test(release): reject changed payload bytes before installation #22

New Issue

2026-10-10T20:50:18Z

KofTwentyTwo commented

2026-10-10 20:50:18 +00:00

(Migrated from github.com)

Problem

The GUI-only installed smoke observed a corrupted framework dependency in locally generated Velopack 1.2.161 packages. System.Text.Json.dll was valid in the actual published output, but both its portable ZIP and full nupkg copy had a zeroed header, unchanged length and different SHA256. The probe then failed to load the assembly. The other three versions in the same run retained valid headers. The cause is not yet established; do not attribute it to Velopack code or storage without further evidence.

Acceptance criteria

Compare original publish payload bytes with both archive forms before installing or claiming a successful smoke run.
Reject missing files and changed bytes, including unchanged-length corruption; preserve legitimate default packaging exclusions.
Prove rejection against the actual failing fixture and retain that evidence.
Verify freshly generated CLI/no-CLI packages and document any unresolved cause or reproduction limits.
Ensure production packaging verification preserves third-party binaries. Signing/shared-builder publication remains tracked separately in #12.

Current work

An additive byte gate now rejects the actual corrupted package; its regression tests and fresh package checks are underway in fix/template-onboarding. The original failing artifact and host trace are retained locally. No corrupted package was published. Substantial AI assistance: Codex.

## Problem The GUI-only installed smoke observed a corrupted framework dependency in locally generated Velopack 1.2.161 packages. `System.Text.Json.dll` was valid in the actual published output, but both its portable ZIP and full nupkg copy had a zeroed header, unchanged length and different SHA256. The probe then failed to load the assembly. The other three versions in the same run retained valid headers. The cause is not yet established; do not attribute it to Velopack code or storage without further evidence. ## Acceptance criteria - Compare original publish payload bytes with both archive forms before installing or claiming a successful smoke run. - Reject missing files and changed bytes, including unchanged-length corruption; preserve legitimate default packaging exclusions. - Prove rejection against the actual failing fixture and retain that evidence. - Verify freshly generated CLI/no-CLI packages and document any unresolved cause or reproduction limits. - Ensure production packaging verification preserves third-party binaries. Signing/shared-builder publication remains tracked separately in #12. ## Current work An additive byte gate now rejects the actual corrupted package; its regression tests and fresh package checks are underway in `fix/template-onboarding`. The original failing artifact and host trace are retained locally. No corrupted package was published. Substantial AI assistance: Codex.

KofTwentyTwo commented

2026-10-10 20:57:42 +00:00

(Migrated from github.com)

Saved the regression gate in locally signed starter commit 90af2f75dfa8c713e9f604c1f1b844492139e73c (not pushed). build/Assert-PackageBytes.ps1 checks every original non-PDB publish file outside Velopack default exclusions against both current/ portable and lib/app/ full-package entries. It runs immediately after packaging and before any installation. Three tests cover exact bytes, changed bytes at unchanged length, and an omitted dependency; all 30 tooling tests pass.

Observed real failures are retained locally: System.Text.Json.dll in the first GUI-only package, mscordbi.dll in an earlier dev package, and Microsoft.DiaSymReader.Native.amd64.dll in the new GUI-only dev package. Their source/archive hashes differ. The new gate correctly rejects them. Root cause is not established; no corrupt artifact has been published. A separate fresh x64 repack of one existing GUI-only publish passed all 533 file comparisons in both archives, but this does not establish that all four releases are safe.

Remaining: diagnose the changing bytes, obtain complete fresh byte-verified CLI and GUI-only runs, and apply/verify the relevant production packaging checks. No tool/storage/antivirus attribution is justified yet. This issue remains open.

