diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/_jellyfin-try1-stale-fixture/MV-jellyfin.log b/documentation/audits/security-app-updates-2026-10-27/bench/_jellyfin-try1-stale-fixture/MV-jellyfin.log new file mode 100644 index 00000000..a0796eed --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/_jellyfin-try1-stale-fixture/MV-jellyfin.log @@ -0,0 +1,36 @@ +[13:38:56] scratch drive folders cleared before FROM (R-656): ['/srv/felhom-gate/hdd/userdata/media'] +[13:38:56] MV-jellyfin: deploying jellyfin at FROM {'jellyfin': 'jellyfin/jellyfin:10.11.11'} +[13:39:32] FROM settled=True in 31.1s :: {"jellyfin": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:39:32] fixture: the BOX walk's own (Jellyfin), through upgrade_boxport +[13:39:32] jellyfin: /Startup/User -> 404 {"type":"https://tools.ietf.org/html/rfc9110#section-15.5.5","title":"Not Found","status":404,"traceId":"00-bc4cffd8dd479b1332eb6d2678a71ddc-1181512ad +[13:39:32] INCONCLUSIVE — no non-browser seed route. Nothing was planted by hand. +{ + "harness_version": 5, + "edge": "MV-jellyfin", + "app": "jellyfin", + "note": "night 2026-09-23 within-a-major move: jellyfin=jellyfin/jellyfin:12.4", + "from": { + "jellyfin": "jellyfin/jellyfin:10.11.11" + }, + "to": { + "jellyfin": "jellyfin/jellyfin:12.4" + }, + "verdict": "inconclusive", + "seed_read_before": false, + "seed_read_after": false, + "healthy_after": false, + "migration_observed": null, + "abort": "not-attempted", + "abort_detail": "no non-browser seed route \u2014 tried: POST /Startup/User -> 404 {\"type\":\"https://tools.ietf.org/html/rfc9110#section-15.5.5\",\"title\":\"Not Found\",\"status\":404,\"traceId\":\"00-bc4cffd8dd479b1332eb6d2678a71ddc-1181512ad", + "engine_state_after": null, + "memory": null, + "marks": [], + "bench_overrides": null, + "duration_s": 36.4, + "measured_at": "2026-10-27T13:39:32Z", + "evidence": "evidence/MV-jellyfin", + "scratch_cleared": [ + "/srv/felhom-gate/hdd/userdata/media" + ], + "total_s": 36.4 +} diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/_jellyfin-try1-stale-fixture/evidence/MV-jellyfin/compose-final.log b/documentation/audits/security-app-updates-2026-10-27/bench/_jellyfin-try1-stale-fixture/evidence/MV-jellyfin/compose-final.log new file mode 100644 index 00000000..898c34b0 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/_jellyfin-try1-stale-fixture/evidence/MV-jellyfin/compose-final.log @@ -0,0 +1,213 @@ +jellyfin | [felhom] network.xml seeded: KnownProxies 172.16.0.0/12 (R-777) +jellyfin | [14:39:02] [INF] [4] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:39:02] [INF] [6] Jellyfin.Server.ServerSetupApp.SetupServer: Kestrel is listening on 0.0.0.0 +jellyfin | [14:39:02] [INF] [6] Main: Jellyfin version: 10.11.11 +jellyfin | [14:39:02] [INF] [6] Main: Environment Variables: ["[JELLYFIN_CACHE_DIR, /cache]", "[JELLYFIN_DATA_DIR, /config]", "[JELLYFIN_LOG_DIR, /config/log]", "[JELLYFIN_CONFIG_DIR, /config/config]", "[JELLYFIN_FFMPEG, /usr/lib/jellyfin-ffmpeg/ffmpeg]", "[JELLYFIN_WEB_DIR, /jellyfin/jellyfin-web]"] +jellyfin | [14:39:02] [INF] [6] Main: Arguments: ["/jellyfin/jellyfin.dll"] +jellyfin | [14:39:02] [INF] [6] Main: Operating system: Debian GNU/Linux 13 (trixie) +jellyfin | [14:39:02] [INF] [6] Main: Architecture: X64 +jellyfin | [14:39:02] [INF] [6] Main: 64-Bit Process: True +jellyfin | [14:39:02] [INF] [6] Main: User Interactive: True +jellyfin | [14:39:02] [INF] [6] Main: Processor count: 6 +jellyfin | [14:39:02] [INF] [6] Main: Program data path: /config +jellyfin | [14:39:02] [INF] [6] Main: Log directory path: /config/log +jellyfin | [14:39:02] [INF] [6] Main: Config directory path: /config/config +jellyfin | [14:39:02] [INF] [6] Main: Cache path: /cache +jellyfin | [14:39:02] [INF] [6] Main: Temp directory path: /tmp/jellyfin +jellyfin | [14:39:02] [INF] [6] Main: Web resources path: /jellyfin/jellyfin-web +jellyfin | [14:39:02] [INF] [6] Main: Application directory: /jellyfin/ +jellyfin | [14:39:02] [INF] [6] Jellyfin.Server.Startup: Storage path `/config/data` (Fixed) successfully checked with 42GiB free which is over the minimum of 2GiB. +jellyfin | [14:39:02] [INF] [6] Jellyfin.Server.Startup: Storage path `/cache` (Fixed) successfully checked with 42GiB free which is over the minimum of 2GiB. +jellyfin | [14:39:02] [INF] [6] Jellyfin.Server.Startup: Storage path `/config` (Fixed) successfully checked with 42GiB free which is over the minimum of 2GiB. +jellyfin | [14:39:02] [INF] [6] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:39:03] [INF] [6] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: SQLite connection string: Data Source=/config/data/jellyfin.db;Cache=Default;Default Timeout=30;Pooling=True +jellyfin | [14:39:03] [INF] [6] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: SQLITE connection pragma command set to: +jellyfin | PRAGMA locking_mode=NORMAL; +jellyfin | PRAGMA journal_size_limit=134217728; +jellyfin | PRAGMA synchronous=1; +jellyfin | PRAGMA temp_store=2; +jellyfin | +jellyfin | [14:39:03] [INF] [6] Jellyfin.Database.Implementations.Locking.NoLockBehavior: The database locking mode has been set to: NoLock. +jellyfin | [14:39:03] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Initialise Migration service. +jellyfin | [14:39:03] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: System initialisation detected. Seed data. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration null-UpdateNormalizedUsername. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration null-CleanMusicArtist. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration ef103419-8451-40d8-9f34-d1a8e93a1679-CreateUserLoggingConfigFile. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration 4124c2cd-e939-4ffb-9be9-9b311c413638-DisableTranscodingThrottling. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration cf6fabc2-9fbe-4933-84a5-ffe52ef22a58-FixAudioData. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration null-FixDates. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration null-FixLibrarySubtitleDownloadLanguages. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration 615dfa9e-2497-4dbb-a472-61938b752c5b-FixPlaylistOwner. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration 3793eb59-bc8c-456c-8b9f-bd5a62a42978-MigrateActivityLogDb. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration 5bd72f41-e6f3-4f60-90aa-09869abe0e22-MigrateAuthenticationDb. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration 06387815-c3cc-421f-a888-fb5f9992bea8-MigrateDisplayPreferencesDb. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration null-MigrateKeyframeData. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration null-MigrateLibraryDb. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration null-MigrateLibraryDbCompatibilityCheck. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration null-MigrateLibraryUserData. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration null-MigrateRatingLevels. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration 5c4b82a2-f053-4009-bd05-b6fcad82f14c-MigrateUserDb. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration null-MoveExtractedFiles. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration null-RefreshInternalDateModified. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration a81f75e0-8f43-416f-a5e8-516ccab4d8cc-RemoveDownloadImagesInAdvance. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration acbe17b7-8435-4a83-8b64-6fcf162cb9bd-RemoveDuplicateExtras. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration 96c156a2-7a13-4b3b-a8b8-fb80c94d20c0-RemoveDuplicatePlaylistChildren. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration null-ReseedFolderFlag. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration 9b354818-94d5-4b68-ac49-e35cb85f9d84-CreateNetworkConfiguration. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration a8e61960-7726-4450-8f3d-82c12daabbcb-MigrateEncodingOptions. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration a6dcacf4-c057-4ef9-80d3-61cef9ddb4f0-MigrateMusicBrainzTimeout. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration 4fb5c950-1991-11ee-9b4b-0800200c9a66-MigrateNetworkConfiguration. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Seed migration e73b777d-cd5c-4e71-957a-b86b3660b7cf-RenameEnableGroupingIntoCollections. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: Migration system initialisation completed. +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: There are 0 migrations for stage PreInitialisation. +jellyfin | [14:39:06] [INF] [6] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:39:06] [INF] [6] Emby.Server.Implementations.ApplicationHost: Loading assemblies +jellyfin | [14:39:06] [INF] [6] Jellyfin.Networking.Manager.NetworkManager: Defined LAN subnets: ["127.0.0.1/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"] +jellyfin | [14:39:06] [INF] [6] Jellyfin.Networking.Manager.NetworkManager: Defined LAN exclusions: [] +jellyfin | [14:39:06] [INF] [6] Jellyfin.Networking.Manager.NetworkManager: Used LAN subnets: ["127.0.0.1/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"] +jellyfin | [14:39:06] [INF] [6] Jellyfin.Networking.Manager.NetworkManager: Filtered interface addresses: ["127.0.0.1", "172.18.0.2"] +jellyfin | [14:39:06] [INF] [6] Jellyfin.Networking.Manager.NetworkManager: Bind Addresses ["0.0.0.0"] +jellyfin | [14:39:06] [INF] [6] Jellyfin.Networking.Manager.NetworkManager: Remote IP filter is Allowlist +jellyfin | [14:39:06] [INF] [6] Jellyfin.Networking.Manager.NetworkManager: Filtered subnets: [] +jellyfin | [14:39:06] [INF] [6] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: SQLite connection string: Data Source=/config/data/jellyfin.db;Cache=Default;Default Timeout=30;Pooling=True +jellyfin | [14:39:06] [INF] [6] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: SQLITE connection pragma command set to: +jellyfin | PRAGMA locking_mode=NORMAL; +jellyfin | PRAGMA journal_size_limit=134217728; +jellyfin | PRAGMA synchronous=1; +jellyfin | PRAGMA temp_store=2; +jellyfin | +jellyfin | [14:39:06] [INF] [6] Jellyfin.Database.Implementations.Locking.NoLockBehavior: The database locking mode has been set to: NoLock. +jellyfin | [14:39:06] [INF] [6] Main: Prepare system for possible migrations +jellyfin | [14:39:06] [INF] [6] Main: A migration will attempt to modify the jellyfin.db, will attempt to backup the file now. +jellyfin | [14:39:06] [INF] [6] Main: Jellyfin database has been backed up as 20261027013906 +jellyfin | [14:39:06] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: There are 0 migrations for stage CoreInitialisation. +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Perform migration 20200514181226_AddActivityLog +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Migration 20200514181226_AddActivityLog was successfully applied +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Perform migration 20200613202153_AddUsers +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Migration 20200613202153_AddUsers was successfully applied +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Perform migration 20200728005145_AddDisplayPreferences +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Migration 20200728005145_AddDisplayPreferences was successfully applied +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Perform migration 20200905220533_FixDisplayPreferencesIndex +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Migration 20200905220533_FixDisplayPreferencesIndex was successfully applied +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Perform migration 20201004171403_AddMaxActiveSessions +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Migration 20201004171403_AddMaxActiveSessions was successfully applied +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Perform migration 20201204223655_AddCustomDisplayPreferences +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Migration 20201204223655_AddCustomDisplayPreferences was successfully applied +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Perform migration 20210320181425_AddIndexesAndCollations +jellyfin | [14:39:06] [WRN] [6] Microsoft.EntityFrameworkCore.Migrations: An operation of type 'SqlOperation' will be attempted while a rebuild of table 'ImageInfos' is pending. The database may not be in an expected state. Review the SQL generated by this migration to help diagnose any failures. Consider moving these operations to a subsequent migration. +jellyfin | [14:39:06] [WRN] [6] Microsoft.EntityFrameworkCore.Migrations: An operation of type 'SqlOperation' will be attempted while a rebuild of table 'ImageInfos' is pending. The database may not be in an expected state. Review the SQL generated by this migration to help diagnose any failures. Consider moving these operations to a subsequent migration. +jellyfin | [14:39:06] [WRN] [6] Microsoft.EntityFrameworkCore.Migrations: An operation of type 'SqlOperation' will be attempted while a rebuild of table 'Permissions' is pending. The database may not be in an expected state. Review the SQL generated by this migration to help diagnose any failures. Consider moving these operations to a subsequent migration. +jellyfin | [14:39:06] [WRN] [6] Microsoft.EntityFrameworkCore.Migrations: An operation of type 'SqlOperation' will be attempted while a rebuild of table 'Permissions' is pending. The database may not be in an expected state. Review the SQL generated by this migration to help diagnose any failures. Consider moving these operations to a subsequent migration. +jellyfin | [14:39:06] [WRN] [6] Microsoft.EntityFrameworkCore.Migrations: An operation of type 'SqlOperation' will be attempted while a rebuild of table 'Preferences' is pending. The database may not be in an expected state. Review the SQL generated by this migration to help diagnose any failures. Consider moving these operations to a subsequent migration. +jellyfin | [14:39:06] [WRN] [6] Microsoft.EntityFrameworkCore.Migrations: An operation of type 'SqlOperation' will be attempted while a rebuild of table 'Preferences' is pending. The database may not be in an expected state. Review the SQL generated by this migration to help diagnose any failures. Consider moving these operations to a subsequent migration. +jellyfin | [14:39:06] [WRN] [6] Microsoft.EntityFrameworkCore.Migrations: An operation of type 'SqlOperation' will be attempted while a rebuild of table 'Users' is pending. The database may not be in an expected state. Review the SQL generated by this migration to help diagnose any failures. Consider moving these operations to a subsequent migration. +jellyfin | [14:39:06] [WRN] [6] Microsoft.EntityFrameworkCore.Migrations: An operation of type 'SqlOperation' will be attempted while a rebuild of table 'Users' is pending. The database may not be in an expected state. Review the SQL generated by this migration to help diagnose any failures. Consider moving these operations to a subsequent migration. +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Migration 20210320181425_AddIndexesAndCollations was successfully applied +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Perform migration 20210407110544_NullableCustomPrefValue +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Migration 20210407110544_NullableCustomPrefValue was successfully applied +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Perform migration 20210814002109_AddDevices +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Migration 20210814002109_AddDevices was successfully applied +jellyfin | [14:39:06] [INF] [6] InternalDatabaseMigration: Perform migration 20221022080052_AddIndexActivityLogsDateCreated +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20221022080052_AddIndexActivityLogsDateCreated was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20230526173516_RemoveEasyPassword +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20230526173516_RemoveEasyPassword was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20230626233818_AddTrickplayInfos +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20230626233818_AddTrickplayInfos was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20230923170422_UserCastReceiver +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20230923170422_UserCastReceiver was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20240729140605_AddMediaSegments +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20240729140605_AddMediaSegments was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20240928082930_MarkSegmentProviderIdNonNullable +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20240928082930_MarkSegmentProviderIdNonNullable was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20241020103111_LibraryDbMigration +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20241020103111_LibraryDbMigration was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20241111131257_AddedCustomDataKey +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20241111131257_AddedCustomDataKey was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20241111135439_AddedCustomDataKeyKey +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20241111135439_AddedCustomDataKeyKey was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20241112152323_FixAncestorIdConfig +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20241112152323_FixAncestorIdConfig was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20241112232041_FixMediaStreams +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20241112232041_FixMediaStreams was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20241112234144_FixMediaStreams2 +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20241112234144_FixMediaStreams2 was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20241113133548_EnforceUniqueItemValue +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20241113133548_EnforceUniqueItemValue was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20250202021306_FixedCollation +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20250202021306_FixedCollation was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20250204092455_MakeStartEndDateNullable +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Migration 20250204092455_MakeStartEndDateNullable was successfully applied +jellyfin | [14:39:07] [INF] [6] InternalDatabaseMigration: Perform migration 20250214031148_ChannelIdGuid +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20250214031148_ChannelIdGuid was successfully applied +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Perform migration 20250326065026_AddInheritedParentalRatingSubValue +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20250326065026_AddInheritedParentalRatingSubValue was successfully applied +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Perform migration 20250327101120_AddKeyframeData +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20250327101120_AddKeyframeData was successfully applied +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Perform migration 20250327171413_AddHdr10PlusFlag +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20250327171413_AddHdr10PlusFlag was successfully applied +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Perform migration 20250331182844_FixAttachmentMigration +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20250331182844_FixAttachmentMigration was successfully applied +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Perform migration 20250401142247_FixAncestors +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20250401142247_FixAncestors was successfully applied +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Perform migration 20250405075612_FixItemValuesIndices +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20250405075612_FixItemValuesIndices was successfully applied +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Perform migration 20250609115616_DetachUserDataInsteadOfDelete +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20250609115616_DetachUserDataInsteadOfDelete was successfully applied +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Perform migration 20250622170802_BaseItemImageInfoDateModifiedNullable +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20250622170802_BaseItemImageInfoDateModifiedNullable was successfully applied +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Perform migration 20250714044826_ResetJournalMode +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20250714044826_ResetJournalMode was successfully applied +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Perform migration 20250913211637_AddProperParentChildRelationBaseItemWithCascade +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20250913211637_AddProperParentChildRelationBaseItemWithCascade was successfully applied +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Perform migration 20250925203415_ExtendPeopleMapKey +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20250925203415_ExtendPeopleMapKey was successfully applied +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Perform migration 20260522092303_AddNormalizedUsername +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20260522092303_AddNormalizedUsername was successfully applied +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Perform migration 20260524120336_AddUniqueNormalizedUsernameIndex +jellyfin | [14:39:08] [INF] [6] InternalDatabaseMigration: Migration 20260524120336_AddUniqueNormalizedUsernameIndex was successfully applied +jellyfin | [14:39:09] [INF] [6] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Saving system configuration +jellyfin | [14:39:09] [INF] [6] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:39:10] [INF] [6] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: TMDb 10.11.11.0 +jellyfin | [14:39:10] [INF] [6] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: Studio Images 10.11.11.0 +jellyfin | [14:39:10] [INF] [6] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: OMDb 10.11.11.0 +jellyfin | [14:39:10] [INF] [6] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: MusicBrainz 10.11.11.0 +jellyfin | [14:39:10] [INF] [6] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: AudioDB 10.11.11.0 +jellyfin | [14:39:10] [INF] [6] Jellyfin.Server.Migrations.JellyfinMigrationService: There are 5 migrations for stage AppInitialisation. +jellyfin | [14:39:10] [INF] [6] InternalCodeMigration: Perform migration 20250420090000_AddDefaultPluginRepository +jellyfin | [14:39:10] [INF] [6] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Saving system configuration +jellyfin | [14:39:10] [INF] [6] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:39:10] [INF] [6] InternalCodeMigration: Migration 20250420090000_AddDefaultPluginRepository was successfully applied +jellyfin | [14:39:10] [INF] [6] InternalCodeMigration: Perform migration 20250420110000_ReaddDefaultPluginRepository +jellyfin | [14:39:10] [INF] [6] InternalCodeMigration: Migration 20250420110000_ReaddDefaultPluginRepository was successfully applied +jellyfin | [14:39:10] [INF] [6] InternalCodeMigration: Perform migration 20250420160000_AddDefaultCastReceivers +jellyfin | [14:39:10] [INF] [6] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Saving system configuration +jellyfin | [14:39:10] [INF] [6] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:39:10] [INF] [6] InternalCodeMigration: Migration 20250420160000_AddDefaultCastReceivers was successfully applied +jellyfin | [14:39:10] [INF] [6] InternalCodeMigration: Perform migration 20250420170000_UpdateDefaultPluginRepository +jellyfin | [14:39:10] [INF] [6] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Saving system configuration +jellyfin | [14:39:10] [INF] [6] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:39:10] [INF] [6] InternalCodeMigration: Migration 20250420170000_UpdateDefaultPluginRepository was successfully applied +jellyfin | [14:39:10] [INF] [6] InternalCodeMigration: Perform migration 20250420230000_MoveTrickplayFiles +jellyfin | [14:39:10] [INF] [6] Jellyfin.Server.Migrations.Routines.MoveTrickplayFiles: Checked: 5000 - Moved: 0 - Time: 00:00:00.7942551 +jellyfin | [14:39:10] [INF] [6] Jellyfin.Server.Migrations.Routines.MoveTrickplayFiles: Moved 0 items in 00:00:00.7958083 +jellyfin | [14:39:10] [INF] [6] InternalCodeMigration: Migration 20250420230000_MoveTrickplayFiles was successfully applied +jellyfin | [14:39:10] [INF] [6] Main: Attempt to cleanup JellyfinDb backup. +jellyfin | [14:39:11] [INF] [6] Main: Kestrel is listening on 0.0.0.0 +jellyfin | [14:39:11] [WRN] [4] Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager: No XML encryptor configured. Key {a96c7bee-e1e8-4835-8f47-0444b603fc1c} may be persisted to storage in unencrypted form. +jellyfin | [14:39:12] [WRN] [6] Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware: The WebRootPath was not found: /wwwroot. Static files may be unavailable. +jellyfin | [14:39:13] [INF] [6] Emby.Server.Implementations.ApplicationHost: Running startup tasks +jellyfin | [14:39:13] [INF] [6] Emby.Server.Implementations.ScheduledTasks.TaskManager: Daily trigger for Generate Trickplay Images set to fire at 2026-10-28 03:00:00.000 +01:00, which is 12:20:46.2859285 from now. +jellyfin | [14:39:13] [INF] [6] Emby.Server.Implementations.ScheduledTasks.TaskManager: Daily trigger for Extract Chapter Images set to fire at 2026-10-28 02:00:00.000 +01:00, which is 11:20:46.2802212 from now. +jellyfin | [14:39:14] [INF] [6] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Found ffmpeg version 7.1.4 +jellyfin | [14:39:16] [INF] [4] Emby.Server.Implementations.ScheduledTasks.TaskManager: Clean Transcode Directory Completed after 0 minute(s) and 0 seconds +jellyfin | [14:39:16] [INF] [10] Emby.Server.Implementations.ScheduledTasks.TaskManager: Clean up collections and playlists Completed after 0 minute(s) and 0 seconds +jellyfin | [14:39:17] [INF] [6] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available decoders: ["libdav1d", "av1", "av1_cuvid", "av1_qsv", "h264", "h264_qsv", "h264_cuvid", "hevc", "hevc_qsv", "hevc_cuvid", "mpeg2video", "mpeg2_qsv", "mpeg2_cuvid", "mpeg4", "mpeg4_cuvid", "msmpeg4", "vc1_qsv", "vc1_cuvid", "vp8", "libvpx", "vp8_cuvid", "vp8_qsv", "vp9", "libvpx-vp9", "vp9_cuvid", "vp9_qsv", "aac", "ac3", "ac4", "dca", "flac", "mp3", "truehd"] +jellyfin | [14:39:17] [INF] [6] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available encoders: ["libsvtav1", "av1_nvenc", "av1_qsv", "av1_amf", "av1_vaapi", "libx264", "h264_amf", "h264_nvenc", "h264_qsv", "h264_v4l2m2m", "h264_vaapi", "libx265", "hevc_amf", "hevc_nvenc", "hevc_qsv", "hevc_vaapi", "mjpeg_qsv", "mjpeg_vaapi", "aac", "libfdk_aac", "ac3", "alac", "dca", "flac", "libmp3lame", "libopus", "truehd", "libvorbis", "srt"] +jellyfin | [14:39:17] [INF] [6] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available filters: ["bwdif_cuda", "bwdif_opencl", "deinterlace_qsv", "deinterlace_vaapi", "flip_vulkan", "hwupload_cuda", "hwupload_vaapi", "libplacebo", "overlay_opencl", "overlay_qsv", "overlay_vaapi", "overlay_vulkan", "overlay_cuda", "procamp_vaapi", "scale_cuda", "scale_opencl", "scale_qsv", "scale_vaapi", "scale_vulkan", "tonemapx", "tonemap_cuda", "tonemap_opencl", "tonemap_vaapi", "transpose_cuda", "transpose_opencl", "transpose_vaapi", "transpose_vulkan", "vpp_qsv", "yadif_cuda", "yadif_opencl", "zscale", "alphasrc"] +jellyfin | [14:39:17] [INF] [6] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available hwaccel types: ["cuda", "vaapi", "qsv", "drm", "opencl", "vulkan"] +jellyfin | [14:39:18] [INF] [11] Emby.Server.Implementations.ScheduledTasks.TaskManager: Update Plugins Completed after 0 minute(s) and 1 seconds +jellyfin | [14:39:21] [INF] [6] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: FFmpeg: /usr/lib/jellyfin-ffmpeg/ffmpeg +jellyfin | [14:39:21] [INF] [6] Emby.Server.Implementations.ApplicationHost: ServerId: e4f9236432a24c39b8cdc71c8673c442 +jellyfin | [14:39:21] [INF] [6] Emby.Server.Implementations.ApplicationHost: Core startup complete +jellyfin | [14:39:21] [INF] [6] Main: Startup complete 0:00:19.7129337 +jellyfin | [14:39:32] [WRN] [11] Microsoft.EntityFrameworkCore.Query: The query uses the 'First'/'FirstOrDefault' operator without 'OrderBy' and filter operators. This may lead to unpredictable results. diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/_jellyfin-try1-stale-fixture/evidence/MV-jellyfin/run.log b/documentation/audits/security-app-updates-2026-10-27/bench/_jellyfin-try1-stale-fixture/evidence/MV-jellyfin/run.log new file mode 100644 index 00000000..fa656aad --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/_jellyfin-try1-stale-fixture/evidence/MV-jellyfin/run.log @@ -0,0 +1,6 @@ +[13:38:56] scratch drive folders cleared before FROM (R-656): ['/srv/felhom-gate/hdd/userdata/media'] +[13:38:56] MV-jellyfin: deploying jellyfin at FROM {'jellyfin': 'jellyfin/jellyfin:10.11.11'} +[13:39:32] FROM settled=True in 31.1s :: {"jellyfin": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:39:32] fixture: the BOX walk's own (Jellyfin), through upgrade_boxport +[13:39:32] jellyfin: /Startup/User -> 404 {"type":"https://tools.ietf.org/html/rfc9110#section-15.5.5","title":"Not Found","status":404,"traceId":"00-bc4cffd8dd479b1332eb6d2678a71ddc-1181512ad +[13:39:32] INCONCLUSIVE — no non-browser seed route. Nothing was planted by hand. \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/_jellyfin-try1-stale-fixture/evidence/MV-jellyfin/verdict.json b/documentation/audits/security-app-updates-2026-10-27/bench/_jellyfin-try1-stale-fixture/evidence/MV-jellyfin/verdict.json new file mode 100644 index 00000000..955bd07e --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/_jellyfin-try1-stale-fixture/evidence/MV-jellyfin/verdict.json @@ -0,0 +1,30 @@ +{ + "harness_version": 5, + "edge": "MV-jellyfin", + "app": "jellyfin", + "note": "night 2026-09-23 within-a-major move: jellyfin=jellyfin/jellyfin:12.4", + "from": { + "jellyfin": "jellyfin/jellyfin:10.11.11" + }, + "to": { + "jellyfin": "jellyfin/jellyfin:12.4" + }, + "verdict": "inconclusive", + "seed_read_before": false, + "seed_read_after": false, + "healthy_after": false, + "migration_observed": null, + "abort": "not-attempted", + "abort_detail": "no non-browser seed route \u2014 tried: POST /Startup/User -> 404 {\"type\":\"https://tools.ietf.org/html/rfc9110#section-15.5.5\",\"title\":\"Not Found\",\"status\":404,\"traceId\":\"00-bc4cffd8dd479b1332eb6d2678a71ddc-1181512ad", + "engine_state_after": null, + "memory": null, + "marks": [], + "bench_overrides": null, + "duration_s": 36.4, + "measured_at": "2026-10-27T13:39:32Z", + "evidence": "evidence/MV-jellyfin", + "scratch_cleared": [ + "/srv/felhom-gate/hdd/userdata/media" + ], + "total_s": 36.4 +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/MV-bookstack.log b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/MV-bookstack.log new file mode 100644 index 00000000..8cba31df --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/MV-bookstack.log @@ -0,0 +1,135 @@ +[13:25:18] scratch drive folders cleared before FROM (R-656): none existed +[13:25:18] MV-bookstack: deploying bookstack at FROM {'bookstack': 'lscr.io/linuxserver/bookstack:26.09.1', 'bookstack-db': 'mariadb:12.3'} +[13:26:25] FROM settled=True in 31.1s :: {"bookstack": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}, "bookstack-db": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:26:26] bookstack: artisan create-admin rc=0 :: Admin account with email "spike-77c1b4dd@gate.invalid" successfully created! +[13:26:27] bookstack: readback of the seeded account found=True :: This will delete any configure multi-factor authentication methods for user: - ID: 3 - Name: spike-023492 - Email: spike +[13:26:27] C1 (seed reads back BEFORE): True +[13:26:27] MV-bookstack: swapping to TO {'bookstack': 'lscr.io/linuxserver/bookstack:26.09.2', 'bookstack-db': 'mariadb:12.3'} +[13:26:59] TO up -d rc=0 +[13:27:30] TO settled=True in 31.1s :: {"bookstack": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}, "bookstack-db": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:27:31] engine state bookstack-db: 12.3.3-MariaDB| This installation of MariaDB is already upgraded to 12.3.3-MariaDB. There is no need to run mariadb-upgrade again. [exit=1] +[13:27:31] migration lines observed: 5 +[13:27:32] bookstack: readback of the seeded account found=True :: This will delete any configure multi-factor authentication methods for user: - ID: 3 - Name: spike-023492 - Email: spike +[13:27:32] RESULT (seed reads back AFTER): True +[13:27:32] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:80 +[13:27:47] + 15s bookstack=59M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=268 +[13:28:02] + 30s bookstack=62M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=534 +[13:28:18] + 46s bookstack=62M/512M peak=90M kills=0 rs=0 bookstack-db=171M/256M peak=177M kills=0 rs=0 reqs=804 +[13:28:33] + 61s bookstack=66M/512M peak=90M kills=0 rs=0 bookstack-db=171M/256M peak=177M kills=0 rs=0 reqs=1074 +[13:28:48] + 76s bookstack=68M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=1340 +[13:29:03] + 91s bookstack=71M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=1607 +[13:29:18] + 106s bookstack=72M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=1875 +[13:29:33] + 121s bookstack=74M/512M peak=90M kills=0 rs=0 bookstack-db=171M/256M peak=177M kills=0 rs=0 reqs=2142 +[13:29:49] + 136s bookstack=77M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=2411 +[13:30:04] + 152s bookstack=79M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=2677 +[13:30:19] + 167s bookstack=81M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=2944 +[13:30:34] + 182s bookstack=85M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=3208 +[13:30:49] + 197s bookstack=87M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=3475 +[13:31:04] + 212s bookstack=89M/512M peak=94M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=3743 +[13:31:19] + 227s bookstack=91M/512M peak=94M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=4009 +[13:31:35] + 242s bookstack=94M/512M peak=96M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=4273 +[13:31:50] + 258s bookstack=97M/512M peak=97M kills=0 rs=0 bookstack-db=171M/256M peak=177M kills=0 rs=0 reqs=4536 +[13:32:05] + 273s bookstack=99M/512M peak=100M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=4801 +[13:32:20] + 288s bookstack=102M/512M peak=103M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=5065 +[13:32:35] + 303s bookstack=104M/512M peak=106M kills=0 rs=0 bookstack-db=171M/256M peak=177M kills=0 rs=0 reqs=5328 +[13:32:50] + 318s bookstack=107M/512M peak=108M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=5592 +[13:33:06] + 334s bookstack=109M/512M peak=111M kills=0 rs=0 bookstack-db=171M/256M peak=177M kills=0 rs=0 reqs=5858 +[13:33:21] + 349s bookstack=115M/512M peak=119M kills=0 rs=0 bookstack-db=167M/256M peak=177M kills=0 rs=0 reqs=6079 +[13:33:36] + 364s bookstack=114M/512M peak=119M kills=0 rs=0 bookstack-db=167M/256M peak=177M kills=0 rs=0 reqs=6344 +[13:33:51] + 379s bookstack=117M/512M peak=119M kills=0 rs=0 bookstack-db=166M/256M peak=177M kills=0 rs=0 reqs=6611 +[13:34:06] + 394s bookstack=120M/512M peak=121M kills=0 rs=0 bookstack-db=166M/256M peak=177M kills=0 rs=0 reqs=6872 +[13:34:21] + 409s bookstack=123M/512M peak=126M kills=0 rs=0 bookstack-db=166M/256M peak=177M kills=0 rs=0 reqs=7140 +[13:34:37] + 424s bookstack=126M/512M peak=127M kills=0 rs=0 bookstack-db=165M/256M peak=177M kills=0 rs=0 reqs=7405 +[13:34:52] + 440s bookstack=129M/512M peak=129M kills=0 rs=0 bookstack-db=142M/256M peak=177M kills=0 rs=0 reqs=7685 +[13:35:08] + 456s bookstack=133M/512M peak=133M kills=0 rs=0 bookstack-db=140M/256M peak=177M kills=0 rs=0 reqs=7947 +[13:35:23] + 471s bookstack=135M/512M peak=136M kills=0 rs=0 bookstack-db=139M/256M peak=177M kills=0 rs=0 reqs=8203 +[13:35:38] + 486s bookstack=137M/512M peak=139M kills=0 rs=0 bookstack-db=135M/256M peak=177M kills=0 rs=0 reqs=8470 +[13:35:53] + 501s bookstack=141M/512M peak=141M kills=0 rs=0 bookstack-db=132M/256M peak=177M kills=0 rs=0 reqs=8733 +[13:36:09] + 516s bookstack=144M/512M peak=148M kills=0 rs=0 bookstack-db=132M/256M peak=177M kills=0 rs=0 reqs=8996 +[13:36:24] + 532s bookstack=147M/512M peak=148M kills=0 rs=0 bookstack-db=133M/256M peak=177M kills=0 rs=0 reqs=9261 +[13:36:39] + 547s bookstack=149M/512M peak=151M kills=0 rs=0 bookstack-db=132M/256M peak=177M kills=0 rs=0 reqs=9513 +[13:36:54] + 562s bookstack=153M/512M peak=153M kills=0 rs=0 bookstack-db=133M/256M peak=177M kills=0 rs=0 reqs=9774 +[13:37:09] + 577s bookstack=154M/512M peak=156M kills=0 rs=0 bookstack-db=132M/256M peak=177M kills=0 rs=0 reqs=10031 +[13:37:25] + 592s bookstack=158M/512M peak=162M kills=0 rs=0 bookstack-db=132M/256M peak=177M kills=0 rs=0 reqs=10288 +[13:37:40] + 608s bookstack=161M/512M peak=162M kills=0 rs=0 bookstack-db=132M/256M peak=177M kills=0 rs=0 reqs=10552 +[13:37:40] memory watch: killed=False tight=[] requests=10554 codes={'302': 10554} +[13:37:40] MV-bookstack: ABORT — putting the FROM images back +[13:38:17] bookstack: readback of the seeded account found=True :: This will delete any configure multi-factor authentication methods for user: - ID: 3 - Name: spike-023492 - Email: spike +[13:38:17] ABORT: app came back in 31.1s; data present=True +{ + "harness_version": 5, + "edge": "MV-bookstack", + "app": "bookstack", + "note": "night 2026-09-23 within-a-major move: bookstack=lscr.io/linuxserver/bookstack:26.09.2", + "from": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.1", + "bookstack-db": "mariadb:12.3" + }, + "to": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.2", + "bookstack-db": "mariadb:12.3" + }, + "verdict": "proven", + "seed_read_before": true, + "seed_read_after": true, + "healthy_after": true, + "migration_observed": "\u001b[2Kbookstack | [migrations] started", + "abort": "starts-and-serves", + "abort_detail": null, + "engine_state_after": { + "bookstack-db": { + "image": "mariadb:12.3", + "probe": "datadir version | the engine's own upgrade verdict", + "answer": "12.3.3-MariaDB| This installation of MariaDB is already upgraded to 12.3.3-MariaDB. There is no need to run mariadb-upgrade again. [exit=1]", + "probe_rc": 0 + } + }, + "memory": { + "soak_s": 608.0, + "requested_s": 600, + "requests": 10554, + "codes": { + "302": 10554 + }, + "first_kill": null, + "containers": { + "bookstack": { + "limit": 536870912, + "peak": 170106880, + "peak_pct": 0.317, + "anon_peak_sampled": 25456640, + "anon_peak_pct": 0.047, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + }, + "bookstack-db": { + "limit": 268435456, + "peak": 186318848, + "peak_pct": 0.694, + "anon_peak_sampled": 116486144, + "anon_peak_pct": 0.434, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + } + }, + "unmeasured": [], + "venue_swap_bytes": 0, + "load": "reached" + }, + "marks": [], + "bench_overrides": null, + "duration_s": 31.1, + "measured_at": "2026-10-27T13:38:17Z", + "evidence": "evidence/MV-bookstack", + "scratch_cleared": [], + "files_changed": [], + "files_changed_detail": [], + "files_ignored": [], + "total_s": 779.6 +} diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/abort-states.json b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/abort-states.json new file mode 100644 index 00000000..b910bf46 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/abort-states.json @@ -0,0 +1,14 @@ +{ + "bookstack": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + }, + "bookstack-db": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + } +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/compose-final.log b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/compose-final.log new file mode 100644 index 00000000..8a3d4de9 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/compose-final.log @@ -0,0 +1,119 @@ +bookstack | [migrations] started +bookstack | [migrations] 01-nginx-site-confs-default: skipped +bookstack | [migrations] 02-default-location: skipped +bookstack | [migrations] done +bookstack | ─────────────────────────────────────── +bookstack | +bookstack | ██╗ ███████╗██╗ ██████╗ +bookstack | ██║ ██╔════╝██║██╔═══██╗ +bookstack | ██║ ███████╗██║██║ ██║ +bookstack | ██║ ╚════██║██║██║ ██║ +bookstack | ███████╗███████║██║╚██████╔╝ +bookstack | ╚══════╝╚══════╝╚═╝ ╚═════╝ +bookstack | +bookstack | Brought to you by linuxserver.io +bookstack | ─────────────────────────────────────── +bookstack | +bookstack | To support the app dev(s) visit: +bookstack | Bookstack: https://www.bookstackapp.com/donate/ +bookstack | +bookstack | To support LSIO projects visit: +bookstack | https://www.linuxserver.io/donate/ +bookstack | +bookstack | ─────────────────────────────────────── +bookstack | GID/UID +bookstack | ─────────────────────────────────────── +bookstack | +bookstack | User UID: 1000 +bookstack | User GID: 1000 +bookstack | ─────────────────────────────────────── +bookstack | Linuxserver.io version: v26.09.1-ls290 +bookstack | Build-date: 2026-10-20T00:22:39+00:00 +bookstack | ─────────────────────────────────────── +bookstack | +bookstack | using keys found in /config/keys +bookstack | Waiting for DB to be available +bookstack | +bookstack | INFO Nothing to migrate. +bookstack | +bookstack | [custom-init] No custom files found, skipping... +bookstack | [ls.io-init] done. +bookstack-db | 2026-10-27 14:25:43+01:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:12.3.3+maria~ubu2404 started. +bookstack-db | 2026-10-27 14:25:43+01:00 [Warn] [Entrypoint]: /sys/fs/cgroup///memory.pressure not writable, functionality unavailable to MariaDB +bookstack-db | 2026-10-27 14:25:43+01:00 [Note] [Entrypoint]: Switching to dedicated user 'mysql' +bookstack-db | 2026-10-27 14:25:43+01:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:12.3.3+maria~ubu2404 started. +bookstack-db | 2026-10-27 14:25:43+01:00 [Note] [Entrypoint]: Initializing database files +bookstack-db | 2026-10-27 14:25:44 0 [Warning] mariadbd: io_uring_queue_init() failed with EPERM: sysctl kernel.io_uring_disabled has the value 2, or 1 and the user of the process is not a member of sysctl kernel.io_uring_group. (see man 2 io_uring_setup). +bookstack-db | create_uring failed: falling back to libaio +bookstack-db | 2026-10-27 14:25:46+01:00 [Note] [Entrypoint]: Database files initialized +bookstack-db | 2026-10-27 14:25:46+01:00 [Note] [Entrypoint]: Starting temporary server +bookstack-db | 2026-10-27 14:25:46+01:00 [Note] [Entrypoint]: Waiting for server startup +bookstack-db | 2026-10-27 14:25:46 0 [Note] Starting MariaDB 12.3.3-MariaDB-ubu2404 source revision 83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e server_uid LZ5pYRSfMNmPrIPsQAN9Z/SoloA= as process 95 +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Compressed tables use zlib 1.3 +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Number of transaction pools: 1 +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Using crc32 + pclmulqdq instructions +bookstack-db | 2026-10-27 14:25:46 0 [Warning] mariadbd: io_uring_queue_init() failed with EPERM: sysctl kernel.io_uring_disabled has the value 2, or 1 and the user of the process is not a member of sysctl kernel.io_uring_group. (see man 2 io_uring_setup). +bookstack-db | create_uring failed: falling back to libaio +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Using Linux native AIO +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: innodb_buffer_pool_size_max=8388608m, innodb_buffer_pool_size=128m +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Completed initialization of buffer pool +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: File system buffers for log disabled (block size=512 bytes) +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: End of log at LSN=45568 +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Opened 3 undo tablespaces +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: 128 rollback segments in 3 undo tablespaces are active. +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Setting file './ibtmp1' size to 12.000MiB. Physically writing the file full; Please wait ... +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: File './ibtmp1' size is now 12.000MiB. +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: log sequence number 45568; transaction id 14 +bookstack-db | 2026-10-27 14:25:46 0 [Note] Plugin 'FEEDBACK' is disabled. +bookstack-db | 2026-10-27 14:25:46 0 [Note] Plugin 'wsrep-provider' is disabled. +bookstack-db | 2026-10-27 14:25:48 0 [Note] mariadbd: Event Scheduler: Loaded 0 events +bookstack-db | 2026-10-27 14:25:48 0 [Note] Replication not automatically started: --skip-slave-start was specified +bookstack-db | 2026-10-27 14:25:48 0 [Note] mariadbd: ready for connections. +bookstack-db | Version: '12.3.3-MariaDB-ubu2404' socket: '/run/mysqld/mysqld.sock' port: 0 mariadb.org binary distribution +bookstack-db | 2026-10-27 14:25:48+01:00 [Note] [Entrypoint]: Temporary server started. +bookstack-db | 2026-10-27 14:25:49+01:00 [Note] [Entrypoint]: Creating database bookstack +bookstack-db | 2026-10-27 14:25:49+01:00 [Note] [Entrypoint]: Creating user bookstack +bookstack-db | 2026-10-27 14:25:49+01:00 [Note] [Entrypoint]: Giving user bookstack access to schema bookstack +bookstack-db | 2026-10-27 14:25:49+01:00 [Note] [Entrypoint]: Securing system users (equivalent to running mysql_secure_installation) +bookstack-db | +bookstack-db | 2026-10-27 14:25:49+01:00 [Note] [Entrypoint]: Stopping temporary server +bookstack-db | 2026-10-27 14:25:49 0 [Note] mariadbd (initiated by: unknown): Normal shutdown +bookstack-db | 2026-10-27 14:25:49 0 [Note] InnoDB: FTS optimize thread exiting. +bookstack-db | 2026-10-27 14:25:49 0 [Note] InnoDB: Starting shutdown... +bookstack-db | 2026-10-27 14:25:49 0 [Note] InnoDB: Dumping buffer pool(s) to /var/lib/mysql/ib_buffer_pool +bookstack-db | 2026-10-27 14:25:49 0 [Note] InnoDB: Buffer pool(s) dump completed at 261027 14:25:49 +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Removed temporary tablespace data file: "./ibtmp1" +bookstack-db | 2026-10-27 14:25:50 0 [Note] Shutdown completed; log sequence number 45568; transaction id 15 +bookstack-db | 2026-10-27 14:25:50 0 [Note] mariadbd: Shutdown complete +bookstack-db | 2026-10-27 14:25:50+01:00 [Note] [Entrypoint]: Temporary server stopped +bookstack-db | +bookstack-db | 2026-10-27 14:25:50+01:00 [Note] [Entrypoint]: MariaDB init process done. Ready for start up. +bookstack-db | +bookstack-db | 2026-10-27 14:25:50 0 [Note] Starting MariaDB 12.3.3-MariaDB-ubu2404 source revision 83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e server_uid LZ5pYRSfMNmPrIPsQAN9Z/SoloA= as process 1 +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Compressed tables use zlib 1.3 +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Number of transaction pools: 1 +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Using crc32 + pclmulqdq instructions +bookstack-db | 2026-10-27 14:25:50 0 [Warning] mariadbd: io_uring_queue_init() failed with EPERM: sysctl kernel.io_uring_disabled has the value 2, or 1 and the user of the process is not a member of sysctl kernel.io_uring_group. (see man 2 io_uring_setup). +bookstack-db | create_uring failed: falling back to libaio +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Using Linux native AIO +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: innodb_buffer_pool_size_max=8388608m, innodb_buffer_pool_size=128m +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Completed initialization of buffer pool +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: File system buffers for log disabled (block size=512 bytes) +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: End of log at LSN=45568 +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Opened 3 undo tablespaces +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: 128 rollback segments in 3 undo tablespaces are active. +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Setting file './ibtmp1' size to 12.000MiB. Physically writing the file full; Please wait ... +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: File './ibtmp1' size is now 12.000MiB. +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: log sequence number 45568; transaction id 14 +bookstack-db | 2026-10-27 14:25:50 0 [Note] Plugin 'FEEDBACK' is disabled. +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool +bookstack-db | 2026-10-27 14:25:50 0 [Note] Plugin 'wsrep-provider' is disabled. +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Buffer pool(s) load completed at 261027 14:25:50 +bookstack-db | 2026-10-27 14:25:50 0 [Note] Server socket created on IP: '0.0.0.0', port: '3306'. +bookstack-db | 2026-10-27 14:25:50 0 [Note] Server socket created on IP: '::', port: '3306'. +bookstack-db | 2026-10-27 14:25:50 0 [Note] mariadbd: Event Scheduler: Loaded 0 events +bookstack-db | 2026-10-27 14:25:50 0 [Note] mariadbd: ready for connections. +bookstack-db | Version: '12.3.3-MariaDB-ubu2404' socket: '/run/mysqld/mysqld.sock' port: 3306 mariadb.org binary distribution +bookstack-db | 2026-10-27 14:25:57 5 [Warning] Aborted connection 5 to db: 'unconnected' user: 'unauthenticated' host: '172.20.0.3' (This connection closed normally without authentication) +bookstack-db | 2026-10-27 14:27:01 26 [Warning] Aborted connection 26 to db: 'unconnected' user: 'unauthenticated' host: '172.20.0.3' (This connection closed normally without authentication) +bookstack-db | 2026-10-27 14:37:47 10735 [Warning] Aborted connection 10735 to db: 'unconnected' user: 'unauthenticated' host: '172.20.0.3' (This connection closed normally without authentication) diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/engine-state.json b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/engine-state.json new file mode 100644 index 00000000..d437ae18 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/engine-state.json @@ -0,0 +1,8 @@ +{ + "bookstack-db": { + "image": "mariadb:12.3", + "probe": "datadir version | the engine's own upgrade verdict", + "answer": "12.3.3-MariaDB| This installation of MariaDB is already upgraded to 12.3.3-MariaDB. There is no need to run mariadb-upgrade again. [exit=1]", + "probe_rc": 0 + } +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/files-after-detail.json b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/files-after-detail.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/files-after-detail.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/files-after.json b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/files-after.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/files-after.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/files-before-detail.json b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/files-before-detail.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/files-before-detail.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/files-before.json b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/files-before.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/files-before.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/memory-samples.json b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/memory-samples.json new file mode 100644 index 00000000..831bc847 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/memory-samples.json @@ -0,0 +1,1282 @@ +[ + { + "t": 15.2, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 62205952, + "peak": 95129600, + "anon": 23363584, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180695040, + "peak": 186318848, + "anon": 116273152, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 268 + }, + { + "t": 30.3, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 65126400, + "peak": 95129600, + "anon": 23605248, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180908032, + "peak": 186318848, + "anon": 116277248, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 534 + }, + { + "t": 45.5, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 65970176, + "peak": 95129600, + "anon": 23273472, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 179974144, + "peak": 186318848, + "anon": 116281344, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 804 + }, + { + "t": 60.6, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 69865472, + "peak": 95129600, + "anon": 23289856, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180219904, + "peak": 186318848, + "anon": 116285440, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1074 + }, + { + "t": 75.8, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 71512064, + "peak": 95129600, + "anon": 23265280, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180469760, + "peak": 186318848, + "anon": 116285440, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1340 + }, + { + "t": 90.9, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 74637312, + "peak": 95129600, + "anon": 23265280, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180441088, + "peak": 186318848, + "anon": 116285440, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1607 + }, + { + "t": 106.1, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 76378112, + "peak": 95129600, + "anon": 23064576, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180744192, + "peak": 186318848, + "anon": 116305920, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1875 + }, + { + "t": 121.2, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 77991936, + "peak": 95129600, + "anon": 23072768, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 179974144, + "peak": 186318848, + "anon": 116305920, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2142 + }, + { + "t": 136.4, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 80879616, + "peak": 95129600, + "anon": 23089152, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180453376, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2411 + }, + { + "t": 151.6, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 83390464, + "peak": 95129600, + "anon": 23093248, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180740096, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2677 + }, + { + "t": 166.7, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 85250048, + "peak": 95129600, + "anon": 23080960, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180490240, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2944 + }, + { + "t": 181.9, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 89501696, + "peak": 95129600, + "anon": 23080960, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180719616, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3208 + }, + { + "t": 197.0, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 91938816, + "peak": 95129600, + "anon": 23093248, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180744192, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3475 + }, + { + "t": 212.2, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 93446144, + "peak": 98676736, + "anon": 22769664, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180690944, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3743 + }, + { + "t": 227.4, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 96464896, + "peak": 98676736, + "anon": 22810624, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180731904, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4009 + }, + { + "t": 242.5, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 98672640, + "peak": 100720640, + "anon": 22831104, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180961280, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4273 + }, + { + "t": 257.7, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 101920768, + "peak": 102699008, + "anon": 22843392, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 179978240, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4536 + }, + { + "t": 272.9, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 104673280, + "peak": 105349120, + "anon": 22847488, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180477952, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4801 + }, + { + "t": 288.0, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 107565056, + "peak": 108134400, + "anon": 22831104, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 181002240, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5065 + }, + { + "t": 303.2, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 110043136, + "peak": 111288320, + "anon": 22818816, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 179945472, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5328 + }, + { + "t": 318.3, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 113070080, + "peak": 113717248, + "anon": 22831104, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 180482048, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5592 + }, + { + "t": 333.5, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 115302400, + "peak": 117026816, + "anon": 22818816, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 179970048, + "peak": 186318848, + "anon": 116310016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5858 + }, + { + "t": 348.6, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 121315328, + "peak": 125476864, + "anon": 25456640, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 175841280, + "peak": 186318848, + "anon": 116416512, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6079 + }, + { + "t": 363.8, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 120377344, + "peak": 125476864, + "anon": 22614016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 175357952, + "peak": 186318848, + "anon": 116441088, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6344 + }, + { + "t": 379.0, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 123568128, + "peak": 125476864, + "anon": 22806528, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 174940160, + "peak": 186318848, + "anon": 116441088, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6611 + }, + { + "t": 394.1, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 126234624, + "peak": 127459328, + "anon": 22814720, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 174522368, + "peak": 186318848, + "anon": 116445184, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6872 + }, + { + "t": 409.3, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 129740800, + "peak": 132833280, + "anon": 22568960, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 175054848, + "peak": 186318848, + "anon": 116469760, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7140 + }, + { + "t": 424.4, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 132665344, + "peak": 133316608, + "anon": 22814720, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 174022656, + "peak": 186318848, + "anon": 116469760, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7405 + }, + { + "t": 440.3, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 135413760, + "peak": 135761920, + "anon": 22798336, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 149495808, + "peak": 186318848, + "anon": 116469760, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7685 + }, + { + "t": 455.5, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 140042240, + "peak": 140378112, + "anon": 22822912, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 147152896, + "peak": 186318848, + "anon": 116469760, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7947 + }, + { + "t": 470.6, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 142229504, + "peak": 142913536, + "anon": 22835200, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 146202624, + "peak": 186318848, + "anon": 116477952, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8203 + }, + { + "t": 485.8, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 144486400, + "peak": 145793024, + "anon": 22810624, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 142069760, + "peak": 186318848, + "anon": 116477952, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8470 + }, + { + "t": 501.1, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 147918848, + "peak": 148738048, + "anon": 22814720, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 139382784, + "peak": 186318848, + "anon": 116477952, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8733 + }, + { + "t": 516.4, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 151535616, + "peak": 155582464, + "anon": 22802432, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 139358208, + "peak": 186318848, + "anon": 116477952, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8996 + }, + { + "t": 531.6, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 155086848, + "peak": 155615232, + "anon": 22802432, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 139636736, + "peak": 186318848, + "anon": 116486144, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9261 + }, + { + "t": 546.9, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 156635136, + "peak": 158486528, + "anon": 22863872, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 138883072, + "peak": 186318848, + "anon": 116486144, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9513 + }, + { + "t": 562.1, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 160649216, + "peak": 161394688, + "anon": 22822912, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 139919360, + "peak": 186318848, + "anon": 116486144, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9774 + }, + { + "t": 577.2, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 162500608, + "peak": 164241408, + "anon": 22818816, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 139407360, + "peak": 186318848, + "anon": 116486144, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10031 + }, + { + "t": 592.5, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 166191104, + "peak": 170094592, + "anon": 22626304, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 139419648, + "peak": 186318848, + "anon": 116486144, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10288 + }, + { + "t": 607.6, + "containers": { + "bookstack": { + "limit": 536870912, + "current": 169345024, + "peak": 170106880, + "anon": 22806528, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "bookstack-db": { + "limit": 268435456, + "current": 139386880, + "peak": 186318848, + "anon": 116486144, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10552 + } +] \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/migration-lines.txt b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/migration-lines.txt new file mode 100644 index 00000000..ae593a40 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/migration-lines.txt @@ -0,0 +1,5 @@ +bookstack | [migrations] started +bookstack | [migrations] 01-nginx-site-confs-default: skipped +bookstack | [migrations] 02-default-location: skipped +bookstack | [migrations] done +bookstack | INFO Nothing to migrate. \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/run.log b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/run.log new file mode 100644 index 00000000..cf4a33ad --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/run.log @@ -0,0 +1,58 @@ +[13:25:18] scratch drive folders cleared before FROM (R-656): none existed +[13:25:18] MV-bookstack: deploying bookstack at FROM {'bookstack': 'lscr.io/linuxserver/bookstack:26.09.1', 'bookstack-db': 'mariadb:12.3'} +[13:26:25] FROM settled=True in 31.1s :: {"bookstack": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}, "bookstack-db": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:26:26] bookstack: artisan create-admin rc=0 :: Admin account with email "spike-77c1b4dd@gate.invalid" successfully created! +[13:26:27] bookstack: readback of the seeded account found=True :: This will delete any configure multi-factor authentication methods for user: - ID: 3 - Name: spike-023492 - Email: spike +[13:26:27] C1 (seed reads back BEFORE): True +[13:26:27] MV-bookstack: swapping to TO {'bookstack': 'lscr.io/linuxserver/bookstack:26.09.2', 'bookstack-db': 'mariadb:12.3'} +[13:26:59] TO up -d rc=0 +[13:27:30] TO settled=True in 31.1s :: {"bookstack": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}, "bookstack-db": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:27:31] engine state bookstack-db: 12.3.3-MariaDB| This installation of MariaDB is already upgraded to 12.3.3-MariaDB. There is no need to run mariadb-upgrade again. [exit=1] +[13:27:31] migration lines observed: 5 +[13:27:32] bookstack: readback of the seeded account found=True :: This will delete any configure multi-factor authentication methods for user: - ID: 3 - Name: spike-023492 - Email: spike +[13:27:32] RESULT (seed reads back AFTER): True +[13:27:32] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:80 +[13:27:47] + 15s bookstack=59M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=268 +[13:28:02] + 30s bookstack=62M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=534 +[13:28:18] + 46s bookstack=62M/512M peak=90M kills=0 rs=0 bookstack-db=171M/256M peak=177M kills=0 rs=0 reqs=804 +[13:28:33] + 61s bookstack=66M/512M peak=90M kills=0 rs=0 bookstack-db=171M/256M peak=177M kills=0 rs=0 reqs=1074 +[13:28:48] + 76s bookstack=68M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=1340 +[13:29:03] + 91s bookstack=71M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=1607 +[13:29:18] + 106s bookstack=72M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=1875 +[13:29:33] + 121s bookstack=74M/512M peak=90M kills=0 rs=0 bookstack-db=171M/256M peak=177M kills=0 rs=0 reqs=2142 +[13:29:49] + 136s bookstack=77M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=2411 +[13:30:04] + 152s bookstack=79M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=2677 +[13:30:19] + 167s bookstack=81M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=2944 +[13:30:34] + 182s bookstack=85M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=3208 +[13:30:49] + 197s bookstack=87M/512M peak=90M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=3475 +[13:31:04] + 212s bookstack=89M/512M peak=94M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=3743 +[13:31:19] + 227s bookstack=91M/512M peak=94M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=4009 +[13:31:35] + 242s bookstack=94M/512M peak=96M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=4273 +[13:31:50] + 258s bookstack=97M/512M peak=97M kills=0 rs=0 bookstack-db=171M/256M peak=177M kills=0 rs=0 reqs=4536 +[13:32:05] + 273s bookstack=99M/512M peak=100M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=4801 +[13:32:20] + 288s bookstack=102M/512M peak=103M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=5065 +[13:32:35] + 303s bookstack=104M/512M peak=106M kills=0 rs=0 bookstack-db=171M/256M peak=177M kills=0 rs=0 reqs=5328 +[13:32:50] + 318s bookstack=107M/512M peak=108M kills=0 rs=0 bookstack-db=172M/256M peak=177M kills=0 rs=0 reqs=5592 +[13:33:06] + 334s bookstack=109M/512M peak=111M kills=0 rs=0 bookstack-db=171M/256M peak=177M kills=0 rs=0 reqs=5858 +[13:33:21] + 349s bookstack=115M/512M peak=119M kills=0 rs=0 bookstack-db=167M/256M peak=177M kills=0 rs=0 reqs=6079 +[13:33:36] + 364s bookstack=114M/512M peak=119M kills=0 rs=0 bookstack-db=167M/256M peak=177M kills=0 rs=0 reqs=6344 +[13:33:51] + 379s bookstack=117M/512M peak=119M kills=0 rs=0 bookstack-db=166M/256M peak=177M kills=0 rs=0 reqs=6611 +[13:34:06] + 394s bookstack=120M/512M peak=121M kills=0 rs=0 bookstack-db=166M/256M peak=177M kills=0 rs=0 reqs=6872 +[13:34:21] + 409s bookstack=123M/512M peak=126M kills=0 rs=0 bookstack-db=166M/256M peak=177M kills=0 rs=0 reqs=7140 +[13:34:37] + 424s bookstack=126M/512M peak=127M kills=0 rs=0 bookstack-db=165M/256M peak=177M kills=0 rs=0 reqs=7405 +[13:34:52] + 440s bookstack=129M/512M peak=129M kills=0 rs=0 bookstack-db=142M/256M peak=177M kills=0 rs=0 reqs=7685 +[13:35:08] + 456s bookstack=133M/512M peak=133M kills=0 rs=0 bookstack-db=140M/256M peak=177M kills=0 rs=0 reqs=7947 +[13:35:23] + 471s bookstack=135M/512M peak=136M kills=0 rs=0 bookstack-db=139M/256M peak=177M kills=0 rs=0 reqs=8203 +[13:35:38] + 486s bookstack=137M/512M peak=139M kills=0 rs=0 bookstack-db=135M/256M peak=177M kills=0 rs=0 reqs=8470 +[13:35:53] + 501s bookstack=141M/512M peak=141M kills=0 rs=0 bookstack-db=132M/256M peak=177M kills=0 rs=0 reqs=8733 +[13:36:09] + 516s bookstack=144M/512M peak=148M kills=0 rs=0 bookstack-db=132M/256M peak=177M kills=0 rs=0 reqs=8996 +[13:36:24] + 532s bookstack=147M/512M peak=148M kills=0 rs=0 bookstack-db=133M/256M peak=177M kills=0 rs=0 reqs=9261 +[13:36:39] + 547s bookstack=149M/512M peak=151M kills=0 rs=0 bookstack-db=132M/256M peak=177M kills=0 rs=0 reqs=9513 +[13:36:54] + 562s bookstack=153M/512M peak=153M kills=0 rs=0 bookstack-db=133M/256M peak=177M kills=0 rs=0 reqs=9774 +[13:37:09] + 577s bookstack=154M/512M peak=156M kills=0 rs=0 bookstack-db=132M/256M peak=177M kills=0 rs=0 reqs=10031 +[13:37:25] + 592s bookstack=158M/512M peak=162M kills=0 rs=0 bookstack-db=132M/256M peak=177M kills=0 rs=0 reqs=10288 +[13:37:40] + 608s bookstack=161M/512M peak=162M kills=0 rs=0 bookstack-db=132M/256M peak=177M kills=0 rs=0 reqs=10552 +[13:37:40] memory watch: killed=False tight=[] requests=10554 codes={'302': 10554} +[13:37:40] MV-bookstack: ABORT — putting the FROM images back +[13:38:17] bookstack: readback of the seeded account found=True :: This will delete any configure multi-factor authentication methods for user: - ID: 3 - Name: spike-023492 - Email: spike +[13:38:17] ABORT: app came back in 31.1s; data present=True \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/to-full.log b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/to-full.log new file mode 100644 index 00000000..7a955008 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/to-full.log @@ -0,0 +1,118 @@ +bookstack-db | 2026-10-27 14:25:43+01:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:12.3.3+maria~ubu2404 started. +bookstack-db | 2026-10-27 14:25:43+01:00 [Warn] [Entrypoint]: /sys/fs/cgroup///memory.pressure not writable, functionality unavailable to MariaDB +bookstack-db | 2026-10-27 14:25:43+01:00 [Note] [Entrypoint]: Switching to dedicated user 'mysql' +bookstack-db | 2026-10-27 14:25:43+01:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:12.3.3+maria~ubu2404 started. +bookstack-db | 2026-10-27 14:25:43+01:00 [Note] [Entrypoint]: Initializing database files +bookstack-db | 2026-10-27 14:25:44 0 [Warning] mariadbd: io_uring_queue_init() failed with EPERM: sysctl kernel.io_uring_disabled has the value 2, or 1 and the user of the process is not a member of sysctl kernel.io_uring_group. (see man 2 io_uring_setup). +bookstack | [migrations] started +bookstack | [migrations] 01-nginx-site-confs-default: skipped +bookstack | [migrations] 02-default-location: skipped +bookstack | [migrations] done +bookstack | ─────────────────────────────────────── +bookstack | +bookstack | ██╗ ███████╗██╗ ██████╗ +bookstack | ██║ ██╔════╝██║██╔═══██╗ +bookstack | ██║ ███████╗██║██║ ██║ +bookstack | ██║ ╚════██║██║██║ ██║ +bookstack | ███████╗███████║██║╚██████╔╝ +bookstack | ╚══════╝╚══════╝╚═╝ ╚═════╝ +bookstack | +bookstack-db | create_uring failed: falling back to libaio +bookstack-db | 2026-10-27 14:25:46+01:00 [Note] [Entrypoint]: Database files initialized +bookstack-db | 2026-10-27 14:25:46+01:00 [Note] [Entrypoint]: Starting temporary server +bookstack-db | 2026-10-27 14:25:46+01:00 [Note] [Entrypoint]: Waiting for server startup +bookstack-db | 2026-10-27 14:25:46 0 [Note] Starting MariaDB 12.3.3-MariaDB-ubu2404 source revision 83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e server_uid LZ5pYRSfMNmPrIPsQAN9Z/SoloA= as process 95 +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Compressed tables use zlib 1.3 +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Number of transaction pools: 1 +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Using crc32 + pclmulqdq instructions +bookstack-db | 2026-10-27 14:25:46 0 [Warning] mariadbd: io_uring_queue_init() failed with EPERM: sysctl kernel.io_uring_disabled has the value 2, or 1 and the user of the process is not a member of sysctl kernel.io_uring_group. (see man 2 io_uring_setup). +bookstack-db | create_uring failed: falling back to libaio +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Using Linux native AIO +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: innodb_buffer_pool_size_max=8388608m, innodb_buffer_pool_size=128m +bookstack | Brought to you by linuxserver.io +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Completed initialization of buffer pool +bookstack | ─────────────────────────────────────── +bookstack | +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: File system buffers for log disabled (block size=512 bytes) +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: End of log at LSN=45568 +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Opened 3 undo tablespaces +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: 128 rollback segments in 3 undo tablespaces are active. +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: Setting file './ibtmp1' size to 12.000MiB. Physically writing the file full; Please wait ... +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: File './ibtmp1' size is now 12.000MiB. +bookstack-db | 2026-10-27 14:25:46 0 [Note] InnoDB: log sequence number 45568; transaction id 14 +bookstack-db | 2026-10-27 14:25:46 0 [Note] Plugin 'FEEDBACK' is disabled. +bookstack | To support the app dev(s) visit: +bookstack | Bookstack: https://www.bookstackapp.com/donate/ +bookstack | +bookstack | To support LSIO projects visit: +bookstack | https://www.linuxserver.io/donate/ +bookstack | +bookstack | ─────────────────────────────────────── +bookstack | GID/UID +bookstack | ─────────────────────────────────────── +bookstack | +bookstack | User UID: 1000 +bookstack | User GID: 1000 +bookstack | ─────────────────────────────────────── +bookstack | Linuxserver.io version: v26.09.2-ls293 +bookstack | Build-date: 2026-10-26T22:28:49+00:00 +bookstack | ─────────────────────────────────────── +bookstack | +bookstack | using keys found in /config/keys +bookstack | Waiting for DB to be available +bookstack | +bookstack | INFO Nothing to migrate. +bookstack | +bookstack-db | 2026-10-27 14:25:46 0 [Note] Plugin 'wsrep-provider' is disabled. +bookstack-db | 2026-10-27 14:25:48 0 [Note] mariadbd: Event Scheduler: Loaded 0 events +bookstack-db | 2026-10-27 14:25:48 0 [Note] Replication not automatically started: --skip-slave-start was specified +bookstack-db | 2026-10-27 14:25:48 0 [Note] mariadbd: ready for connections. +bookstack-db | Version: '12.3.3-MariaDB-ubu2404' socket: '/run/mysqld/mysqld.sock' port: 0 mariadb.org binary distribution +bookstack-db | 2026-10-27 14:25:48+01:00 [Note] [Entrypoint]: Temporary server started. +bookstack-db | 2026-10-27 14:25:49+01:00 [Note] [Entrypoint]: Creating database bookstack +bookstack-db | 2026-10-27 14:25:49+01:00 [Note] [Entrypoint]: Creating user bookstack +bookstack-db | 2026-10-27 14:25:49+01:00 [Note] [Entrypoint]: Giving user bookstack access to schema bookstack +bookstack | [custom-init] No custom files found, skipping... +bookstack | [ls.io-init] done. +bookstack-db | 2026-10-27 14:25:49+01:00 [Note] [Entrypoint]: Securing system users (equivalent to running mysql_secure_installation) +bookstack-db | +bookstack-db | 2026-10-27 14:25:49+01:00 [Note] [Entrypoint]: Stopping temporary server +bookstack-db | 2026-10-27 14:25:49 0 [Note] mariadbd (initiated by: unknown): Normal shutdown +bookstack-db | 2026-10-27 14:25:49 0 [Note] InnoDB: FTS optimize thread exiting. +bookstack-db | 2026-10-27 14:25:49 0 [Note] InnoDB: Starting shutdown... +bookstack-db | 2026-10-27 14:25:49 0 [Note] InnoDB: Dumping buffer pool(s) to /var/lib/mysql/ib_buffer_pool +bookstack-db | 2026-10-27 14:25:49 0 [Note] InnoDB: Buffer pool(s) dump completed at 261027 14:25:49 +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Removed temporary tablespace data file: "./ibtmp1" +bookstack-db | 2026-10-27 14:25:50 0 [Note] Shutdown completed; log sequence number 45568; transaction id 15 +bookstack-db | 2026-10-27 14:25:50 0 [Note] mariadbd: Shutdown complete +bookstack-db | 2026-10-27 14:25:50+01:00 [Note] [Entrypoint]: Temporary server stopped +bookstack-db | +bookstack-db | 2026-10-27 14:25:50+01:00 [Note] [Entrypoint]: MariaDB init process done. Ready for start up. +bookstack-db | +bookstack-db | 2026-10-27 14:25:50 0 [Note] Starting MariaDB 12.3.3-MariaDB-ubu2404 source revision 83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e server_uid LZ5pYRSfMNmPrIPsQAN9Z/SoloA= as process 1 +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Compressed tables use zlib 1.3 +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Number of transaction pools: 1 +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Using crc32 + pclmulqdq instructions +bookstack-db | 2026-10-27 14:25:50 0 [Warning] mariadbd: io_uring_queue_init() failed with EPERM: sysctl kernel.io_uring_disabled has the value 2, or 1 and the user of the process is not a member of sysctl kernel.io_uring_group. (see man 2 io_uring_setup). +bookstack-db | create_uring failed: falling back to libaio +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Using Linux native AIO +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: innodb_buffer_pool_size_max=8388608m, innodb_buffer_pool_size=128m +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Completed initialization of buffer pool +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: File system buffers for log disabled (block size=512 bytes) +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: End of log at LSN=45568 +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Opened 3 undo tablespaces +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: 128 rollback segments in 3 undo tablespaces are active. +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Setting file './ibtmp1' size to 12.000MiB. Physically writing the file full; Please wait ... +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: File './ibtmp1' size is now 12.000MiB. +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: log sequence number 45568; transaction id 14 +bookstack-db | 2026-10-27 14:25:50 0 [Note] Plugin 'FEEDBACK' is disabled. +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool +bookstack-db | 2026-10-27 14:25:50 0 [Note] Plugin 'wsrep-provider' is disabled. +bookstack-db | 2026-10-27 14:25:50 0 [Note] InnoDB: Buffer pool(s) load completed at 261027 14:25:50 +bookstack-db | 2026-10-27 14:25:50 0 [Note] Server socket created on IP: '0.0.0.0', port: '3306'. +bookstack-db | 2026-10-27 14:25:50 0 [Note] Server socket created on IP: '::', port: '3306'. +bookstack-db | 2026-10-27 14:25:50 0 [Note] mariadbd: Event Scheduler: Loaded 0 events +bookstack-db | 2026-10-27 14:25:50 0 [Note] mariadbd: ready for connections. +bookstack-db | Version: '12.3.3-MariaDB-ubu2404' socket: '/run/mysqld/mysqld.sock' port: 3306 mariadb.org binary distribution +bookstack-db | 2026-10-27 14:25:57 5 [Warning] Aborted connection 5 to db: 'unconnected' user: 'unauthenticated' host: '172.20.0.3' (This connection closed normally without authentication) +bookstack-db | 2026-10-27 14:27:01 26 [Warning] Aborted connection 26 to db: 'unconnected' user: 'unauthenticated' host: '172.20.0.3' (This connection closed normally without authentication) diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/to-states.json b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/to-states.json new file mode 100644 index 00000000..b910bf46 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/to-states.json @@ -0,0 +1,14 @@ +{ + "bookstack": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + }, + "bookstack-db": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + } +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/verdict.json b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/verdict.json new file mode 100644 index 00000000..d6878294 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/bookstack/evidence/MV-bookstack/verdict.json @@ -0,0 +1,77 @@ +{ + "harness_version": 5, + "edge": "MV-bookstack", + "app": "bookstack", + "note": "night 2026-09-23 within-a-major move: bookstack=lscr.io/linuxserver/bookstack:26.09.2", + "from": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.1", + "bookstack-db": "mariadb:12.3" + }, + "to": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.2", + "bookstack-db": "mariadb:12.3" + }, + "verdict": "proven", + "seed_read_before": true, + "seed_read_after": true, + "healthy_after": true, + "migration_observed": "\u001b[2Kbookstack | [migrations] started", + "abort": "starts-and-serves", + "abort_detail": null, + "engine_state_after": { + "bookstack-db": { + "image": "mariadb:12.3", + "probe": "datadir version | the engine's own upgrade verdict", + "answer": "12.3.3-MariaDB| This installation of MariaDB is already upgraded to 12.3.3-MariaDB. There is no need to run mariadb-upgrade again. [exit=1]", + "probe_rc": 0 + } + }, + "memory": { + "soak_s": 608.0, + "requested_s": 600, + "requests": 10554, + "codes": { + "302": 10554 + }, + "first_kill": null, + "containers": { + "bookstack": { + "limit": 536870912, + "peak": 170106880, + "peak_pct": 0.317, + "anon_peak_sampled": 25456640, + "anon_peak_pct": 0.047, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + }, + "bookstack-db": { + "limit": 268435456, + "peak": 186318848, + "peak_pct": 0.694, + "anon_peak_sampled": 116486144, + "anon_peak_pct": 0.434, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + } + }, + "unmeasured": [], + "venue_swap_bytes": 0, + "load": "reached" + }, + "marks": [], + "bench_overrides": null, + "duration_s": 31.1, + "measured_at": "2026-10-27T13:38:17Z", + "evidence": "evidence/MV-bookstack", + "scratch_cleared": [], + "files_changed": [], + "files_changed_detail": [], + "files_ignored": [], + "total_s": 779.6 +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/MV-jellyfin.log b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/MV-jellyfin.log new file mode 100644 index 00000000..7ba3d6fd --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/MV-jellyfin.log @@ -0,0 +1,116 @@ +[13:41:09] scratch drive folders cleared before FROM (R-656): ['/srv/felhom-gate/hdd/userdata/media'] +[13:41:09] MV-jellyfin: deploying jellyfin at FROM {'jellyfin': 'jellyfin/jellyfin:10.11.11'} +[13:41:41] FROM settled=True in 31.0s :: {"jellyfin": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:41:41] fixture: the BOX walk's own (Jellyfin), through upgrade_boxport +[13:41:42] jellyfin: seeded first user drillb4777ead +[13:41:43] jellyfin: sign-in as the seeded user http=200 token=True (wrong password refused: http 401) +[13:41:43] C1 (seed reads back BEFORE): True +[13:41:44] MV-jellyfin: swapping to TO {'jellyfin': 'jellyfin/jellyfin:12.4'} +[13:42:34] TO up -d rc=0 +[13:43:05] TO settled=True in 30.9s :: {"jellyfin": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:43:05] migration lines observed: 6 +[13:43:06] jellyfin: sign-in as the seeded user http=200 token=True (wrong password refused: http 401) +[13:43:06] RESULT (seed reads back AFTER): True +[13:43:07] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:8096 +[13:43:22] + 15s jellyfin=186M/2048M peak=187M kills=0 rs=0 reqs=301 +[13:43:37] + 30s jellyfin=185M/2048M peak=187M kills=0 rs=0 reqs=601 +[13:43:52] + 45s jellyfin=182M/2048M peak=187M kills=0 rs=0 reqs=904 +[13:44:07] + 60s jellyfin=172M/2048M peak=187M kills=0 rs=0 reqs=1204 +[13:44:22] + 76s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=1504 +[13:44:37] + 91s jellyfin=175M/2048M peak=187M kills=0 rs=0 reqs=1804 +[13:44:53] + 106s jellyfin=175M/2048M peak=187M kills=0 rs=0 reqs=2104 +[13:45:08] + 121s jellyfin=174M/2048M peak=187M kills=0 rs=0 reqs=2405 +[13:45:23] + 136s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=2705 +[13:45:38] + 151s jellyfin=176M/2048M peak=187M kills=0 rs=0 reqs=3006 +[13:45:53] + 166s jellyfin=176M/2048M peak=187M kills=0 rs=0 reqs=3306 +[13:46:08] + 182s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=3606 +[13:46:23] + 197s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=3906 +[13:46:38] + 212s jellyfin=175M/2048M peak=187M kills=0 rs=0 reqs=4206 +[13:46:54] + 227s jellyfin=174M/2048M peak=187M kills=0 rs=0 reqs=4506 +[13:47:09] + 242s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=4806 +[13:47:24] + 257s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=5106 +[13:47:39] + 272s jellyfin=176M/2048M peak=187M kills=0 rs=0 reqs=5406 +[13:47:54] + 288s jellyfin=174M/2048M peak=187M kills=0 rs=0 reqs=5706 +[13:48:09] + 303s jellyfin=175M/2048M peak=187M kills=0 rs=0 reqs=6007 +[13:48:24] + 318s jellyfin=174M/2048M peak=187M kills=0 rs=0 reqs=6307 +[13:48:39] + 333s jellyfin=174M/2048M peak=187M kills=0 rs=0 reqs=6607 +[13:48:55] + 348s jellyfin=174M/2048M peak=187M kills=0 rs=0 reqs=6907 +[13:49:10] + 363s jellyfin=175M/2048M peak=187M kills=0 rs=0 reqs=7207 +[13:49:25] + 378s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=7507 +[13:49:40] + 393s jellyfin=171M/2048M peak=187M kills=0 rs=0 reqs=7807 +[13:49:55] + 408s jellyfin=170M/2048M peak=187M kills=0 rs=0 reqs=8107 +[13:50:10] + 424s jellyfin=178M/2048M peak=187M kills=0 rs=0 reqs=8407 +[13:50:25] + 439s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=8707 +[13:50:40] + 454s jellyfin=171M/2048M peak=187M kills=0 rs=0 reqs=9007 +[13:50:56] + 469s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=9307 +[13:51:11] + 484s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=9607 +[13:51:26] + 499s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=9907 +[13:51:41] + 514s jellyfin=171M/2048M peak=187M kills=0 rs=0 reqs=10208 +[13:51:56] + 530s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=10511 +[13:52:11] + 545s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=10811 +[13:52:26] + 560s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=11111 +[13:52:42] + 575s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=11411 +[13:52:57] + 590s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=11711 +[13:53:12] + 605s jellyfin=170M/2048M peak=187M kills=0 rs=0 reqs=12011 +[13:53:12] memory watch: killed=False tight=[] requests=12011 codes={'302': 12011} +[13:53:12] MV-jellyfin: ABORT — putting the FROM images back +[13:53:44] jellyfin: sign-in as the seeded user http=500 token=False (wrong password refused: http 500) +[13:53:44] ABORT: app came back in 30.9s; data present=False +{ + "harness_version": 5, + "edge": "MV-jellyfin", + "app": "jellyfin", + "note": "night 2026-09-23 within-a-major move: jellyfin=jellyfin/jellyfin:12.4", + "from": { + "jellyfin": "jellyfin/jellyfin:10.11.11" + }, + "to": { + "jellyfin": "jellyfin/jellyfin:12.4" + }, + "verdict": "proven", + "seed_read_before": true, + "seed_read_after": true, + "healthy_after": true, + "migration_observed": "\u001b[2Kjellyfin | [14:42:35] [INF] [9] Jellyfin.Server.Migrations.JellyfinMigrationService: Initialise Migration service.", + "abort": "starts-data-gone", + "abort_detail": "the app started but the seeded data was gone", + "engine_state_after": null, + "memory": { + "soak_s": 605.5, + "requested_s": 600, + "requests": 12011, + "codes": { + "302": 12011 + }, + "first_kill": null, + "containers": { + "jellyfin": { + "limit": 2147483648, + "peak": 196870144, + "peak_pct": 0.092, + "anon_peak_sampled": 107573248, + "anon_peak_pct": 0.05, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + } + }, + "unmeasured": [], + "venue_swap_bytes": 0, + "load": "reached" + }, + "marks": [], + "bench_overrides": null, + "duration_s": 30.9, + "measured_at": "2026-10-27T13:53:44Z", + "evidence": "evidence/MV-jellyfin", + "scratch_cleared": [ + "/srv/felhom-gate/hdd/userdata/media" + ], + "files_changed": [], + "files_changed_detail": [], + "files_ignored": [], + "total_s": 755.4 +} diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/abort-states.json b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/abort-states.json new file mode 100644 index 00000000..86135928 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/abort-states.json @@ -0,0 +1,8 @@ +{ + "jellyfin": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + } +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/compose-final.log b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/compose-final.log new file mode 100644 index 00000000..d0613b7a --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/compose-final.log @@ -0,0 +1,515 @@ +jellyfin | [14:53:13] [INF] [1] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:53:14] [INF] [9] Jellyfin.Server.ServerSetupApp.SetupServer: Kestrel is listening on 0.0.0.0 +jellyfin | [14:53:14] [INF] [9] Main: Jellyfin version: 10.11.11 +jellyfin | [14:53:14] [INF] [9] Main: Environment Variables: ["[JELLYFIN_CONFIG_DIR, /config/config]", "[JELLYFIN_CACHE_DIR, /cache]", "[JELLYFIN_DATA_DIR, /config]", "[JELLYFIN_WEB_DIR, /jellyfin/jellyfin-web]", "[JELLYFIN_LOG_DIR, /config/log]", "[JELLYFIN_FFMPEG, /usr/lib/jellyfin-ffmpeg/ffmpeg]"] +jellyfin | [14:53:14] [INF] [9] Main: Arguments: ["/jellyfin/jellyfin.dll"] +jellyfin | [14:53:14] [INF] [9] Main: Operating system: Debian GNU/Linux 13 (trixie) +jellyfin | [14:53:14] [INF] [9] Main: Architecture: X64 +jellyfin | [14:53:14] [INF] [9] Main: 64-Bit Process: True +jellyfin | [14:53:14] [INF] [9] Main: User Interactive: True +jellyfin | [14:53:14] [INF] [9] Main: Processor count: 6 +jellyfin | [14:53:14] [INF] [9] Main: Program data path: /config +jellyfin | [14:53:14] [INF] [9] Main: Log directory path: /config/log +jellyfin | [14:53:14] [INF] [9] Main: Config directory path: /config/config +jellyfin | [14:53:14] [INF] [9] Main: Cache path: /cache +jellyfin | [14:53:14] [INF] [9] Main: Temp directory path: /tmp/jellyfin +jellyfin | [14:53:14] [INF] [9] Main: Web resources path: /jellyfin/jellyfin-web +jellyfin | [14:53:14] [INF] [9] Main: Application directory: /jellyfin/ +jellyfin | [14:53:14] [INF] [9] Jellyfin.Server.Startup: Storage path `/config/data` (Fixed) successfully checked with 40.4GiB free which is over the minimum of 2GiB. +jellyfin | [14:53:14] [INF] [9] Jellyfin.Server.Startup: Storage path `/cache` (Fixed) successfully checked with 40.4GiB free which is over the minimum of 2GiB. +jellyfin | [14:53:14] [INF] [9] Jellyfin.Server.Startup: Storage path `/config` (Fixed) successfully checked with 40.4GiB free which is over the minimum of 2GiB. +jellyfin | [14:53:14] [INF] [9] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:53:14] [INF] [9] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: SQLite connection string: Data Source=/config/data/jellyfin.db;Cache=Default;Default Timeout=30;Pooling=True +jellyfin | [14:53:14] [INF] [9] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: SQLITE connection pragma command set to: +jellyfin | PRAGMA locking_mode=NORMAL; +jellyfin | PRAGMA journal_size_limit=134217728; +jellyfin | PRAGMA synchronous=1; +jellyfin | PRAGMA temp_store=2; +jellyfin | +jellyfin | [14:53:14] [INF] [9] Jellyfin.Database.Implementations.Locking.NoLockBehavior: The database locking mode has been set to: NoLock. +jellyfin | [14:53:14] [INF] [9] Jellyfin.Server.Migrations.JellyfinMigrationService: Initialise Migration service. +jellyfin | [14:53:15] [INF] [9] Jellyfin.Server.Migrations.JellyfinMigrationService: There are 0 migrations for stage PreInitialisation. +jellyfin | [14:53:15] [INF] [9] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:53:15] [INF] [9] Emby.Server.Implementations.ApplicationHost: Loading assemblies +jellyfin | [14:53:15] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Defined LAN subnets: ["127.0.0.1/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"] +jellyfin | [14:53:15] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Defined LAN exclusions: [] +jellyfin | [14:53:15] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Used LAN subnets: ["127.0.0.1/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"] +jellyfin | [14:53:15] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Filtered interface addresses: ["127.0.0.1", "172.18.0.2"] +jellyfin | [14:53:15] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Bind Addresses ["0.0.0.0"] +jellyfin | [14:53:15] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Remote IP filter is Allowlist +jellyfin | [14:53:15] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Filtered subnets: [] +jellyfin | [14:53:15] [INF] [9] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: SQLite connection string: Data Source=/config/data/jellyfin.db;Cache=Default;Default Timeout=30;Pooling=True +jellyfin | [14:53:15] [INF] [9] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: SQLITE connection pragma command set to: +jellyfin | PRAGMA locking_mode=NORMAL; +jellyfin | PRAGMA journal_size_limit=134217728; +jellyfin | PRAGMA synchronous=1; +jellyfin | PRAGMA temp_store=2; +jellyfin | +jellyfin | [14:53:15] [INF] [9] Jellyfin.Database.Implementations.Locking.NoLockBehavior: The database locking mode has been set to: NoLock. +jellyfin | [14:53:15] [INF] [9] Main: Prepare system for possible migrations +jellyfin | [14:53:15] [INF] [9] Jellyfin.Server.Migrations.JellyfinMigrationService: There are 0 migrations for stage CoreInitialisation. +jellyfin | [14:53:15] [INF] [9] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: TMDb 10.11.11.0 +jellyfin | [14:53:15] [INF] [9] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: Studio Images 10.11.11.0 +jellyfin | [14:53:15] [INF] [9] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: OMDb 10.11.11.0 +jellyfin | [14:53:15] [INF] [9] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: MusicBrainz 10.11.11.0 +jellyfin | [14:53:15] [INF] [9] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: AudioDB 10.11.11.0 +jellyfin | [14:53:15] [INF] [9] Jellyfin.Server.Migrations.JellyfinMigrationService: There are 0 migrations for stage AppInitialisation. +jellyfin | [14:53:16] [INF] [7] Main: Kestrel is listening on 0.0.0.0 +jellyfin | [14:53:16] [WRN] [9] Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager: No XML encryptor configured. Key {01503f47-f63b-49ad-a29a-28f0550063cb} may be persisted to storage in unencrypted form. +jellyfin | [14:53:16] [ERR] [7] Microsoft.EntityFrameworkCore.Database.Command: Failed executing DbCommand (2ms) [Parameters=[@__id_0='?' (DbType = Guid)], CommandType='Text', CommandTimeout='30'] +jellyfin | SELECT "b4"."Id", "b4"."Album", "b4"."AlbumArtists", "b4"."Artists", "b4"."Audio", "b4"."ChannelId", "b4"."CleanName", "b4"."CommunityRating", "b4"."CriticRating", "b4"."CustomRating", "b4"."Data", "b4"."DateCreated", "b4"."DateLastMediaAdded", "b4"."DateLastRefreshed", "b4"."DateLastSaved", "b4"."DateModified", "b4"."EndDate", "b4"."EpisodeTitle", "b4"."ExternalId", "b4"."ExternalSeriesId", "b4"."ExternalServiceId", "b4"."ExtraIds", "b4"."ExtraType", "b4"."ForcedSortName", "b4"."Genres", "b4"."Height", "b4"."IndexNumber", "b4"."InheritedParentalRatingSubValue", "b4"."InheritedParentalRatingValue", "b4"."IsFolder", "b4"."IsInMixedFolder", "b4"."IsLocked", "b4"."IsMovie", "b4"."IsRepeat", "b4"."IsSeries", "b4"."IsVirtualItem", "b4"."LUFS", "b4"."MediaType", "b4"."Name", "b4"."NormalizationGain", "b4"."OfficialRating", "b4"."OriginalTitle", "b4"."Overview", "b4"."OwnerId", "b4"."ParentId", "b4"."ParentIndexNumber", "b4"."Path", "b4"."PreferredMetadataCountryCode", "b4"."PreferredMetadataLanguage", "b4"."PremiereDate", "b4"."PresentationUniqueKey", "b4"."PrimaryVersionId", "b4"."ProductionLocations", "b4"."ProductionYear", "b4"."RunTimeTicks", "b4"."SeasonId", "b4"."SeasonName", "b4"."SeriesId", "b4"."SeriesName", "b4"."SeriesPresentationUniqueKey", "b4"."ShowId", "b4"."Size", "b4"."SortName", "b4"."StartDate", "b4"."Studios", "b4"."Tagline", "b4"."Tags", "b4"."TopParentId", "b4"."TotalBitrate", "b4"."Type", "b4"."UnratedType", "b4"."Width", "b0"."Id", "b0"."ItemId", "b1"."ItemId", "b1"."ProviderId", "b1"."ProviderValue", "b2"."Id", "b2"."ItemId", "u"."ItemId", "u"."UserId", "u"."CustomDataKey", "u"."AudioStreamIndex", "u"."IsFavorite", "u"."LastPlayedDate", "u"."Likes", "u"."PlayCount", "u"."PlaybackPositionTicks", "u"."Played", "u"."Rating", "u"."RetentionDate", "u"."SubtitleStreamIndex", "b3"."Id", "b3"."Blurhash", "b3"."DateModified", "b3"."Height", "b3"."ImageType", "b3"."ItemId", "b3"."Path", "b3"."Width" +jellyfin | FROM ( +jellyfin | SELECT "b"."Id", "b"."Album", "b"."AlbumArtists", "b"."Artists", "b"."Audio", "b"."ChannelId", "b"."CleanName", "b"."CommunityRating", "b"."CriticRating", "b"."CustomRating", "b"."Data", "b"."DateCreated", "b"."DateLastMediaAdded", "b"."DateLastRefreshed", "b"."DateLastSaved", "b"."DateModified", "b"."EndDate", "b"."EpisodeTitle", "b"."ExternalId", "b"."ExternalSeriesId", "b"."ExternalServiceId", "b"."ExtraIds", "b"."ExtraType", "b"."ForcedSortName", "b"."Genres", "b"."Height", "b"."IndexNumber", "b"."InheritedParentalRatingSubValue", "b"."InheritedParentalRatingValue", "b"."IsFolder", "b"."IsInMixedFolder", "b"."IsLocked", "b"."IsMovie", "b"."IsRepeat", "b"."IsSeries", "b"."IsVirtualItem", "b"."LUFS", "b"."MediaType", "b"."Name", "b"."NormalizationGain", "b"."OfficialRating", "b"."OriginalTitle", "b"."Overview", "b"."OwnerId", "b"."ParentId", "b"."ParentIndexNumber", "b"."Path", "b"."PreferredMetadataCountryCode", "b"."PreferredMetadataLanguage", "b"."PremiereDate", "b"."PresentationUniqueKey", "b"."PrimaryVersionId", "b"."ProductionLocations", "b"."ProductionYear", "b"."RunTimeTicks", "b"."SeasonId", "b"."SeasonName", "b"."SeriesId", "b"."SeriesName", "b"."SeriesPresentationUniqueKey", "b"."ShowId", "b"."Size", "b"."SortName", "b"."StartDate", "b"."Studios", "b"."Tagline", "b"."Tags", "b"."TopParentId", "b"."TotalBitrate", "b"."Type", "b"."UnratedType", "b"."Width" +jellyfin | FROM "BaseItems" AS "b" +jellyfin | WHERE "b"."Id" = @__id_0 +jellyfin | LIMIT 1 +jellyfin | ) AS "b4" +jellyfin | LEFT JOIN "BaseItemTrailerTypes" AS "b0" ON "b4"."Id" = "b0"."ItemId" +jellyfin | LEFT JOIN "BaseItemProviders" AS "b1" ON "b4"."Id" = "b1"."ItemId" +jellyfin | LEFT JOIN "BaseItemMetadataFields" AS "b2" ON "b4"."Id" = "b2"."ItemId" +jellyfin | LEFT JOIN "UserData" AS "u" ON "b4"."Id" = "u"."ItemId" +jellyfin | LEFT JOIN "BaseItemImageInfos" AS "b3" ON "b4"."Id" = "b3"."ItemId" +jellyfin | ORDER BY "b4"."Id", "b0"."Id", "b0"."ItemId", "b1"."ItemId", "b1"."ProviderId", "b2"."Id", "b2"."ItemId", "u"."ItemId", "u"."UserId", "u"."CustomDataKey" +jellyfin | [14:53:16] [ERR] [7] Microsoft.EntityFrameworkCore.Query: An exception occurred while iterating over the results of a query for context type 'Jellyfin.Database.Implementations.JellyfinDbContext'. +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: b.ExtraIds'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: b.ExtraIds'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | [14:53:16] [ERR] [7] Emby.Server.Implementations.Library.LibraryManager: Error creating UserRootFolder e9d5075a-555c-1cbc-394e-ec4cef295274 +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: b.ExtraIds'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | at System.Linq.Enumerable.TryGetSingle[TSource](IEnumerable`1 source, Boolean& found) +jellyfin | at lambda_method376(Closure, QueryContext) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.ExecuteCore[TResult](Expression query, Boolean async, CancellationToken cancellationToken) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.Execute[TResult](Expression query) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryProvider.Execute[TResult](Expression expression) +jellyfin | at Jellyfin.Server.Implementations.Item.BaseItemRepository.RetrieveItem(Guid id) +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.RetrieveItem(Guid id) +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.GetItemById(Guid id) +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.GetUserRootFolder() +jellyfin | [14:53:16] [ERR] [7] Microsoft.EntityFrameworkCore.Database.Command: Failed executing DbCommand (1ms) [Parameters=[@__filter_ParentId_0='?' (DbType = Guid)], CommandType='Text', CommandTimeout='30'] +jellyfin | SELECT "b0"."Id", "b0"."Album", "b0"."AlbumArtists", "b0"."Artists", "b0"."Audio", "b0"."ChannelId", "b0"."CleanName", "b0"."CommunityRating", "b0"."CriticRating", "b0"."CustomRating", "b0"."Data", "b0"."DateCreated", "b0"."DateLastMediaAdded", "b0"."DateLastRefreshed", "b0"."DateLastSaved", "b0"."DateModified", "b0"."EndDate", "b0"."EpisodeTitle", "b0"."ExternalId", "b0"."ExternalSeriesId", "b0"."ExternalServiceId", "b0"."ExtraIds", "b0"."ExtraType", "b0"."ForcedSortName", "b0"."Genres", "b0"."Height", "b0"."IndexNumber", "b0"."InheritedParentalRatingSubValue", "b0"."InheritedParentalRatingValue", "b0"."IsFolder", "b0"."IsInMixedFolder", "b0"."IsLocked", "b0"."IsMovie", "b0"."IsRepeat", "b0"."IsSeries", "b0"."IsVirtualItem", "b0"."LUFS", "b0"."MediaType", "b0"."Name", "b0"."NormalizationGain", "b0"."OfficialRating", "b0"."OriginalTitle", "b0"."Overview", "b0"."OwnerId", "b0"."ParentId", "b0"."ParentIndexNumber", "b0"."Path", "b0"."PreferredMetadataCountryCode", "b0"."PreferredMetadataLanguage", "b0"."PremiereDate", "b0"."PresentationUniqueKey", "b0"."PrimaryVersionId", "b0"."ProductionLocations", "b0"."ProductionYear", "b0"."RunTimeTicks", "b0"."SeasonId", "b0"."SeasonName", "b0"."SeriesId", "b0"."SeriesName", "b0"."SeriesPresentationUniqueKey", "b0"."ShowId", "b0"."Size", "b0"."SortName", "b0"."StartDate", "b0"."Studios", "b0"."Tagline", "b0"."Tags", "b0"."TopParentId", "b0"."TotalBitrate", "b0"."Type", "b0"."UnratedType", "b0"."Width", "b1"."ItemId", "b1"."ProviderId", "b1"."ProviderValue", "b2"."Id", "b2"."ItemId", "u"."ItemId", "u"."UserId", "u"."CustomDataKey", "u"."AudioStreamIndex", "u"."IsFavorite", "u"."LastPlayedDate", "u"."Likes", "u"."PlayCount", "u"."PlaybackPositionTicks", "u"."Played", "u"."Rating", "u"."RetentionDate", "u"."SubtitleStreamIndex", "b3"."Id", "b3"."Blurhash", "b3"."DateModified", "b3"."Height", "b3"."ImageType", "b3"."ItemId", "b3"."Path", "b3"."Width" +jellyfin | FROM ( +jellyfin | SELECT DISTINCT "b"."Id", "b"."Album", "b"."AlbumArtists", "b"."Artists", "b"."Audio", "b"."ChannelId", "b"."CleanName", "b"."CommunityRating", "b"."CriticRating", "b"."CustomRating", "b"."Data", "b"."DateCreated", "b"."DateLastMediaAdded", "b"."DateLastRefreshed", "b"."DateLastSaved", "b"."DateModified", "b"."EndDate", "b"."EpisodeTitle", "b"."ExternalId", "b"."ExternalSeriesId", "b"."ExternalServiceId", "b"."ExtraIds", "b"."ExtraType", "b"."ForcedSortName", "b"."Genres", "b"."Height", "b"."IndexNumber", "b"."InheritedParentalRatingSubValue", "b"."InheritedParentalRatingValue", "b"."IsFolder", "b"."IsInMixedFolder", "b"."IsLocked", "b"."IsMovie", "b"."IsRepeat", "b"."IsSeries", "b"."IsVirtualItem", "b"."LUFS", "b"."MediaType", "b"."Name", "b"."NormalizationGain", "b"."OfficialRating", "b"."OriginalTitle", "b"."Overview", "b"."OwnerId", "b"."ParentId", "b"."ParentIndexNumber", "b"."Path", "b"."PreferredMetadataCountryCode", "b"."PreferredMetadataLanguage", "b"."PremiereDate", "b"."PresentationUniqueKey", "b"."PrimaryVersionId", "b"."ProductionLocations", "b"."ProductionYear", "b"."RunTimeTicks", "b"."SeasonId", "b"."SeasonName", "b"."SeriesId", "b"."SeriesName", "b"."SeriesPresentationUniqueKey", "b"."ShowId", "b"."Size", "b"."SortName", "b"."StartDate", "b"."Studios", "b"."Tagline", "b"."Tags", "b"."TopParentId", "b"."TotalBitrate", "b"."Type", "b"."UnratedType", "b"."Width" +jellyfin | FROM "BaseItems" AS "b" +jellyfin | WHERE "b"."ParentId" = @__filter_ParentId_0 +jellyfin | ) AS "b0" +jellyfin | LEFT JOIN "BaseItemProviders" AS "b1" ON "b0"."Id" = "b1"."ItemId" +jellyfin | LEFT JOIN "BaseItemMetadataFields" AS "b2" ON "b0"."Id" = "b2"."ItemId" +jellyfin | LEFT JOIN "UserData" AS "u" ON "b0"."Id" = "u"."ItemId" +jellyfin | LEFT JOIN "BaseItemImageInfos" AS "b3" ON "b0"."Id" = "b3"."ItemId" +jellyfin | ORDER BY "b0"."SortName", "b0"."Id", "b1"."ItemId", "b1"."ProviderId", "b2"."Id", "b2"."ItemId", "u"."ItemId", "u"."UserId", "u"."CustomDataKey" +jellyfin | [14:53:16] [ERR] [7] Microsoft.EntityFrameworkCore.Query: An exception occurred while iterating over the results of a query for context type 'Jellyfin.Database.Implementations.JellyfinDbContext'. +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: b.ExtraIds'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: b.ExtraIds'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | [14:53:16] [ERR] [7] Jellyfin.LiveTv.Recordings.RecordingsManager: Error creating recording folders +jellyfin | System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. +jellyfin | ---> Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: b.ExtraIds'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | at System.Linq.Enumerable.IEnumerableWhereSelectIterator`2.ToArray() +jellyfin | at Jellyfin.Server.Implementations.Item.BaseItemRepository.GetItemList(InternalItemsQuery filter) +jellyfin | at MediaBrowser.Controller.Entities.Folder.GetCachedChildren() +jellyfin | at MediaBrowser.Controller.Entities.Folder.LoadChildren() +jellyfin | at MediaBrowser.Controller.Entities.UserRootFolder.LoadChildren() +jellyfin | at MediaBrowser.Controller.Entities.Folder.get_Children() +jellyfin | at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor) +jellyfin | at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr) +jellyfin | --- End of inner exception stack trace --- +jellyfin | at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr) +jellyfin | at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) +jellyfin | at MediaBrowser.Controller.Entities.BaseItemExtensions.DeepCopy[T,TU](T source, TU dest) +jellyfin | at MediaBrowser.Controller.Entities.BaseItemExtensions.DeepCopy[T,TU](T source) +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.GetUserRootFolder() +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.GetVirtualFolders(Boolean includeRefreshState) +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.GetVirtualFolders() +jellyfin | at Jellyfin.LiveTv.Recordings.RecordingsManager.CreateRecordingFolders() +jellyfin | [14:53:17] [WRN] [7] Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware: The WebRootPath was not found: /wwwroot. Static files may be unavailable. +jellyfin | [14:53:17] [ERR] [7] Microsoft.EntityFrameworkCore.Database.Command: Failed executing DbCommand (0ms) [Parameters=[@__id_0='?' (DbType = Guid)], CommandType='Text', CommandTimeout='30'] +jellyfin | SELECT "b4"."Id", "b4"."Album", "b4"."AlbumArtists", "b4"."Artists", "b4"."Audio", "b4"."ChannelId", "b4"."CleanName", "b4"."CommunityRating", "b4"."CriticRating", "b4"."CustomRating", "b4"."Data", "b4"."DateCreated", "b4"."DateLastMediaAdded", "b4"."DateLastRefreshed", "b4"."DateLastSaved", "b4"."DateModified", "b4"."EndDate", "b4"."EpisodeTitle", "b4"."ExternalId", "b4"."ExternalSeriesId", "b4"."ExternalServiceId", "b4"."ExtraIds", "b4"."ExtraType", "b4"."ForcedSortName", "b4"."Genres", "b4"."Height", "b4"."IndexNumber", "b4"."InheritedParentalRatingSubValue", "b4"."InheritedParentalRatingValue", "b4"."IsFolder", "b4"."IsInMixedFolder", "b4"."IsLocked", "b4"."IsMovie", "b4"."IsRepeat", "b4"."IsSeries", "b4"."IsVirtualItem", "b4"."LUFS", "b4"."MediaType", "b4"."Name", "b4"."NormalizationGain", "b4"."OfficialRating", "b4"."OriginalTitle", "b4"."Overview", "b4"."OwnerId", "b4"."ParentId", "b4"."ParentIndexNumber", "b4"."Path", "b4"."PreferredMetadataCountryCode", "b4"."PreferredMetadataLanguage", "b4"."PremiereDate", "b4"."PresentationUniqueKey", "b4"."PrimaryVersionId", "b4"."ProductionLocations", "b4"."ProductionYear", "b4"."RunTimeTicks", "b4"."SeasonId", "b4"."SeasonName", "b4"."SeriesId", "b4"."SeriesName", "b4"."SeriesPresentationUniqueKey", "b4"."ShowId", "b4"."Size", "b4"."SortName", "b4"."StartDate", "b4"."Studios", "b4"."Tagline", "b4"."Tags", "b4"."TopParentId", "b4"."TotalBitrate", "b4"."Type", "b4"."UnratedType", "b4"."Width", "b0"."Id", "b0"."ItemId", "b1"."ItemId", "b1"."ProviderId", "b1"."ProviderValue", "b2"."Id", "b2"."ItemId", "u"."ItemId", "u"."UserId", "u"."CustomDataKey", "u"."AudioStreamIndex", "u"."IsFavorite", "u"."LastPlayedDate", "u"."Likes", "u"."PlayCount", "u"."PlaybackPositionTicks", "u"."Played", "u"."Rating", "u"."RetentionDate", "u"."SubtitleStreamIndex", "b3"."Id", "b3"."Blurhash", "b3"."DateModified", "b3"."Height", "b3"."ImageType", "b3"."ItemId", "b3"."Path", "b3"."Width" +jellyfin | FROM ( +jellyfin | SELECT "b"."Id", "b"."Album", "b"."AlbumArtists", "b"."Artists", "b"."Audio", "b"."ChannelId", "b"."CleanName", "b"."CommunityRating", "b"."CriticRating", "b"."CustomRating", "b"."Data", "b"."DateCreated", "b"."DateLastMediaAdded", "b"."DateLastRefreshed", "b"."DateLastSaved", "b"."DateModified", "b"."EndDate", "b"."EpisodeTitle", "b"."ExternalId", "b"."ExternalSeriesId", "b"."ExternalServiceId", "b"."ExtraIds", "b"."ExtraType", "b"."ForcedSortName", "b"."Genres", "b"."Height", "b"."IndexNumber", "b"."InheritedParentalRatingSubValue", "b"."InheritedParentalRatingValue", "b"."IsFolder", "b"."IsInMixedFolder", "b"."IsLocked", "b"."IsMovie", "b"."IsRepeat", "b"."IsSeries", "b"."IsVirtualItem", "b"."LUFS", "b"."MediaType", "b"."Name", "b"."NormalizationGain", "b"."OfficialRating", "b"."OriginalTitle", "b"."Overview", "b"."OwnerId", "b"."ParentId", "b"."ParentIndexNumber", "b"."Path", "b"."PreferredMetadataCountryCode", "b"."PreferredMetadataLanguage", "b"."PremiereDate", "b"."PresentationUniqueKey", "b"."PrimaryVersionId", "b"."ProductionLocations", "b"."ProductionYear", "b"."RunTimeTicks", "b"."SeasonId", "b"."SeasonName", "b"."SeriesId", "b"."SeriesName", "b"."SeriesPresentationUniqueKey", "b"."ShowId", "b"."Size", "b"."SortName", "b"."StartDate", "b"."Studios", "b"."Tagline", "b"."Tags", "b"."TopParentId", "b"."TotalBitrate", "b"."Type", "b"."UnratedType", "b"."Width" +jellyfin | FROM "BaseItems" AS "b" +jellyfin | WHERE "b"."Id" = @__id_0 +jellyfin | LIMIT 1 +jellyfin | ) AS "b4" +jellyfin | LEFT JOIN "BaseItemTrailerTypes" AS "b0" ON "b4"."Id" = "b0"."ItemId" +jellyfin | LEFT JOIN "BaseItemProviders" AS "b1" ON "b4"."Id" = "b1"."ItemId" +jellyfin | LEFT JOIN "BaseItemMetadataFields" AS "b2" ON "b4"."Id" = "b2"."ItemId" +jellyfin | LEFT JOIN "UserData" AS "u" ON "b4"."Id" = "u"."ItemId" +jellyfin | LEFT JOIN "BaseItemImageInfos" AS "b3" ON "b4"."Id" = "b3"."ItemId" +jellyfin | ORDER BY "b4"."Id", "b0"."Id", "b0"."ItemId", "b1"."ItemId", "b1"."ProviderId", "b2"."Id", "b2"."ItemId", "u"."ItemId", "u"."UserId", "u"."CustomDataKey" +jellyfin | [14:53:17] [ERR] [7] Microsoft.EntityFrameworkCore.Query: An exception occurred while iterating over the results of a query for context type 'Jellyfin.Database.Implementations.JellyfinDbContext'. +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: b.ExtraIds'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: b.ExtraIds'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | [14:53:17] [FTL] [7] Microsoft.Extensions.Hosting.Internal.ApplicationLifetime: An error occurred starting the application +jellyfin | System.AggregateException: One or more errors occurred. (SQLite Error 1: 'no such column: b.ExtraIds'.) +jellyfin | ---> Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: b.ExtraIds'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | at System.Linq.Enumerable.TryGetSingle[TSource](IEnumerable`1 source, Boolean& found) +jellyfin | at lambda_method376(Closure, QueryContext) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.ExecuteCore[TResult](Expression query, Boolean async, CancellationToken cancellationToken) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.Execute[TResult](Expression query) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryProvider.Execute[TResult](Expression expression) +jellyfin | at Jellyfin.Server.Implementations.Item.BaseItemRepository.RetrieveItem(Guid id) +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.RetrieveItem(Guid id) +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.GetItemById(Guid id) +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.CreateRootFolder() +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.get_RootFolder() +jellyfin | at Emby.Server.Implementations.IO.LibraryMonitor.Start() +jellyfin | at System.Threading.CancellationTokenSource.Invoke(Delegate d, Object state, CancellationTokenSource source) +jellyfin | at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state) +jellyfin | --- End of stack trace from previous location --- +jellyfin | at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state) +jellyfin | at System.Threading.CancellationTokenSource.ExecuteCallbackHandlers(Boolean throwOnFirstException) +jellyfin | --- End of inner exception stack trace --- +jellyfin | at System.Threading.CancellationTokenSource.ExecuteCallbackHandlers(Boolean throwOnFirstException) +jellyfin | at Microsoft.Extensions.Hosting.Internal.ApplicationLifetime.NotifyStarted() +jellyfin | [14:53:17] [INF] [7] Emby.Server.Implementations.ApplicationHost: Running startup tasks +jellyfin | [14:53:17] [INF] [7] Emby.Server.Implementations.ScheduledTasks.TaskManager: Daily trigger for Generate Trickplay Images set to fire at 2026-10-28 03:00:00.000 +01:00, which is 12:06:42.7399308 from now. +jellyfin | [14:53:17] [INF] [7] Emby.Server.Implementations.ScheduledTasks.TaskManager: Daily trigger for Extract Chapter Images set to fire at 2026-10-28 02:00:00.000 +01:00, which is 11:06:42.7327532 from now. +jellyfin | [14:53:17] [INF] [7] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Found ffmpeg version 7.1.4 +jellyfin | [14:53:17] [INF] [7] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available decoders: ["libdav1d", "av1", "av1_cuvid", "av1_qsv", "h264", "h264_qsv", "h264_cuvid", "hevc", "hevc_qsv", "hevc_cuvid", "mpeg2video", "mpeg2_qsv", "mpeg2_cuvid", "mpeg4", "mpeg4_cuvid", "msmpeg4", "vc1_qsv", "vc1_cuvid", "vp8", "libvpx", "vp8_cuvid", "vp8_qsv", "vp9", "libvpx-vp9", "vp9_cuvid", "vp9_qsv", "aac", "ac3", "ac4", "dca", "flac", "mp3", "truehd"] +jellyfin | [14:53:17] [INF] [7] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available encoders: ["libsvtav1", "av1_nvenc", "av1_qsv", "av1_amf", "av1_vaapi", "libx264", "h264_amf", "h264_nvenc", "h264_qsv", "h264_v4l2m2m", "h264_vaapi", "libx265", "hevc_amf", "hevc_nvenc", "hevc_qsv", "hevc_vaapi", "mjpeg_qsv", "mjpeg_vaapi", "aac", "libfdk_aac", "ac3", "alac", "dca", "flac", "libmp3lame", "libopus", "truehd", "libvorbis", "srt"] +jellyfin | [14:53:17] [INF] [7] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available filters: ["bwdif_cuda", "bwdif_opencl", "deinterlace_qsv", "deinterlace_vaapi", "flip_vulkan", "hwupload_cuda", "hwupload_vaapi", "libplacebo", "overlay_opencl", "overlay_qsv", "overlay_vaapi", "overlay_vulkan", "overlay_cuda", "procamp_vaapi", "scale_cuda", "scale_opencl", "scale_qsv", "scale_vaapi", "scale_vulkan", "tonemapx", "tonemap_cuda", "tonemap_opencl", "tonemap_vaapi", "transpose_cuda", "transpose_opencl", "transpose_vaapi", "transpose_vulkan", "vpp_qsv", "yadif_cuda", "yadif_opencl", "zscale", "alphasrc"] +jellyfin | [14:53:17] [INF] [7] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available hwaccel types: ["cuda", "vaapi", "qsv", "drm", "opencl", "vulkan"] +jellyfin | [14:53:20] [INF] [13] Emby.Server.Implementations.ScheduledTasks.TaskManager: Clean Transcode Directory Completed after 0 minute(s) and 0 seconds +jellyfin | [14:53:20] [ERR] [9] Microsoft.EntityFrameworkCore.Database.Command: Failed executing DbCommand (1ms) [Parameters=[@__id_0='?' (DbType = Guid)], CommandType='Text', CommandTimeout='30'] +jellyfin | SELECT "b4"."Id", "b4"."Album", "b4"."AlbumArtists", "b4"."Artists", "b4"."Audio", "b4"."ChannelId", "b4"."CleanName", "b4"."CommunityRating", "b4"."CriticRating", "b4"."CustomRating", "b4"."Data", "b4"."DateCreated", "b4"."DateLastMediaAdded", "b4"."DateLastRefreshed", "b4"."DateLastSaved", "b4"."DateModified", "b4"."EndDate", "b4"."EpisodeTitle", "b4"."ExternalId", "b4"."ExternalSeriesId", "b4"."ExternalServiceId", "b4"."ExtraIds", "b4"."ExtraType", "b4"."ForcedSortName", "b4"."Genres", "b4"."Height", "b4"."IndexNumber", "b4"."InheritedParentalRatingSubValue", "b4"."InheritedParentalRatingValue", "b4"."IsFolder", "b4"."IsInMixedFolder", "b4"."IsLocked", "b4"."IsMovie", "b4"."IsRepeat", "b4"."IsSeries", "b4"."IsVirtualItem", "b4"."LUFS", "b4"."MediaType", "b4"."Name", "b4"."NormalizationGain", "b4"."OfficialRating", "b4"."OriginalTitle", "b4"."Overview", "b4"."OwnerId", "b4"."ParentId", "b4"."ParentIndexNumber", "b4"."Path", "b4"."PreferredMetadataCountryCode", "b4"."PreferredMetadataLanguage", "b4"."PremiereDate", "b4"."PresentationUniqueKey", "b4"."PrimaryVersionId", "b4"."ProductionLocations", "b4"."ProductionYear", "b4"."RunTimeTicks", "b4"."SeasonId", "b4"."SeasonName", "b4"."SeriesId", "b4"."SeriesName", "b4"."SeriesPresentationUniqueKey", "b4"."ShowId", "b4"."Size", "b4"."SortName", "b4"."StartDate", "b4"."Studios", "b4"."Tagline", "b4"."Tags", "b4"."TopParentId", "b4"."TotalBitrate", "b4"."Type", "b4"."UnratedType", "b4"."Width", "b0"."Id", "b0"."ItemId", "b1"."ItemId", "b1"."ProviderId", "b1"."ProviderValue", "b2"."Id", "b2"."ItemId", "u"."ItemId", "u"."UserId", "u"."CustomDataKey", "u"."AudioStreamIndex", "u"."IsFavorite", "u"."LastPlayedDate", "u"."Likes", "u"."PlayCount", "u"."PlaybackPositionTicks", "u"."Played", "u"."Rating", "u"."RetentionDate", "u"."SubtitleStreamIndex", "b3"."Id", "b3"."Blurhash", "b3"."DateModified", "b3"."Height", "b3"."ImageType", "b3"."ItemId", "b3"."Path", "b3"."Width" +jellyfin | FROM ( +jellyfin | SELECT "b"."Id", "b"."Album", "b"."AlbumArtists", "b"."Artists", "b"."Audio", "b"."ChannelId", "b"."CleanName", "b"."CommunityRating", "b"."CriticRating", "b"."CustomRating", "b"."Data", "b"."DateCreated", "b"."DateLastMediaAdded", "b"."DateLastRefreshed", "b"."DateLastSaved", "b"."DateModified", "b"."EndDate", "b"."EpisodeTitle", "b"."ExternalId", "b"."ExternalSeriesId", "b"."ExternalServiceId", "b"."ExtraIds", "b"."ExtraType", "b"."ForcedSortName", "b"."Genres", "b"."Height", "b"."IndexNumber", "b"."InheritedParentalRatingSubValue", "b"."InheritedParentalRatingValue", "b"."IsFolder", "b"."IsInMixedFolder", "b"."IsLocked", "b"."IsMovie", "b"."IsRepeat", "b"."IsSeries", "b"."IsVirtualItem", "b"."LUFS", "b"."MediaType", "b"."Name", "b"."NormalizationGain", "b"."OfficialRating", "b"."OriginalTitle", "b"."Overview", "b"."OwnerId", "b"."ParentId", "b"."ParentIndexNumber", "b"."Path", "b"."PreferredMetadataCountryCode", "b"."PreferredMetadataLanguage", "b"."PremiereDate", "b"."PresentationUniqueKey", "b"."PrimaryVersionId", "b"."ProductionLocations", "b"."ProductionYear", "b"."RunTimeTicks", "b"."SeasonId", "b"."SeasonName", "b"."SeriesId", "b"."SeriesName", "b"."SeriesPresentationUniqueKey", "b"."ShowId", "b"."Size", "b"."SortName", "b"."StartDate", "b"."Studios", "b"."Tagline", "b"."Tags", "b"."TopParentId", "b"."TotalBitrate", "b"."Type", "b"."UnratedType", "b"."Width" +jellyfin | FROM "BaseItems" AS "b" +jellyfin | WHERE "b"."Id" = @__id_0 +jellyfin | LIMIT 1 +jellyfin | ) AS "b4" +jellyfin | LEFT JOIN "BaseItemTrailerTypes" AS "b0" ON "b4"."Id" = "b0"."ItemId" +jellyfin | LEFT JOIN "BaseItemProviders" AS "b1" ON "b4"."Id" = "b1"."ItemId" +jellyfin | LEFT JOIN "BaseItemMetadataFields" AS "b2" ON "b4"."Id" = "b2"."ItemId" +jellyfin | LEFT JOIN "UserData" AS "u" ON "b4"."Id" = "u"."ItemId" +jellyfin | LEFT JOIN "BaseItemImageInfos" AS "b3" ON "b4"."Id" = "b3"."ItemId" +jellyfin | ORDER BY "b4"."Id", "b0"."Id", "b0"."ItemId", "b1"."ItemId", "b1"."ProviderId", "b2"."Id", "b2"."ItemId", "u"."ItemId", "u"."UserId", "u"."CustomDataKey" +jellyfin | [14:53:20] [ERR] [9] Microsoft.EntityFrameworkCore.Query: An exception occurred while iterating over the results of a query for context type 'Jellyfin.Database.Implementations.JellyfinDbContext'. +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: b.ExtraIds'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: b.ExtraIds'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | [14:53:20] [ERR] [9] Emby.Server.Implementations.ScheduledTasks.TaskManager: Error executing Scheduled Task +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: b.ExtraIds'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | at System.Linq.Enumerable.TryGetSingle[TSource](IEnumerable`1 source, Boolean& found) +jellyfin | at lambda_method376(Closure, QueryContext) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.ExecuteCore[TResult](Expression query, Boolean async, CancellationToken cancellationToken) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.Execute[TResult](Expression query) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryProvider.Execute[TResult](Expression expression) +jellyfin | at Jellyfin.Server.Implementations.Item.BaseItemRepository.RetrieveItem(Guid id) +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.RetrieveItem(Guid id) +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.GetItemById(Guid id) +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.CreateRootFolder() +jellyfin | at Emby.Server.Implementations.Library.LibraryManager.get_RootFolder() +jellyfin | at Emby.Server.Implementations.Collections.CollectionManager.FindFolders(String path) +jellyfin | at Emby.Server.Implementations.Collections.CollectionManager.EnsureLibraryFolder(String path, Boolean createIfNeeded) +jellyfin | at Emby.Server.Implementations.ScheduledTasks.Tasks.CleanupCollectionAndPlaylistPathsTask.ExecuteAsync(IProgress`1 progress, CancellationToken cancellationToken) +jellyfin | at Emby.Server.Implementations.ScheduledTasks.ScheduledTaskWorker.ExecuteInternal(TaskOptions options) +jellyfin | [14:53:20] [INF] [9] Emby.Server.Implementations.ScheduledTasks.TaskManager: Clean up collections and playlists Failed after 0 minute(s) and 0 seconds +jellyfin | [14:53:21] [INF] [13] Emby.Server.Implementations.ScheduledTasks.TaskManager: Update Plugins Completed after 0 minute(s) and 0 seconds +jellyfin | [14:53:21] [INF] [7] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: FFmpeg: /usr/lib/jellyfin-ffmpeg/ffmpeg +jellyfin | [14:53:21] [INF] [7] Emby.Server.Implementations.ApplicationHost: ServerId: 3c05d88a7b724053b0db0e4035cb3420 +jellyfin | [14:53:21] [INF] [7] Emby.Server.Implementations.ApplicationHost: Core startup complete +jellyfin | [14:53:21] [INF] [7] Main: Startup complete 0:00:07.6697478 +jellyfin | [14:53:44] [ERR] [17] Microsoft.EntityFrameworkCore.Database.Command: Failed executing DbCommand (0ms) [Parameters=[@__ToUpperInvariant_0='?' (Size = 13)], CommandType='Text', CommandTimeout='30'] +jellyfin | SELECT "s"."Id", "s"."AudioLanguagePreference", "s"."AuthenticationProviderId", "s"."CastReceiverId", "s"."DisplayCollectionsView", "s"."DisplayMissingEpisodes", "s"."EnableAutoLogin", "s"."EnableLocalPassword", "s"."EnableNextEpisodeAutoPlay", "s"."EnableUserPreferenceAccess", "s"."HidePlayedInLatest", "s"."InternalId", "s"."InvalidLoginAttemptCount", "s"."LastActivityDate", "s"."LastLoginDate", "s"."LoginAttemptsBeforeLockout", "s"."MaxActiveSessions", "s"."MaxParentalRatingScore", "s"."MaxParentalRatingSubScore", "s"."MustUpdatePassword", "s"."NormalizedUsername", "s"."Password", "s"."PasswordResetProviderId", "s"."PlayDefaultAudioTrack", "s"."RememberAudioSelections", "s"."RememberSubtitleSelections", "s"."RemoteClientBitrateLimit", "s"."RowVersion", "s"."SubtitleLanguagePreference", "s"."SubtitleMode", "s"."SyncPlayAccess", "s"."Username", "s"."Id0", "p"."Id", "p"."Kind", "p"."Permission_Permissions_Guid", "p"."RowVersion", "p"."UserId", "p"."Value", "p0"."Id", "p0"."Kind", "p0"."Preference_Preferences_Guid", "p0"."RowVersion", "p0"."UserId", "p0"."Value", "a"."Id", "a"."DayOfWeek", "a"."EndHour", "a"."StartHour", "a"."UserId", "s"."LastModified", "s"."Path", "s"."UserId" +jellyfin | FROM ( +jellyfin | SELECT "u"."Id", "u"."AudioLanguagePreference", "u"."AuthenticationProviderId", "u"."CastReceiverId", "u"."DisplayCollectionsView", "u"."DisplayMissingEpisodes", "u"."EnableAutoLogin", "u"."EnableLocalPassword", "u"."EnableNextEpisodeAutoPlay", "u"."EnableUserPreferenceAccess", "u"."HidePlayedInLatest", "u"."InternalId", "u"."InvalidLoginAttemptCount", "u"."LastActivityDate", "u"."LastLoginDate", "u"."LoginAttemptsBeforeLockout", "u"."MaxActiveSessions", "u"."MaxParentalRatingScore", "u"."MaxParentalRatingSubScore", "u"."MustUpdatePassword", "u"."NormalizedUsername", "u"."Password", "u"."PasswordResetProviderId", "u"."PlayDefaultAudioTrack", "u"."RememberAudioSelections", "u"."RememberSubtitleSelections", "u"."RemoteClientBitrateLimit", "u"."RowVersion", "u"."SubtitleLanguagePreference", "u"."SubtitleMode", "u"."SyncPlayAccess", "u"."Username", "i"."Id" AS "Id0", "i"."LastModified", "i"."Path", "i"."UserId" +jellyfin | FROM "Users" AS "u" +jellyfin | LEFT JOIN "ImageInfos" AS "i" ON "u"."Id" = "i"."UserId" +jellyfin | WHERE "u"."NormalizedUsername" = @__ToUpperInvariant_0 +jellyfin | LIMIT 1 +jellyfin | ) AS "s" +jellyfin | LEFT JOIN "Permissions" AS "p" ON "s"."Id" = "p"."UserId" +jellyfin | LEFT JOIN "Preferences" AS "p0" ON "s"."Id" = "p0"."UserId" +jellyfin | LEFT JOIN "AccessSchedules" AS "a" ON "s"."Id" = "a"."UserId" +jellyfin | ORDER BY "s"."Id", "s"."Id0", "p"."Id", "p0"."Id" +jellyfin | [14:53:44] [ERR] [17] Microsoft.EntityFrameworkCore.Query: An exception occurred while iterating over the results of a query for context type 'Jellyfin.Database.Implementations.JellyfinDbContext'. +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: p.Permission_Permissions_Guid'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: p.Permission_Permissions_Guid'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | [14:53:44] [ERR] [17] Jellyfin.Api.Middleware.ExceptionMiddleware: Error processing request. URL POST /Users/AuthenticateByName. +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: p.Permission_Permissions_Guid'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | at System.Linq.Enumerable.TryGetSingle[TSource](IEnumerable`1 source, Boolean& found) +jellyfin | at lambda_method693(Closure, QueryContext) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.ExecuteCore[TResult](Expression query, Boolean async, CancellationToken cancellationToken) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.Execute[TResult](Expression query) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryProvider.Execute[TResult](Expression expression) +jellyfin | at Jellyfin.Server.Implementations.Users.UserManager.GetUserByName(String name) +jellyfin | at Emby.Server.Implementations.Session.SessionManager.AuthenticateNewSessionInternal(AuthenticationRequest request, Boolean enforcePassword) +jellyfin | at Jellyfin.Api.Controllers.UserController.AuthenticateUserByName(AuthenticateUserByName request) +jellyfin | at lambda_method562(Closure, Object) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.AwaitableObjectResultExecutor.Execute(ActionContext actionContext, IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask`1 actionResultValueTask) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync() +jellyfin | --- End of stack trace from previous location --- +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|25_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.InvokeFilterPipelineAsync() +jellyfin | --- End of stack trace from previous location --- +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope) +jellyfin | at Jellyfin.Api.Middleware.ServerStartupMessageMiddleware.Invoke(HttpContext httpContext, IServerApplicationHost serverApplicationHost, ILocalizationManager localizationManager) +jellyfin | at Jellyfin.Api.Middleware.WebSocketHandlerMiddleware.Invoke(HttpContext httpContext, IWebSocketManager webSocketManager) +jellyfin | at Jellyfin.Api.Middleware.IPBasedAccessValidationMiddleware.Invoke(HttpContext httpContext, INetworkManager networkManager) +jellyfin | at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context) +jellyfin | at Jellyfin.Api.Middleware.QueryStringDecodingMiddleware.Invoke(HttpContext httpContext) +jellyfin | at Swashbuckle.AspNetCore.ReDoc.ReDocMiddleware.Invoke(HttpContext httpContext) +jellyfin | at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext) +jellyfin | at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider) +jellyfin | at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context) +jellyfin | at Jellyfin.Api.Middleware.RobotsRedirectionMiddleware.Invoke(HttpContext httpContext) +jellyfin | at Jellyfin.Api.Middleware.LegacyEmbyRouteRewriteMiddleware.Invoke(HttpContext httpContext) +jellyfin | at Jellyfin.Api.Middleware.ResponseTimeMiddleware.Invoke(HttpContext context, IServerConfigurationManager serverConfigurationManager) +jellyfin | at Jellyfin.Api.Middleware.ExceptionMiddleware.Invoke(HttpContext context) +jellyfin | [14:53:44] [ERR] [10] Microsoft.EntityFrameworkCore.Database.Command: Failed executing DbCommand (0ms) [Parameters=[@__ToUpperInvariant_0='?' (Size = 13)], CommandType='Text', CommandTimeout='30'] +jellyfin | SELECT "s"."Id", "s"."AudioLanguagePreference", "s"."AuthenticationProviderId", "s"."CastReceiverId", "s"."DisplayCollectionsView", "s"."DisplayMissingEpisodes", "s"."EnableAutoLogin", "s"."EnableLocalPassword", "s"."EnableNextEpisodeAutoPlay", "s"."EnableUserPreferenceAccess", "s"."HidePlayedInLatest", "s"."InternalId", "s"."InvalidLoginAttemptCount", "s"."LastActivityDate", "s"."LastLoginDate", "s"."LoginAttemptsBeforeLockout", "s"."MaxActiveSessions", "s"."MaxParentalRatingScore", "s"."MaxParentalRatingSubScore", "s"."MustUpdatePassword", "s"."NormalizedUsername", "s"."Password", "s"."PasswordResetProviderId", "s"."PlayDefaultAudioTrack", "s"."RememberAudioSelections", "s"."RememberSubtitleSelections", "s"."RemoteClientBitrateLimit", "s"."RowVersion", "s"."SubtitleLanguagePreference", "s"."SubtitleMode", "s"."SyncPlayAccess", "s"."Username", "s"."Id0", "p"."Id", "p"."Kind", "p"."Permission_Permissions_Guid", "p"."RowVersion", "p"."UserId", "p"."Value", "p0"."Id", "p0"."Kind", "p0"."Preference_Preferences_Guid", "p0"."RowVersion", "p0"."UserId", "p0"."Value", "a"."Id", "a"."DayOfWeek", "a"."EndHour", "a"."StartHour", "a"."UserId", "s"."LastModified", "s"."Path", "s"."UserId" +jellyfin | FROM ( +jellyfin | SELECT "u"."Id", "u"."AudioLanguagePreference", "u"."AuthenticationProviderId", "u"."CastReceiverId", "u"."DisplayCollectionsView", "u"."DisplayMissingEpisodes", "u"."EnableAutoLogin", "u"."EnableLocalPassword", "u"."EnableNextEpisodeAutoPlay", "u"."EnableUserPreferenceAccess", "u"."HidePlayedInLatest", "u"."InternalId", "u"."InvalidLoginAttemptCount", "u"."LastActivityDate", "u"."LastLoginDate", "u"."LoginAttemptsBeforeLockout", "u"."MaxActiveSessions", "u"."MaxParentalRatingScore", "u"."MaxParentalRatingSubScore", "u"."MustUpdatePassword", "u"."NormalizedUsername", "u"."Password", "u"."PasswordResetProviderId", "u"."PlayDefaultAudioTrack", "u"."RememberAudioSelections", "u"."RememberSubtitleSelections", "u"."RemoteClientBitrateLimit", "u"."RowVersion", "u"."SubtitleLanguagePreference", "u"."SubtitleMode", "u"."SyncPlayAccess", "u"."Username", "i"."Id" AS "Id0", "i"."LastModified", "i"."Path", "i"."UserId" +jellyfin | FROM "Users" AS "u" +jellyfin | LEFT JOIN "ImageInfos" AS "i" ON "u"."Id" = "i"."UserId" +jellyfin | WHERE "u"."NormalizedUsername" = @__ToUpperInvariant_0 +jellyfin | LIMIT 1 +jellyfin | ) AS "s" +jellyfin | LEFT JOIN "Permissions" AS "p" ON "s"."Id" = "p"."UserId" +jellyfin | LEFT JOIN "Preferences" AS "p0" ON "s"."Id" = "p0"."UserId" +jellyfin | LEFT JOIN "AccessSchedules" AS "a" ON "s"."Id" = "a"."UserId" +jellyfin | ORDER BY "s"."Id", "s"."Id0", "p"."Id", "p0"."Id" +jellyfin | [14:53:44] [ERR] [10] Microsoft.EntityFrameworkCore.Query: An exception occurred while iterating over the results of a query for context type 'Jellyfin.Database.Implementations.JellyfinDbContext'. +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: p.Permission_Permissions_Guid'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: p.Permission_Permissions_Guid'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | [14:53:44] [ERR] [10] Jellyfin.Api.Middleware.ExceptionMiddleware: Error processing request. URL POST /Users/AuthenticateByName. +jellyfin | Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'no such column: p.Permission_Permissions_Guid'. +jellyfin | at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() +jellyfin | at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) +jellyfin | at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReader(CommandBehavior behavior) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.b__21_0(DbContext _, Enumerator enumerator) +jellyfin | at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext() +jellyfin | at System.Linq.Enumerable.TryGetSingle[TSource](IEnumerable`1 source, Boolean& found) +jellyfin | at lambda_method693(Closure, QueryContext) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.ExecuteCore[TResult](Expression query, Boolean async, CancellationToken cancellationToken) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.Execute[TResult](Expression query) +jellyfin | at Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryProvider.Execute[TResult](Expression expression) +jellyfin | at Jellyfin.Server.Implementations.Users.UserManager.GetUserByName(String name) +jellyfin | at Emby.Server.Implementations.Session.SessionManager.AuthenticateNewSessionInternal(AuthenticationRequest request, Boolean enforcePassword) +jellyfin | at Jellyfin.Api.Controllers.UserController.AuthenticateUserByName(AuthenticateUserByName request) +jellyfin | at lambda_method562(Closure, Object) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.AwaitableObjectResultExecutor.Execute(ActionContext actionContext, IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask`1 actionResultValueTask) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync() +jellyfin | --- End of stack trace from previous location --- +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|25_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.InvokeFilterPipelineAsync() +jellyfin | --- End of stack trace from previous location --- +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope) +jellyfin | at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope) +jellyfin | at