Skip to content

Retain and qualify final Linux agent package bytes - #25

Open
spenceralbrecht wants to merge 2 commits into
masterfrom
security/agent-final-linux-retention-20261027
Open

spenceralbrecht wants to merge 2 commits into
masterfrom
security/agent-final-linux-retention-20261027

Conversation

@spenceralbrecht

Copy link
Copy Markdown
Contributor

Green fixture receipts do not retain a release package. Build one final Linux vmpower-agent 0.2.0 archive from the unmodified compiled bundle, then independently stat, hash and reopen its complete control/data contents immediately before installing those same bytes from each retained legacy package family.

Keep every existing adverse phase, quarantine/BPF/cleanup control, Windows job and timeout. Only after both final-package lifecycle/report proofs, supervisor, cleanup and isolation pass, reopen the archive again and upload exactly the final deb plus its bounded provenance manifest with three-day retention. Fixture upgrade/crash variants and configuration are excluded.

Validation: 162 author tests, 79 independent focused tests and seven additional direct controls pass. Actual package construction, native deadline fit and artifact readback remain to be proved by this PR's configured native checks.

This prepares retained candidate bytes only. It creates no release tag, publishes no package, changes no customer agent and claims no post-success rollback or customer OS compatibility. Publication, an eligible pilot and safe recovery remain separate acceptance work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant