From e803ad2b9143c54384c28306eda018d7f7631ae1 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Thu, 22 Oct 2026 18:13:35 +0200 Subject: [PATCH] =?UTF-8?q?night=202026-10-22:=20REPORT;=20CHANGELOG=20cor?= =?UTF-8?q?rected=20=E2=80=94=20a=20push=20of=20the=20installer=20to=20mai?= =?UTF-8?q?n=20publishes=20nothing=20(R-110,=20tag=20installer-v1.35.0);?= =?UTF-8?q?=20D4=20stays=20a=20patch=20because=20both=20halves=20need=20a?= =?UTF-8?q?=20release?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 5 +---- REPORT.md | 32 +++++++++++++++++--------------- 2 files changed, 18 insertions(+), 19 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2ec921d..dca92db 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,10 +5,7 @@ (`PermitRootLogin prohibit-password`), a `sshd` content check (exactly `prohibit-password`; `sshd -t -f`), and after an install that wrote it `sshd -t` + `systemctl reload ssh`; tests `RootKeyOnly` (3), red-proved. Live on a fresh nested box from ISO 1.30.0: root password over SSH refused, root key works, the console and the web page still take - the password. It was committed (`a0c88e5`) and moved back out (this commit): the installer's uninstall must remove - every bundle file (felhom.eu `scripts/test_hostinstall.py`), and a push of `felhom-host-install.sh` publishes the - installer to every new box — forbidden tonight. Both halves are patches: `felhom-agent-bundle-D4.patch` and - `felhom.eu-installer-D4.patch` in that folder; apply them together with the agent release. + the password. It was committed (`a0c88e5`) and moved back out (`7651461`): the installer's uninstall must remove every bundle file (felhom.eu `scripts/test_hostinstall.py`), the bundle half reaches a box only with an agent release, and the installer half only with a new `installer-v…` tag (R-110 — a push to `main` alone publishes nothing) — both forbidden tonight. *(Corrected the same night: the first reason written here, „a push of `felhom-host-install.sh` publishes the installer", was wrong — the website serves `/scripts/` from the tag `installer-v1.35.0`, read live in `manifests/webpage.yaml` and the running Deployment.)* Both halves are patches: `felhom-agent-bundle-D4.patch` and `felhom.eu-installer-D4.patch` in that folder; apply them together with the agent release and the next installer tag. - **R-1204 — `wireguard.handshake_future_s`.** A box that ran once with its clock ahead keeps a handshake stamped in the future; ep0 refuses every newer one, and `last_handshake_age_s` (clamped at 0) read „just now" for ever. The heartbeat now carries how many seconds the handshake lies ahead (> 60 s only); the age keeps its clamp. The hub alarms on it diff --git a/REPORT.md b/REPORT.md index 1872674..d0bbade 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,17 +1,19 @@ -# REPORT — agent v0.162.0 released (2026-10-22 morning, operator yes) — NOT VOUCHED (the vouch is the operator's) +# REPORT — night 2026-10-22: one change on `main`, one ready patch, nothing released -**What:** the swap fix (R-1192: every guest may swap as much as its RAM), the host-swap report and check, and R-1194 (no -false „operator access degraded" on a fresh box). Proven the night before on a fresh 8 GB box: 11 h, no freeze; with the -host's swap off the freeze comes back (felhom.eu `REPORT-night-2026-10-21.md`). +**What:** the night brief's agent parts. No agent release, no vouch (both forbidden tonight). Design read: +`03-host-agent.md` (the WireGuard tunnel, the config bundle), `06-offsite-connectivity.md`. -- **Released** with `scripts/release-agent.sh 0.162.0` from a clean clone at `b310773`: binary sha256 - `5fd7a23bfe319cb521c4bc399612d5fb3413f1e695f79bc663c386f69c757928` (the same bytes as the night's candidate), bundle - `ac772967…60b5a5`, tag `v0.162.0`, round trip verified by the script. -- **Delivered** by one signed `agent_update` job per box to demo-hp, Tester 1 and demo-felhom: all three `update - committed` with `capabilities self-check ok=76 total=76`; each raised its 9201's swap from 512 MB to its RAM. Evidence - felhom.eu `documentation/audits/morning-2026-10-22/release/04-agent-delivery.txt`. -- **Found:** the host-swap check is too strict for a guest larger than 8 GB. demo-hp (host 8191 MB vs guests 25898 MB) - and demo-felhom (8191 vs 12288) warned and the hub mailed `host_swap_short`; the soak used at most 2.7 GB of host swap. - Filed felhom.eu R-1216 with two options for the operator. -- **Not done:** the vouch (Configs → Day-0 artifacts, agent 0.162.0 / the sha above, the bundle with it) — the operator's - click; CC's token cannot. Tester 2's box was not sent the update (not a test box; the operator's word). +- **R-1204, `a0c88e5` (on `main`, unreleased).** The heartbeat's `wireguard` block gains `handshake_future_s` when the + last handshake lies more than 60 s in the future (`wgtunnel.handshakeFuture`) — the clock-ahead lock-out that the + clamped `last_handshake_age_s` hid. Red-proved (`TestR1204_AFutureHandshakeIsReported`). The hub's alarm on it is + hub 0.166.0 (felhom.eu, built, not deployed). +- **R-982 / D4 (operator 15:47: root SSH from the LAN by key only) — a ready patch, NOT on main (`7651461` moved it + out).** A bundle drop-in `/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf` (`PermitRootLogin prohibit-password`), + checked and reloaded by `felhom-os-apply`; proven on a fresh install from ISO 1.30.0 (nested VM 9343, destroyed): + password SSH refused, key works, the console and the PVE web login keep the password. Patches: + felhom.eu `audits/night-2026-10-22/P2-D4/felhom-agent-bundle-D4.patch` + `felhom.eu-installer-D4.patch`. They ship + with the next agent release (the operator's vouch) and the next installer tag. +- **Correction:** the CHANGELOG first said a push of the installer would publish it. Wrong: `/scripts/` is served from + the tag `installer-v1.35.0` (R-110). The decision to keep D4 as a patch stands on the other two reasons. +- **Gates:** `agent_gates.py --fast` green before each push. CI by commit: felhom.eu `REPORT-night-2026-10-22.md`. +- **Teardown:** VM 9343 destroyed on demo-hp (own id); its hub appliance (id 49) waits for the operator's Discard.