Saved the regression gate in locally signed starter commit `90af2f75dfa8c713e9f604c1f1b844492139e73c` (not pushed). `build/Assert-PackageBytes.ps1` checks every original non-PDB publish file outside Velopack default exclusions against both `current/` portable and `lib/app/` full-package entries. It runs immediately after packaging and before any installation. Three tests cover exact bytes, changed bytes at unchanged length, and an omitted dependency; all 30 tooling tests pass. Observed real failures are retained locally: System.Text.Json.dll in the first GUI-only package, mscordbi.dll in an earlier dev package, and Microsoft.DiaSymReader.Native.amd64.dll in the new GUI-only dev package. Their source/archive hashes differ. The new gate correctly rejects them. Root cause is not established; no corrupt artifact has been published. A separate fresh x64 repack of one existing GUI-only publish passed all 533 file comparisons in both archives, but this does not establish that all four releases are safe. Remaining: diagnose the changing bytes, obtain complete fresh byte-verified CLI and GUI-only runs, and apply/verify the relevant production packaging checks. No tool/storage/antivirus attribution is justified yet. This issue remains open.

KofTwentyTwo commented

2026-10-10 21:32:56 +00:00

(Migrated from github.com)

Progress: corruption has also appeared in the published source DLLs before packaging, so matching archive hashes alone cannot establish a healthy payload. The starter now parses original executable headers before comparing package bytes, and copies only the probe's own four files rather than overwriting application framework dependencies. Each smoke run uses a unique system-temp build and Velopack staging directory; its location is recorded in build-directory.txt. These changes do not establish the corruption's cause.

The fresh GUI-only template run has passed: four versions, 532 files preserved in both portable/full archives per version, loose/portable behavior, actual stable 0.1.0 -> 0.4.0 and dev 0.3.0-beta.1 -> 0.3.0-beta.2 upgrades, real app restart, target assembly hashes, isolated feeds, 19 UI checks and guarded uninstall. Evidence: artifacts/starter-finish/artifacts/temp-stage-no-cli/artifacts/installed-temp-stage/. The CLI-enabled variant is still running; source changes are not committed until its applicable acceptance completes. Starter script tests: 31 passing.

Production missing-dependency checks are committed locally: AppKit 146138957506b79459a6d811a1e70a626e006699 and isolated standards 4dfde0976a59f3a2b07b974444e837574310c083. Portable, full and CLI archives must retain inventoried third-party binaries and unchanged hashes, with legitimate Velopack helper exclusions preserved. New regressions cover all three missing-dependency forms, changed bytes and allowed exclusions. AppKit script suite: 36 passing; shared signing/wrapper suite: 31 passing.

Original bad fixtures are retained, and independent 7-Zip extraction confirms one archive stores the changed bytes. Controlled copy/repack probes have passed without reproducing the failure; no specific tool, storage driver or filesystem is established as the cause. No corrupt package was published. Hosted CI, CLI acceptance and reviewed shared-builder rollout remain pending; issue remains open. No push or release was performed. Substantial AI assistance: Codex (GPT-6).

Progress: corruption has also appeared in the published source DLLs before packaging, so matching archive hashes alone cannot establish a healthy payload. The starter now parses original executable headers before comparing package bytes, and copies only the probe's own four files rather than overwriting application framework dependencies. Each smoke run uses a unique system-temp build and Velopack staging directory; its location is recorded in `build-directory.txt`. These changes do not establish the corruption's cause. The fresh GUI-only template run has passed: four versions, 532 files preserved in both portable/full archives per version, loose/portable behavior, actual stable `0.1.0 -> 0.4.0` and dev `0.3.0-beta.1 -> 0.3.0-beta.2` upgrades, real app restart, target assembly hashes, isolated feeds, 19 UI checks and guarded uninstall. Evidence: `artifacts/starter-finish/artifacts/temp-stage-no-cli/artifacts/installed-temp-stage/`. The CLI-enabled variant is still running; source changes are not committed until its applicable acceptance completes. Starter script tests: 31 passing. Production missing-dependency checks are committed locally: AppKit `146138957506b79459a6d811a1e70a626e006699` and isolated standards `4dfde0976a59f3a2b07b974444e837574310c083`. Portable, full and CLI archives must retain inventoried third-party binaries and unchanged hashes, with legitimate Velopack helper exclusions preserved. New regressions cover all three missing-dependency forms, changed bytes and allowed exclusions. AppKit script suite: 36 passing; shared signing/wrapper suite: 31 passing. Original bad fixtures are retained, and independent 7-Zip extraction confirms one archive stores the changed bytes. Controlled copy/repack probes have passed without reproducing the failure; no specific tool, storage driver or filesystem is established as the cause. No corrupt package was published. Hosted CI, CLI acceptance and reviewed shared-builder rollout remain pending; issue remains open. No push or release was performed. Substantial AI assistance: Codex (GPT-6).

