%s\\n' ${quoteEnvValue(basename3(helperPath))} ${quoteEnvValue(SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME)} | LC_ALL=C sort)`,
+    `ACTUAL_HELPER_ENTRIES=$(find "$HELPER_DIRECTORY" -mindepth 1 -maxdepth 1 -printf '%f\\n' | LC_ALL=C sort)`,
+    `test "$ACTUAL_HELPER_ENTRIES" = "$EXPECTED_HELPER_ENTRIES" || { echo 'Upgrade helper directory does not match its strict file allowlist' >&2; exit 1; }`,
+    `test -f "$TRUSTED_ROOT" && test ! -L "$TRUSTED_ROOT" && test "$(stat -c '%h' "$TRUSTED_ROOT")" = 1 || { echo 'Pinned trusted root must be a direct regular file without links' >&2; exit 1; }`,
+    `test "$(stat -c '%a' "$TRUSTED_ROOT")" = 600 || { echo 'Pinned trusted root must use mode 0600' >&2; exit 1; }`,
+    `test "$(stat -c '%s' "$TRUSTED_ROOT")" = ${SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SIZE} || { echo 'Pinned trusted root size mismatch' >&2; exit 1; }`,
+    `test "$(sha256sum "$TRUSTED_ROOT" | awk '{print $1}')" = ${quoteEnvValue(SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SHA256)} || { echo 'Pinned trusted root digest mismatch' >&2; exit 1; }`,
+    'chown -h root:root "$TRUSTED_ROOT"',
+    `test "$(stat -c '%u:%g:%a:%h' "$TRUSTED_ROOT")" = 0:0:600:1 || { echo 'Pinned trusted root ownership or mode changed during adoption' >&2; exit 1; }`,
+    `test "$(stat -c '%s' "$TRUSTED_ROOT")" = ${SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SIZE} && test "$(sha256sum "$TRUSTED_ROOT" | awk '{print $1}')" = ${quoteEnvValue(SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SHA256)} || { echo 'Pinned trusted root changed during adoption' >&2; exit 1; }`,
+    'export SUPACLOUD_ATTESTATION_TRUSTED_ROOT="$TRUSTED_ROOT"'
+  ];
+}
 function buildRootUpgradeScript(request) {
   const envAssignments = upgradeEnvAssignments(request);
   return [
@@ -27710,16 +27409,18 @@ function buildRootUpgradeScript(request) {
     "umask 077",
     "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
     "export PATH",
-    "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW SUPACLOUD_GH_VERSION SUPACLOUD_GH_MIN_VERSION SUPACLOUD_GH_AMD64_SHA256 SUPACLOUD_GH_ARM64_SHA256 GH_PROXY",
+    "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW SUPACLOUD_ATTESTATION_TRUSTED_ROOT SUPACLOUD_GH_VERSION SUPACLOUD_GH_MIN_VERSION SUPACLOUD_GH_AMD64_SHA256 SUPACLOUD_GH_ARM64_SHA256 GH_PROXY",
     request.githubProxy ? `export SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : "unset SUPACLOUD_GITHUB_PROXY SUPACLOUD_GITHUB_PROXIES",
-    'for tool in curl jq file sha256sum stat tar flock; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
+    'for tool in curl jq file sha256sum stat tar flock find sort chown; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
     "test -d /run/lock || { echo '/run/lock is unavailable' >&2; exit 1; }",
     "test -x /usr/local/bin/supacloud || { echo 'SupaCloud binary not found at /usr/local/bin/supacloud; run ssh install first.' >&2; exit 127; }",
+    ...trustedRootPreflightCommands(request.helperPath),
     buildUpgradeLockScript(SUPACLOUD_UPGRADE_LOCK_PATH),
     ...componentPreflightCommands(request),
     "STAGED_MANAGEMENT=''",
     ...signalSafeCleanupTraps('test -z "$STAGED_MANAGEMENT" || rm -f "$STAGED_MANAGEMENT"'),
     `source ${quoteEnvValue(request.helperPath)}`,
+    "supacloud_attestation_trusted_root_available || { echo 'Pinned Sigstore trusted root failed helper validation' >&2; exit 1; }",
     "if ! supacloud_attestation_verifier_available; then supacloud_install_pinned_gh /usr/local/bin/gh; fi",
     "supacloud_attestation_verifier_available || { echo 'Pinned GitHub attestation verifier is unavailable' >&2; exit 1; }",
     ...componentBootstrapCommands(request),
@@ -27741,8 +27442,7 @@ async function prepareRemoteUpgradeHelperDirectory(ssh, helperPath) {
   const command = [
     "set -e",
     "umask 077",
-    `test ! -e ${quoteEnvValue(helperDirectory)}`,
-    `install -d -m 700 -- ${quoteEnvValue(helperDirectory)}`
+    `mkdir -m 700 -- ${quoteEnvValue(helperDirectory)}`
   ].join("; ");
   const preparation = await ssh.exec(command, 30000);
   if (!preparation.success) {
@@ -27769,44 +27469,56 @@ function remoteUpgradeFailure(execution) {
   const diagnostic = execution.stderr.trim() || execution.stdout.trim() || "no remote diagnostic";
   return new Error(`Remote upgrade failed (exit ${execution.code}): ${diagnostic.slice(-500)}`);
 }
-function officialUpgradeOutcome(execution, executionError, cleanupError) {
-  if (executionError && cleanupError) {
-    throw new AggregateError([executionError, cleanupError], "Upgrade execution failed and helper cleanup did not complete");
