Add c1i upgrade: Sigstore-verified self-update from the C1 distribution center

[leet-c1]

What

Adds c1i upgrade (alias update), which installs a newer release from the C1 distribution center (dist.conductorone.com) and verifies it before replacing anything. Targeted for 0.9.0.

c1i upgrade                     # latest stable release (asks first; -y/--yes to skip)
c1i upgrade --check             # JSON: current, latest, channel, update_available, install_method
c1i upgrade --channel latest -y # newest build, no prompt

Only a standalone binary is replaced in place. For Homebrew, go install, and container installs it prints the right upgrade command and exits 0; --check includes it as upgrade_command. Windows and system-package installs are never self-replaced. Development builds (dev, (devel), Go pseudo-versions) refuse to replace themselves.

Verification

1. Sigstore signature on the release manifest.
   • The certificate must come from the release workflow: an anchored match on ConductorOne/github-workflows/.github/workflows/release.yaml@refs/tags/v<major> and the GitHub Actions OIDC issuer. It must also carry source repo ConductorOne/c1i, source ref refs/tags/v<manifest version>, trigger push, and a GitHub-hosted runner.
   • The certificate chain, embedded SCT, and Rekor transparency-log entry are verified against the Sigstore public-good trust root. That root is fetched over TUF through c1i's shared transport, so --debug and --max-retries apply to it.
   • The manifest's version must equal the target the channel named.
2. SHA-256 of the downloaded archive, taken from the verified manifest's entry for this OS and architecture.

The binary is replaced atomically: staged in the same directory, fsync, rename. The writability of the install directory is checked before anything is downloaded. Concurrent upgrades are serialized with a flock on the install directory. On NFS-style filesystems that can't lock a directory, the upgrade proceeds unlocked, since the rename is atomic. The installed version is re-checked under the lock.

Exit codes

Dist 404 → 4, 429 → 5, 5xx → 6. Any other dist 4xx, an unreachable dist or TUF host, a refused redirect, or a signature or checksum failure → 8. A local failure (directory not writable, replace failed) → 1, naming the install directory.

Known residual

index.json (channel targets and yank status) is not signed; only per-release manifests are. A compromised distribution origin can withhold upgrades or offer any signed release newer than yours, including a yanked or prerelease one. It can never deliver an unsigned build, or one older than the binary you run. Closing this needs a signed index on the dist side.

Dependencies

• New direct dependencies: sigstore-go, sigstore/sigstore, protobuf-specs, go-tuf/v2, golang.org/x/mod. All are at their latest release, except grpc, held at v1.83.2 because v1.84.0 is still affected by GO-2026-6443. grpc-gateway stays at v2.30.0 for the same reason, because v2.31.0 requires grpc v1.84.0.
• govulncheck -show verbose on linux, darwin and windows: 0 called and 0 imported vulnerabilities. One module-level finding, GO-2026-5932 (x/crypto/openpgp), has no fix and isn't imported.
• The stripped binary grows from 12.9 MB to 23.4 MB, almost all of it sigstore-go's verify/tlog/bundle packages (which pull in grpc). Hand-rolling those checks would save about 6.5 MB; we chose not to reimplement security-critical verification to save space.

The shared transport also gains WithMaxResponseBytes (opt-in), and now refuses an https → http redirect.

Also in this PR

• Saving the tenant URL to ~/.c1i.yaml no longer overwrites a file it can't read or parse. It leaves the file unchanged and auth login prints a warning. The credential is still stored.
• A ~/.c1i.yaml holding only ---, ~ or null no longer crashes login. It used to panic on save; it's now treated as empty.
• SaveToConfigFile now has tests, each confirmed by a mutant.
• Two code comments no longer use internal shorthand for the API gateway.

Testing

• Offline verification tests. These use a snapshot of the Sigstore trust root and the real signed v0.7.0 release. Forged certificates, tampered manifests and bundle mismatches are rejected.
• End-to-end httptest flow with a throwaway Fulcio CA, CT log and Rekor log. Unsigned, tampered, wrong-version, wrong-checksum and yanked releases all exit 8, with the binary byte-identical afterwards.
• Mutation testing. Each load-bearing check was removed in turn, 33 checks in all: signature call, tlog, SCT, chain, identity fields, version binding, sha, yank, lock re-check, TUF routing, exit-code mapping, writability. A test fails for every one. Two independent rounds of security review re-ran these.
• Live tests against dist.conductorone.com.
  • A v0.7.0 build replaced itself with v0.8.0, and its SHA matches the published archive.
  • --check returns JSON on all three channels.
  • The symlinked, Homebrew-shaped, and go install-shaped paths, plus dev builds, behave as described above.
  • A read-only directory fails before download (exit 1). Offline exits 8, instantly with --max-retries 0.
  • Two concurrent upgrades leave one valid binary and no stray files.
  • The Sigstore TUF fetch is visible in --debug.
• Gates at the CI-pinned versions: build, vet, test -count=1 -shuffle=on, golangci-lint v2.14.0 (0 issues), gosec v2.29.0, govulncheck v1.8.0 ×3 GOOS, go mod tidy, and gitleaks all pass.

Not tested live: tampered releases (covered offline), the interactive prompt, macOS, Windows, and container installs.

🤖 Generated with Claude Code