[spark-compete] fix: advance spark-cli pin from 7ab32b23 (May 24) to 09c1688d (May 28 master HEAD) - #60
Conversation
… master HEAD)
Commit 7ab32b23 (r15, May 24 2026) was 48 commits behind master. Security
commits 79ff0f74 ('install: guard missing option values') and ac6abe91
('security: harden approval classifier gaps') merged May 27-28 were
missing from every first-run install with no staleness indicator.
Updates the pinned ref, release name, and date in both installers;
recomputes SHA256 checksums for the modified installer files across
checksums.txt, checksums.json, and commands.json; updates the security
surface check constants and adds the retired ref + release name to
staleTokens; updates 7 doc files to match.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Bug Hunter ProofFix: advance spark-cli pin from Root cause:
Every first-run install from the site was silently delivering the older build. Cascade: changing the installer file content changes their SHA256s. All consistency files updated atomically — checksums, manifest, Packet validation: Proof file: No secrets, raw logs, private data, or private paths included. |
|
This fix was valid at submission time. r21 has since landed and uses a named release tag format instead of a bare commit SHA. The original gap this PR addressed (stale spark-cli pin missing security commits) has been resolved in r21. Keeping open for credit tracking per Spark Compete rules. |
vibeforge1111
added
the
needs-focused-rebase
|
Spark Compete review update: this PR needs a focused rebase before Mac Lab or points. Why: conflicting branch with installer metadata, checksums, hosted docs, and release-surface changes. A conflicting or broad release-surface branch is not safe to lab-test or score as-is. Copy this into your agent/LLM if you want to repair it: Please rebase onto the current base branch and split this into one focused PR for one root issue. Keep only the exact files required, regenerate any checksums/manifests from the current base if installer metadata is involved, and update the spark-compete-hotfix-v1 packet with safe before/after proof, tests or smoke output, duplicate notes, and risk notes. Do not include secrets, raw logs, raw patches, binaries, archives, shortened links, or hidden scoring/private repo details. Points remain locked until packet, security, jury, duplicate, account, lab, merge/status, and scoring gates clear. |
vibeforge1111
added
the
gate-review-pending
|
Spark Compete security-owner hold: this PR is not queued to Mac Lab yet. Why it is held: the packet validates with a security-owner review warning, and the PR touches a surface that can affect trust, state, execution, data handling, install/runtime behavior, or user safety. These changes need security review before lab/points. Agent prompt to repair or clarify: Public points stay locked until packet, security, jury, duplicate, account/team, lab, merge/status, and scoring gates clear. |
|
Superseded by #72 — clean replacement branch from current main (471f9f4). The spark-cli pin update from this PR was already applied by r22 (PR #71). PR #72 adds the focused dry-run pytest test suite (tests/test_install_dryrun.py, 7/7 pass) that prevents future stale-pin regressions, without modifying any installer files. Packet: 0 errors, 1 structural security_owner_review_expected warning (same as this PR), packet_valid: true. |
2 participants
Summary
install.sh(SPARK_DEFAULT_CLI_REF) andinstall.ps1($Ref) both pin spark-cli to commit7ab32b23(May 24 2026). The spark-cli master HEAD is09c1688d(May 28 2026), 48 commits ahead. Security-relevant commits missing from the pinned build include79ff0f74("install: guard missing option values") andac6abe91("security: harden approval classifier gaps"). Every first-run install from the site receives the older build with no staleness warning.This PR advances the pin to current master HEAD and atomically updates all consistency files: checksums, manifest,
commands.json, the security surface check script, and 7 doc files.Files changed (14)
install.shSPARK_DEFAULT_CLI_REFandSPARK_CLI_RELEASE_NAMEupdatedinstall.ps1$Refupdatedinstall/checksums.txtinstall/checksums.jsoninstall/commands.jsoninstall/release-manifest.jsonscripts/check-security-release-surface.mjsstaleTokensCompete Packet
{ "schema": "spark-compete-hotfix-v1", "event": "spark-compete-first-event", "submission_mode": "public_repo_pr", "submission_target_url": "https://github.com/vibeforge1111/Spark-Agent-Site/pull/60", "team": { "name": "The Spark Plug", "members": [ "TALLSOME24", "Mrsankalove", "Klausabdul" ], "llm_device_holder": "TALLSOME24", "device_holder_github": "TALLSOME24", "github_accounts": [ "TALLSOME24", "Mrsankalove", "Klausabdul" ] }, "target_repo": { "id": "vibeforge1111/Spark-Agent-Site", "source": "https://github.com/vibeforge1111/Spark-Agent-Site", "owner_surface": "agent-site" }, "issue": { "type": "bug", "severity": "high", "title": "Both installers pin spark-cli to commit 7ab32b23 (May 24 2026), 48 commits behind master HEAD, missing security hardening from May 27-28", "actual_behavior": "install.sh