diff --git a/gpuk b/gpuk index dbc1d58..4e4a774 100644 --- a/gpuk +++ b/gpuk @@ -41,6 +41,10 @@ set -eu # host. Unset (the real install) they are exactly the systemd defaults workerd uses # (apps/worker/src/module.rs, apps/worker/src/identity.rs). BIN_DEST="${GPUK_BIN_DEST:-/usr/local/bin/gpu-kitchen-worker}" +# This CLI, installed next to the daemon by `gpuk install`: it carries the +# release key pinned at install time, and install.sh hands a plain re-run to its +# `update` (INS-03, OPS-20). +CLI_DEST="${GPUK_CLI_DEST:-$(dirname "$BIN_DEST")/gpuk}" ETC_DIR="${GPUK_ETC_DIR:-/etc/gpu-kitchen}" MANIFEST="$ETC_DIR/manifest.json" IDENTITY_DIR="${GPUK_IDENTITY_DIR:-$ETC_DIR/identity}" @@ -95,6 +99,19 @@ install_binary() { # [local-path] # Not -s: the binary is tens of MB and a silent download reads as a hang. curl -fL --progress-bar "$_url" -o "$BIN_DEST.new" \ || { rm -f "$BIN_DEST.new"; die "cannot download $_url"; } + # The root daemon is swapped in only once its minisign signature verifies + # against the release key pinned in this gpuk (OPS-20, INS-05). + if [ "${GPUK_CHANNEL_INSECURE:-}" = "1" ]; then + echo "WARNING: GPUK_CHANNEL_INSECURE=1 — $_url NOT verified" >&2 + else + require_release_key + curl -fsSL "$_url.minisig" -o "$BIN_DEST.new.minisig" \ + || { rm -f "$BIN_DEST.new" "$BIN_DEST.new.minisig"; die "no signature at $_url.minisig — refusing an unsigned daemon binary"; } + "$MINISIGN" -Vq -m "$BIN_DEST.new" -x "$BIN_DEST.new.minisig" -P "$CHANNEL_PUBKEY" >/dev/null 2>&1 \ + || { rm -f "$BIN_DEST.new" "$BIN_DEST.new.minisig"; die "$_url: signature verification FAILED — refusing it (OPS-20)"; } + rm -f "$BIN_DEST.new.minisig" + echo "==> signature verified" + fi chmod 0755 "$BIN_DEST.new" mv "$BIN_DEST.new" "$BIN_DEST" elif [ -x "$BIN_DEST" ]; then @@ -104,6 +121,18 @@ install_binary() { # [local-path] fi } +# Leave this very gpuk on the host, next to the daemon: `gpuk status`, `gpuk +# update` and install.sh's plain re-run all use it. It is the copy that carries +# the release key this install pinned (substituted at publish time), so later +# updates are verified against the key the first install trusted. +install_cli() { + # Already this copy (gpuk re-run from its installed path, or identical bytes). + if [ -e "$CLI_DEST" ] && cmp -s "$0" "$CLI_DEST"; then return 0; fi + install -m 0755 "$0" "$CLI_DEST.new" && mv "$CLI_DEST.new" "$CLI_DEST" \ + || die "cannot install the gpuk CLI at $CLI_DEST" + echo "==> installed $CLI_DEST" +} + gen_secret() { head -c 32 /dev/urandom | base64 | tr '+/' '-_' | tr -d '='; } # The host ports a leftover app container is reached on ("ui mtls inference"), @@ -202,7 +231,9 @@ prepare_claim_code() { # The file is the operator's recoverable proof of machine possession. Create # it once, preserve it across reinstalls, and let the backend unlink it after # the atomic first-account claim. A missing file beside an existing manifest - # therefore means "consumed", never "rotate the credential". + # therefore means "consumed", never "rotate the credential". homelab and studio + # have no claim window at all (PRF-12, SEC-53): no code is made for them. + case "$PROFILE" in homelab|studio) return 0 ;; esac if [ -f "$CLAIM_CODE_FILE" ]; then chmod 0600 "$CLAIM_CODE_FILE" elif [ ! -f "$MANIFEST" ]; then @@ -256,7 +287,7 @@ UNIT } # TLS reverse-proxy example, FILLED with the operator's domain (INS-47) — written -# only under `--profile public --domain `. Kept aligned with +# under `--domain `, whatever the profile. Kept aligned with # deployments/controller/Caddyfile.example (the compose variant); this copy # targets the all-in-one image, where nginx on the UI port is the single front # door (INS-09) so one upstream carries pages, /api and the /ws upgrade alike. @@ -266,15 +297,18 @@ UNIT write_caddyfile() { mkdir -p "$DATA_ROOT/caddy" cat > "$DATA_ROOT/caddy/Caddyfile" <worker data transfers (:8300): LAN-only by contract (OPS-68). @@ -406,8 +440,6 @@ cmd_install() { esac if [ -n "$DOMAIN" ]; then - [ "$PROFILE" = "public" ] \ - || die "--domain applies only to --profile public (it fills the TLS reverse-proxy example)" case "$DOMAIN" in *[!A-Za-z0-9.-]*) die "--domain must be a bare domain name (got '$DOMAIN')" ;; esac @@ -438,7 +470,10 @@ cmd_install() { CLAIM_CODE_AVAILABLE=0 if [ "$DRY_RUN" -eq 1 ]; then - [ "$MODE" != "controller" ] || CLAIM_CODE_AVAILABLE=1 + case "$MODE:$PROFILE" in + controller:homelab|controller:studio) ;; + controller:*) CLAIM_CODE_AVAILABLE=1 ;; + esac echo "==> dry run: no file, service or container was changed" [ ! -f "$MANIFEST" ] \ || echo "==> dry run: $MANIFEST exists — this render would be MERGED into it, controller-owned settings kept" @@ -508,6 +543,7 @@ cmd_install() { need_root install_binary "$BIN_SRC" + install_cli mkdir -p "$ETC_DIR" "$DATA_ROOT" "$CACHE_DIR" seed_secrets "$DATA_ROOT" @@ -711,6 +747,14 @@ render_controller_manifest() { EXTRA_ENV="$EXTRA_ENV,\"GPUK_HSTS\":\"true\"" EXTRA_ENV="$EXTRA_ENV,\"GPUK_SESSION_COOKIE_SECURE\":\"true\"" fi + # SEC-16: the DNS-rebinding Host guard stays on during the anonymous first run even + # under `enforced`, so the operator's own name must be a known host of the install + # before the wizard can load through it — whatever the profile. SEC-15: that name + # is served through a reverse proxy, whose X-Forwarded-For carries the real client. + if [ -n "$DOMAIN" ]; then + EXTRA_ENV="$EXTRA_ENV,\"GPUK_ALLOWED_HOSTS\":\"$(json_str "$DOMAIN")\"" + EXTRA_ENV="$EXTRA_ENV,\"GPUK_TRUST_PROXY\":\"true\"" + fi