main: Enhance CLI security, authentication, and configuration features

.github/workflows/build.yml

@@ -34,6 +34,26 @@ jobs:
       - name: scripts/sync-schema.sh --check
         run: ./scripts/sync-schema.sh --check
 
+  installer:
+    timeout-minutes: 10
+    name: Installer (shell)
+    # The curl|sh installer is the most privileged code we ship (it places the
+    # binary on PATH) and had NO automated test until R8. shellcheck it under
+    # the POSIX sh dialect it actually runs as, parse it with dash, and run the
+    # functional harness that asserts cosign verification is mandatory / fails
+    # closed when cosign is absent (RFC-0001 R8, backend#889).
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: shellcheck + dash parse
+        run: |
+          sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck dash
+          shellcheck --shell=sh --severity=error scripts/install.sh
+          dash -n scripts/install.sh
+          bash -n scripts/tests/install-verify.sh
+      - name: Verification harness (mandatory cosign / fail-closed)
+        run: bash scripts/tests/install-verify.sh
+
   test:
     timeout-minutes: 15
     name: Test

README.md

@@ -6,9 +6,9 @@ The customer-facing CLI for the tracebloc declarative ingestion path. Wraps the
 
 ## Status
 
-**v0.3.0 is released** — the latest stable [release](https://github.com/tracebloc/cli/releases/latest), cut from `develop`. It builds on v0.2.0's guided `dataset push` and `dataset rm` with a new `dataset list` command plus home-screen / output polish (clearer copy, guided-first framing). The binary implements `version`, `completion`, `ingest validate`, `cluster info`, and the full `dataset push` / `dataset list` / `dataset rm` flow — local schema validation, cluster discovery, data staging, submission, and Job watching, end to end.
+**v0.3.0 is released** — the latest stable [release](https://github.com/tracebloc/cli/releases/latest), cut from `develop`. It builds on v0.2.0's guided `data ingest` and `dataset rm` with a new `dataset list` command plus home-screen / output polish (clearer copy, guided-first framing). The binary implements `version`, `completion`, `data validate`, `cluster info`, and the full `data ingest` / `dataset list` / `dataset rm` flow — local schema validation, cluster discovery, data staging, submission, and Job watching, end to end.
 
-`dataset push` covers **9 of 10 task categories**: `image_classification`, `object_detection`, `keypoint_detection`, `text_classification`, `masked_language_modeling`, `tabular_classification`, `tabular_regression`, `time_series_forecasting`, and `time_to_event_prediction`. `semantic_segmentation` is pending mask-sidecar support upstream ([data-ingestors#136](https://github.com/tracebloc/data-ingestors/issues/136)); `instance_segmentation` is not yet implemented.
+`data ingest` covers **9 of 10 task categories**: `image_classification`, `object_detection`, `keypoint_detection`, `text_classification`, `masked_language_modeling`, `tabular_classification`, `tabular_regression`, `time_series_forecasting`, and `time_to_event_prediction`. `semantic_segmentation` is pending mask-sidecar support upstream ([data-ingestors#136](https://github.com/tracebloc/data-ingestors/issues/136)); `instance_segmentation` is not yet implemented.
 
 The release pipeline ships [`v0.3.0`](https://github.com/tracebloc/cli/releases/latest) as **cosign-signed, multi-arch binaries** — Linux (`amd64`, `arm64`, `386`, `arm`), macOS (`amd64`, `arm64`), and Windows (`amd64`, `arm64`) — each with `SHA256SUMS` and the install scripts. Install via [Customer experience](#customer-experience) or [build from source](#building-from-source). (A Homebrew tap and the `install.tracebloc.io` vanity URL are later follow-ups; the GitHub release URL serves installs today.)
 
@@ -24,7 +24,7 @@ The CLI is a sibling interface to the chart, not a replacement. Both translate t
 Customer interfaces (pick one or many):
 ┌─────────────────────────────────────────────────┐
 │  Web UI       Studio for clicking through       │  ← future
-│  CLI          `tracebloc dataset push ./data`   │  ← this repo
+│  CLI          `tracebloc data ingest ./data`   │  ← this repo
 │  Python SDK   `IngestConfig(...).submit()`      │  ← future
 │  K8s CRD      `kubectl apply` Ingestion CR      │  ← future
 │  Helm chart   tracebloc/ingestor                │  ← today
@@ -50,9 +50,10 @@ The protocol — the v1 schema + the POST endpoint — is the stable point. Ever
 curl -fsSL https://github.com/tracebloc/cli/releases/latest/download/install.sh | sh
 # Install — Windows (PowerShell)
 irm https://github.com/tracebloc/cli/releases/latest/download/install.ps1 | iex
+# The installer also creates a short alias: tb works everywhere tracebloc does.
 