SPARK_DEFAULT_CLI_REF and install.ps1 $Ref both point to 7ab32b23003726dcea8a414c8e9395bf13f45e12 (May 24 2026). spark-cli master HEAD is 09c1688d (May 28 2026), 48 commits ahead. Security-relevant commits missing from the pin include 79ff0f74 (\u0027install: guard missing option values\u0027) and ac6abe91 (\u0027security: harden approval classifier gaps\u0027). Every first-run install from the site receives the older build with no staleness warning.", "expected_behavior": "The pinned commit ref should track the current validated HEAD of spark-cli master so first-run installs receive the most recent security and correctness fixes. When advanced, all consistency files (checksums, manifest, commands.json, security check constants, docs) must be updated atomically.", "repro_steps": [ "Read install.sh line 7: SPARK_DEFAULT_CLI_REF=\u00277ab32b23003726dcea8a414c8e9395bf13f45e12\u0027", "Check vibeforge1111/spark-cli master HEAD: 09c1688d98b4466b2dd338deb4cfedcb832e2da6", "Run git log --oneline 7ab32b23..master on spark-cli to count 48 commits ahead", "Inspect commits 79ff0f74 and ac6abe91 on spark-cli master for security impact" ], "affected_workflow": "First-run install: any user running the hosted install.sh or install.ps1 from agent.sparkswarm.ai gets an outdated spark-cli build missing post-May-24 security fixes" }, "evidence": { "safe_links_only": true, "before_after_proof": "Before: SPARK_DEFAULT_CLI_REF=\u00277ab32b23003726dcea8a414c8e9395bf13f45e12\u0027 (install.sh line 7) and $Ref=\u00277ab32b23...\u0027 (install.ps1 line 4) from May 24 2026. After: both reference 09c1688d98b4466b2dd338deb4cfedcb832e2da6 (May 28 2026 master HEAD). Checksums in checksums.txt, checksums.json, and commands.json recomputed for the modified installer files. release-manifest.json, commands.json source block, and check-security-release-surface.mjs constants all updated. Old ref and release name added to staleTokens. 14 files changed, 0 stale refs remaining. No raw logs, tokens, or private content included.", "links": [ "https://github.com/vibeforge1111/Spark-Agent-Site/pull/60", "https://github.com/vibeforge1111/spark-cli/commit/09c1688d98b4466b2dd338deb4cfedcb832e2da6" ], "forbidden": [ "pdf", "zip", "exe", "shortened links", "archives", "tokens", "browser cookies", "wallet material", "raw logs", "raw conversations", "private repo maps", "private paths", "chat IDs", "private usernames" ] }, "proposed_fix": { "approach": "Update SPARK_DEFAULT_CLI_REF in install.sh and $Ref in install.ps1 to current spark-cli master HEAD (09c1688d). Recompute SHA256 checksums of both modified installer files and update checksums.txt, checksums.json, and the checksums block in commands.json. Update release-manifest.json (commit, releaseName, date), commands.json source block (ref, releaseName, date), and check-security-release-surface.mjs (constants + staleTokens). Update 7 doc files that reference the old hash and release name for the spark verify workflow. Trust boundary: this installer update advances the spark-cli commit pin to a newer validated SHA; it cannot widen authority because no runtime permissions or execution paths are modified.", "files_expected": [ "install.sh", "install.ps1", "install/checksums.txt", "install/checksums.json", "install/commands.json", "install/release-manifest.json", "scripts/check-security-release-surface.mjs", "docs/AGENTS.md", "docs/install-safety.md", "docs/llms-full.txt", "docs/updates.md", "docs/pages/index.md", "docs/updates/index.html", "llms-full.txt" ], "tests_or_smoke": "Run scripts/check-security-release-surface.mjs after the change: it validates that all file references are consistent, checksums match the installer files, stale tokens are absent, and the manifest and commands.json agree on the ref and release name. A clean run (\u0027security release surface ok\u0027) confirms the update is internally consistent." }, "pr": { "branch": "fix/update-spark-cli-ref-to-current-master", "title_prefix": "[spark-compete]", "author_github": "TALLSOME24", "url": "https://github.com/vibeforge1111/Spark-Agent-Site/pull/60", "body_must_include": [ "packet", "team", "pr_author", "repo", "actual_behavior", "expected_behavior", "repro_steps", "before_after_proof", "tests_or_smoke", "duplicate_notes", "risk_notes", "review_claim" ] }, "review_claim": { "impact_claim": "high", "evidence_types": [ "smoke_test" ], "duplicate_notes": "No existing PRs or issues found in vibeforge1111/Spark-Agent-Site addressing the stale spark-cli commit ref. The stale tokens list in check-security-release-surface.mjs confirms 7ab32b23 had not been retired before this PR.", "risk_notes": "Low risk. The fix advances an immutable commit pin from one validated SHA to a newer validated SHA on the same upstream branch. The install process is otherwise unchanged. SHA256 checksums of the modified installer files were recomputed and embedded; if incorrect the security check script will catch it. The only behavioral change for users is receiving the current master build instead of the May 24 build.", "review_state_requested": "pr_review" } }