Jellyfin.Api.Middleware.ServerStartupMessageMiddleware.Invoke(HttpContext httpContext, IServerApplicationHost serverApplicationHost, ILocalizationManager localizationManager) +jellyfin | at Jellyfin.Api.Middleware.WebSocketHandlerMiddleware.Invoke(HttpContext httpContext, IWebSocketManager webSocketManager) +jellyfin | at Jellyfin.Api.Middleware.IPBasedAccessValidationMiddleware.Invoke(HttpContext httpContext, INetworkManager networkManager) +jellyfin | at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context) +jellyfin | at Jellyfin.Api.Middleware.QueryStringDecodingMiddleware.Invoke(HttpContext httpContext) +jellyfin | at Swashbuckle.AspNetCore.ReDoc.ReDocMiddleware.Invoke(HttpContext httpContext) +jellyfin | at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext) +jellyfin | at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider) +jellyfin | at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context) +jellyfin | at Jellyfin.Api.Middleware.RobotsRedirectionMiddleware.Invoke(HttpContext httpContext) +jellyfin | at Jellyfin.Api.Middleware.LegacyEmbyRouteRewriteMiddleware.Invoke(HttpContext httpContext) +jellyfin | at Jellyfin.Api.Middleware.ResponseTimeMiddleware.Invoke(HttpContext context, IServerConfigurationManager serverConfigurationManager) +jellyfin | at Jellyfin.Api.Middleware.ExceptionMiddleware.Invoke(HttpContext context) diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/engine-state.json b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/engine-state.json new file mode 100644 index 00000000..ec747fa4 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/engine-state.json @@ -0,0 +1 @@ +null \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/files-after-detail.json b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/files-after-detail.json new file mode 100644 index 00000000..68db7a93 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/files-after-detail.json @@ -0,0 +1,3 @@ +{ + "/srv/felhom-gate/hdd/userdata/media": {} +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/files-after.json b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/files-after.json new file mode 100644 index 00000000..65fca25a --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/files-after.json @@ -0,0 +1,3 @@ +{ + "/srv/felhom-gate/hdd/userdata/media": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/files-before-detail.json b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/files-before-detail.json new file mode 100644 index 00000000..68db7a93 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/files-before-detail.json @@ -0,0 +1,3 @@ +{ + "/srv/felhom-gate/hdd/userdata/media": {} +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/files-before.json b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/files-before.json new file mode 100644 index 00000000..65fca25a --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/files-before.json @@ -0,0 +1,3 @@ +{ + "/srv/felhom-gate/hdd/userdata/media": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/memory-samples.json b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/memory-samples.json new file mode 100644 index 00000000..9665ee89 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/memory-samples.json @@ -0,0 +1,762 @@ +[ + { + "t": 15.1, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 195948544, + "peak": 196870144, + "anon": 107573248, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 301 + }, + { + "t": 30.3, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 194011136, + "peak": 196870144, + "anon": 105316352, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 601 + }, + { + "t": 45.4, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 191225856, + "peak": 196870144, + "anon": 103079936, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 904 + }, + { + "t": 60.5, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 181391360, + "peak": 196870144, + "anon": 93257728, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1204 + }, + { + "t": 75.7, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 181891072, + "peak": 196870144, + "anon": 93450240, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1504 + }, + { + "t": 90.8, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 183521280, + "peak": 196870144, + "anon": 95334400, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1804 + }, + { + "t": 105.9, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 183816192, + "peak": 196870144, + "anon": 95608832, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2104 + }, + { + "t": 121.0, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 182648832, + "peak": 196870144, + "anon": 94195712, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2405 + }, + { + "t": 136.2, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 181731328, + "peak": 196870144, + "anon": 93548544, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2705 + }, + { + "t": 151.3, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 184786944, + "peak": 196870144, + "anon": 96026624, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3006 + }, + { + "t": 166.4, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 184762368, + "peak": 196870144, + "anon": 95977472, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3306 + }, + { + "t": 181.6, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 181903360, + "peak": 196870144, + "anon": 93880320, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3606 + }, + { + "t": 196.7, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 182116352, + "peak": 196870144, + "anon": 93601792, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3906 + }, + { + "t": 211.8, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 183742464, + "peak": 196870144, + "anon": 94404608, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4206 + }, + { + "t": 227.0, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 182726656, + "peak": 196870144, + "anon": 93937664, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4506 + }, + { + "t": 242.1, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 182358016, + "peak": 196870144, + "anon": 94298112, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4806 + }, + { + "t": 257.2, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 182022144, + "peak": 196870144, + "anon": 93716480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5106 + }, + { + "t": 272.3, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 184700928, + "peak": 196870144, + "anon": 96346112, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5406 + }, + { + "t": 287.5, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 182525952, + "peak": 196870144, + "anon": 93921280, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5706 + }, + { + "t": 302.6, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 183685120, + "peak": 196870144, + "anon": 95023104, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6007 + }, + { + "t": 317.7, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 182583296, + "peak": 196870144, + "anon": 94195712, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6307 + }, + { + "t": 332.8, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 183029760, + "peak": 196870144, + "anon": 94629888, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6607 + }, + { + "t": 348.0, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 183410688, + "peak": 196870144, + "anon": 94707712, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6907 + }, + { + "t": 363.1, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 183795712, + "peak": 196870144, + "anon": 95580160, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7207 + }, + { + "t": 378.2, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 177434624, + "peak": 196870144, + "anon": 89333760, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7507 + }, + { + "t": 393.4, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 179470336, + "peak": 196870144, + "anon": 91172864, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7807 + }, + { + "t": 408.5, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 178315264, + "peak": 196870144, + "anon": 89968640, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8107 + }, + { + "t": 423.6, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 187310080, + "peak": 196870144, + "anon": 99012608, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8407 + }, + { + "t": 438.8, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 178249728, + "peak": 196870144, + "anon": 89939968, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8707 + }, + { + "t": 453.9, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 179478528, + "peak": 196870144, + "anon": 91123712, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9007 + }, + { + "t": 469.0, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 177709056, + "peak": 196870144, + "anon": 89366528, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9307 + }, + { + "t": 484.2, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 178049024, + "peak": 196870144, + "anon": 89657344, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9607 + }, + { + "t": 499.3, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 177684480, + "peak": 196870144, + "anon": 89055232, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9907 + }, + { + "t": 514.4, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 179658752, + "peak": 196870144, + "anon": 90476544, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10208 + }, + { + "t": 529.6, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 178122752, + "peak": 196870144, + "anon": 88973312, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10511 + }, + { + "t": 544.7, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 181448704, + "peak": 196870144, + "anon": 92774400, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10811 + }, + { + "t": 559.8, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 182231040, + "peak": 196870144, + "anon": 92798976, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11111 + }, + { + "t": 575.0, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 181800960, + "peak": 196870144, + "anon": 93040640, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11411 + }, + { + "t": 590.1, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 177614848, + "peak": 196870144, + "anon": 89411584, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11711 + }, + { + "t": 605.2, + "containers": { + "jellyfin": { + "limit": 2147483648, + "current": 178601984, + "peak": 196870144, + "anon": 89833472, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 12011 + } +] \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/migration-lines.txt b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/migration-lines.txt new file mode 100644 index 00000000..a4a8ecf2 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/migration-lines.txt @@ -0,0 +1,6 @@ +jellyfin | [14:42:35] [INF] [9] Jellyfin.Server.Migrations.JellyfinMigrationService: Initialise Migration service. +jellyfin | [14:42:36] [INF] [9] Jellyfin.Server.Migrations.JellyfinMigrationService: There are 1 migrations for stage PreInitialisation. +jellyfin | [14:42:36] [INF] [9] InternalCodeMigration: Perform migration 20260915104305_FixNullEncoderPreset +jellyfin | [14:42:36] [INF] [9] Jellyfin.Server.Migrations.Routines.FixNullEncoderPreset: Replaced null encoder preset with auto in encoding configuration +jellyfin | [14:42:36] [INF] [9] InternalCodeMigration: Migration 20260915104305_FixNullEncoderPreset was successfully applied +jellyfin | [14:42:37] [INF] [9] Main: Prepare system for possible migrations \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/run.log b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/run.log new file mode 100644 index 00000000..8a46d56a --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/run.log @@ -0,0 +1,58 @@ +[13:41:09] scratch drive folders cleared before FROM (R-656): ['/srv/felhom-gate/hdd/userdata/media'] +[13:41:09] MV-jellyfin: deploying jellyfin at FROM {'jellyfin': 'jellyfin/jellyfin:10.11.11'} +[13:41:41] FROM settled=True in 31.0s :: {"jellyfin": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:41:41] fixture: the BOX walk's own (Jellyfin), through upgrade_boxport +[13:41:42] jellyfin: seeded first user drillb4777ead +[13:41:43] jellyfin: sign-in as the seeded user http=200 token=True (wrong password refused: http 401) +[13:41:43] C1 (seed reads back BEFORE): True +[13:41:44] MV-jellyfin: swapping to TO {'jellyfin': 'jellyfin/jellyfin:12.4'} +[13:42:34] TO up -d rc=0 +[13:43:05] TO settled=True in 30.9s :: {"jellyfin": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:43:05] migration lines observed: 6 +[13:43:06] jellyfin: sign-in as the seeded user http=200 token=True (wrong password refused: http 401) +[13:43:06] RESULT (seed reads back AFTER): True +[13:43:07] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:8096 +[13:43:22] + 15s jellyfin=186M/2048M peak=187M kills=0 rs=0 reqs=301 +[13:43:37] + 30s jellyfin=185M/2048M peak=187M kills=0 rs=0 reqs=601 +[13:43:52] + 45s jellyfin=182M/2048M peak=187M kills=0 rs=0 reqs=904 +[13:44:07] + 60s jellyfin=172M/2048M peak=187M kills=0 rs=0 reqs=1204 +[13:44:22] + 76s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=1504 +[13:44:37] + 91s jellyfin=175M/2048M peak=187M kills=0 rs=0 reqs=1804 +[13:44:53] + 106s jellyfin=175M/2048M peak=187M kills=0 rs=0 reqs=2104 +[13:45:08] + 121s jellyfin=174M/2048M peak=187M kills=0 rs=0 reqs=2405 +[13:45:23] + 136s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=2705 +[13:45:38] + 151s jellyfin=176M/2048M peak=187M kills=0 rs=0 reqs=3006 +[13:45:53] + 166s jellyfin=176M/2048M peak=187M kills=0 rs=0 reqs=3306 +[13:46:08] + 182s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=3606 +[13:46:23] + 197s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=3906 +[13:46:38] + 212s jellyfin=175M/2048M peak=187M kills=0 rs=0 reqs=4206 +[13:46:54] + 227s jellyfin=174M/2048M peak=187M kills=0 rs=0 reqs=4506 +[13:47:09] + 242s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=4806 +[13:47:24] + 257s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=5106 +[13:47:39] + 272s jellyfin=176M/2048M peak=187M kills=0 rs=0 reqs=5406 +[13:47:54] + 288s jellyfin=174M/2048M peak=187M kills=0 rs=0 reqs=5706 +[13:48:09] + 303s jellyfin=175M/2048M peak=187M kills=0 rs=0 reqs=6007 +[13:48:24] + 318s jellyfin=174M/2048M peak=187M kills=0 rs=0 reqs=6307 +[13:48:39] + 333s jellyfin=174M/2048M peak=187M kills=0 rs=0 reqs=6607 +[13:48:55] + 348s jellyfin=174M/2048M peak=187M kills=0 rs=0 reqs=6907 +[13:49:10] + 363s jellyfin=175M/2048M peak=187M kills=0 rs=0 reqs=7207 +[13:49:25] + 378s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=7507 +[13:49:40] + 393s jellyfin=171M/2048M peak=187M kills=0 rs=0 reqs=7807 +[13:49:55] + 408s jellyfin=170M/2048M peak=187M kills=0 rs=0 reqs=8107 +[13:50:10] + 424s jellyfin=178M/2048M peak=187M kills=0 rs=0 reqs=8407 +[13:50:25] + 439s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=8707 +[13:50:40] + 454s jellyfin=171M/2048M peak=187M kills=0 rs=0 reqs=9007 +[13:50:56] + 469s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=9307 +[13:51:11] + 484s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=9607 +[13:51:26] + 499s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=9907 +[13:51:41] + 514s jellyfin=171M/2048M peak=187M kills=0 rs=0 reqs=10208 +[13:51:56] + 530s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=10511 +[13:52:11] + 545s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=10811 +[13:52:26] + 560s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=11111 +[13:52:42] + 575s jellyfin=173M/2048M peak=187M kills=0 rs=0 reqs=11411 +[13:52:57] + 590s jellyfin=169M/2048M peak=187M kills=0 rs=0 reqs=11711 +[13:53:12] + 605s jellyfin=170M/2048M peak=187M kills=0 rs=0 reqs=12011 +[13:53:12] memory watch: killed=False tight=[] requests=12011 codes={'302': 12011} +[13:53:12] MV-jellyfin: ABORT — putting the FROM images back +[13:53:44] jellyfin: sign-in as the seeded user http=500 token=False (wrong password refused: http 500) +[13:53:44] ABORT: app came back in 30.9s; data present=False \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/to-full.log b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/to-full.log new file mode 100644 index 00000000..b42ac81a --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/to-full.log @@ -0,0 +1,205 @@ +jellyfin | [14:42:34] [INF] [1] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:42:35] [INF] [9] Jellyfin.Server.ServerSetupApp.SetupServer: Kestrel is listening on 0.0.0.0 +jellyfin | [14:42:35] [INF] [9] Main: Jellyfin version: 12.4.0 +jellyfin | [14:42:35] [INF] [9] Main: Environment Variables: ["[JELLYFIN_DATA_DIR, /config]", "[JELLYFIN_CONFIG_DIR, /config/config]", "[JELLYFIN_CACHE_DIR, /cache]", "[JELLYFIN_FFMPEG, /usr/lib/jellyfin-ffmpeg/ffmpeg]", "[JELLYFIN_LOG_DIR, /config/log]", "[JELLYFIN_WEB_DIR, /jellyfin/jellyfin-web]"] +jellyfin | [14:42:35] [INF] [9] Main: Arguments: ["/jellyfin/jellyfin.dll"] +jellyfin | [14:42:35] [INF] [9] Main: Operating system: Debian GNU/Linux 13 (trixie) +jellyfin | [14:42:35] [INF] [9] Main: Architecture: X64 +jellyfin | [14:42:35] [INF] [9] Main: 64-Bit Process: True +jellyfin | [14:42:35] [INF] [9] Main: User Interactive: True +jellyfin | [14:42:35] [INF] [9] Main: Processor count: 6 +jellyfin | [14:42:35] [INF] [9] Main: Program data path: /config +jellyfin | [14:42:35] [INF] [9] Main: Log directory path: /config/log +jellyfin | [14:42:35] [INF] [9] Main: Config directory path: /config/config +jellyfin | [14:42:35] [INF] [9] Main: Cache path: /cache +jellyfin | [14:42:35] [INF] [9] Main: Temp directory path: /tmp/jellyfin +jellyfin | [14:42:35] [INF] [9] Main: Web resources path: /jellyfin/jellyfin-web +jellyfin | [14:42:35] [INF] [9] Main: Application directory: /jellyfin/ +jellyfin | [14:42:35] [INF] [9] Jellyfin.Server.Startup: Storage path `/config/data` (Fixed) successfully checked with 40.4GiB free which is over the minimum of 2GiB. +jellyfin | [14:42:35] [INF] [9] Jellyfin.Server.Startup: Storage path `/cache` (Fixed) successfully checked with 40.4GiB free which is over the minimum of 2GiB. +jellyfin | [14:42:35] [INF] [9] Jellyfin.Server.Startup: Storage path `/config` (Fixed) successfully checked with 40.4GiB free which is over the minimum of 2GiB. +jellyfin | [14:42:35] [INF] [9] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:42:35] [INF] [9] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: SQLite connection string: Data Source=/config/data/jellyfin.db;Cache=Private;Default Timeout=60;Pooling=True +jellyfin | [14:42:35] [INF] [9] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: SQLITE connection pragma command set to: +jellyfin | PRAGMA locking_mode=NORMAL; +jellyfin | PRAGMA journal_size_limit=134217728; +jellyfin | PRAGMA synchronous=1; +jellyfin | PRAGMA temp_store=2; +jellyfin | +jellyfin | [14:42:35] [INF] [9] Jellyfin.Database.Implementations.Locking.NoLockBehavior: The database locking mode has been set to: NoLock. +jellyfin | [14:42:35] [INF] [9] Jellyfin.Server.Migrations.JellyfinMigrationService: Initialise Migration service. +jellyfin | [14:42:36] [INF] [9] Jellyfin.Server.Migrations.JellyfinMigrationService: There are 1 migrations for stage PreInitialisation. +jellyfin | [14:42:36] [INF] [9] InternalCodeMigration: Perform migration 20260915104305_FixNullEncoderPreset +jellyfin | [14:42:36] [INF] [9] Jellyfin.Server.Migrations.Routines.FixNullEncoderPreset: Replaced null encoder preset with auto in encoding configuration +jellyfin | [14:42:36] [INF] [9] InternalCodeMigration: Migration 20260915104305_FixNullEncoderPreset was successfully applied +jellyfin | [14:42:36] [INF] [9] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:42:36] [INF] [9] Emby.Server.Implementations.ApplicationHost: Loading assemblies +jellyfin | [14:42:36] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Defined LAN subnets: ["127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"] +jellyfin | [14:42:36] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Defined LAN exclusions: [] +jellyfin | [14:42:36] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Used LAN subnets: ["127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"] +jellyfin | [14:42:36] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Filtered interface addresses: ["127.0.0.1", "172.18.0.2"] +jellyfin | [14:42:36] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Bind Addresses ["0.0.0.0"] +jellyfin | [14:42:36] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Remote IP filter is Allowlist +jellyfin | [14:42:36] [INF] [9] Jellyfin.Networking.Manager.NetworkManager: Filtered subnets: [] +jellyfin | [14:42:37] [INF] [9] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: SQLite connection string: Data Source=/config/data/jellyfin.db;Cache=Private;Default Timeout=60;Pooling=True +jellyfin | [14:42:37] [INF] [9] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: SQLITE connection pragma command set to: +jellyfin | PRAGMA locking_mode=NORMAL; +jellyfin | PRAGMA journal_size_limit=134217728; +jellyfin | PRAGMA synchronous=1; +jellyfin | PRAGMA temp_store=2; +jellyfin | +jellyfin | [14:42:37] [INF] [9] Jellyfin.Database.Implementations.Locking.NoLockBehavior: The database locking mode has been set to: NoLock. +jellyfin | [14:42:37] [INF] [9] Main: Prepare system for possible migrations +jellyfin | [14:42:37] [INF] [9] Main: A migration will attempt to modify the jellyfin.db, will attempt to backup the file now. +jellyfin | [14:42:37] [INF] [9] Main: Jellyfin database has been backed up as 20261027134237 +jellyfin | [14:42:37] [INF] [9] Jellyfin.Server.Migrations.JellyfinMigrationService: There are 19 migrations for stage CoreInitialisation. +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Perform migration 20260113102337_AddLinkedChildrenTable +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Migration 20260113102337_AddLinkedChildrenTable was successfully applied +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Perform migration 20260113203012_ChangeOwnerIdToGuid +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Migration 20260113203012_ChangeOwnerIdToGuid was successfully applied +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Perform migration 20260113233000_AddForeignKeyToOwnerId +jellyfin | [14:42:37] [WRN] [9] Microsoft.EntityFrameworkCore.Migrations: An operation of type 'SqlOperation' will be attempted while a rebuild of table 'BaseItems' is pending. The database may not be in an expected state. Review the SQL generated by this migration to help diagnose any failures. Consider moving these operations to a subsequent migration. +jellyfin | [14:42:37] [WRN] [9] Microsoft.EntityFrameworkCore.Migrations: An operation of type 'UpdateDataOperation' will be attempted while a rebuild of table 'BaseItems' is pending. The database may not be in an expected state. Review the SQL generated by this migration to help diagnose any failures. Consider moving these operations to a subsequent migration. +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Migration 20260113233000_AddForeignKeyToOwnerId was successfully applied +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Perform migration 20260113233500_DropExtraIdsColumn +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Migration 20260113233500_DropExtraIdsColumn was successfully applied +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Perform migration 20260116114245_AddLatestItemsDateCreatedIndexes +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Migration 20260116114245_AddLatestItemsDateCreatedIndexes was successfully applied +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Perform migration 20260118182305_AddIndicesToImageInfo +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Migration 20260118182305_AddIndicesToImageInfo was successfully applied +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Perform migration 20260130232147_AddBaseItemNameIndex +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Migration 20260130232147_AddBaseItemNameIndex was successfully applied +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Perform migration 20260206224832_IndexOptimizations +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Migration 20260206224832_IndexOptimizations was successfully applied +jellyfin | [14:42:37] [INF] [9] InternalDatabaseMigration: Perform migration 20260215201634_ChangePrimaryVersionIdToGuid +jellyfin | [14:42:38] [INF] [9] InternalDatabaseMigration: Migration 20260215201634_ChangePrimaryVersionIdToGuid was successfully applied +jellyfin | [14:42:38] [INF] [9] InternalDatabaseMigration: Perform migration 20260308123920_AddTypeCleanNameIndex +jellyfin | [14:42:38] [INF] [9] InternalDatabaseMigration: Migration 20260308123920_AddTypeCleanNameIndex was successfully applied +jellyfin | [14:42:38] [INF] [9] InternalDatabaseMigration: Perform migration 20260504075755_AddPartialIndexForItemCounts +jellyfin | [14:42:38] [INF] [9] InternalDatabaseMigration: Migration 20260504075755_AddPartialIndexForItemCounts was successfully applied +jellyfin | [14:42:38] [INF] [9] InternalDatabaseMigration: Perform migration 20260522092303_AddNormalizedUsername +jellyfin | [14:42:38] [INF] [9] InternalDatabaseMigration: Migration 20260522092303_AddNormalizedUsername was successfully applied +jellyfin | [14:42:38] [INF] [9] InternalCodeMigration: Perform migration 20260522092304_UpdateNormalizedUsername +jellyfin | [14:42:38] [INF] [9] InternalCodeMigration: Migration 20260522092304_UpdateNormalizedUsername was successfully applied +jellyfin | [14:42:38] [INF] [9] InternalDatabaseMigration: Perform migration 20260524120336_AddUniqueNormalizedUsernameIndex +jellyfin | [14:42:38] [INF] [9] InternalDatabaseMigration: Migration 20260524120336_AddUniqueNormalizedUsernameIndex was successfully applied +jellyfin | [14:42:38] [INF] [9] InternalCodeMigration: Perform migration 20260531160000_DisableLegacyAuthorization +jellyfin | [14:42:38] [INF] [9] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Saving system configuration +jellyfin | [14:42:38] [INF] [9] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /cache +jellyfin | [14:42:38] [INF] [9] InternalCodeMigration: Migration 20260531160000_DisableLegacyAuthorization was successfully applied +jellyfin | [14:42:38] [INF] [9] InternalDatabaseMigration: Perform migration 20260723111547_AllowDuplicatePlaylistChildren +jellyfin | [14:42:39] [INF] [9] InternalDatabaseMigration: Migration 20260723111547_AllowDuplicatePlaylistChildren was successfully applied +jellyfin | [14:42:39] [INF] [9] InternalDatabaseMigration: Perform migration 20260724185102_AddPrimaryVersionIdIndex +jellyfin | [14:42:39] [INF] [9] InternalDatabaseMigration: Migration 20260724185102_AddPrimaryVersionIdIndex was successfully applied +jellyfin | [14:42:39] [INF] [9] InternalDatabaseMigration: Perform migration 20260728170000_AddPeopleNameLowerIndex +jellyfin | [14:42:39] [INF] [9] InternalDatabaseMigration: Migration 20260728170000_AddPeopleNameLowerIndex was successfully applied +jellyfin | [14:42:39] [INF] [9] InternalDatabaseMigration: Perform migration 20260728182152_AddPeopleItemMapCoveringIndex +jellyfin | [14:42:39] [INF] [9] InternalDatabaseMigration: Migration 20260728182152_AddPeopleItemMapCoveringIndex was successfully applied +jellyfin | [14:42:39] [INF] [9] InternalDatabaseMigration: Perform migration 20260812050902_AddMediaStreamFilterIndex +jellyfin | [14:42:39] [INF] [9] InternalDatabaseMigration: Migration 20260812050902_AddMediaStreamFilterIndex was successfully applied +jellyfin | [14:42:39] [INF] [9] InternalDatabaseMigration: Perform migration 20260815063607_RemoveOrphanedUserPermissionsAndPreferences +jellyfin | [14:42:39] [INF] [9] InternalDatabaseMigration: Migration 20260815063607_RemoveOrphanedUserPermissionsAndPreferences was successfully applied +jellyfin | [14:42:39] [INF] [9] InternalDatabaseMigration: Perform migration 20261002210711_MakeOwnerIdIndexesPartial +jellyfin | [14:42:39] [INF] [9] InternalDatabaseMigration: Migration 20261002210711_MakeOwnerIdIndexesPartial was successfully applied +jellyfin | [14:42:39] [INF] [9] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: TMDb 12.4.0.0 +jellyfin | [14:42:39] [INF] [9] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: Studio Images 12.4.0.0 +jellyfin | [14:42:39] [INF] [9] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: OMDb 12.4.0.0 +jellyfin | [14:42:39] [INF] [9] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: MusicBrainz 12.4.0.0 +jellyfin | [14:42:39] [INF] [9] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: ListenBrainz Similarity Provider 12.4.0.0 +jellyfin | [14:42:39] [INF] [9] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: AudioDB 12.4.0.0 +jellyfin | [14:42:39] [INF] [9] Emby.Server.Implementations.Library.Search.SearchManager: Registered 0 external search providers: . Fallback providers: Database (priority 100) +jellyfin | [14:42:39] [INF] [9] Jellyfin.Server.Migrations.JellyfinMigrationService: There are 16 migrations for stage AppInitialisation. +jellyfin | [14:42:39] [INF] [9] InternalCodeMigration: Perform migration 20260113120000_MigrateLinkedChildren +jellyfin | [14:42:39] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: Found 0 potential items with LinkedChildren data to process. +jellyfin | [14:42:39] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: No LinkedChildren data found to migrate. +jellyfin | [14:42:39] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: LinkedChildren migration completed. Processed 0 items, dropped 0 unresolvable children. +jellyfin | [14:42:39] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: Cleaning up alternate version items with wrong type... +jellyfin | [14:42:39] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: No wrong-type alternate version items found. +jellyfin | [14:42:39] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: Starting cleanup of orphaned alternate version BaseItems... +jellyfin | [14:42:39] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: No orphaned alternate version BaseItems found. +jellyfin | [14:42:39] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: Starting cleanup of items from deleted libraries... +jellyfin | [14:42:39] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: No items from deleted libraries found. +jellyfin | [14:42:39] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: Starting cleanup of items with missing files... +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: Checking 0 items for missing files. +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: No stale items found. +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: Starting cleanup of orphaned LinkedChildren records... +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateLinkedChildren: No orphaned LinkedChildren found. +jellyfin | [14:42:40] [INF] [9] InternalCodeMigration: Migration 20260113120000_MigrateLinkedChildren was successfully applied +jellyfin | [14:42:40] [INF] [9] InternalCodeMigration: Perform migration 20260113230000_CleanupOrphanedExtras +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.CleanupOrphanedExtras: No orphaned extras found, skipping migration. +jellyfin | [14:42:40] [INF] [9] InternalCodeMigration: Migration 20260113230000_CleanupOrphanedExtras was successfully applied +jellyfin | [14:42:40] [INF] [9] InternalCodeMigration: Perform migration 20260115120000_FixIncorrectOwnerIdRelationships +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.FixIncorrectOwnerIdRelationships: No duplicate items found, skipping duplicate removal. +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.FixIncorrectOwnerIdRelationships: No items with incorrect OwnerId found, skipping OwnerId cleanup. +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.FixIncorrectOwnerIdRelationships: No orphaned extras found, skipping reassignment. +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.FixIncorrectOwnerIdRelationships: No alternate version items need PrimaryVersionId population, skipping. +jellyfin | [14:42:40] [INF] [9] InternalCodeMigration: Migration 20260115120000_FixIncorrectOwnerIdRelationships was successfully applied +jellyfin | [14:42:40] [INF] [9] InternalCodeMigration: Perform migration 20260508120000_MergeDuplicateMusicArtists +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.MergeDuplicateMusicArtists: No case-only duplicate MusicArtist records found. +jellyfin | [14:42:40] [INF] [9] InternalCodeMigration: Migration 20260508120000_MergeDuplicateMusicArtists was successfully applied +jellyfin | [14:42:40] [INF] [9] InternalCodeMigration: Perform migration 20260508130000_MergeDuplicatePeople +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.MergeDuplicatePeople: No case-only duplicate Person BaseItems found. +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.MergeDuplicatePeople: No case-only duplicate Peoples rows found. +jellyfin | [14:42:40] [INF] [9] InternalCodeMigration: Migration 20260508130000_MergeDuplicatePeople was successfully applied +jellyfin | [14:42:40] [INF] [9] InternalCodeMigration: Perform migration 20260525010000_CleanupOrphanedExternalData +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.CleanupOrphanedExternalData: Skipping attachment cleanup; root /config/data/attachments does not exist +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.CleanupOrphanedExternalData: Skipping subtitle cleanup; root /config/data/subtitles