Release: install.sh is a release asset and an attested subject (F20)

.github/workflows/release.yml

@@ -4,8 +4,9 @@ name: Release
 #
 #   tag vX.Y.Z[-rc.N] -> check -> build every target on its own runner
 #                     -> publish: manifest, ONE Sigstore attestation over the
-#                        manifest and every executable, a draft release with
-#                        everything attached, the ordering gate, publish once.
+#                        manifest, every executable and install.sh, a draft
+#                        release with everything attached, the ordering gate,
+#                        publish once.
 #
 # THE NAME OF THIS FILE IS PERMANENT. Every installed client accepts a release
 # only when its attestation names `.github/workflows/release.yml` at the exact
@@ -151,7 +152,14 @@ jobs:
           bun run scripts/release-manifest.ts --version "$VERSION" --commit "$GITHUB_SHA" \
             --directory "$RUNNER_TEMP/release"
           cat "$RUNNER_TEMP/release/manifest.json"
-      # ONE attestation whose subjects are the manifest and every executable.
+      # The one-command installer of this very tag, byte for byte: what
+      # releases/latest/download/install.sh (and lazurio.ai/install) serves.
+      # It is not in the manifest, whose targets are executables only.
+      - name: install.sh is a release asset
+        run: cp install.sh "$RUNNER_TEMP/release/install.sh"
+      # ONE attestation whose subjects are the manifest, every executable and
+      # install.sh. Clients require their digests to be AMONG the subjects, so
+      # an added subject changes nothing for them.
       - id: attest
         uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
@@ -160,6 +168,7 @@ jobs:
             ${{ runner.temp }}/release/lazurio-linux-x64
             ${{ runner.temp }}/release/lazurio-linux-arm64
             ${{ runner.temp }}/release/lazurio-darwin-arm64
+            ${{ runner.temp }}/release/install.sh
       - name: The bundle is a release asset
         env:
           BUNDLE: ${{ steps.attest.outputs.bundle-path }}
@@ -182,7 +191,8 @@ jobs:
             "$RUNNER_TEMP/release/lazurio.sigstore.json" \
             "$RUNNER_TEMP/release/lazurio-linux-x64" \
             "$RUNNER_TEMP/release/lazurio-linux-arm64" \
-            "$RUNNER_TEMP/release/lazurio-darwin-arm64"
+            "$RUNNER_TEMP/release/lazurio-darwin-arm64" \
+            "$RUNNER_TEMP/release/install.sh"
       - name: Ordering gate, immediately before publishing
         run: |
           # A final version must be greater than EVERY published final

README.md

@@ -3,14 +3,14 @@
 **Install Lazurio with one command** (Linux x64 and arm64, macOS on Apple silicon):
 
 ```sh
-curl -fsSL https://lazurio.ai/install | sh
+curl --proto '=https' --tlsv1.2 -fsSL https://lazurio.ai/install | sh
 ```
 
 `lazurio.ai/install` serves this once the website route is deployed. Until then, and
 until a release carries `install.sh` as an asset, use the script of this repository:
 
 ```sh
-curl -fsSL https://raw.githubusercontent.com/Lazurio/LazurioPlatform/main/install.sh | sh
+curl --proto '=https' --tlsv1.2 -fsSL https://raw.githubusercontent.com/Lazurio/LazurioPlatform/main/install.sh | sh
 ```
 
 It installs the `lazurio` CLI and the Launchpad (one program) for your user, without

docs/decisions.md

@@ -1547,7 +1547,7 @@ prompt gh`, not rendered into the Folder) states this target state for an agent.
 Recorded from the Principal's words: "with one command I am able to install the
 lazurio platform (CLI and Launchpad) on a customer's new laptop". The first
 installation is one command, an install script served from `https://lazurio.ai/install`
-(`curl -fsSL https://lazurio.ai/install | sh`); it installs the Platform, the CLI and
+(`curl --proto '=https' --tlsv1.2 -fsSL https://lazurio.ai/install | sh`); it installs the Platform, the CLI and
 the Launchpad as one program, and afterwards Lazurio takes over with `lazurio update`.
 Platforms in order: Linux, then macOS; Windows later. npm is not the primary door. The
 same day: **Lazurio is installed exactly the standard way on every Environment**;
@@ -1574,9 +1574,8 @@ in [product update](update.md#first-installation). (4) `lazurio install prompt`
 prints the prepared prompt an agent follows to straighten a non-standard installation
 (standard layout, deviations found, what the agent may do, what only on the operator's
 instruction, how success is proven); `lazurio install` points to it whenever it finds
-a deviation. (5) `release.yml` is to attach `install.sh` of the tag to every release and
-make it an attested subject (its own pull request, not merged yet), so that
-`releases/latest/download/install.sh` is what the
+a deviation. (5) `release.yml` attaches `install.sh` of the tag to every release and
+makes it an attested subject, so that `releases/latest/download/install.sh` is what the
 website serves, by redirect (recommended) or as a byte-identical proxy; the contract
 is in [product update](update.md#serving-httpslazurioaiinstall).
 

docs/update.md

@@ -180,7 +180,7 @@ On a new computer Lazurio is installed by one command, and from then on it updat
 itself with `lazurio update`:
 
 ```sh
-curl -fsSL https://lazurio.ai/install | sh
+curl --proto '=https' --tlsv1.2 -fsSL https://lazurio.ai/install | sh
 ```
 
 Until the website route is deployed, and until a release carries `install.sh` as an
@@ -370,16 +370,16 @@ The website lives in another repository; this is its contract.
   text/x-shellscript; charset=utf-8` (or `text/plain; charset=utf-8`); no
   `Content-Encoding` unless the client asked for one; `Cache-Control: public,
   max-age=300` at most, so a new release takes over within minutes. Checkable at any
-  time: the SHA-256 of `curl -fsSL https://lazurio.ai/install` equals that of the
+  time: the SHA-256 of `curl --proto '=https' --tlsv1.2 -fsSL https://lazurio.ai/install` equals that of the
   release asset, and `gh attestation verify install.sh --bundle lazurio.sigstore.json
   --repo Lazurio/LazurioPlatform` accepts it, because `install.sh` is an attested
   subject.
 - **HTTPS only.** Plain `http://lazurio.ai/install` redirects to the HTTPS route and
   serves nothing else.
 - **Order.** `releases/latest/download/install.sh` exists only from the first release
-  built by a workflow that attaches it; the route goes live after that release. The
-  change of `release.yml` that attaches and attests `install.sh` is its own pull
-  request and is not merged yet; until it is, no release carries the asset.
+  built by a workflow that attaches it; the route goes live after that release.
+  `release.yml` attaches `install.sh` of the tag and makes it an attested subject;
+  releases up to v0.1.7 were built before that and carry no such asset.
 
 ## State on disk
 

install.sh

@@ -1,8 +1,8 @@
 #!/bin/sh
 # Lazurio in one command (docs/update.md "First installation"):
 #
-#   curl -fsSL https://lazurio.ai/install | sh
-#   curl -fsSL https://lazurio.ai/install | sh -s -- --service systemd-user --folder /absolute/Folder
+#   curl --proto '=https' --tlsv1.2 -fsSL https://lazurio.ai/install | sh
+#   curl --proto '=https' --tlsv1.2 -fsSL https://lazurio.ai/install | sh -s -- --service systemd-user --folder /absolute/Folder
 #   LAZURIO_VERSION=v1.2.3-rc.1 sh install.sh     # one exact tag instead of the latest release
 #
 # Installs the Lazurio Platform (the `lazurio` CLI and the Launchpad, one