[hivecommons-hive]

Summary: Bluefin Server ships Tailscale (a VPN that joins machines into a private network) as an optional add-on pinned to one upstream release. The automated checker that proposes patch-release updates for every other bundled upstream program did not know about Tailscale, so its security and bug-fix releases would only arrive by hand. This teaches the checker about Tailscale so updates are proposed and checksum-verified automatically like the rest.

---

Security Fix

Adds a tailscale component to .github/scripts/track-binaries.py:

• version atom tailscale-version in include/tailscale.yml, series = MAJOR.MINOR (patch releases only; odd unstable minors are never proposed);
• pins are the two include atoms tailscale-x86-64-sha256 / tailscale-arm64-sha256 (standalone keys, same mechanism as the NVIDIA driver), read from elements/runtimes/tailscale-bin.bst's two url: lines and verified against pkgs.tailscale.com's bare-digest <tarball>.sha256 and the downloaded tarball;
• candidates are tailscale/tailscale GitHub releases (tags vX.Y.Z, no attached assets — the tarballs live on pkgs.tailscale.com, so the asset-attached check is skipped for them as the existing code already does for non-GitHub URLs).

Tests (tests/unit/test_track_binaries.py): newest stays inside the pinned minor and skips drafts/prereleases; apply moves the version and both sha256 atoms together and writes nothing else; a tampered tarball or a missing arm64 checksum writes nothing; the real element reads both include atoms. The existing real-tree invariants (multi_arch amd64 == arm64, every pinned source owned by exactly one component, every pin readable) now cover Tailscale too. docs/skills/ci-tooling.md lists Tailscale in the tracker row.

Verified against upstream on 2026-10-28: current 1.104.2, newest 1.104.4; both existing pins read back as the published sha256s. python3 -m pytest tests/unit/test_track_binaries.py: 73 passed. ruff check clean.

Closes #559

---

Filed by sec-check agent (ACMM L6 — full mode)

— hive: agent=sec-check backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign ahmedadan after the PR has been reviewed.
You can assign the PR to them by writing /assign @ahmedadan in a comment when ready.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

Summary: This change teaches the daily upstream-update checker about Tailscale so its bug-fix and security patch releases get proposed and checksum-verified automatically, like the other bundled programs. It does what the linked finding (#559) asked for, and I confirmed against the live upstream that the checksum file format and release tags match the code's assumptions. One small robustness note below; nothing blocks it.

---

correctness

• (low, advisory) .github/scripts/track-binaries.py:336-363 — Component.candidates only requires release assets to be attached for URLs under github.com/<repo>/releases/download/. Tailscale's tarballs live on pkgs.tailscale.com, so wanted is empty and every vX.Y.Z tag in the series counts as a candidate the moment the GitHub release appears, before the tarball or its .sha256 exists there. apply then fails with HTTP 404 (exit 1) and the scheduled run is red until upstream publishes. NvidiaDriverComponent.candidates (:507-519) already solves this by HEAD-checking _published(pin.url) and _published(pin.sums); a short candidates override on TailscaleComponent filtering super().candidates(...) the same way would make the check self-healing. Fine to land as-is or as a follow-up.

Verified at c87fbaa: python3 -m pytest tests/unit/test_track_binaries.py → 73 passed; pkgs.tailscale.com/stable/tailscale_1.104.4_amd64.tgz.sha256 is a bare digest (parsed by published_sha256, :779-802); tailscale/tailscale releases are vX.Y.Z, non-prerelease, 0 assets.

No findings from: security, intent-alignment, style, docs-currency.

Confidence: 5/5 (safe)

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign ahmedadan after the PR has been reviewed.
You can assign the PR to them by writing /assign @ahmedadan in a comment when ready.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment