[Task] Publish and verify the one-file GovOPlaN deployment bootstrap #22

New Issue

2026-07-30T15:08:25+02:00

zemion commented

2026-07-30 15:08:25 +02:00

Objective

Turn the standard-library deployer under tools/deployment into the verified
one-file entry point from GovOPlaN #13.

Implemented Locally

Versioned installation intent and JSON Schema.
Managed/external PostgreSQL and Redis choices.
Disabled/external/test mail and local/S3 storage choices.
Private generated secrets, deterministic Compose, plan/doctor/status/apply,
locking, migration ordering, health receipt, and safe reconfiguration.
A build command for one executable Python zipapp.

Remaining Scope

Make the zipapp reproducible and publish it as a release artifact.
Publish independent checksum/signature verification before execution.
Embed or explicitly install a trusted deployment keyring.
Fetch a bounded HTTPS distribution manifest and verify signature, digest,
channel, expiry, and revocation before accepting image identities.
Add offline/prefetched manifest and image handling.
Add download/install documentation and CI tamper tests.

Acceptance Criteria

One verified artifact runs without GovOPlaN installed.
It executes no downloaded shell text or arbitrary command strings.
Re-running is idempotent and preserves deployment secrets.
Tampered, expired, revoked, wrong-channel, and unknown-key manifests fail.

## Objective Turn the standard-library deployer under `tools/deployment` into the verified one-file entry point from GovOPlaN #13. ## Implemented Locally - Versioned installation intent and JSON Schema. - Managed/external PostgreSQL and Redis choices. - Disabled/external/test mail and local/S3 storage choices. - Private generated secrets, deterministic Compose, plan/doctor/status/apply, locking, migration ordering, health receipt, and safe reconfiguration. - A build command for one executable Python zipapp. ## Remaining Scope - Make the zipapp reproducible and publish it as a release artifact. - Publish independent checksum/signature verification before execution. - Embed or explicitly install a trusted deployment keyring. - Fetch a bounded HTTPS distribution manifest and verify signature, digest, channel, expiry, and revocation before accepting image identities. - Add offline/prefetched manifest and image handling. - Add download/install documentation and CI tamper tests. ## Acceptance Criteria - [x] One verified artifact runs without GovOPlaN installed. - [x] It executes no downloaded shell text or arbitrary command strings. - [x] Re-running is idempotent and preserves deployment secrets. - [x] Tampered, expired, revoked, wrong-channel, and unknown-key manifests fail.

zemion added the module/ops

type

task

area/devex codex/ready area/release area/security

module/core labels 2026-07-30 15:08:25 +02:00

zemion referenced this issue

2026-07-30 15:08:55 +02:00

[User Story] One-command Core bootstrap, module lifecycle, scale-out, and environment promotion #13

zemion commented

2026-07-30 15:29:30 +02:00

Pushed implementation and verification

The first standard-library deployment bootstrap is pushed in GovOPlaN/govoplan@82e836b with init, configure, render, doctor, apply, and status; deterministic Compose generation; private state; reconfiguration plans; migration/readiness ordering; and a one-file zipapp builder.

Verified locally:

19 focused unit/integration-style orchestration tests pass;
Ruff and py_compile pass;
the Draft 2020-12 installation schema is valid and accepts the generated default specification;
a built zipapp initializes and renders a bundle and now propagates blocked/error exit status correctly;
workflow YAML parses successfully;
git diff --check passes.

A real Compose launch was not run on this workstation because Docker is unavailable. Gitea CI covers packaging/tests after push; runtime container integration remains dependent on #21. The self-hosted path intentionally remains blocked pending #21, GovOPlaN #24, govoplan-core #278, and the signed manifest verifier.

## Pushed implementation and verification The first standard-library deployment bootstrap is pushed in `GovOPlaN/govoplan@82e836b` with `init`, `configure`, `render`, `doctor`, `apply`, and `status`; deterministic Compose generation; private state; reconfiguration plans; migration/readiness ordering; and a one-file zipapp builder. Verified locally: - 19 focused unit/integration-style orchestration tests pass; - Ruff and `py_compile` pass; - the Draft 2020-12 installation schema is valid and accepts the generated default specification; - a built zipapp initializes and renders a bundle and now propagates blocked/error exit status correctly; - workflow YAML parses successfully; - `git diff --check` passes. A real Compose launch was not run on this workstation because Docker is unavailable. Gitea CI covers packaging/tests after push; runtime container integration remains dependent on #21. The self-hosted path intentionally remains blocked pending #21, GovOPlaN #24, govoplan-core #278, and the signed manifest verifier.

zemion commented

2026-08-03 20:19:08 +02:00

Completed by the standalone bootstrap published with GovOPlaN v0.1.14.