KofTwentyTwo commented

2026-10-10 21:47:05 +00:00

(Migrated from github.com)

The byte-gate issue's listed implementation/verification criteria are now satisfied locally; closing this scoped ticket. This does not establish the corruption's cause or certify overall release readiness.

Starter signed local commit 2c8816b187b3a9a540f28daea20e0b1b061e8c5b: reject missing/changed files and invalid original PE headers, preserve documented packaging exclusions, add source corruption regression, isolate staging and retain evidence. All 31 script tests pass; analysis/build/format/documentation/hooks pass.
Both actual renamed CLI/no-CLI generated variants passed all four original-to-portable/full byte checks: 532 files per version. GUI-only completed both installed upgrades and 19 UI checks. CLI installed input instability is separately tracked in #23; it did not affect byte checks.
The actual bad fixtures were rejected and retained. Independent 7-Zip extraction confirmed stored changed bytes. Their cause remains unknown; successful controlled copies/repacking and system-temp staging do not establish causation.
AppKit 146138957506b79459a6d811a1e70a626e006699 and shared builder 4dfde0976a59f3a2b07b974444e837574310c083 require present, unchanged third-party binaries in final portable/full/CLI archives, preserve legitimate helper exclusions, and test missing and changed dependencies. AppKit's 36 and shared builder's 31 script cases pass. Signing/builder publication remains in #12; hosted readiness remains in #20.

Completed corruption fixtures were moved intact to C:/Users/james/.cache/AppKit-retained-fixtures/2026-10-10/: installed-current-no-cli, byte-verified-no-cli, installed-proof-final, plus isolated-no-cli and dpi-no-cli. Historical paths in earlier comments refer to those retained directory names; no evidence was deleted. A subsequent focused-input run exhausted artifact-volume space during portable extraction; the new preflight requires 8 GB before starting.

All commits remain unpushed. No corrupted package, new release or live settings change was published by this session. Substantial AI assistance: Codex (GPT-6).

The byte-gate issue's listed implementation/verification criteria are now satisfied locally; closing this scoped ticket. This does not establish the corruption's cause or certify overall release readiness. - Starter signed local commit `2c8816b187b3a9a540f28daea20e0b1b061e8c5b`: reject missing/changed files and invalid original PE headers, preserve documented packaging exclusions, add source corruption regression, isolate staging and retain evidence. All 31 script tests pass; analysis/build/format/documentation/hooks pass. - Both actual renamed CLI/no-CLI generated variants passed all four original-to-portable/full byte checks: 532 files per version. GUI-only completed both installed upgrades and 19 UI checks. CLI installed input instability is separately tracked in #23; it did not affect byte checks. - The actual bad fixtures were rejected and retained. Independent 7-Zip extraction confirmed stored changed bytes. Their cause remains unknown; successful controlled copies/repacking and system-temp staging do not establish causation. - AppKit `146138957506b79459a6d811a1e70a626e006699` and shared builder `4dfde0976a59f3a2b07b974444e837574310c083` require present, unchanged third-party binaries in final portable/full/CLI archives, preserve legitimate helper exclusions, and test missing and changed dependencies. AppKit's 36 and shared builder's 31 script cases pass. Signing/builder publication remains in #12; hosted readiness remains in #20. Completed corruption fixtures were moved intact to `C:/Users/james/.cache/AppKit-retained-fixtures/2026-10-10/`: `installed-current-no-cli`, `byte-verified-no-cli`, `installed-proof-final`, plus `isolated-no-cli` and `dpi-no-cli`. Historical paths in earlier comments refer to those retained directory names; no evidence was deleted. A subsequent focused-input run exhausted artifact-volume space during portable extraction; the new preflight requires 8 GB before starting. All commits remain unpushed. No corrupted package, new release or live settings change was published by this session. Substantial AI assistance: Codex (GPT-6).

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/AppKit#22