does not exist +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.CleanupOrphanedExternalData: Skipping trickplay cleanup; root /config/data/trickplay does not exist +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.CleanupOrphanedExternalData: Skipping chapter image cleanup; root /config/metadata/library does not exist +jellyfin | [14:42:40] [INF] [9] InternalCodeMigration: Migration 20260525010000_CleanupOrphanedExternalData was successfully applied +jellyfin | [14:42:40] [INF] [9] InternalCodeMigration: Perform migration 20260610120000_RefreshCleanNamesAndValues +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.RefreshCleanNamesAndValues: Refreshing CleanName for 4 library items +jellyfin | [14:42:40] [INF] [9] Jellyfin.Server.Migrations.Routines.RefreshCleanNamesAndValues: Processed: 0/4 - Updated: 0 - Time: 00:00:00.0219906 +jellyfin | [14:42:41] [INF] [9] Jellyfin.Server.Migrations.Routines.RefreshCleanNamesAndValues: Refreshed CleanName for 1 out of 4 items in 00:00:00.4470042 +jellyfin | [14:42:41] [INF] [9] Jellyfin.Server.Migrations.Routines.RefreshCleanNamesAndValues: Refreshing CleanValue for 0 item values +jellyfin | [14:42:41] [INF] [9] Jellyfin.Server.Migrations.Routines.RefreshCleanNamesAndValues: Processed: 0/0 - Updated: 0 - Time: 00:00:00.0081262 +jellyfin | [14:42:41] [INF] [9] Jellyfin.Server.Migrations.Routines.RefreshCleanNamesAndValues: Refreshed CleanValue for 0 out of 0 item values in 00:00:00.0246982 +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Migration 20260610120000_RefreshCleanNamesAndValues was successfully applied +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Perform migration 20260722120000_RefreshForcedSortNames +jellyfin | [14:42:41] [INF] [9] Jellyfin.Server.Migrations.Routines.RefreshForcedSortNames: Refreshing SortName for 0 library items with a forced sort name +jellyfin | [14:42:41] [INF] [9] Jellyfin.Server.Migrations.Routines.RefreshForcedSortNames: Processed: 0/0 - Updated: 0 - Time: 00:00:00.0059981 +jellyfin | [14:42:41] [INF] [9] Jellyfin.Server.Migrations.Routines.RefreshForcedSortNames: Refreshed SortName for 0 out of 0 items in 00:00:00.0350714 +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Migration 20260722120000_RefreshForcedSortNames was successfully applied +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Perform migration 20260729120000_RestorePlaylistChildrenFromMetadata +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Migration 20260729120000_RestorePlaylistChildrenFromMetadata was successfully applied +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Perform migration 20260821120000_RecomputeSeriesPresentationKey +jellyfin | [14:42:41] [INF] [9] Jellyfin.Server.Migrations.Routines.RecomputeSeriesPresentationKey: Recomputing presentation unique key for 0 series +jellyfin | [14:42:41] [INF] [9] Jellyfin.Server.Migrations.Routines.RecomputeSeriesPresentationKey: Recomputed presentation unique key for 0 of 0 series and 0 seasons in 00:00:00.0060333 +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Migration 20260821120000_RecomputeSeriesPresentationKey was successfully applied +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Perform migration 20260825200000_ConsolidateLocalizedUserViews +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Migration 20260825200000_ConsolidateLocalizedUserViews was successfully applied +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Perform migration 20260831100000_EnableLocalSimilarityProviders +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Migration 20260831100000_EnableLocalSimilarityProviders was successfully applied +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Perform migration 20260908120000_RepairAlternateVersionLinks +jellyfin | [14:42:41] [INF] [9] Jellyfin.Server.Migrations.Routines.RepairAlternateVersionLinks: No alternate version links found, nothing to repair. +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Migration 20260908120000_RepairAlternateVersionLinks was successfully applied +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Perform migration 20260911120000_StripEmbeddedLinkedChildren +jellyfin | [14:42:41] [INF] [9] Jellyfin.Server.Migrations.Routines.StripEmbeddedLinkedChildren: Dropped dead keys from the serialized data of 2 items +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Migration 20260911120000_StripEmbeddedLinkedChildren was successfully applied +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Perform migration 20260912120000_HarmonizeConflictingUserData +jellyfin | [14:42:41] [INF] [9] Jellyfin.Server.Migrations.Routines.HarmonizeConflictingUserData: No conflicting user data found. +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Migration 20260912120000_HarmonizeConflictingUserData was successfully applied +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Perform migration 20260915120000_MigrateRatingLevels +jellyfin | [14:42:41] [INF] [9] Jellyfin.Server.Migrations.Routines.MigrateRatingLevels: Recalculating parental rating levels based on rating string. +jellyfin | [14:42:41] [INF] [9] InternalCodeMigration: Migration 20260915120000_MigrateRatingLevels was successfully applied +jellyfin | [14:42:41] [INF] [9] Main: Attempt to cleanup JellyfinDb backup. +jellyfin | [14:42:41] [INF] [9] Main: Migrations have been applied, optimizing the database... This might take a while +jellyfin | [14:42:41] [INF] [9] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: Not analyzing jellyfin.db, the library holds no items yet +jellyfin | [14:42:41] [INF] [9] Jellyfin.Database.Providers.Sqlite.SqliteDatabaseProvider: jellyfin.db optimized successfully! +jellyfin | [14:42:41] [INF] [7] Main: Kestrel is listening on 0.0.0.0 +jellyfin | [14:42:41] [WRN] [7] Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager: No XML encryptor configured. Key {65fcd327-b162-4ff5-be36-4b79af184ef1} may be persisted to storage in unencrypted form. +jellyfin | [14:42:42] [WRN] [7] Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware: The WebRootPath was not found: /wwwroot. Static files may be unavailable. +jellyfin | [14:42:42] [INF] [7] Emby.Server.Implementations.ApplicationHost: Running startup tasks +jellyfin | [14:42:42] [INF] [7] Emby.Server.Implementations.ScheduledTasks.TaskManager: Daily trigger for Generate Trickplay Images set to fire at 2026-10-28 03:00:00.000 +01:00, which is 12:17:17.8047772 from now. +jellyfin | [14:42:42] [INF] [7] Emby.Server.Implementations.ScheduledTasks.TaskManager: Daily trigger for Extract Chapter Images set to fire at 2026-10-28 02:00:00.000 +01:00, which is 11:17:17.7997321 from now. +jellyfin | [14:42:42] [INF] [7] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Found ffmpeg version 8.1.3 +jellyfin | [14:42:42] [INF] [7] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available decoders: ["libdav1d", "av1", "av1_cuvid", "av1_qsv", "h264", "h264_qsv", "h264_cuvid", "hevc", "hevc_qsv", "hevc_cuvid", "mpeg2video", "mpeg2_qsv", "mpeg2_cuvid", "mpeg4", "mpeg4_cuvid", "msmpeg4", "vc1_qsv", "vc1_cuvid", "vp8", "libvpx", "vp8_cuvid", "vp8_qsv", "vp9", "libvpx-vp9", "vp9_cuvid", "vp9_qsv", "aac", "ac3", "ac4", "dca", "flac", "mp3", "truehd"] +jellyfin | [14:42:42] [INF] [7] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available encoders: ["libsvtav1", "av1_nvenc", "av1_qsv", "av1_amf", "av1_vaapi", "libx264", "h264_amf", "h264_nvenc", "h264_qsv", "h264_v4l2m2m", "h264_vaapi", "libx265", "hevc_amf", "hevc_nvenc", "hevc_qsv", "hevc_vaapi", "mjpeg_qsv", "mjpeg_vaapi", "aac", "libfdk_aac", "ac3", "alac", "dca", "flac", "libmp3lame", "libopus", "truehd", "libvorbis", "srt"] +jellyfin | [14:42:42] [INF] [7] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available filters: ["bwdif_cuda", "bwdif_opencl", "deinterlace_qsv", "deinterlace_vaapi", "flip_vulkan", "hwupload_cuda", "hwupload_vaapi", "libplacebo", "overlay_opencl", "overlay_qsv", "overlay_vaapi", "overlay_vulkan", "overlay_cuda", "procamp_vaapi", "scale_cuda", "scale_opencl", "scale_qsv", "scale_vaapi", "scale_vulkan", "tonemapx", "tonemap_cuda", "tonemap_opencl", "tonemap_vaapi", "transpose_cuda", "transpose_opencl", "transpose_vaapi", "transpose_vulkan", "vpp_qsv", "yadif_cuda", "yadif_opencl", "zscale", "alphasrc"] +jellyfin | [14:42:42] [INF] [7] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available hwaccel types: ["cuda", "vaapi", "qsv", "drm", "opencl", "vulkan", "amf"] +jellyfin | [14:42:44] [INF] [7] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: FFmpeg: /usr/lib/jellyfin-ffmpeg/ffmpeg +jellyfin | [14:42:44] [INF] [7] Emby.Server.Implementations.ApplicationHost: ServerId: 3c05d88a7b724053b0db0e4035cb3420 +jellyfin | [14:42:44] [INF] [7] Emby.Server.Implementations.ApplicationHost: Core startup complete +jellyfin | [14:42:44] [INF] [7] Main: Startup complete 0:00:09.8379626 +jellyfin | [14:42:45] [INF] [10] Emby.Server.Implementations.ScheduledTasks.TaskManager: Clean Transcode Directory Completed after 0 minute(s) and 0 seconds +jellyfin | [14:42:46] [INF] [7] Emby.Server.Implementations.ScheduledTasks.TaskManager: Update Plugins Completed after 0 minute(s) and 0 seconds diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/to-states.json b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/to-states.json new file mode 100644 index 00000000..86135928 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/to-states.json @@ -0,0 +1,8 @@ +{ + "jellyfin": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + } +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/verdict.json b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/verdict.json new file mode 100644 index 00000000..143c1bd2 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/jellyfin/evidence/MV-jellyfin/verdict.json @@ -0,0 +1,58 @@ +{ + "harness_version": 5, + "edge": "MV-jellyfin", + "app": "jellyfin", + "note": "night 2026-09-23 within-a-major move: jellyfin=jellyfin/jellyfin:12.4", + "from": { + "jellyfin": "jellyfin/jellyfin:10.11.11" + }, + "to": { + "jellyfin": "jellyfin/jellyfin:12.4" + }, + "verdict": "proven", + "seed_read_before": true, + "seed_read_after": true, + "healthy_after": true, + "migration_observed": "\u001b[2Kjellyfin | [14:42:35] [INF] [9] Jellyfin.Server.Migrations.JellyfinMigrationService: Initialise Migration service.", + "abort": "starts-data-gone", + "abort_detail": "the app started but the seeded data was gone", + "engine_state_after": null, + "memory": { + "soak_s": 605.5, + "requested_s": 600, + "requests": 12011, + "codes": { + "302": 12011 + }, + "first_kill": null, + "containers": { + "jellyfin": { + "limit": 2147483648, + "peak": 196870144, + "peak_pct": 0.092, + "anon_peak_sampled": 107573248, + "anon_peak_pct": 0.05, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + } + }, + "unmeasured": [], + "venue_swap_bytes": 0, + "load": "reached" + }, + "marks": [], + "bench_overrides": null, + "duration_s": 30.9, + "measured_at": "2026-10-27T13:53:44Z", + "evidence": "evidence/MV-jellyfin", + "scratch_cleared": [ + "/srv/felhom-gate/hdd/userdata/media" + ], + "files_changed": [], + "files_changed_detail": [], + "files_ignored": [], + "total_s": 755.4 +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/MV-wishlist.log b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/MV-wishlist.log new file mode 100644 index 00000000..2215fc62 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/MV-wishlist.log @@ -0,0 +1,114 @@ +[13:11:06] scratch drive folders cleared before FROM (R-656): none existed +[13:11:06] MV-wishlist: deploying wishlist at FROM {'wishlist': 'ghcr.io/cmintey/wishlist:v0.67.1'} +[13:12:20] FROM settled=True in 31.7s :: {"wishlist": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:12:20] fixture: the BOX walk's own (Wishlist), through upgrade_boxport +[13:12:21] wishlist: /signup http=200 type=success +[13:12:22] wishlist: sign-in as the seeded user type=success ok=True (wrong password refused) +[13:12:22] C1 (seed reads back BEFORE): True +[13:12:22] MV-wishlist: swapping to TO {'wishlist': 'ghcr.io/cmintey/wishlist:v0.69.0'} +[13:13:22] TO up -d rc=0 +[13:13:59] TO settled=True in 36.2s :: {"wishlist": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:13:59] migration lines observed: 6 +[13:14:00] wishlist: sign-in as the seeded user type=success ok=True (wrong password refused) +[13:14:00] RESULT (seed reads back AFTER): True +[13:14:00] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:3000 +[13:14:15] + 15s wishlist=297M/512M peak=456M kills=0 rs=0 reqs=300 +[13:14:30] + 30s wishlist=274M/512M peak=456M kills=0 rs=0 reqs=596 +[13:14:46] + 45s wishlist=259M/512M peak=456M kills=0 rs=0 reqs=896 +[13:15:01] + 61s wishlist=221M/512M peak=456M kills=0 rs=0 reqs=1192 +[13:15:16] + 76s wishlist=221M/512M peak=456M kills=0 rs=0 reqs=1488 +[13:15:31] + 91s wishlist=221M/512M peak=456M kills=0 rs=0 reqs=1788 +[13:15:46] + 106s wishlist=222M/512M peak=456M kills=0 rs=0 reqs=2088 +[13:16:01] + 121s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=2384 +[13:16:16] + 136s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=2682 +[13:16:31] + 151s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=2980 +[13:16:47] + 166s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=3278 +[13:17:02] + 182s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=3576 +[13:17:17] + 197s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=3872 +[13:17:32] + 212s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=4172 +[13:17:47] + 227s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=4468 +[13:18:02] + 242s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=4768 +[13:18:17] + 257s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=5067 +[13:18:32] + 272s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=5364 +[13:18:48] + 288s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=5661 +[13:19:03] + 303s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=5960 +[13:19:18] + 318s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=6260 +[13:19:33] + 333s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=6556 +[13:19:48] + 348s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=6856 +[13:20:03] + 363s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=7152 +[13:20:18] + 378s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=7452 +[13:20:34] + 393s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=7748 +[13:20:49] + 408s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=8048 +[13:21:04] + 424s wishlist=224M/512M peak=456M kills=0 rs=0 reqs=8344 +[13:21:19] + 439s wishlist=224M/512M peak=456M kills=0 rs=0 reqs=8644 +[13:21:34] + 454s wishlist=224M/512M peak=456M kills=0 rs=0 reqs=8940 +[13:21:49] + 469s wishlist=225M/512M peak=456M kills=0 rs=0 reqs=9240 +[13:22:04] + 484s wishlist=224M/512M peak=456M kills=0 rs=0 reqs=9536 +[13:22:19] + 499s wishlist=225M/512M peak=456M kills=0 rs=0 reqs=9836 +[13:22:34] + 514s wishlist=225M/512M peak=456M kills=0 rs=0 reqs=10132 +[13:22:50] + 530s wishlist=227M/512M peak=456M kills=0 rs=0 reqs=10432 +[13:23:05] + 545s wishlist=227M/512M peak=456M kills=0 rs=0 reqs=10728 +[13:23:20] + 560s wishlist=227M/512M peak=456M kills=0 rs=0 reqs=11028 +[13:23:35] + 575s wishlist=227M/512M peak=456M kills=0 rs=0 reqs=11324 +[13:23:50] + 590s wishlist=227M/512M peak=456M kills=0 rs=0 reqs=11624 +[13:24:05] + 605s wishlist=231M/512M peak=456M kills=0 rs=0 reqs=11920 +[13:24:05] memory watch: killed=False tight=[] requests=11920 codes={'307': 11920} +[13:24:05] MV-wishlist: ABORT — putting the FROM images back +[13:24:38] wishlist: sign-in as the seeded user type=success ok=True (wrong password refused) +[13:24:38] ABORT: app came back in 30.9s; data present=True +{ + "harness_version": 5, + "edge": "MV-wishlist", + "app": "wishlist", + "note": "night 2026-09-23 within-a-major move: wishlist=ghcr.io/cmintey/wishlist:v0.69.0", + "from": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.67.1" + }, + "to": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.69.0" + }, + "verdict": "proven", + "seed_read_before": true, + "seed_read_after": true, + "healthy_after": true, + "migration_observed": "\u001b[2Kwishlist | Prisma schema loaded from prisma/schema.prisma.", + "abort": "starts-and-serves", + "abort_detail": null, + "engine_state_after": null, + "memory": { + "soak_s": 605.3, + "requested_s": 600, + "requests": 11920, + "codes": { + "307": 11920 + }, + "first_kill": null, + "containers": { + "wishlist": { + "limit": 536870912, + "peak": 479076352, + "peak_pct": 0.892, + "anon_peak_sampled": 116011008, + "anon_peak_pct": 0.216, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + } + }, + "unmeasured": [], + "venue_swap_bytes": 0, + "load": "reached" + }, + "marks": [], + "bench_overrides": null, + "duration_s": 36.2, + "measured_at": "2026-10-27T13:24:38Z", + "evidence": "evidence/MV-wishlist", + "scratch_cleared": [], + "files_changed": [], + "files_changed_detail": [], + "files_ignored": [], + "total_s": 811.7 +} diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/abort-states.json b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/abort-states.json new file mode 100644 index 00000000..62e166e2 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/abort-states.json @@ -0,0 +1,8 @@ +{ + "wishlist": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + } +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/compose-final.log b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/compose-final.log new file mode 100644 index 00000000..e43df9a4 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/compose-final.log @@ -0,0 +1,38 @@ +wishlist | {"level":"info","ts":1793107446.8871257,"msg":"maxprocs: Leaving GOMAXPROCS=6: CPU quota undefined"} +wishlist | {"level":"info","ts":1793107446.8879023,"msg":"GOMEMLIMIT is updated","package":"github.com/KimMachineGun/automemlimit/memlimit","GOMEMLIMIT":483183820,"previous":9223372036854775807} +wishlist | {"level":"info","ts":1793107446.888173,"msg":"using config from file","file":"/usr/src/app/Caddyfile"} +wishlist | {"level":"info","ts":1793107446.891926,"msg":"adapted config to JSON","adapter":"caddyfile"} +wishlist | {"level":"warn","ts":1793107446.8919544,"msg":"Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies","adapter":"caddyfile","file":"/usr/src/app/Caddyfile","line":2} +wishlist | {"level":"warn","ts":1793107446.8925297,"logger":"admin","msg":"admin endpoint disabled"} +wishlist | {"level":"info","ts":1793107446.893272,"logger":"http.auto_https","msg":"automatic HTTPS is completely disabled for server","server_name":"srv0"} +wishlist | {"level":"info","ts":1793107446.8940003,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc0000c0c00"} +wishlist | {"level":"warn","ts":1793107446.8950841,"logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":3280"} +wishlist | {"level":"warn","ts":1793107446.8950963,"logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":3280"} +wishlist | {"level":"info","ts":1793107446.8950994,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]} +wishlist | {"level":"info","ts":1793107446.8966992,"msg":"autosaved config (load with --resume flag)","file":"/root/.config/caddy/autosave.json"} +wishlist | {"level":"info","ts":1793107446.8967144,"msg":"serving initial configuration"} +wishlist | Successfully started Caddy (pid=16) - Caddy is running in the background +wishlist | {"level":"info","ts":1793107446.901803,"logger":"tls","msg":"cleaning storage unit","storage":"FileStorage:/root/.local/share/caddy"} +wishlist | {"level":"info","ts":1793107446.905808,"logger":"tls","msg":"finished cleaning storage units"} +wishlist | Loaded Prisma config from prisma.config.ts. +wishlist | +wishlist | Prisma schema loaded from prisma/schema.prisma. +wishlist | Datasource "db": SQLite database "prod.db" at "file:/usr/src/app/data/prod.db" +wishlist | +wishlist | 46 migrations found in prisma/migrations +wishlist | +wishlist | +wishlist | No pending migrations to apply. +wishlist | Loaded Prisma config from prisma.config.ts. +wishlist | +wishlist | Running seed command `tsx prisma/seed.ts` ... +wishlist | roles are synced +wishlist | skipping default group creation +wishlist | +wishlist | 🌱 The seed command has been executed. +wishlist | $ tsx prisma/patches/index.ts +wishlist | Skipping already applied patch: 'item-price' +wishlist | Skipping already applied patch: 'list-relationship' +wishlist | Skipping already applied patch: 'list-item-ids' +wishlist | $ node build +wishlist | Listening on http://0.0.0.0:3000 diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/engine-state.json b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/engine-state.json new file mode 100644 index 00000000..ec747fa4 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/engine-state.json @@ -0,0 +1 @@ +null \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/files-after-detail.json b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/files-after-detail.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/files-after-detail.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/files-after.json b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/files-after.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/files-after.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/files-before-detail.json b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/files-before-detail.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/files-before-detail.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/files-before.json b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/files-before.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/files-before.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/memory-samples.json b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/memory-samples.json new file mode 100644 index 00000000..14eab38c --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/memory-samples.json @@ -0,0 +1,762 @@ +[ + { + "t": 15.1, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 312426496, + "peak": 479076352, + "anon": 116011008, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 300 + }, + { + "t": 30.3, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 288051200, + "peak": 479076352, + "anon": 91713536, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 596 + }, + { + "t": 45.4, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 271781888, + "peak": 479076352, + "anon": 93745152, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 896 + }, + { + "t": 60.6, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 232161280, + "peak": 479076352, + "anon": 93863936, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1192 + }, + { + "t": 75.7, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 232714240, + "peak": 479076352, + "anon": 94404608, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1488 + }, + { + "t": 90.9, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 232685568, + "peak": 479076352, + "anon": 94900224, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1788 + }, + { + "t": 106.0, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 233345024, + "peak": 479076352, + "anon": 95043584, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2088 + }, + { + "t": 121.1, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234115072, + "peak": 479076352, + "anon": 96067584, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2384 + }, + { + "t": 136.3, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234172416, + "peak": 479076352, + "anon": 96116736, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2682 + }, + { + "t": 151.4, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234442752, + "peak": 479076352, + "anon": 96145408, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2980 + }, + { + "t": 166.5, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234196992, + "peak": 479076352, + "anon": 96153600, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3278 + }, + { + "t": 181.6, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234180608, + "peak": 479076352, + "anon": 96165888, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3576 + }, + { + "t": 196.7, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234541056, + "peak": 479076352, + "anon": 96235520, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3872 + }, + { + "t": 211.9, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234340352, + "peak": 479076352, + "anon": 96235520, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4172 + }, + { + "t": 227.0, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 233959424, + "peak": 479076352, + "anon": 95862784, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4468 + }, + { + "t": 242.1, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234262528, + "peak": 479076352, + "anon": 95891456, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4768 + }, + { + "t": 257.3, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234758144, + "peak": 479076352, + "anon": 96141312, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5067 + }, + { + "t": 272.4, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234336256, + "peak": 479076352, + "anon": 96223232, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5364 + }, + { + "t": 287.5, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234283008, + "peak": 479076352, + "anon": 96235520, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5661 + }, + { + "t": 302.6, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234328064, + "peak": 479076352, + "anon": 96239616, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5960 + }, + { + "t": 317.8, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234340352, + "peak": 479076352, + "anon": 96243712, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6260 + }, + { + "t": 332.9, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234106880, + "peak": 479076352, + "anon": 96247808, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6556 + }, + { + "t": 348.0, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234635264, + "peak": 479076352, + "anon": 96251904, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6856 + }, + { + "t": 363.2, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234422272, + "peak": 479076352, + "anon": 96251904, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7152 + }, + { + "t": 378.3, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234594304, + "peak": 479076352, + "anon": 96292864, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7452 + }, + { + "t": 393.4, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234680320, + "peak": 479076352, + "anon": 96329728, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7748 + }, + { + "t": 408.5, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 234688512, + "peak": 479076352, + "anon": 96333824, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8048 + }, + { + "t": 423.7, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 235012096, + "peak": 479076352, + "anon": 96854016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8344 + }, + { + "t": 438.8, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 235163648, + "peak": 479076352, + "anon": 96854016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8644 + }, + { + "t": 453.9, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 235081728, + "peak": 479076352, + "anon": 96854016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8940 + }, + { + "t": 469.1, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 235991040, + "peak": 479076352, + "anon": 97886208, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9240 + }, + { + "t": 484.2, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 235814912, + "peak": 479076352, + "anon": 97902592, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9536 + }, + { + "t": 499.3, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 236195840, + "peak": 479076352, + "anon": 97902592, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9836 + }, + { + "t": 514.4, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 236060672, + "peak": 479076352, + "anon": 97910784, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10132 + }, + { + "t": 529.5, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 238448640, + "peak": 479076352, + "anon": 100020224, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10432 + }, + { + "t": 544.6, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 238854144, + "peak": 479076352, + "anon": 100646912, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10728 + }, + { + "t": 559.8, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 239022080, + "peak": 479076352, + "anon": 100839424, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11028 + }, + { + "t": 574.9, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 239054848, + "peak": 479076352, + "anon": 100872192, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11324 + }, + { + "t": 590.0, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 239058944, + "peak": 479076352, + "anon": 100884480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11624 + }, + { + "t": 605.1, + "containers": { + "wishlist": { + "limit": 536870912, + "current": 242561024, + "peak": 479076352, + "anon": 104136704, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11920 + } +] \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/migration-lines.txt b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/migration-lines.txt new file mode 100644 index 00000000..d0647da5 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/migration-lines.txt @@ -0,0 +1,6 @@ +wishlist | Prisma schema loaded from prisma/schema.prisma. +wishlist | 47 migrations found in prisma/migrations +wishlist | Applying migration `20260818202017_allow_self_claims` +wishlist | The following migration(s) have been applied: +wishlist | migrations/ +wishlist | └─ migration.sql \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/run.log b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/run.log new file mode 100644 index 00000000..844bd6e6 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/run.log @@ -0,0 +1,58 @@ +[13:11:06] scratch drive folders cleared before FROM (R-656): none existed +[13:11:06] MV-wishlist: deploying wishlist at FROM {'wishlist': 'ghcr.io/cmintey/wishlist:v0.67.1'} +[13:12:20] FROM settled=True in 31.7s :: {"wishlist": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:12:20] fixture: the BOX walk's own (Wishlist), through upgrade_boxport +[13:12:21] wishlist: /signup http=200 type=success +[13:12:22] wishlist: sign-in as the seeded user type=success ok=True (wrong password refused) +[13:12:22] C1 (seed reads back BEFORE): True +[13:12:22] MV-wishlist: swapping to TO {'wishlist': 'ghcr.io/cmintey/wishlist:v0.69.0'} +[13:13:22] TO up -d rc=0 +[13:13:59] TO settled=True in 36.2s :: {"wishlist": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[13:13:59] migration lines observed: 6 +[13:14:00] wishlist: sign-in as the seeded user type=success ok=True (wrong password refused) +[13:14:00] RESULT (seed reads back AFTER): True +[13:14:00] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:3000 +[13:14:15] + 15s wishlist=297M/512M peak=456M kills=0 rs=0 reqs=300 +[13:14:30] + 30s wishlist=274M/512M peak=456M kills=0 rs=0 reqs=596 +[13:14:46] + 45s wishlist=259M/512M peak=456M kills=0 rs=0 reqs=896 +[13:15:01] + 61s wishlist=221M/512M peak=456M kills=0 rs=0 reqs=1192 +[13:15:16] + 76s wishlist=221M/512M peak=456M kills=0 rs=0 reqs=1488 +[13:15:31] + 91s wishlist=221M/512M peak=456M kills=0 rs=0 reqs=1788 +[13:15:46] + 106s wishlist=222M/512M peak=456M kills=0 rs=0 reqs=2088 +[13:16:01] + 121s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=2384 +[13:16:16] + 136s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=2682 +[13:16:31] + 151s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=2980 +[13:16:47] + 166s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=3278 +[13:17:02] + 182s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=3576 +[13:17:17] + 197s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=3872 +[13:17:32] + 212s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=4172 +[13:17:47] + 227s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=4468 +[13:18:02] + 242s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=4768 +[13:18:17] + 257s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=5067 +[13:18:32] + 272s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=5364 +[13:18:48] + 288s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=5661 +[13:19:03] + 303s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=5960 +[13:19:18] + 318s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=6260 +[13:19:33] + 333s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=6556 +[13:19:48] + 348s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=6856 +[13:20:03] + 363s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=7152 +[13:20:18] + 378s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=7452 +[13:20:34] + 393s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=7748 +[13:20:49] + 408s wishlist=223M/512M peak=456M kills=0 rs=0 reqs=8048 +[13:21:04] + 424s wishlist=224M/512M peak=456M kills=0 rs=0 reqs=8344 +[13:21:19] + 439s wishlist=224M/512M peak=456M kills=0 rs=0 reqs=8644 +[13:21:34] + 454s wishlist=224M/512M peak=456M kills=0 rs=0 reqs=8940 +[13:21:49] + 469s wishlist=225M/512M peak=456M kills=0 rs=0 reqs=9240 +[13:22:04] + 484s wishlist=224M/512M peak=456M kills=0 rs=0 reqs=9536 +[13:22:19] + 499s wishlist=225M/512M peak=456M kills=0 rs=0 reqs=9836 +[13:22:34] + 