Infrastructure hardening: CI enforcement, supply chain, updater, diagnostics #14
Assignees
dtourolle (Duncan Tourolle)
Clear assignees
dtourolle (Duncan Tourolle)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: dtourolle/jellytau#14
Reference in New Issue
Block a user
Infrastructure hardening across five areas: CI enforcement, supply chain, release integrity, the upgrade path, and diagnostics. Each phase is independently reviewable and landed as its own commit.
What this fixes
The project already had the hard parts — pinned toolchain, tracked hooks, a traceability ratchet, a no-toolchain-installs rule. The gaps were in enforcement (configured gates that ran nowhere), supply chain (no scanning at all), release integrity (an advertised artifact that was never built), and feedback (an app that forgot everything on exit).
Several of these were found only by turning the gate on:
cargo denyrun — all closed by acargo updatenobody had reason to runbun run test:coveragebroken for months@vitest/coverage-v8pinsvitestexactly;">=1.0.0 <5.0.0"resolved to a mismatched pair, so every run died on a missing exportappimagewas absent frombundle.targets; the artifact step globbed for it, found nothing, and said nothingpublish-docs.ymlinstalled mdBook at job time.ts/.svelte/.rs, soDR-205/206/207carried TRACES comments nothing ever readPhases
0–1 · Enforcement. Prettier sweep (199 files, isolated commit), then
format:check,lint --max-warnings=159,bun run checkand coverage thresholds became CI gates.no-consolepromoted toerror— the logger migration it waited on had already finished. The coverage gate was verified to fail by raising it to 99, not assumed to work.2 · Supply chain.
cargo denyover advisories/licences/bans/sources,bun audit(advisory for now),SHA256SUMS+ CycloneDX SBOM on every release, and workflows pinned to an immutablejellytau-builder:2026.08instead of:latest. The graph is scoped to shipped targets so Apple-only findings are correctly absent rather than ignored by ID, andlibmpvis pinned by rev rather thanbranch = "master"— it was the one unsigned, C-linking dependency free to change under anycargo update. LGPL-2.1 obligations for libmpv are written down rather than assumed.3 · Updater. Desktop checks a signed manifest and installs in place; Android gets the releases page, because an app cannot overwrite its own APK.
latest.jsonlives on a dedicatedupdaterbranch read over Gitea's raw-file URL — this instance serves/releases/download/<tag>/<asset>but 404s on/releases/latest/download/<asset>(verified against a real asset), and the docs branch is force-pushed, so neither could host it. Release notes now come fromrelease:notesand the traceability graph instead of a fixed heredoc that linked "GitHub Issues" on a Gitea project.4 · Diagnostics. Rotating, size-capped, redacted logs; logcat on Android, where
env_logger's stdout went nowhere and the backend was therefore invisible on the platform carrying this project's hardest bugs. Panic capture with backtrace. Frontend messages forwarded into the same file, so one timeline holds both halves of the app — which is what makes a race between them legible after the fact. Redaction runs in the log formatter, not at export: a credential in a file on the device is already a disclosure. Spec indocs/specs/diagnostics-and-logging.md.5 · Governance.
SECURITY.md,CONTRIBUTING.md, code of conduct, issue/PR templates, anddocs/build/ci-operations.md(builder-image procedure, secrets, what losing the signing key would mean).Two bugs the tests caught that review would not have
redact_headersrecursed on its own output — the replacement keeps the header name, so it matched forever and the test died with a stack overflow. Rewritten as a forward scan.void plugin.error(...).voiddiscards a promise's value but not its rejection, so in any webview without IPC every log line became an unhandled rejection — 20 surfaced the first time coverage ran.Verification
bun run check(0 errors) · 1079 frontend tests + coverage thresholds · 759 Rust tests ·cargo clippy -D warnings·cargo fmt --check·cargo deny check(all four clean) ·cargo check --target aarch64-linux-android(confirming the updater plugins are absent there) ·check:boundary·check:links· traceability 90% ≥ 89%.The builder image
:2026.08is already built and pushed, withcargo-deny,cargo-cyclonedxandmdbookverified inside it — CI will not fail on the new tag.Before merging
master, requiringRun Tests,Android Compile Check,Supply Chainand the traceability job. Until that is on, every gate here is advisory.~/.tauri/jellytau.key.Also included: spec updates
Three commits here come from a parallel session working in the same checkout, carried along so the docs travel with the code:
32043a21— shipped specs folded into the architecture docs and deleted96abc3af— "a spec becomes an architecture doc" made the written rulef11f5edd— the Linux native-video compositing spike, which re-opens finding 2 ofplayback-backend-unification.md. Its general form was already falsified on Android, and the original evidence only ever covered foreign-window embedding — never mpv's render API drawing into a GL context inside Tauri's own GTK tree. That comes back green on X11 and Wayland. Findings 3–6 are deliberately left standing; finding 3 (mpv has no adaptive bitrate) is an independent disqualifier a green compositing result does not clear.The spec index's next-free-id line moved to UR-079 / IR-033 / DR-219 — this branch consumed UR-077/078 and DR-215–218 after that line was last written.
