Documents and release tooling match 1.1.1: stale statements, and package manifests that verify the file they name #183

New Issue

2026-11-11T05:49:19Z

james.maes commented

2026-11-11 05:49:19 +00:00

Found by the release reviews of the 1.1.1 candidate (main at 6696e37): statements that are no longer true at this commit, and two gaps in the release tooling.

Documents

docs/security/threat-model.md: the header still names v1.0.1 as the version reviewed; section 1 says gclo contacts nothing but GitHub (installed builds check git.kof22.com for updates); the residual-risk list says the binaries are not yet signed (they are, ADR 0008); T2 and T11 do not say what changed with ADR 0009 (for Scoop, the manifest with the pinned hash and the file it names now come from the same server; the copy of release assets to that server is a manual step outside the attested pipeline).
SECURITY.md: the supported line reads 1.0.x.
README.md: the stable installer is said to take over a beta install (the dev edition is a separate app with its own accounts); parallelism is described before loading (it is under Sync options, after loading); two button names are not the ones on screen; the build section describes a packaged build and Developer Mode (the app is always built unpackaged).
CONTRIBUTING.md: the same packaged-build wording.
docs/CLI.md: an example shows version 1.0.0.
docs/RELEASING.md: does not say on which forge the packaging commit lands; puts the check that the release answers from outside after the point of no return; has no rehearsal of the first update that is read from git.kof22.com.

Release tooling

.github/scripts/Update-PackageManifests.ps1 takes the hash from the zip it is given and writes the download URL on git.kof22.com after a HEAD request. A file copied there that differs from the one that was hashed would produce manifests that fail for every user. It should download the file it names and compare.
gclo.Engine.Tests/VaultEdgeTests.cs: one test stores an entry in the credential namespace the installed app uses (under a random id, removed afterwards). Tests are meant to stay out of that namespace (#161).

Not in this issue

The public change in gclo.Engine (IGitClient.FetchAndPullAsync takes the expected URL) is named in the release notes; whether the package is published under a patch number is the owner's decision.

Found by the release reviews of the 1.1.1 candidate (main at 6696e37): statements that are no longer true at this commit, and two gaps in the release tooling. ## Documents - `docs/security/threat-model.md`: the header still names v1.0.1 as the version reviewed; section 1 says gclo contacts nothing but GitHub (installed builds check `git.kof22.com` for updates); the residual-risk list says the binaries are not yet signed (they are, ADR 0008); T2 and T11 do not say what changed with ADR 0009 (for Scoop, the manifest with the pinned hash and the file it names now come from the same server; the copy of release assets to that server is a manual step outside the attested pipeline). - `SECURITY.md`: the supported line reads 1.0.x. - `README.md`: the stable installer is said to take over a beta install (the dev edition is a separate app with its own accounts); parallelism is described before loading (it is under Sync options, after loading); two button names are not the ones on screen; the build section describes a packaged build and Developer Mode (the app is always built unpackaged). - `CONTRIBUTING.md`: the same packaged-build wording. - `docs/CLI.md`: an example shows version 1.0.0. - `docs/RELEASING.md`: does not say on which forge the packaging commit lands; puts the check that the release answers from outside after the point of no return; has no rehearsal of the first update that is read from git.kof22.com. ## Release tooling - `.github/scripts/Update-PackageManifests.ps1` takes the hash from the zip it is given and writes the download URL on git.kof22.com after a HEAD request. A file copied there that differs from the one that was hashed would produce manifests that fail for every user. It should download the file it names and compare. - `gclo.Engine.Tests/VaultEdgeTests.cs`: one test stores an entry in the credential namespace the installed app uses (under a random id, removed afterwards). Tests are meant to stay out of that namespace (#161). ## Not in this issue The public change in `gclo.Engine` (`IGitClient.FetchAndPullAsync` takes the expected URL) is named in the release notes; whether the package is published under a patch number is the owner's decision.

james.maes added the documentation label 2026-11-11 05:49:19 +00:00

james.maes referenced this issue from a commit

2026-11-11 06:04:05 +00:00

docs(release): the documents say what 1.1.1 does, and the package manifests verify the file they name

james.maes referenced a pull request that will close this issue

2026-11-11 06:04:05 +00:00

docs(release): the documents say what 1.1.1 does, and the package manifests verify the file they name #199

james.maes referenced this issue from a commit

2026-11-11 06:14:22 +00:00

docs(release): second review of #199: the runbook no longer contradicts itself, and says which file the manifests are made from

james.maes referenced this issue from a commit

2026-11-11 06:20:48 +00:00