fix(release): resume identical profile publications

Author: ebursztein

.github/workflows/release-assets.yaml

@@ -578,8 +578,11 @@ jobs:
             echo '#!/usr/bin/env bash'
             echo 'set -euo pipefail'
             printf 'if gh release view %q >/dev/null 2>&1; then\n' "$TAG"
-            printf '  echo %q >&2\n' "immutable profile release already exists: $TAG"
-            printf '  exit 1\n'
+            printf '  existing=$(mktemp -d)\n'
+            printf '  trap '"'"'rm -rf "$existing"'"'"' EXIT\n'
+            printf '  gh release download %q --dir "$existing"\n' "$TAG"
+            printf '  uv run python scripts/verify-immutable-publication.py --expected %q --actual "$existing"\n' "$RELEASE_DIR"
+            printf '  echo %q\n' "reusing byte-identical immutable profile release: $TAG"
             printf 'else\n'
             printf '  gh release create %q' "$TAG"
             printf ' %q' "${files[@]}"

scripts/verify-immutable-publication.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Require two flat immutable publication directories to contain identical bytes."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import sys
+from pathlib import Path
+
+
+def publication_files(root: Path, label: str) -> dict[str, Path]:
+    if root.is_symlink() or not root.is_dir():
+        raise ValueError(f"{label} publication root is missing or unsafe: {root}")
+    files: dict[str, Path] = {}
+    for entry in root.iterdir():
+        if entry.is_symlink() or not entry.is_file():
+            raise ValueError(f"{label} publication contains unsafe entry: {entry}")
+        files[entry.name] = entry
+    if not files:
+        raise ValueError(f"{label} publication contains no files")
+    return files
+
+
+def file_identity(path: Path) -> tuple[int, str]:
+    digest = hashlib.sha256()
+    size = 0
+    with path.open("rb") as source:
+        for block in iter(lambda: source.read(1024 * 1024), b""):
+            size += len(block)
+            digest.update(block)
+    return size, digest.hexdigest()
+
+
+def verify_identical_publication(expected: Path, actual: Path) -> None:
+    expected_files = publication_files(expected, "expected")
+    actual_files = publication_files(actual, "existing")
+    expected_names = set(expected_files)
+    actual_names = set(actual_files)
+    if expected_names != actual_names:
+        raise ValueError(
+            "immutable publication file set mismatch: "
+            f"missing={sorted(expected_names - actual_names)} "
+            f"extra={sorted(actual_names - expected_names)}"
+        )
+    mismatches = [
+        name
+        for name in sorted(expected_names)
+        if file_identity(expected_files[name]) != file_identity(actual_files[name])
+    ]
+    if mismatches:
+        raise ValueError(f"immutable publication byte mismatch: {mismatches}")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--expected", type=Path, required=True)
+    parser.add_argument("--actual", type=Path, required=True)
+    args = parser.parse_args()
+    try:
+        verify_identical_publication(args.expected, args.actual)
+    except (OSError, ValueError) as error:
+        print(f"immutable publication verification failed: {error}", file=sys.stderr)
+        return 1
+    print(f"immutable publication matches exactly: {args.actual}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tests/capsem-release/test_immutable_profile_publication.py

@@ -0,0 +1,66 @@
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+import sys
+
+import pytest
+
+
+ROOT = Path(__file__).resolve().parents[2]
+SCRIPT = ROOT / "scripts" / "verify-immutable-publication.py"
+SPEC = importlib.util.spec_from_file_location("verify_immutable_publication", SCRIPT)
+assert SPEC is not None and SPEC.loader is not None
+VERIFY = importlib.util.module_from_spec(SPEC)
+sys.modules[SPEC.name] = VERIFY
+SPEC.loader.exec_module(VERIFY)
+
+
+def _publication(root: Path) -> None:
+    root.mkdir()
+    (root / "channel-source-nightly.json").write_bytes(b'{"channel":"nightly"}\n')
+    (root / "x86_64-rootfs.erofs").write_bytes(b"rootfs")
+
+
+def test_identical_immutable_publication_is_resumable(tmp_path: Path) -> None:
+    expected = tmp_path / "expected"
+    actual = tmp_path / "actual"
+    _publication(expected)
+    _publication(actual)
+
+    VERIFY.verify_identical_publication(expected, actual)
+
+
+@pytest.mark.parametrize("mutation", ("missing", "extra", "changed", "nested"))
+def test_immutable_publication_rejects_any_file_set_or_byte_drift(
+    tmp_path: Path,
+    mutation: str,
+) -> None:
+    expected = tmp_path / "expected"
+    actual = tmp_path / "actual"
+    _publication(expected)
+    _publication(actual)
+    if mutation == "missing":
+        (actual / "x86_64-rootfs.erofs").unlink()
+    elif mutation == "extra":
+        (actual / "unexpected").write_bytes(b"extra")
+    elif mutation == "changed":
+        (actual / "x86_64-rootfs.erofs").write_bytes(b"changed")
+    else:
+        (actual / "nested").mkdir()
+
+    with pytest.raises(ValueError, match="publication"):
+        VERIFY.verify_identical_publication(expected, actual)
+
+
+def test_immutable_publication_rejects_symlinked_files(tmp_path: Path) -> None:
+    expected = tmp_path / "expected"
+    actual = tmp_path / "actual"
+    _publication(expected)
+    _publication(actual)
+    target = actual / "x86_64-rootfs.erofs"
+    target.unlink()
+    target.symlink_to(expected / "x86_64-rootfs.erofs")
+
+    with pytest.raises(ValueError, match="unsafe entry"):
+        VERIFY.verify_identical_publication(expected, actual)

tests/capsem-release/test_staged_profile_binary_activation.py

@@ -179,3 +179,20 @@ def test_profile_then_binary_reuses_authored_source_without_rebuilding_assets()
     assert "Prove binary candidate preserved every profile" in binary
     assert 'before.get("profiles") != after.get("profiles")' in binary
     assert "name: binary-channel-candidate" in binary
+
+
+def test_existing_profile_publication_is_reused_only_after_exact_byte_comparison() -> None:
+    workflow = PROFILE_WORKFLOW.read_text(encoding="utf-8")
+    publish = _job(workflow, "publish-profile-release", "deploy-channel")
+    immutable = _step(
+        publish,
+        "Publish immutable GitHub profile release",
+        "Attest VM asset provenance",
+    )
+
+    assert "gh release download" in immutable
+    assert "scripts/verify-immutable-publication.py" in immutable
+    assert "--expected" in immutable
+    assert "--actual" in immutable
+    assert "gh release upload" not in immutable
+    assert "immutable profile release already exists" not in immutable