The repo configured four frontend gates and enforced one of them. eslint and prettier ran in no workflow and no hook; `bun run check` ran only in build-release.yml, so a type error could sit on master until somebody cut a tag; and `bun run test:coverage` had been dead for months. CI (build-and-test.yml) now runs format:check, lint, check and coverage alongside the existing boundary and doc-link tripwires. The coverage script failure was a version mismatch, not a config problem: @vitest/coverage-v8 resolved to 4.1.10, whose peer range pins vitest exactly, while package.json asked for ">=1.0.0 <5.0.0" and got 4.0.16 -- every run died on a missing BaseCoverageProvider export. The loose range is what allowed the pair to drift, so it is now ^4.1.10. Two ratchets, same policy as MIN_THRESHOLD in traceability-check.yml: eslint --max-warnings=159 (0 errors; 159 is today's backlog, only ever lower it) vitest thresholds (statements 51 / branches 45 / functions 46 / lines 52, measured at 54.6 / 48.7 / 49.6 / 55.1) no-console is promoted from "off" to "error": the logger-facade migration it was waiting on is finished -- 8 calls remained, 2 of them real stragglers in the settings page, now on the facade the file already imported. The sink itself, tests, and scripts/ are exempted; a CLI whose stdout is the product is not a stray debug statement. The threshold was verified to bite by raising it to 99 and watching the run go red, not by assuming an unfailed gate works. DR-205 moves to Done; the coverage gate is DR-215.The project shipped signed Android builds and unsigned desktop binaries with no vulnerability scanning of any kind. Nothing checked the ~500 crate Rust graph or the JS packages against an advisory feed, and nothing checked that what we redistribute inside an MIT bundle permits it. The first cargo-deny run found eight vulnerabilities and one unsoundness -- bytes, four in rustls-webpki, time, two in quick-xml and rand -- every one of them closed by a `cargo update` nobody had a reason to run. That update is in this commit; 740 Rust tests and clippy -D warnings pass on the new lockfile. Two structural fixes matter as much as the gate itself: - deny.toml scopes the graph to the targets we actually ship. Without it the Apple targets pull in plist -> quick-xml and report two DoS advisories against a crate that is in no binary we release. Ignoring those by ID would silence them everywhere, including where they would matter; scoping makes them correctly absent. - libmpv is pinned by rev instead of branch = "master". A branch means the revision is whatever Cargo.lock happens to hold and any `cargo update` silently substitutes new upstream code -- in the one dependency that is not from crates.io and that links a C library into the player. The rev is the commit already locked, so this pins current behaviour rather than changing it. Licence findings are recorded rather than waved through. libmpv and libmpv-sys are LGPL-2.1, satisfied here by dynamic linking against the system library; deny.toml carries the two obligations that follow (keep the linkage dynamic, ship libmpv's licence text with any bundle carrying the .so). MPL-2.0 crates are file-level copyleft and fine unmodified. Releases now publish SHA256SUMS (verified in-job with `sha256sum -c` before upload) and a CycloneDX SBOM for both halves, so "does this release contain <vulnerable crate>?" has an answer that is not "rebuild the tag and re-resolve it". Workflows pin jellytau-builder:2026.08 instead of :latest. While every job said :latest, rebuilding the image changed what every build compiled against, including rebuilds of old release tags. Also folded in, because both were the same class of problem: - publish-docs.yml downloaded mdBook from GitHub releases into /usr/local/bin at job time -- a toolchain install in CI, which CLAUDE.md explicitly forbids, and a hard dependency on GitHub's CDN at publish time. It is in the builder image now. - extract-traces.ts only ever read .ts/.svelte/.rs, so every requirement implemented by *configuration* was invisible to the matrix that measures it. DR-205, DR-206, DR-207 and DR-215 all carry TRACES comments nothing read, and each counted as uncovered while being covered. Coverage was really 90%, not 88%; MIN_THRESHOLD moves to 89 accordingly. CI workflows stay excluded and there is a test saying why: traceability-check.yml quotes "a TRACES: comment" beside deliberately-undefined example IDs, which the extractor would read as real traces and then fail its own dangling-ID check. Supply-chain requirement is DR-216. 🔴 The builder image must be rebuilt and pushed (scripts/build-builder-image.sh 2026.08) before this reaches master -- the workflows now name a tag and tools that do not exist in the registry yet.Anyone who installed an AppImage or ran the Windows installer was frozen on that version forever. Nothing in the app ever mentioned a new release existed, and the release notes were the only announcement. Desktop now checks a signed manifest, shows the version and its notes in Settings, and installs and relaunches on request. The signature check is the whole point: it is what stops a substituted download from being installed by the app itself. Windows binaries stay unsigned for SmartScreen purposes -- that is a code-signing certificate, a separate problem -- but the update payload is verified against our own key. Android is deliberately not wired to the updater. An app may not replace its own APK; that is the package installer's job, and the plugin has no Android implementation. It gets a link to the releases page instead of a button that would throw. The plugins are gated with a target-triple cfg rather than cfg(desktop). Cargo only evaluates target cfgs in a [target.'cfg(..)'] table, so cfg(desktop) matches nothing, silently drops the dependency, and fails much later with "Permission updater:default not found" -- which is exactly what the first attempt here did. Where the manifest lives took some finding. This Gitea serves /releases/download/<tag>/<asset> but 404s on /releases/latest/download/<asset> (verified against a real asset), so there is no stable latest-release URL. The gitea-pages branch is force-pushed wholesale by publish-docs.yml, so it cannot host the file either. latest.json therefore gets its own orphan branch, read over the raw-file URL, and is published from a scratch repo in RUNNER_TEMP rather than by switching branches in the checkout -- doing that would have left the following steps standing on a one-commit history, and the next step but one runs release:notes against the real commit range. Also fixed, all of it release-integrity: - "appimage" is in bundle.targets. The release notes have advertised an AppImage for months; tauri.conf.json never built one, the artifact step globbed for *.AppImage, found nothing, and said nothing. The step now fails instead. - The .AppImage.tar.gz/.sig pair and the NSIS .sig are collected. A manifest referencing a signature that was never uploaded fails only on the user's machine, so the manifest step also refuses to write an entry with an empty signature. - Release notes are generated by release:notes from the traceability graph, which is what CLAUDE.md has asked for all along, instead of a fixed heredoc that said "see CHANGELOG.md for detailed changes" and linked "GitHub Issues" on a Gitea-hosted project. - The notes tell users how to verify a download with SHA256SUMS. Requirements UR-077 / DR-217, tests UT-208 (12 cases over the version comparison and the platform decision, including that a pre-release does not offer itself as an upgrade to the matching release). Verified: 1070 frontend tests, cargo check for both the host and aarch64-linux-android (confirming the plugins are absent there), clippy -D warnings, svelte-check 0 errors.The app forgot everything it did the moment it exited. The Rust half logged through env_logger to stdout only -- invisible to anyone who launched from a desktop icon, and on Android worse than that: stdout is not logcat, so the backend produced no visible output at all on the platform carrying this project's hardest bugs. The autoplay deadlock, the truncated-stream restart and the background-audio stall were all diagnosed by talking a user through `adb logcat`, because there was no other way to see anything. A panic left nothing behind at all. Logs now go to a size-capped rotating file, to logcat on Android, and to the webview console in dev. A panic is recorded with its backtrace before the process dies. The frontend's messages are forwarded into the same file, so one timeline holds both halves of the app in order -- which is what makes a race between them legible after the fact, and races between them are the expensive bug class here. Redaction runs in the log FORMATTER, not at export time. A credential sitting in a file on the device is already a disclosure; stripping it on the way out would be too late. The exporter redacts a second time to cover files written by builds that predate this. api_key, X-Emby-Token, Authorization, "AccessToken" and Token="..." all reduce to [REDACTED], while host, item ids and filenames are deliberately kept -- a log scrubbed of those is one nobody can debug anything from. Server URLs keep scheme and host and drop any embedded user:pass@. Two things the tests caught that review would not have: - redact_headers recursed on its own output. The replacement keeps the header NAME, so the next call matched the same header forever; the test died with a stack overflow. It is a forward scan now. - The frontend forwarder used `void plugin.error(...)`. `void` discards a promise's value but not its rejection, so in any webview without IPC -- a unit test, SSR, a browser preview -- every log line became an unhandled rejection. 20 of them showed up the first time coverage ran. Each call now attaches a catch. Only info and above cross the IPC boundary: debug is per-tick player state and forwarding it would be thousands of calls a minute for output nobody reads. A failing forwarder never propagates and never prevents the console write. Nothing is transmitted anywhere. The export writes a zip and reports its path; the user attaches it themselves, which is also what keeps this from becoming telemetry. An Android share intent is explicitly out of scope -- it is Kotlin work that belongs with the other native code. The panic hook chains to the previous hook rather than replacing it, because utils/lock.rs installs a silencing hook around tests that provoke poisoned locks on purpose. Spec in docs/specs/diagnostics-and-logging.md; UR-078 / DR-218 / UT-209. Verified: 1079 frontend tests and the coverage gate, 759 Rust tests, clippy -D warnings, svelte-check 0 errors, and cargo check for aarch64-linux-android.