Recover deleted kiosks and allow updates during authentication failures - #35
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
bcbetterninja
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 92410f72a3
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2abbd87bc0
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 908a342517
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e77750139a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
2 participants
A deleted or rejected kiosk key could leave a Linux kiosk displaying cached content indefinitely: deletion never sent the explicit reset signal expected by installed clients, and authenticated update checks could not download a repair.
This change adds two recovery paths:
bf_kiosk_deletedenvelope on polling. Installed Linux clients independently confirm rejection through_checkbefore resetting.Public selection honors saved pins without falling through missing/yanked versions. A valid authenticated up-to-date response stays authoritative. Signature verification, compatibility selection, upgrade-only checks, rollback protections, OTA flags, demo restrictions, and existing failed-version limits remain. Pairing reset preserves the saved policy; bootstrap updates honor it and share the update-apply lock with recovery.
Deploy the server migration/change first, then the Linux client. The client needs one successful heartbeat to save its recovery policy. This does not retroactively recover keys deleted before the migration or install recovery code on an already-inaccessible old binary. New targeted admin pushes still need a working control connection; publishing a newer release on a saved, unpinned channel provides recovery during auth outages. See
docs/update-recovery.mdfor details.Validation: 146 server tests passed, 5 skipped; TypeScript no-emit check passed; 39 Rust core tests passed; 18 tests passed using a harness that compiles the production updater/recovery/rollback modules. HTTP tests exercise 401/503 fallback, saved pins, credential-free artifact downloads, hash rejection, valid up-to-date behavior, and policy invalidation. Rust parser checks passed for UI wiring. Full Linux UI compilation and live-device testing were unavailable because GTK/GStreamer/WebKit development libraries and the affected Pi are unavailable.
Review follow-up: normal fleet downloads retain their authenticated routes instead of sharing the public per-IP quota. Regression tests cover seven healthy downloads, recovery after rejected authentication, preserved OS Range headers, 429 cooldown, and retaining prior genuine failures when refunding a deferred OS attempt. Updater harness: 22 tests passed. The merge with master also preserves full-OS eligibility for all OS recovery and bootstrap paths.