root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(FN-5375): enforce manifest-gated cloudflared checksum installation

Browse Source 
Added manifest-gated checksum verification for cloudflared remote access tunnels: a pinned manifest validator (Step 1) and enforcement logic (Step 2) wired into the settings memory routes, with aligned tests and documentation covering fail-closed install behavior and pending-manifest guidance.

Fusion-Task-Id: FN-5375
This commit is contained in:
Fusion (runfusion.ai)
2026-05-20 18:42:00 -07:00
committed by gsxdsm
parent e814ba9508
commit dbccdb1275
5 changed files with 307 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/fn-5375-cloudflared-manifest.md Normal file
View File

@@ -0,0 +1,5 @@
---
"@runfusion/fusion": patch
---
Harden cloudflared auto-install (dashboard remote-access opt-in flow): add a pinned release manifest and SHA-256 verification, mirroring the FN-5320 Worktrunk pattern. Auto-download fails closed in `upstream-pending-verification` mode; package-manager paths (`brew`, `winget`) are unchanged. Replaces the previous unverified `releases/latest/download` direct-curl install path.