admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hub v0.29.0: Day-0 artifact manifest — version dropdowns + auto-derived sha

Browse Source 
Operator picks a version from a Gitea-populated dropdown; the hub reads that
version's sha256 from Gitea itself (files-metadata API, no artifact download) and
vouches it — no hand-copied checksums. New internal/gitea read-only client
(ListVersions + FileSHA256, unit-tested). Configuration UI: version <select>s +
read-only sha display; handleSetArtifacts derives the sha authoritatively and
refuses the save on a Gitea lookup failure. Degrades to manual text entry without
registry creds. go build/vet/test clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-07-01 09:02:13 +02:00
parent ce26c9d646
commit 079a2cdd08
7 changed files with 375 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hub/CHANGELOG.md
+24
View File
@@ -1,5 +1,29 @@
# Felhom Hub — Changelog
## v0.29.0 — Day-0 artifact manifest: version dropdowns + auto-derived sha (2026-07-01)
Removes the hand-copied sha256 from the Day-0 artifact manifest. The operator now **picks a version**
from a dropdown of what's actually in Gitea (olders get pruned), and the hub **reads that version's
sha256 from Gitea itself** — no transcription, no stale checksums. Keeps the human-in-the-loop trust
gate (the operator still deliberately chooses the version; "latest" is never auto-promoted) while the
hub stays the checksum trust root.
- **`internal/gitea`** (new): a minimal read-only Gitea packages client — `ListVersions` (generic
package versions, newest-semver first) + `FileSHA256` (a version's file sha256 via the files-metadata
API, **without downloading** the artifact — important for the ~GB golden). Basic-auth with the
registry creds the hub already holds. Unit-tested against an httptest server (filter+sort, preferred
file match + fallback, non-200 → error).
- **Configuration → Day-0 artifacts:** the two version text inputs are now `<select>` dropdowns
populated from Gitea; the sha256 fields are **read-only, displayed** (mirrored from the picked
version via a tiny inline script). Choosing "— none —" clears an artifact.
- **`handleSetArtifacts`:** derives each chosen version's sha256 from Gitea **authoritatively** (a
client-submitted sha is ignored); a Gitea lookup failure REFUSES the save (never stores a version
with a wrong/blank checksum) rather than corrupting the manifest.
- **Graceful degradation:** with no registry creds (`web.SetGiteaClient` not wired) the form falls back
to the previous manual text-entry path. `main.go` enables the Gitea browser when `REGISTRY_USERNAME`
/`REGISTRY_TOKEN` are set.
- `go build`/`vet`/`test ./...` clean.
## v0.28.0 — global settings → Configuration tab + online setup command (2026-07-01)
Three operator-requested improvements (companion: host-install script v1.2.0).