External installer checksum authorization 6b9439ca7426

Release-campaign review of digest 6b9439ca742656dc… (still current as of 2026-10-18 19:50 UTC)

Review evidence only. This comment does not authorize anything. The monitor's gate is still the owner-only authorized-checksum-change file on the monitor host.

I recomputed the digest with external_authorization_digest over the current pins (9956dd9c) and the live bytes. It is unchanged since this issue was opened, so the bytes below are exactly what it asks about.

Upstream content review (diffs read; nothing executed on a real host)

• atuin (releases/latest/download/atuin-installer.sh)
  • Pinned e632c6d1… is the v18.23.0 asset. Live 69c7c0e0… is byte-identical to the v18.24.1 asset; both match GitHub's published asset digests.
  • The cargo-dist (0.31.0) script changed only the version strings, the versioned download URLs, the receipt version and the 7 per-platform archive sha256 values. All 7 match the v18.24.1 assets.
  • No logic change: same install path, same checksum verification, same ATUIN_NO_MODIFY_PATH handling, no new endpoints.
• opencode (https://opencode.ai/install)
  • The live bytes equal install on the upstream v1 branch at 3be039593a9a (PR #54904, merged with a verified signature). The pinned fc3c1b21… is 4018c863; no other commit touched the file in between.
  • The installer now refuses 2.x. It resolves the latest 1.x from registry.npmjs.org/opencode-ai/latest, validated as 1.x.y, and falls back to GitHub releases filtered to v1.x.y. It also checks that the download URL exists.
  • Downloads still come from GitHub Releases. The install path (~/.opencode/bin), shell profile edits and no-sudo behaviour are unchanged.
  • New egress: registry.npmjs.org.
  • Pre-existing gap, not introduced by this change: the archive itself is still not checksum-verified.

Real tests (trj, clean containers, unprivileged target user)

• ACFS security.sh path (load_checksums + fetch_and_run_with_runner) on ubuntu:24.04 amd64, arm64v8/ubuntu:24.04 and ubuntu:22.04:
  • The old pins are refused with Checksum mismatch.
  • The new pins install and run atuin 18.24.1 and opencode 1.19.3.
• automated_flywheel_setup_checker 0.1.0 validate --check-urls --check-hashes on the candidate pins: valid, 48/48 reachable, 48/48 hashes match.
• Staged coherent candidate, not pushed. Local commit 1e0765a6 on base 9956dd9c:
  • Regenerated with packages/manifest bun run generate (bun 1.4.3). The diff is exactly checksums.yaml (header + these two sha256 lines), scripts/generated/internal_checksums.sh and apps/web/lib/generated/manifest-modules.ts; both generated files pin fb358e42….
  • check-manifest-drift.sh --json: drift_detected=false; internal checksums 121 checked, 0 drifted.
  • Real install.sh --bootstrap-archive <candidate archive> --yes --only tools.atuin,agents.opencode on ubuntu:24.04: integrity verified (121 scripts), Verified: atuin, atuin 18.24.1 plus the ACFS guard wrapper, Verified: opencode, opencode 1.19.3, ACFS_RC=0.
  • The same command against the current 9956dd9c archive fails both modules with Checksum mismatch and ACFS_RC=1.

Decision left to the owner

• If both are acceptable, write authorize:6b9439ca742656dc90d1ce8038620577b0ffde628ea3af9cfc3df58c12d6174b into the monitor host's authorization file; the monitor then publishes coherently.
• For opencode, re-pinning keeps ACFS on OpenCode 1. Moving to OpenCode 2 would need a different URL (opencode.ai/v2/install) and a new pin.
• The atuin pin follows releases/latest, so it will drift on every atuin release. A versioned URL would avoid that.

Related: the incident write-up in #468. A checksums.yaml-only re-pin of these two entries (7368ba66) briefly broke the bootstrap ledger and was restored in 9956dd9c.