514s wishlist=225M/512M peak=456M kills=0 rs=0 reqs=10132 +[13:22:50] + 530s wishlist=227M/512M peak=456M kills=0 rs=0 reqs=10432 +[13:23:05] + 545s wishlist=227M/512M peak=456M kills=0 rs=0 reqs=10728 +[13:23:20] + 560s wishlist=227M/512M peak=456M kills=0 rs=0 reqs=11028 +[13:23:35] + 575s wishlist=227M/512M peak=456M kills=0 rs=0 reqs=11324 +[13:23:50] + 590s wishlist=227M/512M peak=456M kills=0 rs=0 reqs=11624 +[13:24:05] + 605s wishlist=231M/512M peak=456M kills=0 rs=0 reqs=11920 +[13:24:05] memory watch: killed=False tight=[] requests=11920 codes={'307': 11920} +[13:24:05] MV-wishlist: ABORT — putting the FROM images back +[13:24:38] wishlist: sign-in as the seeded user type=success ok=True (wrong password refused) +[13:24:38] ABORT: app came back in 30.9s; data present=True \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/to-full.log b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/to-full.log new file mode 100644 index 00000000..aa286c1c --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/to-full.log @@ -0,0 +1,44 @@ +wishlist | {"level":"info","ts":1793106803.18796,"msg":"maxprocs: Leaving GOMAXPROCS=6: CPU quota undefined"} +wishlist | {"level":"info","ts":1793106803.1896274,"msg":"GOMEMLIMIT is updated","package":"github.com/KimMachineGun/automemlimit/memlimit","GOMEMLIMIT":483183820,"previous":9223372036854775807} +wishlist | {"level":"info","ts":1793106803.190062,"msg":"using config from file","file":"/usr/src/app/Caddyfile"} +wishlist | {"level":"info","ts":1793106803.1950161,"msg":"adapted config to JSON","adapter":"caddyfile"} +wishlist | {"level":"warn","ts":1793106803.195044,"msg":"Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies","adapter":"caddyfile","file":"/usr/src/app/Caddyfile","line":2} +wishlist | {"level":"warn","ts":1793106803.1959794,"logger":"admin","msg":"admin endpoint disabled"} +wishlist | {"level":"info","ts":1793106803.1968539,"logger":"http.auto_https","msg":"automatic HTTPS is completely disabled for server","server_name":"srv0"} +wishlist | {"level":"info","ts":1793106803.197102,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc0004eb180"} +wishlist | {"level":"warn","ts":1793106803.2030804,"logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":3280"} +wishlist | {"level":"warn","ts":1793106803.2031035,"logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":3280"} +wishlist | {"level":"info","ts":1793106803.2031088,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]} +wishlist | {"level":"info","ts":1793106803.203523,"msg":"autosaved config (load with --resume flag)","file":"/root/.config/caddy/autosave.json"} +wishlist | {"level":"info","ts":1793106803.203552,"msg":"serving initial configuration"} +wishlist | Successfully started Caddy (pid=16) - Caddy is running in the background +wishlist | {"level":"info","ts":1793106803.2075653,"logger":"tls","msg":"cleaning storage unit","storage":"FileStorage:/root/.local/share/caddy"} +wishlist | {"level":"info","ts":1793106803.2127435,"logger":"tls","msg":"finished cleaning storage units"} +wishlist | Loaded Prisma config from prisma.config.ts. +wishlist | +wishlist | Prisma schema loaded from prisma/schema.prisma. +wishlist | Datasource "db": SQLite database "prod.db" at "file:/usr/src/app/data/prod.db" +wishlist | +wishlist | 47 migrations found in prisma/migrations +wishlist | +wishlist | Applying migration `20260818202017_allow_self_claims` +wishlist | +wishlist | The following migration(s) have been applied: +wishlist | +wishlist | migrations/ +wishlist | └─ 20260818202017_allow_self_claims/ +wishlist | └─ migration.sql +wishlist | +wishlist | All migrations have been successfully applied. +wishlist | Loaded Prisma config from prisma.config.ts. +wishlist | +wishlist | Running seed command `tsx prisma/seed.ts` ... +wishlist | roles are synced +wishlist | skipping default group creation +wishlist | +wishlist | 🌱 The seed command has been executed. +wishlist | $ tsx prisma/patches/index.ts +wishlist | Skipping already applied patch: 'item-price' +wishlist | Skipping already applied patch: 'list-relationship' +wishlist | Skipping already applied patch: 'list-item-ids' +wishlist | Listening on http://0.0.0.0:3000 diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/to-states.json b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/to-states.json new file mode 100644 index 00000000..62e166e2 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/to-states.json @@ -0,0 +1,8 @@ +{ + "wishlist": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + } +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/verdict.json b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/verdict.json new file mode 100644 index 00000000..cfc4a5db --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/bench/wishlist/evidence/MV-wishlist/verdict.json @@ -0,0 +1,56 @@ +{ + "harness_version": 5, + "edge": "MV-wishlist", + "app": "wishlist", + "note": "night 2026-09-23 within-a-major move: wishlist=ghcr.io/cmintey/wishlist:v0.69.0", + "from": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.67.1" + }, + "to": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.69.0" + }, + "verdict": "proven", + "seed_read_before": true, + "seed_read_after": true, + "healthy_after": true, + "migration_observed": "\u001b[2Kwishlist | Prisma schema loaded from prisma/schema.prisma.", + "abort": "starts-and-serves", + "abort_detail": null, + "engine_state_after": null, + "memory": { + "soak_s": 605.3, + "requested_s": 600, + "requests": 11920, + "codes": { + "307": 11920 + }, + "first_kill": null, + "containers": { + "wishlist": { + "limit": 536870912, + "peak": 479076352, + "peak_pct": 0.892, + "anon_peak_sampled": 116011008, + "anon_peak_pct": 0.216, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + } + }, + "unmeasured": [], + "venue_swap_bytes": 0, + "load": "reached" + }, + "marks": [], + "bench_overrides": null, + "duration_s": 36.2, + "measured_at": "2026-10-27T13:24:38Z", + "evidence": "evidence/MV-wishlist", + "scratch_cleared": [], + "files_changed": [], + "files_changed_detail": [], + "files_ignored": [], + "total_s": 811.7 +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/_negative-control/box-verdict-privatebin.json b/documentation/audits/security-app-updates-2026-10-27/walks/_negative-control/box-verdict-privatebin.json new file mode 100644 index 00000000..37027028 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/_negative-control/box-verdict-privatebin.json @@ -0,0 +1,177 @@ +{ + "app": "privatebin", + "walk": "security", + "box_walk_version": 1, + "verdict": "failed", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "privatebin": "privatebin/pdo:2.0.6" + }, + "to": { + "privatebin": "busybox:1.36.1" + }, + "observables_before": { + "pinned_images": { + "privatebin": "privatebin/pdo:2.0.6" + }, + "installed_images": { + "privatebin": "privatebin/pdo:2.0.6" + }, + "catalog_images": null, + "live_compose_image_lines": [ + "image: privatebin/pdo:2.0.6@sha256:4c141b2326f8b353598ce9ce7507a9cfecf2dad5c60a39fea903d430e296d8f5" + ], + "docker_inspect": [ + "privatebin privatebin/pdo:2.0.6@sha256:4c141b2326f8b353598ce9ce7507a9cfecf2dad5c60a39fea903d430e296d8f5 running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "200", + "redirect": null + }, + "script": { + "status": "200", + "redirect": null + } + }, + "seed": "read_back", + "drill_commit": "a1476a7b8e96", + "sync_waited_s": 4.5, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-10-27T13:03:08Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 2.1, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 3.1, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 4.1, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 5.1, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 308.2, + "phase": "undoing", + "label": "Visszaállítás az előző változatra…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 314.4, + "phase": "undone", + "label": "Visszaállítva az előző változatra", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 314.4, + "final_phase": "undone", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "privatebin": "privatebin/pdo:2.0.6" + }, + "installed_images": { + "privatebin": "privatebin/pdo:2.0.6" + }, + "catalog_images": { + "privatebin": "busybox:1.36.1" + }, + "live_compose_image_lines": [ + "image: privatebin/pdo:2.0.6@sha256:4c141b2326f8b353598ce9ce7507a9cfecf2dad5c60a39fea903d430e296d8f5" + ], + "docker_inspect": [ + "privatebin privatebin/pdo:2.0.6@sha256:4c141b2326f8b353598ce9ce7507a9cfecf2dad5c60a39fea903d430e296d8f5 running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "privatebin": "sha256:4c141b2326f8b353598ce9ce7507a9cfecf2dad5c60a39fea903d430e296d8f5" + }, + "why": "the update ended 'undone' (error None, hold None)", + "log": [ + "14:02:30 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "14:02:50 [1] deployed, controller state=running, pinned={'privatebin': 'privatebin/pdo:2.0.6'}", + "14:02:54 [2] setup gate as installed: {'browser': {'status': '200', 'redirect': None}, 'script': {'status': '200', 'redirect': None}}", + "14:02:54 privatebin: seeded paste id=a5c1beda8bb3faba", + "14:02:54 privatebin: readback http=200 marker_present=True", + "14:02:55 [5] drill commit a1476a7b8e96: privatebin privatebin/pdo:2.0.6 -> busybox:1.36.1 (push rc=0)", + "14:03:03 [5] the box's drill mirror now at a1476a7", + "14:03:08 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "14:03:08 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "14:03:10 + 2.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "14:03:11 + 3.1s phase=pulling label=Új verzió letöltése… err=None hold=None", + "14:03:12 + 4.1s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "14:03:13 + 5.1s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "14:08:16 + 308.2s phase=undoing label=Visszaállítás az előző változatra… err=None hold=None", + "14:08:23 + 314.4s phase=undone label=Visszaállítva az előző változatra err=None hold=None" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/_negative-control/walk.txt b/documentation/audits/security-app-updates-2026-10-27/walks/_negative-control/walk.txt new file mode 100644 index 00000000..d355f56b --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/_negative-control/walk.txt @@ -0,0 +1,20 @@ +14:02:30 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +14:02:50 [1] deployed, controller state=running, pinned={'privatebin': 'privatebin/pdo:2.0.6'} +14:02:54 [2] setup gate as installed: {'browser': {'status': '200', 'redirect': None}, 'script': {'status': '200', 'redirect': None}} +14:02:54 privatebin: seeded paste id=a5c1beda8bb3faba +14:02:54 privatebin: readback http=200 marker_present=True +14:02:55 [5] drill commit a1476a7b8e96: privatebin privatebin/pdo:2.0.6 -> busybox:1.36.1 (push rc=0) +14:03:03 [5] the box's drill mirror now at a1476a7 +14:03:08 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +14:03:08 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +14:03:10 + 2.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +14:03:11 + 3.1s phase=pulling label=Új verzió letöltése… err=None hold=None +14:03:12 + 4.1s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +14:03:13 + 5.1s phase=verifying label=Működés ellenőrzése… err=None hold=None +14:08:16 + 308.2s phase=undoing label=Visszaállítás az előző változatra… err=None hold=None +14:08:23 + 314.4s phase=undone label=Visszaállítva az előző változatra err=None hold=None +14:08:41 [9] verdict failed -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/_negative-control/verdict.json +14:08:41 RESULT failed — the update ended 'undone' (error None, hold None) +14:08:42 [X] stop -> 200 {'ok': True, 'message': 'Stack privatebin stop completed'} +14:09:14 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'privatebin', 'volumes_removed': ['privatebin_privatebin_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note' +14:09:22 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/_rallly-try1-stale-fixture/box-verdict-rallly.json b/documentation/audits/security-app-updates-2026-10-27/walks/_rallly-try1-stale-fixture/box-verdict-rallly.json new file mode 100644 index 00000000..8de7f7b8 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/_rallly-try1-stale-fixture/box-verdict-rallly.json @@ -0,0 +1,52 @@ +{ + "app": "rallly", + "walk": "security", + "box_walk_version": 1, + "verdict": "inconclusive", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "rallly": "lukevella/rallly:4.15.3", + "rallly-postgres": "postgres:18-alpine" + }, + "to": { + "rallly": "lukevella/rallly:4.16.3", + "rallly-postgres": "postgres:18-alpine" + }, + "observables_before": { + "pinned_images": { + "rallly": "lukevella/rallly:4.15.3", + "rallly-postgres": "postgres:18-alpine" + }, + "installed_images": { + "rallly": "lukevella/rallly:4.15.3", + "rallly-postgres": "postgres:18-alpine" + }, + "catalog_images": null, + "live_compose_image_lines": [ + "image: lukevella/rallly:4.15.3@sha256:8cd979aefe8d06e1822bc67054eb2d31088cdb831aa3f7b5615b3768f35431d9", + "image: postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873" + ], + "docker_inspect": [ + "rallly lukevella/rallly:4.15.3@sha256:8cd979aefe8d06e1822bc67054eb2d31088cdb831aa3f7b5615b3768f35431d9 running=true restarts=0", + "rallly-postgres postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873 running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "why": "C1: the fixture could not seed and read back before the update", + "log": [ + "14:10:18 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "14:11:03 [1] deployed, controller state=running, pinned={'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'}", + "14:11:03 gate: poll is gated — passed as the household (cookie set)", + "14:11:07 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}", + "14:11:07 rallly: sign-up http=400" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/_rallly-try1-stale-fixture/walk.txt b/documentation/audits/security-app-updates-2026-10-27/walks/_rallly-try1-stale-fixture/walk.txt new file mode 100644 index 00000000..1bd6fe38 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/_rallly-try1-stale-fixture/walk.txt @@ -0,0 +1,10 @@ +14:10:18 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +14:11:03 [1] deployed, controller state=running, pinned={'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'} +14:11:03 gate: poll is gated — passed as the household (cookie set) +14:11:07 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}} +14:11:07 rallly: sign-up http=400 +14:11:07 [9] verdict inconclusive -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/rallly/verdict.json +14:11:07 RESULT inconclusive — C1: the fixture could not seed and read back before the update +14:11:20 [X] stop -> 200 {'ok': True, 'message': 'Stack rallly stop completed'} +14:11:52 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'rallly', 'volumes_removed': ['rallly_rallly_postgres_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': ' +14:12:01 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/bookstack/box-verdict-bookstack.json b/documentation/audits/security-app-updates-2026-10-27/walks/bookstack/box-verdict-bookstack.json new file mode 100644 index 00000000..e2987e6b --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/bookstack/box-verdict-bookstack.json @@ -0,0 +1,260 @@ +{ + "app": "bookstack", + "walk": "security", + "box_walk_version": 1, + "verdict": "proven", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.1", + "bookstack-db": "mariadb:12.3" + }, + "to": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.2", + "bookstack-db": "mariadb:12.3" + }, + "observables_before": { + "pinned_images": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.1", + "bookstack-db": "mariadb:12.3" + }, + "installed_images": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.1", + "bookstack-db": "mariadb:12.3" + }, + "catalog_images": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.1", + "bookstack-db": "mariadb:12.3" + }, + "live_compose_image_lines": [ + "image: lscr.io/linuxserver/bookstack:26.09.1@sha256:99cd1f5707c1911afad213adec5c9739763b76f843d1477142231834ecdcb6f7", + "image: mariadb:12.3@sha256:805c8e104bd563d5bfa24fadd3f31cd419ea859cb5277f32b5dbf2db714f9ed1" + ], + "docker_inspect": [ + "bookstack lscr.io/linuxserver/bookstack:26.09.1@sha256:99cd1f5707c1911afad213adec5c9739763b76f843d1477142231834ecdcb6f7 running=true restarts=0", + "bookstack-db mariadb:12.3@sha256:805c8e104bd563d5bfa24fadd3f31cd419ea859cb5277f32b5dbf2db714f9ed1 running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "404", + "redirect": null + }, + "script": { + "status": "404", + "redirect": null + } + }, + "seed": "read_back", + "drill_commit": "cbb4196e7162", + "sync_waited_s": 4.6, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-10-27T13:40:36Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 14.4, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 15.5, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 41.1, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 53.4, + "phase": "starting", + "label": "Indítás az új verzióval…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 59.5, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 76.9, + "phase": "done", + "label": "Frissítve", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 76.9, + "final_phase": "done", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.2", + "bookstack-db": "mariadb:12.3" + }, + "installed_images": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.2", + "bookstack-db": "mariadb:12.3" + }, + "catalog_images": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.2", + "bookstack-db": "mariadb:12.3" + }, + "live_compose_image_lines": [ + "image: lscr.io/linuxserver/bookstack:26.09.2", + "image: mariadb:12.3" + ], + "docker_inspect": [ + "bookstack lscr.io/linuxserver/bookstack:26.09.2 running=true restarts=0", + "bookstack-db mariadb:12.3 running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.", + "text": "Naprakész" + } + ], + "en": [ + { + "title": "This app is running the newest version available.", + "text": "Up to date" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "bookstack": "sha256:2fdeeb1a2028ce7cb1274696237e32b9f849e16b6d77314d08c78356a6016fca", + "bookstack-db": "sha256:d46e102fa8b9b72bfcdeb56f9dd538742092119dc8b11f31fe662605cd234cd9" + }, + "four_observables": { + "pinned": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.2", + "bookstack-db": "mariadb:12.3" + }, + "installed": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.2", + "bookstack-db": "mariadb:12.3" + }, + "catalog": { + "bookstack": "lscr.io/linuxserver/bookstack:26.09.2", + "bookstack-db": "mariadb:12.3" + }, + "live_compose": [ + "lscr.io/linuxserver/bookstack:26.09.2", + "mariadb:12.3" + ] + }, + "seed_read_after": true, + "setup_gate_after": { + "browser": { + "status": "404", + "redirect": null + }, + "script": { + "status": "404", + "redirect": null + } + }, + "memory": { + "soak_s": 600, + "interval_s": 10, + "samples": 118, + "containers": { + "bookstack": { + "samples": 59, + "anon_peak_bytes": 21417984, + "limit_bytes": 536870912, + "anon_peak_pct": 4.0, + "cgroup_peak_pct": 18.9, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-02a0824975a3d83f37b881059857a096b1e8fb07b70c45ac35e9bf3c2a2b380f.scope" + }, + "bookstack-db": { + "samples": 59, + "anon_peak_bytes": 99962880, + "limit_bytes": 268435456, + "anon_peak_pct": 37.2, + "cgroup_peak_pct": 43.7, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-8beb2b13dfc2dba96fa95b781acda2fbe0206b255efa842d163f987c1baf4292.scope" + } + }, + "oom_kills": 0, + "restarts": 0, + "peak_pct": 37.2 + }, + "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back", + "log": [ + "14:38:50 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['ADMIN_PASSWORD']", + "14:38:50 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "14:40:06 [1] deployed, controller state=unhealthy, pinned={'bookstack': 'lscr.io/linuxserver/bookstack:26.09.1', 'bookstack-db': 'mariadb:12.3'}", + "14:40:06 [1] NOTE: the controller's own state is 'unhealthy', not 'running' — recorded, not treated as a failure; the fixture's front-door wait is the real gate", + "14:40:10 [2] setup gate as installed: {'browser': {'status': '404', 'redirect': None}, 'script': {'status': '404', 'redirect': None}}", + "14:40:14 bookstack: artisan create-admin :: Admin account with email \"drill-c575a897@gate.invalid\" successfully created!", + "14:40:21 bookstack: readback of the seeded account found=True :: This will delete any configure multi-factor authentication methods for user: - ID: 3 - Name: drill-de83a8 - Email: drill-c575a897@gate.inval", + "14:40:22 [5] drill commit cbb4196e7162: bookstack lscr.io/linuxserver/bookstack:26.09.1 -> lscr.io/linuxserver/bookstack:26.09.2 (push rc=0)", + "14:40:31 [5] the box's drill mirror now at cbb4196e7", + "14:40:36 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "14:40:36 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "14:40:51 + 14.4s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "14:40:52 + 15.5s phase=pulling label=Új verzió letöltése… err=None hold=None", + "14:41:17 + 41.1s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "14:41:30 + 53.4s phase=starting label=Indítás az új verzióval… err=None hold=None", + "14:41:36 + 59.5s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "14:41:53 + 76.9s phase=done label=Frissítve err=None hold=None", + "14:42:20 bookstack: readback of the seeded account found=True :: This will delete any configure multi-factor authentication methods for user: - ID: 3 - Name: drill-de83a8 - Email: drill-c575a897@gate.inval", + "14:42:21 [7] memory soak 600 s …", + "14:52:28 [7] soak: peak 37.2% of the limit (anon), kills 0, restarts 0" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/bookstack/drill-back.txt b/documentation/audits/security-app-updates-2026-10-27/walks/bookstack/drill-back.txt new file mode 100644 index 00000000..369afbc6 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/bookstack/drill-back.txt @@ -0,0 +1,3 @@ +14:53:16 [5] drill commit cf5bca2a4af8: bookstack lscr.io/linuxserver/bookstack:26.09.2 -> lscr.io/linuxserver/bookstack:26.09.1 (push rc=0) +14:53:24 [5] the box's drill mirror now at cf5bca2a4 +cf5bca2a4af8 diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/bookstack/walk.txt b/documentation/audits/security-app-updates-2026-10-27/walks/bookstack/walk.txt new file mode 100644 index 00000000..e9b314d0 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/bookstack/walk.txt @@ -0,0 +1,25 @@ +14:38:50 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['ADMIN_PASSWORD'] +14:38:50 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +14:40:06 [1] deployed, controller state=unhealthy, pinned={'bookstack': 'lscr.io/linuxserver/bookstack:26.09.1', 'bookstack-db': 'mariadb:12.3'} +14:40:06 [1] NOTE: the controller's own state is 'unhealthy', not 'running' — recorded, not treated as a failure; the fixture's front-door wait is the real gate +14:40:10 [2] setup gate as installed: {'browser': {'status': '404', 'redirect': None}, 'script': {'status': '404', 'redirect': None}} +14:40:14 bookstack: artisan create-admin :: Admin account with email "drill-c575a897@gate.invalid" successfully created! +14:40:21 bookstack: readback of the seeded account found=True :: This will delete any configure multi-factor authentication methods for user: - ID: 3 - Name: drill-de83a8 - Email: drill-c575a897@gate.inval +14:40:22 [5] drill commit cbb4196e7162: bookstack lscr.io/linuxserver/bookstack:26.09.1 -> lscr.io/linuxserver/bookstack:26.09.2 (push rc=0) +14:40:31 [5] the box's drill mirror now at cbb4196e7 +14:40:36 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +14:40:36 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +14:40:51 + 14.4s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +14:40:52 + 15.5s phase=pulling label=Új verzió letöltése… err=None hold=None +14:41:17 + 41.1s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +14:41:30 + 53.4s phase=starting label=Indítás az új verzióval… err=None hold=None +14:41:36 + 59.5s phase=verifying label=Működés ellenőrzése… err=None hold=None +14:41:53 + 76.9s phase=done label=Frissítve err=None hold=None +14:42:20 bookstack: readback of the seeded account found=True :: This will delete any configure multi-factor authentication methods for user: - ID: 3 - Name: drill-de83a8 - Email: drill-c575a897@gate.inval +14:42:21 [7] memory soak 600 s … +14:52:28 [7] soak: peak 37.2% of the limit (anon), kills 0, restarts 0 +14:52:28 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/bookstack/verdict.json +14:52:28 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back +14:52:33 [X] stop -> 200 {'ok': True, 'message': 'Stack bookstack stop completed'} +14:53:05 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'bookstack', 'volumes_removed': ['bookstack_bookstack_config', 'bookstack_bookstack_db_data'], 'hdd_paths_removed': [], 'hdd_pa +14:53:13 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/bookstack/writer-drill.txt b/documentation/audits/security-app-updates-2026-10-27/walks/bookstack/writer-drill.txt new file mode 100644 index 00000000..f09b9fee --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/bookstack/writer-drill.txt @@ -0,0 +1,3 @@ +STEP bookstack: the superseded step {'bookstack': 'lscr.io/linuxserver/bookstack:26.09.1', 'bookstack-db': 'mariadb:12.3'} keeps its definition at steps/b0574d943276d5b3.yml +STEP bookstack: … and its .felhom.yml at steps/b0574d943276d5b3.felhom.yml +WROTE bookstack: {'bookstack': 'lscr.io/linuxserver/bookstack:26.09.1', 'bookstack-db': 'mariadb:12.3'} -> {'bookstack': 'lscr.io/linuxserver/bookstack:26.09.2', 'bookstack-db': 'mariadb:12.3'} peak 43.4% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False} diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/code-server/box-verdict-code-server.json b/documentation/audits/security-app-updates-2026-10-27/walks/code-server/box-verdict-code-server.json new file mode 100644 index 00000000..5aca7ee1 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/code-server/box-verdict-code-server.json @@ -0,0 +1,229 @@ +{ + "app": "code-server", + "walk": "security", + "box_walk_version": 1, + "verdict": "proven", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "code-server": "lscr.io/linuxserver/code-server:4.129.0" + }, + "to": { + "code-server": "lscr.io/linuxserver/code-server:4.143.1" + }, + "observables_before": { + "pinned_images": { + "code-server": "lscr.io/linuxserver/code-server:4.129.0" + }, + "installed_images": { + "code-server": "lscr.io/linuxserver/code-server:4.129.0" + }, + "catalog_images": { + "code-server": "lscr.io/linuxserver/code-server:4.129.0" + }, + "live_compose_image_lines": [ + "image: lscr.io/linuxserver/code-server:4.129.0" + ], + "docker_inspect": [ + "code-server lscr.io/linuxserver/code-server:4.129.0 running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "401", + "redirect": null + }, + "script": { + "status": "401", + "redirect": null + } + }, + "seed": "none", + "seed_why": "its front door is a browser IDE behind one password; it exposes no data API, and writing a file with docker exec would not be the front door (R-156)", + "drill_commit": "e9d45463d7d9", + "sync_waited_s": 15.8, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-10-27T13:14:40Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "checking", + "label": "Ellenőrzés…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 1.0, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 23.6, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 47.1, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 51.2, + "phase": "starting", + "label": "Indítás az új verzióval…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 52.3, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 57.4, + "phase": "done", + "label": "Frissítve", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 57.4, + "final_phase": "done", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "code-server": "lscr.io/linuxserver/code-server:4.143.1" + }, + "installed_images": { + "code-server": "lscr.io/linuxserver/code-server:4.143.1" + }, + "catalog_images": { + "code-server": "lscr.io/linuxserver/code-server:4.143.1" + }, + "live_compose_image_lines": [ + "image: lscr.io/linuxserver/code-server:4.143.1" + ], + "docker_inspect": [ + "code-server lscr.io/linuxserver/code-server:4.143.1 running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.", + "text": "Naprakész" + } + ], + "en": [ + { + "title": "This app is running the newest version available.", + "text": "Up to date" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "code-server": "sha256:4524d0b00478e41264f42e0e660c1819e3b7d0c460f78ce73e44fa39b2b55134" + }, + "four_observables": { + "pinned": { + "code-server": "lscr.io/linuxserver/code-server:4.143.1" + }, + "installed": { + "code-server": "lscr.io/linuxserver/code-server:4.143.1" + }, + "catalog": { + "code-server": "lscr.io/linuxserver/code-server:4.143.1" + }, + "live_compose": [ + "lscr.io/linuxserver/code-server:4.143.1" + ] + }, + "setup_gate_after": { + "browser": { + "status": "401", + "redirect": null + }, + "script": { + "status": "401", + "redirect": null + } + }, + "memory": { + "soak_s": 600, + "interval_s": 10, + "samples": 60, + "containers": { + "code-server": { + "samples": 60, + "anon_peak_bytes": 56635392, + "limit_bytes": 1073741824, + "anon_peak_pct": 5.3, + "cgroup_peak_pct": 6.5, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-3e70f1cab90c32e664a14c2861fdebbbf7c7bc27370465d09a60f0048b2a437d.scope" + } + }, + "oom_kills": 0, + "restarts": 0, + "peak_pct": 5.3 + }, + "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak", + "log": [ + "14:13:20 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['PASSWORD']", + "14:13:21 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "14:14:11 [1] deployed, controller state=running, pinned={'code-server': 'lscr.io/linuxserver/code-server:4.129.0'}", + "14:14:15 [2] setup gate as installed: {'browser': {'status': '401', 'redirect': None}, 'script': {'status': '401', 'redirect': None}}", + "14:14:15 [3] seed: none — its front door is a browser IDE behind one password; it exposes no data API, and writing a file with docker exec would not be the front door (R-156)", + "14:14:16 [5] drill commit e9d45463d7d9: code-server lscr.io/linuxserver/code-server:4.129.0 -> lscr.io/linuxserver/code-server:4.143.1 (push rc=0)", + "14:14:25 [5] the box's drill mirror now at e9d45463", + "14:14:40 [sync] the badge needed 15.8s and 2 sync+rescan rounds to catch up to lscr.io/linuxserver/code-server:4.143.1 — R-607's window, measured", + "14:14:41 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "14:14:41 + 0.0s phase=checking label=Ellenőrzés… err=None hold=None", + "14:14:42 + 1.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "14:15:04 + 23.6s phase=pulling label=Új verzió letöltése… err=None hold=None", + "14:15:28 + 47.1s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "14:15:32 + 51.2s phase=starting label=Indítás az új verzióval… err=None hold=None", + "14:15:33 + 52.3s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "14:15:38 + 57.4s phase=done label=Frissítve err=None hold=None", + "14:15:57 [7] memory soak 600 s …", + "14:26:03 [7] soak: peak 5.3% of the limit (anon), kills 0, restarts 0" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/code-server/drill-back.txt b/documentation/audits/security-app-updates-2026-10-27/walks/code-server/drill-back.txt new file mode 100644 index 00000000..37e2c11f --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/code-server/drill-back.txt @@ -0,0 +1,3 @@ +14:26:52 [5] drill commit 26f60a061f06: code-server lscr.io/linuxserver/code-server:4.143.1 -> lscr.io/linuxserver/code-server:4.129.0 (push rc=0) +14:27:01 [5] the box's drill mirror now at 26f60a06 +26f60a061f06 diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/code-server/walk.txt b/documentation/audits/security-app-updates-2026-10-27/walks/code-server/walk.txt new file mode 100644 index 00000000..a44979ab --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/code-server/walk.txt @@ -0,0 +1,23 @@ +14:13:20 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['PASSWORD'] +14:13:21 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +14:14:11 [1] deployed, controller state=running, pinned={'code-server': 'lscr.io/linuxserver/code-server:4.129.0'} +14:14:15 [2] setup gate as installed: {'browser': {'status': '401', 'redirect': None}, 'script': {'status': '401', 'redirect': None}} +14:14:15 [3] seed: none — its front door is a browser IDE behind one password; it exposes no data API, and writing a file with docker exec would not be the front door (R-156) +14:14:16 [5] drill commit e9d45463d7d9: code-server lscr.io/linuxserver/code-server:4.129.0 -> lscr.io/linuxserver/code-server:4.143.1 (push rc=0) +14:14:25 [5] the box's drill mirror now at e9d45463 +14:14:40 [sync] the badge needed 15.8s and 2 sync+rescan rounds to catch up to lscr.io/linuxserver/code-server:4.143.1 — R-607's window, measured +14:14:41 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +14:14:41 + 0.0s phase=checking label=Ellenőrzés… err=None hold=None +14:14:42 + 1.