BOOTSTRAP_SECRET_JSON="" if [ -s "$BOOTSTRAP_PASSWORD_FILE" ]; then EXTRA_ENV="$EXTRA_ENV,\"GPUK_BOOTSTRAP_MUST_CHANGE\":\"1\"" @@ -837,6 +881,58 @@ CHANNEL_URL="${GPUK_CHANNEL_URL:-https://repo.byterain.io/gpukitchen/channel/raw # no longer pick what an existing install runs. CHANNEL_PUBKEY="${GPUK_UPDATE_PUBKEY:-RWQ7BKXJqGX2jdKXu1GxeSPVAN3JDRTefpImM/mFRjtFwq4E7mhnQtA7}" +# The pinned key and the minisign CLI every verification needs (channel +# document, downloaded daemon binary); fail-closed. +require_release_key() { + case "$CHANNEL_PUBKEY" in + # The unstamped placeholder, matched by its prefix only: the release stamps + # the key by substituting the whole placeholder wherever it appears, and a + # guard spelling it in full would become one refusing the very key it pinned. + ""|__GPUK_UPDATE_*) + die "this gpuk carries no pinned release public key — set GPUK_UPDATE_PUBKEY (the minisign public-key line), or GPUK_CHANNEL_INSECURE=1 to skip verification" ;; + esac + ensure_minisign 0 +} + +# The minisign CLI is what verifies the release; a host without it gets it from +# its own package manager — detected, non-interactive, quiet — before anything +# else changes. No known manager, or an install that fails: stop, naming the +# manual command. GPUK_MINISIGN names another verifier binary (test seam). +MINISIGN="${GPUK_MINISIGN:-minisign}" +minisign_manual_command() { + if command -v apt-get >/dev/null 2>&1; then echo "apt-get install minisign" + elif command -v dnf >/dev/null 2>&1; then echo "dnf install minisign (EPEL on RHEL)" + elif command -v yum >/dev/null 2>&1; then echo "yum install minisign (EPEL)" + elif command -v zypper >/dev/null 2>&1; then echo "zypper install minisign" + elif command -v apk >/dev/null 2>&1; then echo "apk add minisign" + elif command -v pacman >/dev/null 2>&1; then echo "pacman -S minisign" + else echo "install minisign from https://jedisct1.github.io/minisign/" + fi +} +ensure_minisign() { # $1 = 1 when nothing may be installed (dry run) + command -v "$MINISIGN" >/dev/null 2>&1 && return 0 + [ "${1:-0}" -eq 0 ] \ + || die "minisign is required to verify the release and a dry run installs nothing: $(minisign_manual_command), or set GPUK_CHANNEL_INSECURE=1" + _mlog=$(mktemp) + for _pm in apt-get dnf yum zypper apk pacman; do + command -v "$_pm" >/dev/null 2>&1 || continue + echo "==> minisign is missing — installing it with $_pm" + case "$_pm" in + apt-get) { DEBIAN_FRONTEND=noninteractive apt-get update -qq \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq minisign; } ;; + dnf) dnf install -y -q minisign ;; + yum) yum install -y -q minisign ;; + zypper) zypper --non-interactive --quiet install minisign ;; + apk) apk add --quiet minisign ;; + pacman) pacman -S --noconfirm --needed --quiet minisign ;; + esac >"$_mlog" 2>&1 || true + if command -v "$MINISIGN" >/dev/null 2>&1; then rm -f "$_mlog"; return 0; fi + done + tail -5 "$_mlog" >&2 2>/dev/null || true + rm -f "$_mlog" + die "minisign is required to verify the release and could not be installed automatically. Nothing was changed: run '$(minisign_manual_command)' as root, then re-run — or set GPUK_CHANNEL_INSECURE=1" +} + # Fetch latest.json AND its minisign signature, verify, and leave the verified # document at $CHANNEL_DOC. Fail-closed: no signature, bad signature, no # minisign CLI or no pinned key are all fatal — GPUK_CHANNEL_INSECURE=1 is the @@ -850,18 +946,13 @@ channel_fetch() { echo "WARNING: GPUK_CHANNEL_INSECURE=1 — release channel signature NOT verified" >&2 return 0 fi - case "$CHANNEL_PUBKEY" in - ""|RWQ7BKXJqGX2jdKXu1GxeSPVAN3JDRTefpImM/mFRjtFwq4E7mhnQtA7*) - die "this gpuk carries no pinned release public key — set GPUK_UPDATE_PUBKEY (the minisign public-key line), or GPUK_CHANNEL_INSECURE=1 to skip verification" ;; - esac - command -v minisign >/dev/null 2>&1 \ - || die "minisign is required to verify the release channel (apt install minisign), or set GPUK_CHANNEL_INSECURE=1" + require_release_key _sig=$(mktemp) if ! curl -fsSL --max-time 20 "${CHANNEL_URL}.minisig" -o "$_sig" 2>/dev/null; then rm -f "$_sig" die "no signature at ${CHANNEL_URL}.minisig — refusing an unsigned channel document (OPS-20)" fi - if ! minisign -Vq -m "$CHANNEL_DOC" -x "$_sig" -P "$CHANNEL_PUBKEY" >/dev/null 2>&1; then + if ! "$MINISIGN" -Vq -m "$CHANNEL_DOC" -x "$_sig" -P "$CHANNEL_PUBKEY" >/dev/null 2>&1; then rm -f "$_sig" die "latest.json signature verification FAILED — refusing the channel document (OPS-20)" fi @@ -1054,25 +1145,38 @@ cmd_update() { fi _digest="" - if [ -z "$_want" ]; then - # channel_fetch runs in THIS shell (not a $(…) subshell) so a signature - # failure is fatal here — fail-closed — and $CHANNEL_DOC survives. The - # verified signature closes the document half of OPS-20; the digest read - # from it pins CONTENT, closing the mutable-tag half. - if channel_fetch; then - _want=$(channel_field "$CHANNEL_DOC" version) - fi - if [ -z "$_want" ]; then - echo "==> cannot reach $CHANNEL_URL — re-applying the pinned $_current" - GPUK_MANIFEST_PATH="$MANIFEST" "$BIN_DEST" apply - return 0 - fi + # channel_fetch runs in THIS shell (not a $(…) subshell) so a signature + # failure is fatal here — fail-closed — and $CHANNEL_DOC survives. The + # verified signature closes the document half of OPS-20; the digest read + # from it pins CONTENT, closing the mutable-tag half. A named --version goes + # through the same document: it vouches for ONE release, the