+function officialUpgradeOutcome(outcome) {
+  if (outcome.executionFailed && outcome.cleanupFailed) {
+    throw new AggregateError([outcome.executionError, outcome.cleanupError], "Upgrade execution failed and helper cleanup did not complete");
   }
-  if (executionError)
-    throw executionError;
-  if (!execution)
+  if (outcome.executionFailed)
+    throw outcome.executionError;
+  if (!outcome.execution)
     throw new Error("Upgrade execution did not return a result");
-  if (cleanupError && !execution.success) {
-    throw new AggregateError([remoteUpgradeFailure(execution), cleanupError], "Remote upgrade failed and helper cleanup did not complete");
+  if (outcome.cleanupFailed && !outcome.execution.success) {
+    throw new AggregateError([remoteUpgradeFailure(outcome.execution), outcome.cleanupError], "Remote upgrade failed and helper cleanup did not complete");
   }
-  if (cleanupError)
-    throw cleanupError;
-  if (!execution.success)
-    throw remoteUpgradeFailure(execution);
-  return execution;
+  if (outcome.cleanupFailed)
+    throw outcome.cleanupError;
+  if (!outcome.execution.success)
+    throw remoteUpgradeFailure(outcome.execution);
+  return outcome.execution;
 }
 async function executeOfficialUpgrade(ssh, helperPath, command, timeoutMs) {
   let execution;
+  let executionFailed = false;
   let executionError;
   let helperPrepared = false;
   try {
     await prepareRemoteUpgradeHelperDirectory(ssh, helperPath);
     helperPrepared = true;
     await ssh.uploadText(helperPath, release_assets_default, 384);
+    const trustedRootPath = join2(dirname(helperPath), SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME);
+    await ssh.uploadText(trustedRootPath, SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_JSONL, 384);
     execution = await ssh.exec(command, timeoutMs);
   } catch (error) {
+    executionFailed = true;
     executionError = error;
   }
+  let cleanupFailed = false;
   let cleanupError;
   if (helperPrepared) {
     try {
       await removeRemoteUpgradeHelper(ssh, helperPath);
     } catch (error) {
+      cleanupFailed = true;
       cleanupError = error;
     }
   }
-  return officialUpgradeOutcome(execution, executionError, cleanupError);
+  return officialUpgradeOutcome({
+    execution,
+    executionFailed,
+    executionError,
+    cleanupFailed,
+    cleanupError
+  });
 }
 function assertSafeGithubProxy(value) {
   const trimmed = value.trim();
@@ -28029,7 +27741,7 @@ ${bootstrapDeps.stderr.slice(-500)}`;
           break;
         }
         const osCheck = await ssh.exec("cat /etc/os-release | grep -E 'NAME|VERSION_ID' | head -4");
-        const clone2 = await ssh.exec(`set -e; umask 077; rm -rf ${quoteEnvValue(BOOTSTRAP)}; ` + `${bootstrapClone}; ` + `git -C ${quoteEnvValue(BOOTSTRAP)} remote set-url origin ${quoteEnvValue(REPO)}; ` + `test "$(git -C ${quoteEnvValue(BOOTSTRAP)} remote get-url origin)" = ${quoteEnvValue(REPO)}; ` + `test "$(git -C ${quoteEnvValue(BOOTSTRAP)} symbolic-ref --short HEAD)" = main; ` + `test -z "$(git -C ${quoteEnvValue(BOOTSTRAP)} status --porcelain --untracked-files=no)"; ` + `git -C ${quoteEnvValue(BOOTSTRAP)} ls-files --error-unmatch setup.sh scripts/lib/install_config.sh scripts/lib/release_assets.sh >/dev/null; ` + `test -f ${quoteEnvValue(`${BOOTSTRAP}/setup.sh`)}; echo BOOTSTRAP_OK`, 120000);
+        const clone2 = await ssh.exec(`set -e; umask 077; rm -rf ${quoteEnvValue(BOOTSTRAP)}; ` + `${bootstrapClone}; ` + `git -C ${quoteEnvValue(BOOTSTRAP)} remote set-url origin ${quoteEnvValue(REPO)}; ` + `test "$(git -C ${quoteEnvValue(BOOTSTRAP)} remote get-url origin)" = ${quoteEnvValue(REPO)}; ` + `test "$(git -C ${quoteEnvValue(BOOTSTRAP)} symbolic-ref --short HEAD)" = main; ` + `test -z "$(git -C ${quoteEnvValue(BOOTSTRAP)} status --porcelain --untracked-files=no)"; ` + `git -C ${quoteEnvValue(BOOTSTRAP)} ls-files --error-unmatch setup.sh scripts/lib/install_config.sh scripts/lib/release_assets.sh packages/management-api/src/assets/sigstore-public-good-trusted-root.jsonl >/dev/null; ` + `test -f ${quoteEnvValue(`${BOOTSTRAP}/setup.sh`)}; echo BOOTSTRAP_OK`, 120000);
         if (!clone2.stdout.includes("BOOTSTRAP_OK")) {
           await ssh.exec(`rm -rf ${quoteEnvValue(BOOTSTRAP)}`);
           text = `❌ Trusted bootstrap clone failed
@@ -28980,7 +28692,7 @@ Actions: routes, upsert_route, update_route, delete_route, config, get_certifica
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.7.10",
+  version: "0.7.12",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.7.10",
+  "version": "0.7.12",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",