Repository navigation
[Feature]: Verify APK identity and release bundle before fresh provisioning #21
Description
Activity
Implementation started on branch fix/lab-correctness-batch. The fresh provisioner will verify the complete bundle plus APK identity and signer before any ADB mutation. Coverage will be hardware-free and the existing updater contract will remain unchanged.
Implementation update: fresh provisioning now enters fail-closed Release mode when bundle markers are present and verifies the exact manifest allowlist/hashes, APK checksum, package/version, and exactly one manifest-bound signer before resolving ADB or selecting/mutating a device. Release mode rejects local builds and an APK path outside the bundle; source-development APKs are signature/package checked but explicitly not claimed as Release-trusted. PowerShell AST, updater regression (32/32), cellular policy, and new provisioner verification tests (13/13) pass. No hardware/ADB action was performed; physical fresh-provisioning acceptance remains deferred until a device is connected.
Implementation is ready in PR #26.
Fresh Provisioner now fails closed before ADB on incomplete/tampered Release bundles, wrong package/version, signer mismatch, local build in Release mode, or an APK path outside the bundle. It captures APK hash/identity/signer at preflight and repeats the complete binding immediately before native
adb install, so post-preflight replacement is refused.The signed-release workflow now checks out reviewed main first and authorizes only a tag whose commit exactly equals current
origin/mainbefore tag code or signing secrets are used. The separately published outer ZIP checksum is documented as the pre-extraction trust anchor; an in-bundle verifier does not claim to authenticate itself.Verification: Fresh Provisioner 16/16, updater 33/33 including a real built APK, PowerShell AST/cellular policy/workflow YAML checks pass. Physical Fresh Provisioner install remains open until hardware is attached.
Problem
The fresh provisioning path installs minimum-foss.apk without applying the manifest, checksum, package identity, version and signer validation already used by the existing-device updater.
Scope
Acceptance