Repository navigation
feat(install): default install mode to --from-release (D4 flip, #249) - #368
Merged
Merged
Conversation
Completes ADR-011: install.sh now defaults to the cosign-verified release tarball. An unset INSTALL_MODE resolves to release; --from-source is the opt-in escape hatch and requires --i-accept-unverified-source to acknowledge that a local tree carries no cosign chain. Migrated the source-default assumption out of the test suite (run_install in test-upgrade-roundtrip; the smoke-harness source leg + both --system calls; the case-10 prefix-rejection invocations) and added flow-test cases 18b (--from-source requires the ack flag) and 18c (bare ack flag with no mode is rejected). Pre-PR review (shell-expert + security-review-expert + code-review-expert) caught an ordering bug: the ack-flag guard ran before the unset->release resolution, so a bare --i-accept-unverified-source silently resolved to release with the flag ignored. Fixed by resolving mode first, then guarding on mode != source. macOS ADR-011 gate (E3 CI red under #366) satisfied out-of-band: local verify-release.sh + bsdtar of v1.2.0 on Apple Silicon (cosign PASS, sha bind PASS, osx-arm64 ONNX native present). Windows install.ps1 parity tracked in #367. Closes #249.
3 tasks
|
🎉 This PR is included in version 1.3.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #249.
Summary
Completes ADR-011's Archetype A2 migration:
install.shnow defaults to the cosign-verified--from-releasetarball. An unsetINSTALL_MODEresolves torelease;--from-sourceis the opt-in escape hatch and requires--i-accept-unverified-sourceto acknowledge that a local tree carries no cosign chain.This is the last-line "flip" the issue anticipated, plus the test-suite migration it implies (the suite assumed source-as-default in several places).
Changes
scripts/install.sh— unset mode →release;--from-sourcegated behind--i-accept-unverified-source; usage/comments updated.run_install()(roundtrip) and the smoke harness source leg + both--systemcalls now pin--from-source --i-accept-unverified-source; flow-test cases 17/18 rewritten for explicit source mode; new case 18b (--from-sourcerequires the ack flag) and 18c (bare ack flag with no mode is rejected).docs/install-upgrade-track.md(D4 done, only feat(install): RHEL/Fedora host-dependency bootstrap module (--install-deps) #247 left), ADR-011 status line.macOS ADR-011 gate
The flip gate wants the from-release smoke green on both runners; macOS CI is blocked by #366 (Homebrew bottle). Satisfied out-of-band with real evidence on Apple Silicon:
verify-release.shagainst v1.2.0 → cosign verify PASS (psmfd identity), manifest→tarball sha256 PASS, bsdtar extract OK, andruntimes/osx-arm64/native/libonnxruntime.dylibpresent (the RID-packing crash risk #249 called out).Pre-PR review (3 reviewers, most-severe-wins)
--i-accept-unverified-sourcesilently resolved to release.install.ps1platform-asymmetry gap.Fixes applied: reordered mode-resolution before the ack-flag guard (guard now fires on
mode != source), verified with the exact repro + new regression test 18c; updated two stale comment blocks; corrected the marker fallback default; clarified the usage synopsis. Filed #367 forinstall.ps1from-release parity (Windows has no cosign path — the flip widens that asymmetry) and noted it in the README.Doc-impact
Verification
shellcheck clean;
validate-pr.shPASS; flow-test 40/1 (the 1 is the pre-existing case-23 host quirk, identical onorigin/dev); exact ordering-bug repro now errors; control case unchanged. (macOS install-smoke jobs remain non-blocking under #366.)