 # Per dataset
-tracebloc dataset push ./my-data \
+tracebloc data ingest ./my-data \
   --table cats_dogs_train \
   --category image_classification \
   --intent train \
@@ -61,6 +62,15 @@ tracebloc dataset push ./my-data \
 
 > **`tracebloc: command not found` after installing?** The binary installs to `~/.local/bin` when `/usr/local/bin` isn't writable, and an already-running shell won't see the new PATH entry until you open a new terminal (or `. ~/.bashrc`). See **[Troubleshooting installation](docs/troubleshooting.md)**.
 
+> **Signature verification is mandatory.** The installer verifies the binary's
+> SHA256 **and** its cosign signature before installing. If `cosign` isn't on
+> PATH it bootstraps a pinned, checksum-verified copy; if it can't, the install
+> **fails closed** rather than trusting the same-channel checksum alone (it no
+> longer silently skips the signature). The one escape, for a genuinely
+> constrained environment, is to re-run with `TRACEBLOC_ALLOW_UNVERIFIED=1` —
+> which prints a loud warning. For the highest trust, pre-install `cosign`
+> (`brew install cosign`, your package manager, or the [released binary](https://github.com/sigstore/cosign/releases)) before running the installer. (RFC-0001 R8.)
+
 What that runs under the curtain:
 
 1. Reads kubeconfig, discovers the parent `tracebloc/client` release in the cluster
@@ -99,15 +109,15 @@ All v0.1 phases are merged:
 | Phase | Ticket | What | Status |
 |---|---|---|---|
 | 0 | [#148](https://github.com/tracebloc/client/issues/148) | Repo bootstrap + Go module + CI + `tracebloc version` | ✅ |
-| 1 | [#149](https://github.com/tracebloc/client/issues/149) | Embed `ingest.v1.json` + `tracebloc ingest validate <path>` (local-only) | ✅ |
+| 1 | [#149](https://github.com/tracebloc/client/issues/149) | Embed `ingest.v1.json` + `tracebloc data validate <path>` (local-only) | ✅ |
 | 2 | [#150](https://github.com/tracebloc/client/issues/150) | Cluster discovery + ingestor SA token via TokenRequest | ✅ |
 | 3 | [#151](https://github.com/tracebloc/client/issues/151) | Stage data into the shared PVC via ephemeral Pod | ✅ |
 | 4 | [#152](https://github.com/tracebloc/client/issues/152) | Submit to jobs-manager + watch ingestor Job + summary | ✅ |
 | 5 | [#153](https://github.com/tracebloc/client/issues/153) | GitHub Releases + install.sh distribution (Homebrew tap deferred) | ✅ — [`v0.1.0`](https://github.com/tracebloc/cli/releases/tag/v0.1.0) released (stable, 8-platform) |
 
-Beyond the original phases, `dataset push` was widened from image-classification-only to 9 of 10 modalities, and the test suite gained unit-coverage wins plus a kind-based integration harness for the real-I/O seams.
+Beyond the original phases, `data ingest` was widened from image-classification-only to 9 of 10 modalities, and the test suite gained unit-coverage wins plus a kind-based integration harness for the real-I/O seams.
 
-**v0.2.0** added a friendlier guided `dataset push` and `dataset rm` on the home screen (#44, #47). **v0.3.0** added the `dataset list` command (#53) plus home-screen / output-spacing polish and feedback-copy refinements (#52, #56). **Next:** cloud-source ingestion (S3/GCS/HTTPS) for datasets above the 1 GiB local cap; `semantic_segmentation` ([data-ingestors#136](https://github.com/tracebloc/data-ingestors/issues/136)) and `instance_segmentation`. Smaller follow-ups are tracked as [open issues](https://github.com/tracebloc/cli/issues).
+**v0.2.0** added a friendlier guided `data ingest` and `dataset rm` on the home screen (#44, #47). **v0.3.0** added the `dataset list` command (#53) plus home-screen / output-spacing polish and feedback-copy refinements (#52, #56). **Next:** cloud-source ingestion (S3/GCS/HTTPS) for datasets above the 1 GiB local cap; `semantic_segmentation` ([data-ingestors#136](https://github.com/tracebloc/data-ingestors/issues/136)) and `instance_segmentation`. Smaller follow-ups are tracked as [open issues](https://github.com/tracebloc/cli/issues).
 
 Epic: [tracebloc/client#147](https://github.com/tracebloc/client/issues/147).