root/goodbuddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: recover managed SSH Agent package release
GoodBuddy Agents / Validate Agent source (push) Canceled after 0s
Details
GoodBuddy Agents / Build Linux arm64 Agent (push) Canceled after 0s
Details
GoodBuddy Agents / Build Linux x64 Agent (push) Canceled after 0s
Details
Cross-platform packages / Validate source (push) Canceled after 0s
Details
Cross-platform packages / Authorize desktop packaging (push) Canceled after 0s
Details
Cross-platform packages / linux arm64 (push) Canceled after 0s
Details
Cross-platform packages / macos arm64 (push) Canceled after 0s
Details
Cross-platform packages / windows arm64 (push) Canceled after 0s
Details
Cross-platform packages / linux x64 (push) Canceled after 0s
Details
Cross-platform packages / macos x64 (push) Canceled after 0s
Details
Cross-platform packages / windows x64 (push) Canceled after 0s
Details
Cross-platform packages / Publish GitHub and OSS release (push) Canceled after 0s
Details

Browse Source 
Linux .gbagent extraction inherited permissive directory modes, so compound packages failed secure Runtime verification on POSIX runners. Package roots and nested bundle directories now use private modes.

The production workflow now uses one GoodBuddy Agent signing identity for the Agent, bundled Runtime, outer package, and catalog. The unpublished 0.11.2 candidate is carried forward as desktop and Agent 0.11.3 without a LoongArch preview.

Release note: 修复 Linux 上 Agent 包解压后无法通过权限验证的问题，并将复合包各层统一为一组 GoodBuddy Agent 发布密钥。
This commit is contained in:
mesalogo
2026-08-25 20:53:28 +08:00
parent 53269f8b1a
commit fcedaf578e
17 changed files with 106 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
BUILD.md
+5 -5
View File
@@ -197,15 +197,15 @@ Linux x64/arm64 复合包。每个 job 从 `agent-runtime-lock.json` 解析官
发布路径：只接受指向受保护 `main` 历史的 annotated
`agent-v${agent-runtime-lock.agentVersion}` 标签，在 `agent-signing` Environment 中
原生构建两种架构，生成并签名累计目录，然后同步到非 Latest 的 GitHub Agent Release
与北京 OSS。该 Environment 保护以下两组变量与 Secret：
与北京 OSS。该 Environment 只保护一组 GoodBuddy Agent 发布变量与 Secret：
- `GOODBUDDY_AGENT_SIGNING_KEY_ID` /
`GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY`
- `GOODBUDDY_REMOTE_RUNTIME_SIGNING_KEY_ID` /
`GOODBUDDY_REMOTE_RUNTIME_SIGNING_PRIVATE_KEY`
私钥只注入对应签名步骤；预检只读取 key ID 并确认公钥已在
`resources/agent-release-keys.json` 注册为 production 且未撤销。
该身份统一签署内部 Agent、固定 Runtime manifest、外层 `.gbagent` 描述符和累计目录，
各层通过既有签名域区分用途，不再要求内部 Runtime 单独配置生产身份。私钥只注入签名
步骤；预检只读取 key ID 并确认公钥已在 `resources/agent-release-keys.json`
注册为 production 且未撤销。
累计目录使用 `agent-catalog.json` 与 `agent-catalog.sig`。每个条目绑定 Agent 版本、
最低桌面版本、Agent 协议、远端 OpenCode 版本/digest、架构、文件名、大小、SHA-256