one it names. + _latest="" + if channel_fetch; then + _latest=$(channel_field "$CHANNEL_DOC" version) + fi + if [ -z "$_latest" ]; then + [ -z "$_want" ] \ + || die "cannot read the release channel at $CHANNEL_URL — refusing to pin $_want unverified" + echo "==> cannot reach $CHANNEL_URL — re-applying the pinned $_current" + GPUK_MANIFEST_PATH="$MANIFEST" "$BIN_DEST" apply + return 0 + fi + if [ -n "$_want" ] && [ "$_want" != "$_latest" ]; then + [ "${GPUK_CHANNEL_INSECURE:-}" = "1" ] \ + || die "the signed channel vouches for $_latest only, not $_want — refusing an unpinned tag (OPS-20)" + else + _want="$_latest" # Pick the digest matching the installed edition by image basename — the # repo itself may be a mirror, the basename is the edition marker. case "${_repo##*/}" in *-ee) _digest=$(channel_field "$CHANNEL_DOC" controllerImageDigestEnterprise) ;; *) _digest=$(channel_field "$CHANNEL_DOC" controllerImageDigest) ;; esac + case "$_digest" in + sha256:*) ;; + *) [ "${GPUK_CHANNEL_INSECURE:-}" = "1" ] \ + || die "the signed release channel names no image digest for $_want — refusing to pin a mutable tag (OPS-20)" ;; + esac fi _new="$_repo:$_want" @@ -1089,7 +1193,10 @@ cmd_update() { else echo "==> already on $_current — re-pulling and recreating" fi - GPUK_MANIFEST_PATH="$MANIFEST" "$BIN_DEST" apply + GPUK_MANIFEST_PATH="$MANIFEST" "$BIN_DEST" apply \ + || die "the update did not apply — the [worker] lines above say why. A manifest refused for a field + an older release wrote is repaired by re-running the same install command with --reset-manifest: + the file is archived beside itself and rebuilt from this install's settings." } # ── uninstall ────────────────────────────────────────────────────────────────── @@ -1131,6 +1238,7 @@ cmd_uninstall() { done [ ! -e "$MACHINE_ID_FILE" ] || rm -f "$MACHINE_ID_FILE" [ ! -e "$BIN_DEST" ] || { rm -f "$BIN_DEST"; echo "==> removed $BIN_DEST"; } + [ ! -e "$CLI_DEST" ] || { rm -f "$CLI_DEST"; echo "==> removed $CLI_DEST"; } echo echo "Kept: the data root${_root:+ $_root} — database, models and secrets (ENCRYPTION_KEY)." echo "A new install over it reuses them. To delete it too, knowingly: rm -rf ${_root:-}" @@ -1141,12 +1249,14 @@ usage() { gpuk — GPU Kitchen host daemon (gpu-kitchen-worker) gpuk install --mode controller --image [--profile homelab|studio|enterprise|public] - [--cluster N] [--cache-dir P] [--data-root P] + [--domain D] [--cluster N] [--cache-dir P] [--data-root P] [--http-port P] [--mtls-port P] [--inference-port P] [--network bridge|host|] [--binary ] [--reset-manifest] --network: bridge by default — the container publishes its three ports and nothing else it listens on touches the host; host makes every listener a host-wide claim (a re-run keeps the mode installed) + --domain: the name the UI is reached by through a reverse proxy, any + profile — allowed as a host, trusted proxy on, filled Caddyfile written gpuk install --mode worker --controller wss://: --enroll-token gk_enroll_... [--cluster N] [--cache-dir P] [--binary ] [--health-port P] [--data-port P] [--transfer-port P] [--handover-port P] @@ -1163,7 +1273,7 @@ gpuk — GPU Kitchen host daemon (gpu-kitchen-worker) gpuk logs Follow the app container logs (controller) or the daemon journal; after a failed start, the kept -failed log gpuk uninstall Remove the systemd service, leave everything else in place - gpuk uninstall --purge Also remove the app container, /etc/gpu-kitchen and the binary + gpuk uninstall --purge Also remove the app container, /etc/gpu-kitchen, the binary and gpuk (never the data root: database, models, secrets) Most people never run this directly: the channel's install.sh installs it diff --git a/install.sh b/install.sh index f332df4..27948a0 100644 --- a/install.sh +++ b/install.sh @@ -25,8 +25,11 @@ # 5. hand over workerd pulls the pinned all-in-one controller image and starts it # 6. print the UI URL on the real host, plus the profile-specific next step # -# Re-running is how you UPDATE: same command, newer tag, `docker pull` + recreate, -# data untouched (it lives in the data root, not the container). +# Re-running is how you UPDATE: on a host that already runs GPU Kitchen, the same +# command hands over to the installed `gpuk update` — the signed channel checked +# against the key that install pinned, the image pinned by digest, data untouched +# (it lives in the data root, not the container). A flag that changes a setting, +# --reinstall or --reset-manifest reinstall over it instead (INS-03). # # This installs a CONTROLLER node (the full app + UI). A headless compute node is # `gpuk install --mode worker …` — see deployments/install/gpuk and @@ -35,8 +38,14 @@ # Design note — this script starts nothing itself. workerd owns the container's # lifecycle (create, health-gate, roll back, update); the UI's update button and # `gpuk update` drive that same daemon. One updater, three front doors. +# +# The whole script is the body of main(), called on its very last line: `sh` +# reads a piped script as it arrives, so a download cut short would otherwise +# run as root up to wherever it stopped. Truncated, main is never called. set -eu +main() { + # ── Defaults (every one overridable by flag or env) ─────────────────────────── # The channel is the single source of truth for "what is the current release": # it is served next to this script, and the backend's update check reads the SAME @@ -75,8 +84,21 @@ ETC_DIR="${GPUK_ETC_DIR:-/etc/gpu-kitchen}" MANIFEST="$ETC_DIR/manifest.json" UNIT_DEST="${GPUK_UNIT_DEST:-/etc/systemd/system/gpu-kitchen-worker.service}" BIN_DEST="${GPUK_BIN_DEST:-/usr/local/bin/gpu-kitchen-worker}" +# The gpuk CLI `gpuk install` leaves on the host, next to the daemon binary: the +# one that carries the release key this install pinned, and the one a re-run +# hands the update to (same override as gpuk's). +GPUK_CLI="${GPUK_CLI_DEST:-$(dirname "$BIN_DEST")/gpuk}" +# The release public key pinned in THIS copy of install.sh (OPS-20). The channel +# copy gets the real key substituted at publish time, exactly like gpuk's; the +# operator override covers a self-hosted channel with its own keypair. The +# script itself arrives over HTTPS (trust on first use); everything it then +# takes from the channel — latest.json, the gpuk installer, the daemon binary, +# the image digest — is verified against this key before it is used. +CHANNEL_PUBKEY="${GPUK_UPDATE_PUBKEY:-RWQ7BKXJqGX2jdKXu1GxeSPVAN3JDRTefpImM/mFRjtFwq4E7mhnQtA7}" +EDITION_GIVEN=0; [ -z "${GPUK_EDITION:-}" ] || EDITION_GIVEN=1 PROFILE="" RESET_MANIFEST=0 +REINSTALL=0 DOMAIN="" VERSION="" IMAGE="" @@ -121,7 +143,7 @@ GPU Kitchen installer curl -fsSL https://repo.byterain.io/gpukitchen/channel/raw/branch/main/install.sh | sudo sh -s -- [options] Options: - --version Install this release instead of the channel's current one + --version The release the channel names (another one: --image @sha256:…) --image Use this controller image outright (implies --version none) --edition community (default) | enterprise --port

Port the UI listens on (default 1337) @@ -135,8 +157,13 @@ Options: host-wide claim. An existing install keeps its mode. --profile

homelab | studio | enterprise | public (no flag + a terminal = the script asks; no flag + no terminal = first-run asks) - --domain Domain for the public profile: writes a filled TLS - reverse-proxy example to /caddy/Caddyfile + --domain Name the UI is reached by through a reverse proxy, any + profile: allowed as a host of the install, proxy trusted for + the client address, and a filled TLS reverse-proxy example + written to /caddy/Caddyfile + --reinstall On a host that already runs GPU Kitchen, reinstall over it + (settings kept, merged into its manifest) instead of the + default re-run, which is 'gpuk update' --reset-manifest Rebuild /etc/gpu-kitchen/manifest.json from this run's settings when the daemon refuses the existing one (a field an older release wrote); the old file is archived beside it and what @@ -156,7 +183,7 @@ while [ $# -gt 0 ]; do case "$1" in --version) VERSION="$2"; shift 2 ;; --image) IMAGE="$2"; shift 2 ;; - --edition) EDITION="$2"; shift 2 ;; + --edition) EDITION="$2"; EDITION_GIVEN=1; shift 2 ;; --port) PORT="$2"; PORT_GIVEN=1; shift 2 ;; --mtls-port) MTLS_PORT="$2"; MTLS_GIVEN=1; shift 2 ;; --inference-port) INFERENCE_PORT="$2"; INFERENCE_GIVEN=1; shift 2 ;; @@ -168,6 +195,7 @@ while [ $# -gt 0 ]; do --domain) DOMAIN="$2"; shift 2 ;; --non-interactive) NON_INTERACTIVE=1; shift ;; --reset-manifest) RESET_MANIFEST=1; shift ;; + --reinstall) REINSTALL=1; shift ;; --worker-binary) WORKER_BINARY="$2"; shift 2 ;; --gpuk-script) GPUK_SCRIPT="$2"; shift 2 ;; --skip-gpu-check) SKIP_GPU_CHECK=1; shift ;; @@ -260,7 +288,8 @@ published_ports() { # $1 = network mode → OURS_UI OURS_MTLS OURS_INF fi [ -n "$OURS_INF" ] || OURS_INF=8200 } -EXISTING=""; OUR_PORTS=""; CONTAINER_NAME="gpu-kitchen" +EXISTING=""; OUR_PORTS=""; CONTAINER_NAME="gpu-kitchen"; RECONFIGURE="" +reconfigure() { RECONFIGURE="${RECONFIGURE:+$RECONFIGURE, }$1"; } OURS_UI=""; OURS_MTLS=""; OURS_INF="" if [ -f "$MANIFEST" ] && [ ! -r "$MANIFEST" ]; then EXISTING="unreadable" @@ -290,6 +319,28 @@ case "$EXISTING" in ok "image $(manifest_str image)" _root=$(manifest_str dataRoot); _cache=$(manifest_str hostPath) _cluster=$(manifest_str GPUK_CLUSTER); _profile=$(manifest_str GPUK_INSTALL_PROFILE) + # The edition an install runs is its image's basename (gpukitchen-controller-ee). + _edition=$(manifest_str image); _edition=${_edition%@*}; _edition=${_edition##*/} + case "${_edition%%:*}" in *-ee) _edition=enterprise ;; *) _edition=community ;; esac + # What this run asks to CHANGE, before anything is inherited: a flag restating + # the installed value changes nothing, so the same command line re-run later + # is still an update. Anything else is an explicit reinstall. + [ "$PORT_GIVEN" -eq 0 ] || [ "$PORT" = "$OURS_UI" ] || reconfigure "--port" + [ "$MTLS_GIVEN" -eq 0 ] || [ "$MTLS_PORT" = "$OURS_MTLS" ] || reconfigure "--mtls-port" + [ "$INFERENCE_GIVEN" -eq 0 ] || [ "$INFERENCE_PORT" = "$OURS_INF" ] || reconfigure "--inference-port" + [ "$DATA_ROOT_GIVEN" -eq 0 ] || [ "$DATA_ROOT" = "$_root" ] || reconfigure "--data-root" + [ "$CACHE_GIVEN" -eq 0 ] || [ "$CACHE_DIR" = "$_cache" ] || reconfigure "--cache-dir" + [ "$CLUSTER_GIVEN" -eq 0 ] || [ "$CLUSTER" = "$_cluster" ] || reconfigure "--cluster" + [ "$NETWORK_GIVEN" -eq 0 ] || [ "$NETWORK" = "${C_NETMODE:-host}" ] || reconfigure "--network" + [ "$EDITION_GIVEN" -eq 0 ] || [ "$EDITION" = "$_edition" ] || reconfigure "--edition" + [ -z "$PROFILE" ] || [ "$PROFILE" = "$_profile" ] || reconfigure "--profile" + [ -z "$DOMAIN" ] || reconfigure "--domain" + [ -z "$IMAGE" ] || reconfigure "--image" + [ -z "$VERSION" ] || reconfigure "--version" + [ -z "$WORKER_BINARY" ] || reconfigure "--worker-binary" + [ -z "$GPUK_SCRIPT" ] || reconfigure "--gpuk-script" + [ "$REINSTALL" -eq 0 ] || reconfigure "--reinstall" + [ "$RESET_MANIFEST" -eq 0 ] || reconfigure "--reset-manifest" [ "$DATA_ROOT_GIVEN" -eq 1 ] || [ -z "$_root" ] || DATA_ROOT="$_root" [ "$CACHE_GIVEN" -eq 1 ] || [ -z "$_cache" ] || CACHE_DIR="$_cache" [ "$CLUSTER_GIVEN" -eq 1 ] || [ -z "$_cluster" ] || CLUSTER="$_cluster" @@ -308,7 +359,11 @@ case "$EXISTING" in ok "ports UI $OURS_UI, worker channel $OURS_MTLS, inference $OURS_INF" ok "network ${C_NETMODE:-host}" [ -z "$_profile" ] || ok "profile $_profile" - ok "re-running updates it in place. Its settings are kept unless a flag says otherwise." + if [ -n "$RECONFIGURE" ]; then + ok "reinstalling over it ($RECONFIGURE). Its other settings are kept." + else + ok "re-running updates it in place, through the installed gpuk. Its settings are kept." + fi ;; unreadable) step "Existing install — $MANIFEST" @@ -327,6 +382,33 @@ case "$EXISTING" in esac [ -n "$CACHE_DIR" ] || CACHE_DIR="$DATA_ROOT/hf" +# ── 0b. A plain re-run is `gpuk update` (INS-03, OPS-20) ────────────────────── +# The gpuk this install left on the host carries the release key pinned when it +# was installed: it verifies the signed channel against THAT key, pins the image +# by digest, and lets the daemon pull, health-gate and roll back. A freshly +# downloaded install.sh is trust-on-first-use again; handing the update to the +# installed gpuk keeps a re-run inside the chain the first install established. +if [ "$EXISTING" = "manifest" ] && [ -z "$RECONFIGURE" ]; then + step "Update — handed to the installed gpuk" + if [ "$DRY_RUN" -eq 1 ]; then + step "Dry run — stopping here" + echo " would run : $GPUK_CLI update" + echo " existing : yes — updated in place" + exit 0 + fi + [ -x "$GPUK_CLI" ] \ + || die "this install has no $GPUK_CLI to update it with. Re-run with --reinstall: it reinstalls + over the existing install, keeps its settings, and leaves gpuk on the host for the next update." + "$GPUK_CLI" update || die "the update failed — gpuk reported the cause just above" + echo + echo "${BOLD}${GREEN}GPU Kitchen is up to date.${RESET}" + echo + echo " Status : gpuk status Logs: gpuk logs" + echo " Change a setting: re-run with its flag (a reinstall), or use Settings in the UI" + echo + exit 0 +fi + if [ "$PORT" = "$MTLS_PORT" ] || [ "$PORT" = "$INFERENCE_PORT" ] || [ "$MTLS_PORT" = "$INFERENCE_PORT" ]; then die "the UI, worker channel and inference ports must differ (got $PORT, $MTLS_PORT, $INFERENCE_PORT)" fi @@ -549,6 +631,71 @@ fi # ── 2. Resolve the release ─────────────────────────────────────────────────── step "Release — resolving the version to install" +# Everything fetched from the channel lands here, and is verified here, before use. +TMP=$(mktemp -d) +# shellcheck disable=SC2064 # expand TMP now: it must be removed even if it changes +trap "rm -rf '$TMP'" EXIT INT TERM + +# The trust chain (OPS-20): latest.json is signed with the release key, and so is +# every daemon binary; latest.json names the gpuk installer's sha256 and the +# image digests. Fail-closed: no pinned key, no minisign, no or a bad signature +# are all fatal. GPUK_CHANNEL_INSECURE=1 is the explicit, loudly reported +# opt-out for a private mirror that does not sign — gpuk's own opt-out. +INSECURE=0; [ "${GPUK_CHANNEL_INSECURE:-}" != "1" ] || INSECURE=1 +# The minisign CLI is what verifies the release; a host without it gets it from +# its own package manager — detected, non-interactive, quiet — before anything +# else changes. No known manager, or an install that fails: stop, naming the +# manual command. GPUK_MINISIGN names another verifier binary (test seam). +MINISIGN="${GPUK_MINISIGN:-minisign}" +minisign_manual_command() { + if command -v apt-get >/dev/null 2>&1; then echo "apt-get install minisign" + elif command -v dnf >/dev/null 2>&1; then echo "dnf install minisign (EPEL on RHEL)" + elif command -v yum >/dev/null 2>&1; then echo "yum install minisign (EPEL)" + elif command -v zypper >/dev/null 2>&1; then echo "zypper install minisign" + elif command -v apk >/dev/null 2>&1; then echo "apk add minisign" + elif command -v pacman >/dev/null 2>&1; then echo "pacman -S minisign" + else echo "install minisign from https://jedisct1.github.io/minisign/" + fi +} +ensure_minisign() { # $1 = 1 when nothing may be installed (dry run) + command -v "$MINISIGN" >/dev/null 2>&1 && return 0 + [ "${1:-0}" -eq 0 ] \ + || die "minisign is required to verify the release and a dry run installs nothing: $(minisign_manual_command), or set GPUK_CHANNEL_INSECURE=1" + _mlog=$(mktemp) + for _pm in apt-get dnf yum zypper apk pacman; do + command -v "$_pm" >/dev/null 2>&1 || continue + ok "minisign is missing — installing it with $_pm" + case "$_pm" in + apt-get) { DEBIAN_FRONTEND=noninteractive apt-get update -qq \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq minisign; } ;; + dnf) dnf install -y -q minisign ;; + yum) yum install -y -q minisign ;; + zypper) zypper --non-interactive --quiet install minisign ;; + apk) apk add --quiet minisign ;; + pacman) pacman -S --noconfirm --needed --quiet minisign ;; + esac >"$_mlog" 2>&1 || true + if command -v "$MINISIGN" >/dev/null 2>&1; then rm -f "$_mlog"; return 0; fi + done + tail -5 "$_mlog" >&2 2>/dev/null || true + rm -f "$_mlog" + die "minisign is required to verify the release and could not be installed automatically. Nothing was changed: run '$(minisign_manual_command)' as root, then re-run — or set GPUK_CHANNEL_INSECURE=1" +} +require_verifier() { + case "$CHANNEL_PUBKEY" in + # The unstamped placeholder, matched by its prefix only: the release stamps + # the key by substituting the whole placeholder wherever it appears, and a + # guard spelling it in full would become one refusing the very key it pinned. + ""|__GPUK_UPDATE_*) + die "this install.sh carries no pinned release public key: use the channel's copy, set + GPUK_UPDATE_PUBKEY (the minisign public-key line), or GPUK_CHANNEL_INSECURE=1 to skip verification" ;; + esac + ensure_minisign "$DRY_RUN" +} +verify_signature() { # $1 = file, $2 = its .minisig, $3 = what it is + "$MINISIGN" -Vq -m "$1" -x "$2" -P "$CHANNEL_PUBKEY" >/dev/null 2>&1 \ + || die "$3: signature verification FAILED against the pinned release key — refusing it (OPS-20)" +} + # One tiny JSON document, fetched over TLS, holding what the current release IS. # Parsed with sed rather than jq: `curl … | sudo sh` cannot assume jq exists, and # the document is ours and flat. @@ -576,30 +723,65 @@ if [ -n "$IMAGE" ]; then ok "using the image given on the command line: $IMAGE" [ -n "$VERSION" ] || VERSION="(pinned by --image)" else - CHANNEL=$(curl -fsSL --max-time 20 "$CHANNEL_URL" 2>/dev/null) \ + CHANNEL_DOC="$TMP/latest.json" + curl -fsSL --max-time 20 "$CHANNEL_URL" -o "$CHANNEL_DOC" 2>/dev/null \ || die "cannot reach the release channel at $CHANNEL_URL If this host is offline, pass --image to install a specific image directly." + if [ "$INSECURE" -eq 1 ]; then + warn "GPUK_CHANNEL_INSECURE=1 — the release channel and what it names are NOT verified" + else + require_verifier + curl -fsSL --max-time 20 "$CHANNEL_URL.minisig" -o "$CHANNEL_DOC.minisig" 2>/dev/null \ + || die "no signature at $CHANNEL_URL.minisig — refusing an unsigned channel document (OPS-20)" + verify_signature "$CHANNEL_DOC" "$CHANNEL_DOC.minisig" "the release channel ($CHANNEL_URL)" + ok "release channel signature verified" + fi - [ -n "$VERSION" ] || VERSION=$(echo "$CHANNEL" | json_field version) - [ -n "$VERSION" ] || die "the release channel returned no version: $CHANNEL_URL" + CHANNEL_VERSION=$(json_field version < "$CHANNEL_DOC") + [ -n "$CHANNEL_VERSION" ] || die "the release channel returned no version: $CHANNEL_URL" if [ "$EDITION" = "enterprise" ]; then - IMAGE_TEMPLATE=$(echo "$CHANNEL" | json_field controllerImageEnterprise) + IMAGE_TEMPLATE=$(json_field controllerImageEnterprise < "$CHANNEL_DOC") + IMAGE_DIGEST=$(json_field controllerImageDigestEnterprise < "$CHANNEL_DOC") else - IMAGE_TEMPLATE=$(echo "$CHANNEL" | json_field controllerImage) + IMAGE_TEMPLATE=$(json_field controllerImage < "$CHANNEL_DOC") + IMAGE_DIGEST=$(json_field controllerImageDigest < "$CHANNEL_DOC") fi [ -n "$IMAGE_TEMPLATE" ] \ || die "the release channel names no $EDITION controller image: $CHANNEL_URL" - # The channel gives the repository; WE pin the tag. A floating `:latest` would - # make every container recreate a silent, unrequested upgrade. Strip any tag the - # channel already carries with image_repo (host:port-safe), then pin OUR version. - IMAGE="$(image_repo "$IMAGE_TEMPLATE"):${VERSION}" + # The signed document vouches for ONE release: its digest belongs to that + # version and no other. Another release is installed by its full reference. + if [ -n "$VERSION" ] && [ "$VERSION" != "$CHANNEL_VERSION" ]; then + [ "$INSECURE" -eq 1 ] \ + || die "the signed channel vouches for $CHANNEL_VERSION only, not $VERSION. To install another + release, pass its full reference: --image :$VERSION@sha256:" + IMAGE_DIGEST="" + fi + [ -n "$VERSION" ] || VERSION="$CHANNEL_VERSION" + case "$IMAGE_DIGEST" in + sha256:*) _hex=${IMAGE_DIGEST#sha256:} + case "$_hex" in *[!0-9a-f]*) die "the release channel carries a malformed image digest: $IMAGE_DIGEST" ;; esac + [ "${#_hex}" -eq 64 ] || die "the release channel carries a malformed image digest: $IMAGE_DIGEST" ;; + "") [ "$INSECURE" -eq 1 ] \ + || die "the release channel names no $EDITION image digest: refusing to pin a mutable tag (OPS-20)" ;; + *) die "the release channel carries a malformed image digest: $IMAGE_DIGEST" ;; + esac + + # The channel gives the repository; WE pin the tag and, from the signed + # document, the content: `repo:tag@sha256:…` keeps the tag readable while + # docker resolves by digest, so a registry cannot swap what the tag points at. + # A floating `:latest` would make every recreate a silent, unrequested upgrade. + IMAGE="$(image_repo "$IMAGE_TEMPLATE"):${VERSION}${IMAGE_DIGEST:+@$IMAGE_DIGEST}" ok "release $VERSION" ok "image $IMAGE" + [ -n "$IMAGE_DIGEST" ] || warn "the image is pinned by tag only (no digest in an unverified channel)" - [ -n "$WORKER_BINARY" ] || WORKER_RELEASE_BASE=$(echo "$CHANNEL" | json_field workerBase) - [ -n "${GPUK_SCRIPT}" ] || GPUK_SCRIPT_URL=$(echo "$CHANNEL" | json_field gpukScript) + [ -n "$WORKER_BINARY" ] || WORKER_RELEASE_BASE=$(json_field workerBase < "$CHANNEL_DOC") + if [ -z "${GPUK_SCRIPT}" ]; then + GPUK_SCRIPT_URL=$(json_field gpukScript < "$CHANNEL_DOC") + GPUK_SCRIPT_SHA256=$(json_field gpukScriptSha256 < "$CHANNEL_DOC") + fi fi # A direct --image and a channel version are held to the same immutable-image @@ -616,10 +798,6 @@ case "$IMAGE" in ;; esac -if [ -n "$DOMAIN" ] && [ -n "$PROFILE" ] && [ "$PROFILE" != "public" ]; then - die "--domain applies only to --profile public (it fills the TLS reverse-proxy example)" -fi - if [ "$DRY_RUN" -eq 1 ]; then step "Dry run — stopping here" if [ "$SKIP_PREFLIGHT" -eq 1 ]; then @@ -714,31 +892,45 @@ if [ "$PROFILE" = "public" ] && [ -z "$DOMAIN" ] && can_prompt; then done fi -if [ -n "$DOMAIN" ] && [ "$PROFILE" != "public" ]; then - die "--domain applies only to --profile public (it fills the TLS reverse-proxy example)" -fi - # ── 4. The host daemon ─────────────────────────────────────────────────────── step "Host daemon — gpu-kitchen-worker" -TMP=$(mktemp -d) -# shellcheck disable=SC2064 # expand TMP now: it must be removed even if it changes -trap "rm -rf '$TMP'" EXIT INT TERM - if [ -z "$GPUK_SCRIPT" ]; then - # A checkout right here beats a download (that is how contributors run it). - _local="$(dirname "$0")/gpuk" - if [ -f "$_local" ]; then + # A checkout right here beats a download (that is how contributors run it) — + # but ONLY a checkout. Piped into `sh`, $0 is `sh` and dirname "$0" is the + # current directory: a stray `./gpuk` in /tmp or a shared folder would run as + # root, unverified. So the local copy counts only when this script was run by + # its path, next to its gpuk, inside a repository checkout (dev.sh two levels + # up, deployments/install/); everything else downloads (INS-03). + _local="" + case "$0" in + install.sh|*/install.sh) + _here=$(dirname "$0") + [ -f "$_here/gpuk" ] && [ -f "$_here/../../dev.sh" ] && _local="$_here/gpuk" + ;; + esac + if [ -n "$_local" ]; then GPUK_SCRIPT="$_local" - ok "using the gpuk installer from this checkout" + ok "using the gpuk installer from this checkout ($_local)" else [ -n "${GPUK_SCRIPT_URL:-}" ] \ || die "the release channel names no gpuk installer, and none was found locally" curl -fsSL --max-time 60 "$GPUK_SCRIPT_URL" -o "$TMP/gpuk" \ || die "cannot download the gpuk installer from $GPUK_SCRIPT_URL" + # The signed channel names the installer's sha256: the bytes that run as root + # next are the ones the release signed for, wherever they were served from. + if [ -n "${GPUK_SCRIPT_SHA256:-}" ]; then + _sum=$(sha256sum "$TMP/gpuk" | cut -d' ' -f1) + [ "$_sum" = "$GPUK_SCRIPT_SHA256" ] \ + || die "the gpuk installer from $GPUK_SCRIPT_URL does not match the signed channel (sha256 $_sum)" + ok "downloaded the gpuk installer (sha256 matches the signed channel)" + else + [ "$INSECURE" -eq 1 ] \ + || die "the release channel names no gpukScriptSha256: refusing an unverified gpuk installer (OPS-20)" + warn "downloaded the gpuk installer, NOT verified (GPUK_CHANNEL_INSECURE=1)" + fi chmod +x "$TMP/gpuk" GPUK_SCRIPT="$TMP/gpuk" - ok "downloaded the gpuk installer" fi fi @@ -767,9 +959,45 @@ if [ -n "$WORKER_BINARY" ]; then set -- "$@" --binary "$WORKER_BINARY" ok "using a locally-built gpu-kitchen-worker" elif [ -n "${WORKER_RELEASE_BASE:-}" ]; then - GPUK_RELEASE_BASE="$WORKER_RELEASE_BASE" - export GPUK_RELEASE_BASE - ok "gpu-kitchen-worker will be downloaded from the release" + # The privileged daemon: downloaded here, its minisign signature checked + # against the pinned release key, and only then handed to gpuk (OPS-20). + case "$(uname -m)" in + x86_64|amd64) _asset="gpu-kitchen-worker-x86_64"; _build_key="workerBuildIdX86_64" ;; + aarch64|arm64) _asset="gpu-kitchen-worker-aarch64"; _build_key="workerBuildIdAarch64" ;; + *) die "unsupported architecture: $(uname -m)" ;; + esac + ok "downloading $_asset from the release" + curl -fL --progress-bar "$WORKER_RELEASE_BASE/$_asset" -o "$TMP/gpu-kitchen-worker" \ + || die "cannot download $WORKER_RELEASE_BASE/$_asset" + if [ "$INSECURE" -eq 1 ]; then + warn "gpu-kitchen-worker NOT verified (GPUK_CHANNEL_INSECURE=1)" + else + curl -fsSL --max-time 60 "$WORKER_RELEASE_BASE/$_asset.minisig" -o "$TMP/gpu-kitchen-worker.minisig" \ + || die "no signature at $WORKER_RELEASE_BASE/$_asset.minisig — refusing an unsigned daemon binary" + verify_signature "$TMP/gpu-kitchen-worker" "$TMP/gpu-kitchen-worker.minisig" "gpu-kitchen-worker ($_asset)" + # The signature binds artifact AND build (trusted comment + # `gpu-kitchen-worker@`, P2-29): the build must be the one the signed + # channel names for this release, so an older signed binary served in its + # place is refused, and never older than the daemon already installed. + _build=$(json_field "$_build_key" < "$CHANNEL_DOC") + [ -n "$_build" ] \ + || die "the release channel names no $_build_key: cannot tell which gpu-kitchen-worker build it vouches for (OPS-20)" + _comment=$("$MINISIGN" -V -m "$TMP/gpu-kitchen-worker" -x "$TMP/gpu-kitchen-worker.minisig" -P "$CHANNEL_PUBKEY" 2>/dev/null \ + | sed -n 's/^Trusted comment: //p' | head -1) + [ "$_comment" = "gpu-kitchen-worker@$_build" ] \ + || die "gpu-kitchen-worker ($_asset) is signed for '${_comment:-nothing}', not gpu-kitchen-worker@$_build — refusing it (OPS-20)" + if [ -x "$BIN_DEST" ]; then + _installed=$("$BIN_DEST" --version 2>/dev/null | sed -n 's/^gpu-kitchen-worker //p' | head -1) + case "$_installed" in + [0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]-*) + # buildId = YYYYMMDDHHMMSS-: the timestamp orders builds. + [ "${_build%%-*}" -ge "${_installed%%-*}" ] \ + || die "gpu-kitchen-worker $_build is OLDER than the installed $_installed — refusing a downgrade" ;; + esac + fi + ok "gpu-kitchen-worker signature verified (build $_build)" + fi + set -- "$@" --binary "$TMP/gpu-kitchen-worker" fi # else: gpuk reuses an already-installed binary, or fails with its own message. @@ -803,25 +1031,32 @@ echo echo " ${BOLD}Open:${RESET} http://${HOSTNAME_FQDN}:${PORT}" [ -n "$LAN_IP" ] && echo " http://${LAN_IP}:${PORT}" echo -CLAIM_CODE_FILE="$DATA_ROOT/secrets/claim_code" -CLAIM_CODE="" -[ ! -s "$CLAIM_CODE_FILE" ] || CLAIM_CODE=$(cat "$CLAIM_CODE_FILE" 2>/dev/null || true) -if [ -n "$CLAIM_CODE" ]; then - echo " ${BOLD}Claim code:${RESET} $CLAIM_CODE" - echo " ${BOLD}Read again:${RESET} $CLAIM_CODE_FILE (mode 0600; removed after claim)" -else - echo " ${BOLD}Claim code:${RESET} consumed (the first account already exists)" -fi -echo -# The wizard's first step asks for a Kitchen ACCOUNT key (CPT-04). It is the -# person's credential, never the machine's — this script cannot create or print -# it, and the browser must not receive it in a URL (CPT-05/06). What it can do -# is say so, and say where the key comes from, before the page does. -echo " ${BOLD}Next:${RESET} open the URL above. Its first step asks for your GPU Kitchen account key" -echo " (gpuk_…). Sign in to your GPU Kitchen account and create one under Install keys:" -echo " https://gpu.kitchen/account#install-keys" -echo " That key is yours, not this machine's: the installer never sees it," -echo " and the page exchanges it for a revocable installation token." +# [PRF-12] [SEC-53] homelab and studio open straight into the app: the controller +# closed their claim window at first boot, so there is no code to show. Every other +# profile — or none yet — starts with the claim code (SEC-52). +case "$PROFILE" in + homelab|studio) + echo " ${BOLD}Next:${RESET} open the URL above: GPU Kitchen opens straight away." + ;; + *) + CLAIM_CODE_FILE="$DATA_ROOT/secrets/claim_code" + CLAIM_CODE="" + [ ! -s "$CLAIM_CODE_FILE" ] || CLAIM_CODE=$(cat "$CLAIM_CODE_FILE" 2>/dev/null || true) + if [ -n "$CLAIM_CODE" ]; then + echo " ${BOLD}Claim code:${RESET} $CLAIM_CODE" + echo " ${BOLD}Read again:${RESET} $CLAIM_CODE_FILE (mode 0600; removed after claim)" + else + echo " ${BOLD}Claim code:${RESET} consumed (the first account already exists)" + fi + echo + echo " ${BOLD}Next:${RESET} open the URL above and enter the claim code." + ;; +esac +# [INS-50] Linking to a GPU Kitchen account is never a first-run step: a banner in +# the app offers it, and the person approves on gpu.kitchen — no key is copied here, +# none ever travels in a URL (CPT-05/06). +echo " A banner in the app connects this installation to your GPU Kitchen account:" +echo " \"Connect to my account\" or \"Create an account\" on gpu.kitchen — nothing to copy." case "$PROFILE" in public) @@ -849,7 +1084,6 @@ case "$PROFILE" in echo ;; homelab|studio) - echo " ${BOLD}Then:${RESET} finish first-run in the UI" echo ;; "") @@ -857,6 +1091,13 @@ case "$PROFILE" in echo ;; esac +# Any profile may be reached by a name through a reverse proxy (INS-47); the +# public case above already printed its steps. +if [ -n "$DOMAIN" ] && [ "$PROFILE" != "public" ]; then + echo " ${BOLD}HTTPS:${RESET} https://${DOMAIN} once your reverse proxy serves it; a filled" + echo " Caddy example was written to $DATA_ROOT/caddy/Caddyfile." + echo +fi echo " Inference endpoint : http://${HOSTNAME_FQDN}:${INFERENCE_PORT}/v1" echo " Version : ${VERSION}" echo @@ -888,3 +1129,6 @@ echo " Update : re-run this command, or press Update in the UI, or: gpuk updat echo " Status : gpuk status Logs: gpuk logs" echo " Remove : gpuk uninstall (service only) or gpuk uninstall --purge (all but the data root)" echo +} + +main "$@" diff --git a/latest.json b/latest.json index f9222c9..6ee5ec6 100644 --- a/latest.json +++ b/latest.json @@ -1,11 +1,14 @@ { - "version": "v0.1.11", - "semver": "0.1.11", + "version": "v0.1.13", + "semver": "0.1.13", "controllerImage": "repo.byterain.io/gpukitchen/gpukitchen-controller", "controllerImageEnterprise": "repo.byterain.io/gpukitchen-private/gpukitchen-controller-ee", - "controllerImageDigest": "sha256:358a66cc790d2da9b2fce98593e323747f7638945414ba7a2965090369a5470d", - "controllerImageDigestEnterprise": "sha256:71f254ec52894e1634e9fa7b976dff40efd69ebf1121be0c7c80b5748aea75e8", - "workerBase": "https://repo.byterain.io/api/packages/gpukitchen/generic/gpu-kitchen-worker/v0.1.11", - "gpukScript": "https://repo.byterain.io/api/packages/gpukitchen/generic/gpu-kitchen-channel/v0.1.11/gpuk", + "controllerImageDigest": "sha256:e48971d9f7872b7a3cfbf82260ddaf4fbe0a493496f484894def74442e90cd92", + "controllerImageDigestEnterprise": "sha256:a469c7e5c8e624239a0203574790681d6698d4dbd8574ecfb451f5c5a320f537", + "gpukScriptSha256": "40286416f58d4807c18d62b8dda988ef87714e32c35fe1343e8b4de3fad36dcf", + "workerBuildIdX86_64": "20260928160010-d6ea38b659d912eec5a2b47b3b08f9eeb09aea01", + "workerBuildIdAarch64": "20260928160010-d6ea38b659d912eec5a2b47b3b08f9eeb09aea01", + "workerBase": "https://repo.byterain.io/api/packages/gpukitchen/generic/gpu-kitchen-worker/v0.1.13", + "gpukScript": "https://repo.byterain.io/api/packages/gpukitchen/generic/gpu-kitchen-channel/v0.1.13/gpuk", "releaseNotes": "https://repo.byterain.io/gpukitchen/channel" } diff --git a/latest.json.minisig b/latest.json.minisig index c701885..9b23087 100644 --- a/latest.json.minisig +++ b/latest.json.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RUQ7BKXJqGX2jbXzspPlihd5bObC3/Ex5EYCJWKoVGhMg6nHMqDO/AeCTvOs6eC1Oy+lUIkOLX7aHDVtqJr3NK5ELVlXFGxhOQE= -trusted comment: gpu-kitchen channel v0.1.11 -S2dq0xcF2sO3uSP3KCS9m6Tq8X9bPmfrLjY1WUxhoB9HtBrwBiV5lSUXEtsBX2KKfo0FVisfuyFPM2mDPDKCAA== +RUQ7BKXJqGX2jesWQLAgf8TOhEtR7LdTE/9W4xWixCA2CMU5EjcA73hQkqwF1pPaP53Yrx35nu8dGLVqoDAYcminSfEpwakTxwQ= +trusted comment: gpu-kitchen channel v0.1.13 +8JLHZg2cxj2RjgCyUp6S6tO909AmdxZ9wLScByCswPpzV5Vc8aYyM6DcKAmDRyVPyrPmdy+yKpQOZrOFq2DfCA==