Verification evidence:

govoplan-deploy.pyz SHA-256: 1ff946fba82b0895d153b23352d06e30fe18388450dfd37fed6fb9912310efc5; two independent local builds reproduced that exact digest.
The artifact runs directly with Python and exposes only typed init, configure, render, doctor, apply, status, release/offline verification, Kubernetes verification, operations, and recovery commands. It does not download or evaluate shell text or arbitrary command strings.
Its detached Ed25519 signature verifies with independently retained key runtime-distribution-2026-01. The retained public-key file SHA-256 is 88f8e1032f205f980a7a99f67ea6afd9f0460eeb824c2dc78beb4d13313ffefc; the published keyring contains identical canonical key material.
A one-byte-mutated zipapp is rejected. Manifest adoption checked the independently obtained manifest digest d703267e01855dee63200cb20921c91c3f95fbff550c8ca76e9a35cba3f69109, signature, stable channel, validity interval, revocation state, exact images/dependencies, and module composition.
Fresh init creates a private bundle. A second init fails closed without changing any byte; no-op reconfiguration preserves secrets.env; repeated render output is byte-deterministic.
Automated regressions reject checksum mismatch, tampering, expiry, revocation, wrong channel, unknown keys, mutable/unbound images, and incomplete or digest-mismatched offline bundles. The focused installer/distribution suite passes 55 tests.
Runtime Distribution run #459 independently used the zipapp to verify and adopt the published bundle before publication.

The release evidence and administrator documentation were finalized in ce5528e. Key distribution remains an independent operational trust-channel responsibility, as intended by the contract.

Completed by the standalone bootstrap published with [GovOPlaN v0.1.14](https://git.add-ideas.de/GovOPlaN/govoplan/releases/tag/v0.1.14). Verification evidence: - `govoplan-deploy.pyz` SHA-256: `1ff946fba82b0895d153b23352d06e30fe18388450dfd37fed6fb9912310efc5`; two independent local builds reproduced that exact digest. - The artifact runs directly with Python and exposes only typed `init`, `configure`, `render`, `doctor`, `apply`, `status`, release/offline verification, Kubernetes verification, operations, and recovery commands. It does not download or evaluate shell text or arbitrary command strings. - Its detached Ed25519 signature verifies with independently retained key `runtime-distribution-2026-01`. The retained public-key file SHA-256 is `88f8e1032f205f980a7a99f67ea6afd9f0460eeb824c2dc78beb4d13313ffefc`; the published keyring contains identical canonical key material. - A one-byte-mutated zipapp is rejected. Manifest adoption checked the independently obtained manifest digest `d703267e01855dee63200cb20921c91c3f95fbff550c8ca76e9a35cba3f69109`, signature, stable channel, validity interval, revocation state, exact images/dependencies, and module composition. - Fresh `init` creates a private bundle. A second `init` fails closed without changing any byte; no-op reconfiguration preserves `secrets.env`; repeated render output is byte-deterministic. - Automated regressions reject checksum mismatch, tampering, expiry, revocation, wrong channel, unknown keys, mutable/unbound images, and incomplete or digest-mismatched offline bundles. The focused installer/distribution suite passes 55 tests. - Runtime Distribution [run #459](https://git.add-ideas.de/GovOPlaN/govoplan/actions/runs/459) independently used the zipapp to verify and adopt the published bundle before publication. The release evidence and administrator documentation were finalized in [`ce5528e`](https://git.add-ideas.de/GovOPlaN/govoplan/commit/ce5528e). Key distribution remains an independent operational trust-channel responsibility, as intended by the contract.

zemion closed this issue

2026-08-03 20:19:08 +02:00

zemion removed the codex/ready

status

in-progress

labels 2026-08-03 20:19:09 +02:00

zemion referenced this issue

2026-08-03 20:20:14 +02:00

[Task] Produce signed target maturity and recovery evidence for a pinned release #37

zemion referenced this issue

2026-08-20 23:58:54 +02:00

[Privacy] Complete DSAR provider coverage across data-owning modules #47