catalogue: republish io.pilot.aegis 0.1.3 with the cli.args argv fix (go-live half of app-template#90)#397
Open
Alexgodoroja wants to merge 1 commit into
Open
Conversation
io.pilot.aegis 0.1.3 shipped with every curated method repeating the binary name as argv[0], so the adapter ran "aegis aegis scan <path>" and 6 of its 7 methods returned a usage banner with exit 1 instead of doing the work. Only aegis.exec was usable. app-template#90 drops the duplicated name from cli.args; this is the go-live half — the rebuilt, re-signed bundles. Same version (0.1.3): the AEGIS binary itself is unchanged, this is a wrapper-only fix, and the native artifacts under io.pilot.aegis/0.1.3/ are reused byte-for-byte. Signed with the app's original publisher key, so the update gate's ownership check passes. The bundles are published to a NEW prefix (0.1.3/rev2/) rather than overwriting 0.1.3/. The live catalogue pins the old bundle sha, so overwriting in place would break sha verification for every existing aegis install for the whole window between the upload and this merge. The old objects stay untouched and keep serving the currently-pinned sha; this commit flips url+sha together, so the cutover is atomic and reverting this PR is a complete rollback. metadata.json also picks up the product_demo block from app-template#88, which had not been republished for this app yet. Verified end-to-end before opening: stock daemon + pilotctl against this exact catalogue.json (signature verified against the prod anchor), bundle fetched from prod R2 (sha256 OK), then aegis.scan returns a real scan — "scan complete: 0/1 flagged" on a clean file, and QUARANTINE / "1/1 flagged" on a planted injection. The other five repaired methods all exit 0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Go-live half of pilot-protocol/app-template#90. That PR fixes the submission of record; this one is what actually reaches users.
The bug
io.pilot.aegis0.1.3 shipped withbackend.command = ["aegis"]and every curated method repeating the binary name asargv[0](["aegis","scan","${path}"]). The scaffold builds argv asbase[0]+base[1:]+cli.args, so the adapter ranaegis aegis scan <path>→ unknown subcommand → usage banner, exit 1.6 of 7 methods are dead in production today (
scan,status,targets,config,version,help) — onlyaegis.execworks. Every other CLI app (tldr, duckdb, postgres, redis, mysql, sqlite, docker, otto, miren) omits the binary name; aegis was the sole outlier.Why the version stays 0.1.3
The AEGIS binary is unchanged — this is a wrapper-only fix. Artifact URLs derive from
app_version, so bumping to 0.1.4 would repoint sha-pinned URLs at objects that do not exist. The native artifacts underio.pilot.aegis/0.1.3/are reused byte-for-byte.docs/UPDATING.mdallows a same-version re-publish by the owner (idempotent).Signed with the app’s original publisher key
ed25519:+nt58BA0gpPYuyaeG2GwfTI79j8IHP+zra5GvRQv0N0=, which matches thepublisherpin already in the catalogue, so the ownership gate passes.Bundles go to a NEW prefix — please keep it that way
Bundles are published to
bundles/io.pilot.aegis/0.1.3/rev2/, not over0.1.3/.The live catalogue pins the old bundle sha (
ae40da40…). Overwriting the existing objects in place would make the pinned sha disagree with the bytes R2 serves, breaking sha verification for every existing aegis install for the entire window between the upload and this merge. The old objects are untouched and still serve the currently-pinned sha; this PR flipsbundle_url+bundle_sha256together, so the cutover is atomic and reverting this PR is a complete rollback.What changed
bundle_sha256(linux/amd64)ae40da40…→c8416c11…ad2b5c81…→751aee6d…e582c8e7…→bbd42e0f…metadata_sha256ca71da63…→b3a02a65…version/publishermetadata.jsonalso picks up theproduct_demoblock from app-template#88, which had not been republished for this app yet. It carries nonext_steps— that ships with app-template#89.Verification
Built from app-template#90 at
3364651(main+ the 6-deletion fix). Rehearsed the real client path before opening: stockpilot-daemon+pilotctl, signature verified against the prod anchoriHdBWayA…, bundle fetched from prod R2 over the network:Then, through
pilotctl appstore call:aegis.scan {"path":"/etc/hosts"}→"exit": 0,[AEGIS] scan complete: 0/1 flagged(was: exit 1 + usage banner)QUARANTINE combined=1.00 [Patterns=1.00],scan complete: 1/1 flagged— it genuinely scans, not merely exits 0aegis.status/targets/config/version→ all exit 0Signature re-verified against the prod anchor after signing.
Merge order
Land app-template#90 first (submission of record), then this. Not merging either myself — this one is live for every agent the moment it lands.