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +14:15:04 + 23.6s phase=pulling label=Új verzió letöltése… err=None hold=None +14:15:28 + 47.1s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +14:15:32 + 51.2s phase=starting label=Indítás az új verzióval… err=None hold=None +14:15:33 + 52.3s phase=verifying label=Működés ellenőrzése… err=None hold=None +14:15:38 + 57.4s phase=done label=Frissítve err=None hold=None +14:15:57 [7] memory soak 600 s … +14:26:03 [7] soak: peak 5.3% of the limit (anon), kills 0, restarts 0 +14:26:03 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/code-server/verdict.json +14:26:03 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak +14:26:09 [X] stop -> 200 {'ok': True, 'message': 'Stack code-server stop completed'} +14:26:41 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'code-server', 'volumes_removed': ['code-server_codeserver_config'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_n +14:26:50 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/code-server/writer-drill.txt b/documentation/audits/security-app-updates-2026-10-27/walks/code-server/writer-drill.txt new file mode 100644 index 00000000..58bfd6da --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/code-server/writer-drill.txt @@ -0,0 +1 @@ +WROTE code-server: {'code-server': 'lscr.io/linuxserver/code-server:4.129.0'} -> {'code-server': 'lscr.io/linuxserver/code-server:4.143.1'} peak 5.3% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False} diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/outline/box-verdict-outline.json b/documentation/audits/security-app-updates-2026-10-27/walks/outline/box-verdict-outline.json new file mode 100644 index 00000000..21006b57 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/outline/box-verdict-outline.json @@ -0,0 +1,291 @@ +{ + "app": "outline", + "walk": "security", + "box_walk_version": 1, + "verdict": "proven", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "outline": "outlinewiki/outline:1.10.1", + "outline-postgres": "postgres:18-alpine", + "outline-redis": "redis:7-alpine" + }, + "to": { + "outline": "outlinewiki/outline:1.12.0", + "outline-postgres": "postgres:18-alpine", + "outline-redis": "redis:7-alpine" + }, + "observables_before": { + "pinned_images": { + "outline": "outlinewiki/outline:1.10.1", + "outline-postgres": "postgres:18-alpine", + "outline-redis": "redis:7-alpine" + }, + "installed_images": { + "outline": "outlinewiki/outline:1.10.1", + "outline-postgres": "postgres:18-alpine", + "outline-redis": "redis:7-alpine" + }, + "catalog_images": { + "outline": "outlinewiki/outline:1.10.1", + "outline-postgres": "postgres:18-alpine", + "outline-redis": "redis:7-alpine" + }, + "live_compose_image_lines": [ + "image: outlinewiki/outline:1.10.1@sha256:832051f039b446c87aa23929cf92c00980c66aaa2d744d118c48c016ec816ad8", + "image: postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873", + "image: redis:7-alpine@sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499" + ], + "docker_inspect": [ + "outline outlinewiki/outline:1.10.1@sha256:832051f039b446c87aa23929cf92c00980c66aaa2d744d118c48c016ec816ad8 running=true restarts=0", + "outline-postgres postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873 running=true restarts=0", + "outline-redis redis:7-alpine@sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499 running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "seed": "read_back", + "drill_commit": "965ad8906535", + "sync_waited_s": 15.7, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-10-27T13:38:04Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 13.3, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 15.4, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 62.6, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 82.2, + "phase": "starting", + "label": "Indítás az új verzióval…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 88.3, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 103.7, + "phase": "done", + "label": "Frissítve", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 103.8, + "final_phase": "done", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "outline": "outlinewiki/outline:1.12.0", + "outline-postgres": "postgres:18-alpine", + "outline-redis": "redis:7-alpine" + }, + "installed_images": { + "outline": "outlinewiki/outline:1.12.0", + "outline-postgres": "postgres:18-alpine", + "outline-redis": "redis:7-alpine" + }, + "catalog_images": { + "outline": "outlinewiki/outline:1.12.0", + "outline-postgres": "postgres:18-alpine", + "outline-redis": "redis:7-alpine" + }, + "live_compose_image_lines": [ + "image: outlinewiki/outline:1.12.0", + "image: postgres:18-alpine", + "image: redis:7-alpine" + ], + "docker_inspect": [ + "outline outlinewiki/outline:1.12.0 running=true restarts=0", + "outline-redis redis:7-alpine running=true restarts=0", + "outline-postgres postgres:18-alpine running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.", + "text": "Naprakész" + } + ], + "en": [ + { + "title": "This app is running the newest version available.", + "text": "Up to date" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "outline": "sha256:25d6a2ced2f1f0cf03c09abd776d87ba31941ed96d3a99992aa84b3bd0afc074", + "outline-postgres": "sha256:10a5c69a83035ab5239f5620d708520e8b28f5aa1f2b20143e6024532edadfb5", + "outline-redis": "sha256:6ba19c50b56777f5c11c58eff8ddb69d0d5f27ba131cffb63f180ccfd43c66af" + }, + "four_observables": { + "pinned": { + "outline": "outlinewiki/outline:1.12.0", + "outline-postgres": "postgres:18-alpine", + "outline-redis": "redis:7-alpine" + }, + "installed": { + "outline": "outlinewiki/outline:1.12.0", + "outline-postgres": "postgres:18-alpine", + "outline-redis": "redis:7-alpine" + }, + "catalog": { + "outline": "outlinewiki/outline:1.12.0", + "outline-postgres": "postgres:18-alpine", + "outline-redis": "redis:7-alpine" + }, + "live_compose": [ + "outlinewiki/outline:1.12.0", + "postgres:18-alpine", + "redis:7-alpine" + ] + }, + "seed_read_after": true, + "setup_gate_after": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "memory": { + "soak_s": 600, + "interval_s": 10, + "samples": 174, + "containers": { + "outline": { + "samples": 58, + "anon_peak_bytes": 252518400, + "limit_bytes": 805306368, + "anon_peak_pct": 31.4, + "cgroup_peak_pct": 36.4, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-9ae8bfb6c379710286c62901ccd73e3ff4fa3d478c15cc559cf630f031a202e5.scope" + }, + "outline-redis": { + "samples": 58, + "anon_peak_bytes": 3346432, + "limit_bytes": 134217728, + "anon_peak_pct": 2.5, + "cgroup_peak_pct": 11.0, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-4c009b03222e25232316ab7fb8ebb4830dc6378e5931116e169b2bd3bfcb7915.scope" + }, + "outline-postgres": { + "samples": 58, + "anon_peak_bytes": 9117696, + "limit_bytes": 268435456, + "anon_peak_pct": 3.4, + "cgroup_peak_pct": 16.0, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-d3c7276c0e0a10c3da98b0c867d63d416f22972bd44c7df7114a1bbb4b117fa2.scope" + } + }, + "oom_kills": 0, + "restarts": 0, + "peak_pct": 31.4 + }, + "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back", + "log": [ + "14:35:11 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "14:37:32 [1] deployed, controller state=running, pinned={'outline': 'outlinewiki/outline:1.10.1', 'outline-postgres': 'postgres:18-alpine', 'outline-redis': 'redis:7-alpine'}", + "14:37:32 gate: kb is gated — passed as the household (cookie set)", + "14:37:36 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}", + "14:37:36 outline: installation.create http=302", + "14:37:36 outline: CSRF cookie __Host-csrfToken", + "14:37:37 outline: seeded document drilldoc-09da411e", + "14:37:37 outline: readback of the seeded document http=200 found=True", + "14:37:38 [5] drill commit 965ad8906535: outline outlinewiki/outline:1.10.1 -> outlinewiki/outline:1.12.0 (push rc=0)", + "14:37:48 [5] the box's drill mirror now at 965ad8906", + "14:38:04 [sync] the badge needed 15.7s and 2 sync+rescan rounds to catch up to outlinewiki/outline:1.12.0 — R-607's window, measured", + "14:38:04 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "14:38:04 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "14:38:17 + 13.3s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "14:38:19 + 15.4s phase=pulling label=Új verzió letöltése… err=None hold=None", + "14:39:07 + 62.6s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "14:39:26 + 82.2s phase=starting label=Indítás az új verzióval… err=None hold=None", + "14:39:32 + 88.3s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "14:39:48 + 103.7s phase=done label=Frissítve err=None hold=None", + "14:40:06 outline: readback of the seeded document http=200 found=True", + "14:40:06 [7] memory soak 600 s …", + "14:50:15 [7] soak: peak 31.4% of the limit (anon), kills 0, restarts 0" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/outline/drill-back.txt b/documentation/audits/security-app-updates-2026-10-27/walks/outline/drill-back.txt new file mode 100644 index 00000000..38c13a00 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/outline/drill-back.txt @@ -0,0 +1,3 @@ +14:51:00 [5] drill commit ab5bcee8c41d: outline outlinewiki/outline:1.12.0 -> outlinewiki/outline:1.10.1 (push rc=0) +14:51:08 [5] the box's drill mirror now at ab5bcee8c +ab5bcee8c41d diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/outline/walk.txt b/documentation/audits/security-app-updates-2026-10-27/walks/outline/walk.txt new file mode 100644 index 00000000..28d82235 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/outline/walk.txt @@ -0,0 +1,27 @@ +14:35:11 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +14:37:32 [1] deployed, controller state=running, pinned={'outline': 'outlinewiki/outline:1.10.1', 'outline-postgres': 'postgres:18-alpine', 'outline-redis': 'redis:7-alpine'} +14:37:32 gate: kb is gated — passed as the household (cookie set) +14:37:36 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}} +14:37:36 outline: installation.create http=302 +14:37:36 outline: CSRF cookie __Host-csrfToken +14:37:37 outline: seeded document drilldoc-09da411e +14:37:37 outline: readback of the seeded document http=200 found=True +14:37:38 [5] drill commit 965ad8906535: outline outlinewiki/outline:1.10.1 -> outlinewiki/outline:1.12.0 (push rc=0) +14:37:48 [5] the box's drill mirror now at 965ad8906 +14:38:04 [sync] the badge needed 15.7s and 2 sync+rescan rounds to catch up to outlinewiki/outline:1.12.0 — R-607's window, measured +14:38:04 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +14:38:04 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +14:38:17 + 13.3s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +14:38:19 + 15.4s phase=pulling label=Új verzió letöltése… err=None hold=None +14:39:07 + 62.6s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +14:39:26 + 82.2s phase=starting label=Indítás az új verzióval… err=None hold=None +14:39:32 + 88.3s phase=verifying label=Működés ellenőrzése… err=None hold=None +14:39:48 + 103.7s phase=done label=Frissítve err=None hold=None +14:40:06 outline: readback of the seeded document http=200 found=True +14:40:06 [7] memory soak 600 s … +14:50:15 [7] soak: peak 31.4% of the limit (anon), kills 0, restarts 0 +14:50:15 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/outline/verdict.json +14:50:15 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back +14:50:17 [X] stop -> 200 {'ok': True, 'message': 'Stack outline stop completed'} +14:50:49 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'outline', 'volumes_removed': ['outline_outline_data', 'outline_outline_postgres_data', 'outline_outline_redis_data'], 'hdd_pat +14:50:57 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/outline/writer-drill.txt b/documentation/audits/security-app-updates-2026-10-27/walks/outline/writer-drill.txt new file mode 100644 index 00000000..6e52d13b --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/outline/writer-drill.txt @@ -0,0 +1,3 @@ +STEP outline: the superseded step {'outline': 'outlinewiki/outline:1.10.1', 'outline-postgres': 'postgres:18-alpine', 'outline-redis': 'redis:7-alpine'} keeps its definition at steps/e9a25f94911e5934.yml +STEP outline: … and its .felhom.yml at steps/e9a25f94911e5934.felhom.yml +WROTE outline: {'outline': 'outlinewiki/outline:1.10.1', 'outline-postgres': 'postgres:18-alpine', 'outline-redis': 'redis:7-alpine'} -> {'outline': 'outlinewiki/outline:1.12.0', 'outline-postgres': 'postgres:18-alpine', 'outline-redis': 'redis:7-alpine'} peak 31.4% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False} diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/rallly/box-verdict-rallly.json b/documentation/audits/security-app-updates-2026-10-27/walks/rallly/box-verdict-rallly.json new file mode 100644 index 00000000..deb4f322 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/rallly/box-verdict-rallly.json @@ -0,0 +1,276 @@ +{ + "app": "rallly", + "walk": "security", + "box_walk_version": 1, + "verdict": "proven", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "rallly": "lukevella/rallly:4.15.3", + "rallly-postgres": "postgres:18-alpine" + }, + "to": { + "rallly": "lukevella/rallly:4.16.3", + "rallly-postgres": "postgres:18-alpine" + }, + "observables_before": { + "pinned_images": { + "rallly": "lukevella/rallly:4.15.3", + "rallly-postgres": "postgres:18-alpine" + }, + "installed_images": { + "rallly": "lukevella/rallly:4.15.3", + "rallly-postgres": "postgres:18-alpine" + }, + "catalog_images": { + "rallly": "lukevella/rallly:4.15.3", + "rallly-postgres": "postgres:18-alpine" + }, + "live_compose_image_lines": [ + "image: lukevella/rallly:4.15.3@sha256:8cd979aefe8d06e1822bc67054eb2d31088cdb831aa3f7b5615b3768f35431d9", + "image: postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873" + ], + "docker_inspect": [ + "rallly lukevella/rallly:4.15.3@sha256:8cd979aefe8d06e1822bc67054eb2d31088cdb831aa3f7b5615b3768f35431d9 running=true restarts=0", + "rallly-postgres postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873 running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "seed": "read_back", + "drill_commit": "c8f159314d14", + "sync_waited_s": 4.5, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-10-27T13:36:03Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "checking", + "label": "Ellenőrzés…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 6.2, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 26.7, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 28.7, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 70.0, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 85.4, + "phase": "starting", + "label": "Indítás az új verzióval…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 91.6, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 102.9, + "phase": "done", + "label": "Frissítve", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 102.9, + "final_phase": "done", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "rallly": "lukevella/rallly:4.16.3", + "rallly-postgres": "postgres:18-alpine" + }, + "installed_images": { + "rallly": "lukevella/rallly:4.16.3", + "rallly-postgres": "postgres:18-alpine" + }, + "catalog_images": { + "rallly": "lukevella/rallly:4.16.3", + "rallly-postgres": "postgres:18-alpine" + }, + "live_compose_image_lines": [ + "image: lukevella/rallly:4.16.3", + "image: postgres:18-alpine" + ], + "docker_inspect": [ + "rallly lukevella/rallly:4.16.3 running=true restarts=0", + "rallly-postgres postgres:18-alpine running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.", + "text": "Naprakész" + } + ], + "en": [ + { + "title": "This app is running the newest version available.", + "text": "Up to date" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "rallly": "sha256:7837f8148cc6db5e3e9a8df199912950adaee66898ebad4949d9dbb2f30aa02b", + "rallly-postgres": "sha256:10a5c69a83035ab5239f5620d708520e8b28f5aa1f2b20143e6024532edadfb5" + }, + "four_observables": { + "pinned": { + "rallly": "lukevella/rallly:4.16.3", + "rallly-postgres": "postgres:18-alpine" + }, + "installed": { + "rallly": "lukevella/rallly:4.16.3", + "rallly-postgres": "postgres:18-alpine" + }, + "catalog": { + "rallly": "lukevella/rallly:4.16.3", + "rallly-postgres": "postgres:18-alpine" + }, + "live_compose": [ + "lukevella/rallly:4.16.3", + "postgres:18-alpine" + ] + }, + "seed_read_after": true, + "setup_gate_after": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "memory": { + "soak_s": 600, + "interval_s": 10, + "samples": 118, + "containers": { + "rallly": { + "samples": 59, + "anon_peak_bytes": 336867328, + "limit_bytes": 805306368, + "anon_peak_pct": 41.8, + "cgroup_peak_pct": 46.2, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-ed1a580df25dda53d6816d24261b4d264b064cac75c3497c7eadd3d04b9cae6e.scope" + }, + "rallly-postgres": { + "samples": 59, + "anon_peak_bytes": 15912960, + "limit_bytes": 268435456, + "anon_peak_pct": 5.9, + "cgroup_peak_pct": 17.9, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-d7186cc6b053f20cd65b6d1adb0a4aadb7edda06d5a7aeb919ee0d86cf9d580a.scope" + } + }, + "oom_kills": 0, + "restarts": 0, + "peak_pct": 41.8 + }, + "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back", + "log": [ + "14:33:37 [1] removing the existing rallly first (scratch box)", + "14:33:48 [X] stop -> 200 {'ok': True, 'message': 'Stack rallly stop completed'}", + "14:34:20 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'rallly', 'volumes_removed': ['rallly_rallly_postgres_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': '", + "14:34:28 [X] after remove: deployed=False leftovers=''", + "14:34:33 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "14:35:34 [1] deployed, controller state=running, pinned={'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'}", + "14:35:34 gate: poll is gated — passed as the household (cookie set)", + "14:35:38 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}", + "14:35:38 rallly: sign-up http=400", + "14:35:39 rallly: e-mail code sign-in requested http=200", + "14:35:42 rallly: sign-in with the code http=200 session=True", + "14:35:46 rallly: personal space set up http=200 ok=True", + "14:35:47 rallly: seeded poll drillpoll-ead72747 (N4Zx4ONLi2OS)", + "14:35:47 rallly: readback of the seeded poll http=200 found=True", + "14:35:48 [5] drill commit c8f159314d14: rallly lukevella/rallly:4.15.3 -> lukevella/rallly:4.16.3 (push rc=0)", + "14:35:59 [5] the box's drill mirror now at c8f15931", + "14:36:04 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "14:36:04 + 0.0s phase=checking label=Ellenőrzés… err=None hold=None", + "14:36:10 + 6.2s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "14:36:30 + 26.7s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "14:36:32 + 28.7s phase=pulling label=Új verzió letöltése… err=None hold=None", + "14:37:14 + 70.0s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "14:37:29 + 85.4s phase=starting label=Indítás az új verzióval… err=None hold=None", + "14:37:35 + 91.6s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "14:37:46 + 102.9s phase=done label=Frissítve err=None hold=None", + "14:38:06 rallly: readback of the seeded poll http=200 found=True", + "14:38:06 [7] memory soak 600 s …", + "14:48:15 [7] soak: peak 41.8% of the limit (anon), kills 0, restarts 0" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/rallly/drill-back.txt b/documentation/audits/security-app-updates-2026-10-27/walks/rallly/drill-back.txt new file mode 100644 index 00000000..95fab9b7 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/rallly/drill-back.txt @@ -0,0 +1,3 @@ +14:49:22 [5] drill commit ddd09a827c63: rallly lukevella/rallly:4.16.3 -> lukevella/rallly:4.15.3 (push rc=0) +14:49:31 [5] the box's drill mirror now at ddd09a827 +ddd09a827c63 diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/rallly/walk.txt b/documentation/audits/security-app-updates-2026-10-27/walks/rallly/walk.txt new file mode 100644 index 00000000..f38cb959 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/rallly/walk.txt @@ -0,0 +1,33 @@ +14:33:37 [1] removing the existing rallly first (scratch box) +14:33:48 [X] stop -> 200 {'ok': True, 'message': 'Stack rallly stop completed'} +14:34:20 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'rallly', 'volumes_removed': ['rallly_rallly_postgres_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': ' +14:34:28 [X] after remove: deployed=False leftovers='' +14:34:33 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +14:35:34 [1] deployed, controller state=running, pinned={'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'} +14:35:34 gate: poll is gated — passed as the household (cookie set) +14:35:38 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}} +14:35:38 rallly: sign-up http=400 +14:35:39 rallly: e-mail code sign-in requested http=200 +14:35:42 rallly: sign-in with the code http=200 session=True +14:35:46 rallly: personal space set up http=200 ok=True +14:35:47 rallly: seeded poll drillpoll-ead72747 (N4Zx4ONLi2OS) +14:35:47 rallly: readback of the seeded poll http=200 found=True +14:35:48 [5] drill commit c8f159314d14: rallly lukevella/rallly:4.15.3 -> lukevella/rallly:4.16.3 (push rc=0) +14:35:59 [5] the box's drill mirror now at c8f15931 +14:36:04 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +14:36:04 + 0.0s phase=checking label=Ellenőrzés… err=None hold=None +14:36:10 + 6.2s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +14:36:30 + 26.7s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +14:36:32 + 28.7s phase=pulling label=Új verzió letöltése… err=None hold=None +14:37:14 + 70.0s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +14:37:29 + 85.4s phase=starting label=Indítás az új verzióval… err=None hold=None +14:37:35 + 91.6s phase=verifying label=Működés ellenőrzése… err=None hold=None +14:37:46 + 102.9s phase=done label=Frissítve err=None hold=None +14:38:06 rallly: readback of the seeded poll http=200 found=True +14:38:06 [7] memory soak 600 s … +14:48:15 [7] soak: peak 41.8% of the limit (anon), kills 0, restarts 0 +14:48:15 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/rallly/verdict.json +14:48:15 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back +14:48:26 [X] stop -> 200 {'ok': True, 'message': 'Stack rallly stop completed'} +14:48:58 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'rallly', 'volumes_removed': ['rallly_rallly_postgres_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': ' +14:49:06 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/rallly/writer-drill.txt b/documentation/audits/security-app-updates-2026-10-27/walks/rallly/writer-drill.txt new file mode 100644 index 00000000..21a1dfe4 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/rallly/writer-drill.txt @@ -0,0 +1,3 @@ +STEP rallly: the superseded step {'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'} keeps its definition at steps/cb9ffe27aae45ba0.yml +STEP rallly: … and its .felhom.yml at steps/cb9ffe27aae45ba0.felhom.yml +WROTE rallly: {'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'} -> {'rallly': 'lukevella/rallly:4.16.3', 'rallly-postgres': 'postgres:18-alpine'} peak 41.8% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False} diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/romm/box-verdict-romm.json b/documentation/audits/security-app-updates-2026-10-27/walks/romm/box-verdict-romm.json new file mode 100644 index 00000000..e72cb9a5 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/romm/box-verdict-romm.json @@ -0,0 +1,289 @@ +{ + "app": "romm", + "walk": "security", + "box_walk_version": 1, + "verdict": "proven", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "romm": "rommapp/romm:5.3.1", + "romm-db": "mariadb:11.8", + "romm-redis": "redis:7-alpine" + }, + "to": { + "romm": "rommapp/romm:5.4.1", + "romm-db": "mariadb:11.8", + "romm-redis": "redis:7-alpine" + }, + "observables_before": { + "pinned_images": { + "romm": "rommapp/romm:5.3.1", + "romm-db": "mariadb:11.8", + "romm-redis": "redis:7-alpine" + }, + "installed_images": { + "romm": "rommapp/romm:5.3.1", + "romm-db": "mariadb:11.8", + "romm-redis": "redis:7-alpine" + }, + "catalog_images": { + "romm": "rommapp/romm:5.3.1", + "romm-db": "mariadb:11.8", + "romm-redis": "redis:7-alpine" + }, + "live_compose_image_lines": [ + "image: rommapp/romm:5.3.1@sha256:0d66b4ea152a237c7f24b95e87459f46d3c596a7c0b35a82f26bc971487278b3", + "image: mariadb:11.8@sha256:79d59758afc91b89b120b0a8904d637f5a3b3e1c4900f29b740d6d46c72fef68", + "image: redis:7-alpine@sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499" + ], + "docker_inspect": [ + "romm rommapp/romm:5.3.1@sha256:0d66b4ea152a237c7f24b95e87459f46d3c596a7c0b35a82f26bc971487278b3 running=true restarts=0", + "romm-db mariadb:11.8@sha256:79d59758afc91b89b120b0a8904d637f5a3b3e1c4900f29b740d6d46c72fef68 running=true restarts=0", + "romm-redis redis:7-alpine@sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499 running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "seed": "read_back", + "drill_commit": "369e96ff4a04", + "sync_waited_s": 4.5, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-10-27T13:14:00Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 24.6, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 26.7, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 62.5, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 88.1, + "phase": "starting", + "label": "Indítás az új verzióval…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 99.4, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 130.2, + "phase": "done", + "label": "Frissítve", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 130.2, + "final_phase": "done", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "romm": "rommapp/romm:5.4.1", + "romm-db": "mariadb:11.8", + "romm-redis": "redis:7-alpine" + }, + "installed_images": { + "romm": "rommapp/romm:5.4.1", + "romm-db": "mariadb:11.8", + "romm-redis": "redis:7-alpine" + }, + "catalog_images": { + "romm": "rommapp/romm:5.4.1", + "romm-db": "mariadb:11.8", + "romm-redis": "redis:7-alpine" + }, + "live_compose_image_lines": [ + "image: rommapp/romm:5.4.1", + "image: mariadb:11.8", + "image: redis:7-alpine" + ], + "docker_inspect": [ + "romm rommapp/romm:5.4.1 running=true restarts=0", + "romm-db mariadb:11.8 running=true restarts=0", + "romm-redis redis:7-alpine running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.", + "text": "Naprakész" + } + ], + "en": [ + { + "title": "This app is running the newest version available.", + "text": "Up to date" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "romm": "sha256:8677fb7b81b1d3db20b849e989a1dadc2a11159e51eb34a2acdcb01102274edf", + "romm-db": "sha256:c4124d1afa875e47f2892edf26b482fa54f796e2f342d3717a04ca091a22a9bd", + "romm-redis": "sha256:6ba19c50b56777f5c11c58eff8ddb69d0d5f27ba131cffb63f180ccfd43c66af" + }, + "four_observables": { + "pinned": { + "romm": "rommapp/romm:5.4.1", + "romm-db": "mariadb:11.8", + "romm-redis": "redis:7-alpine" + }, + "installed": { + "romm": "rommapp/romm:5.4.1", + "romm-db": "mariadb:11.8", + "romm-redis": "redis:7-alpine" + }, + "catalog": { + "romm": "rommapp/romm:5.4.1", + "romm-db": "mariadb:11.8", + "romm-redis": "redis:7-alpine" + }, + "live_compose": [ + "mariadb:11.8", + "redis:7-alpine", + "rommapp/romm:5.4.1" + ] + }, + "seed_read_after": true, + "setup_gate_after": { + "browser": { + "status": "200", + "redirect": null + }, + "script": { + "status": "200", + "redirect": null + } + }, + "memory": { + "soak_s": 600, + "interval_s": 10, + "samples": 174, + "containers": { + "romm": { + "samples": 58, + "anon_peak_bytes": 635965440, + "limit_bytes": 1073741824, + "anon_peak_pct": 59.2, + "cgroup_peak_pct": 69.4, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-098d13eab9ce0b2d469ebb4245aa74eaf4b844646d0c5ae4780d69af5da801c7.scope" + }, + "romm-db": { + "samples": 58, + "anon_peak_bytes": 113971200, + "limit_bytes": 402653184, + "anon_peak_pct": 28.3, + "cgroup_peak_pct": 34.6, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-a2a19b142b5efde311ca0b05c96aa9d7dc7bb4a983d8717e94e0b21395c3a137.scope" + }, + "romm-redis": { + "samples": 58, + "anon_peak_bytes": 13832192, + "limit_bytes": 134217728, + "anon_peak_pct": 10.3, + "cgroup_peak_pct": 23.0, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-2dbb1526a65b4698077190d39cffc4314a09095fce57ee8ff3f350c4101f40d1.scope" + } + }, + "oom_kills": 0, + "restarts": 0, + "peak_pct": 59.2 + }, + "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back", + "log": [ + "14:11:48 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']", + "14:11:48 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "14:13:29 [1] deployed, controller state=running, pinned={'romm': 'rommapp/romm:5.3.1', 'romm-db': 'mariadb:11.8', 'romm-redis': 'redis:7-alpine'}", + "14:13:29 gate: arcade is gated — passed as the household (cookie set)", + "14:13:34 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}", + "14:13:41 romm: POST /api/users http=201", + "14:13:42 romm: login as the seeded user http=200 ok=True", + "14:13:44 [5] drill commit 369e96ff4a04: romm rommapp/romm:5.3.1 -> rommapp/romm:5.4.1 (push rc=0)", + "14:13:56 [5] the box's drill mirror now at 369e96ff", + "14:14:01 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "14:14:01 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "14:14:25 + 24.6s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "14:14:27 + 26.7s phase=pulling label=Új verzió letöltése… err=None hold=None", + "14:15:03 + 62.5s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "14:15:29 + 88.1s phase=starting label=Indítás az új verzióval… err=None hold=None", + "14:15:40 + 99.4s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "14:16:11 + 130.2s phase=done label=Frissítve err=None hold=None", + "14:16:32 romm: login as the seeded user http=200 ok=True", + "14:16:32 [7] memory soak 600 s …", + "14:26:40 [7] soak: peak 59.2% of the limit (anon), kills 0, restarts 0" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/romm/drill-back.txt b/documentation/audits/security-app-updates-2026-10-27/walks/romm/drill-back.txt new file mode 100644 index 00000000..f71670c9 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/romm/drill-back.txt @@ -0,0 +1,3 @@ +14:27:38 [5] drill commit 87adf7a79191: romm rommapp/romm:5.4.1 -> rommapp/romm:5.3.1 (push rc=0) +14:27:47 [5] the box's drill mirror now at 87adf7a7 +87adf7a79191 diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/romm/walk.txt b/documentation/audits/security-app-updates-2026-10-27/walks/romm/walk.txt new file mode 100644 index 00000000..5e5b87c5 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/romm/walk.txt @@ -0,0 +1,25 @@ +14:11:48 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH'] +14:11:48 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +14:13:29 [1] deployed, controller state=running, pinned={'romm': 'rommapp/romm:5.3.1', 'romm-db': 'mariadb:11.8', 'romm-redis': 'redis:7-alpine'} +14:13:29 gate: arcade is gated — passed as the household (cookie set) +14:13:34 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}} +14:13:41 romm: POST /api/users http=201 +14:13:42 romm: login as the seeded user http=200 ok=True +14:13:44 [5] drill commit 369e96ff4a04: romm rommapp/romm:5.3.1 -> rommapp/romm:5.4.1 (push rc=0) +14:13:56 [5] the box's drill mirror now at 369e96ff +14:14:01 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +14:14:01 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +14:14:25 + 24.6s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +14:14:27 + 26.7s phase=pulling label=Új verzió letöltése… err=None hold=None +14:15:03 + 62.5s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +14:15:29 + 88.1s phase=starting label=Indítás az új verzióval… err=None hold=None +14:15:40 + 99.4s phase=verifying label=Működés ellenőrzése… err=None hold=None +14:16:11 + 130.2s phase=done label=Frissítve err=None hold=None +14:16:32 romm: login as the seeded user http=200 ok=True +14:16:32 [7] memory soak 600 s … +14:26:40 [7] soak: peak 59.2% of the limit (anon), kills 0, restarts 0 +14:26:40 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/romm/verdict.json +14:26:40 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back +14:26:55 [X] stop -> 200 {'ok': True, 'message': 'Stack romm stop completed'} +14:27:27 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'romm', 'volumes_removed': ['romm_romm_assets', 'romm_romm_config', 'romm_romm_db_data', 'romm_romm_redis_data'], 'hdd_paths_re +14:27:36 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/romm/writer-drill.txt b/documentation/audits/security-app-updates-2026-10-27/walks/romm/writer-drill.txt new file mode 100644 index 00000000..074e5b02 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/romm/writer-drill.txt @@ -0,0 +1,3 @@ +STEP romm: the superseded step {'romm': 'rommapp/romm:5.3.1', 'romm-db': 'mariadb:11.8', 'romm-redis': 'redis:7-alpine'} keeps its definition at steps/211c8ec7a0531f87.yml +STEP romm: … and its .felhom.yml at steps/211c8ec7a0531f87.felhom.yml +WROTE romm: {'romm': 'rommapp/romm:5.3.1', 'romm-db': 'mariadb:11.8', 'romm-redis': 'redis:7-alpine'} -> {'romm': 'rommapp/romm:5.4.1', 'romm-db': 'mariadb:11.8', 'romm-redis': 'redis:7-alpine'} peak 59.2% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False} diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/vikunja/box-verdict-vikunja.json b/documentation/audits/security-app-updates-2026-10-27/walks/vikunja/box-verdict-vikunja.json new file mode 100644 index 00000000..fc9986e3 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/vikunja/box-verdict-vikunja.json @@ -0,0 +1,229 @@ +{ + "app": "vikunja", + "walk": "security", + "box_walk_version": 1, + "verdict": "proven", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "vikunja": "vikunja/vikunja:2.6.0" + }, + "to": { + "vikunja": "vikunja/vikunja:2.7.1" + }, + "observables_before": { + "pinned_images": { + "vikunja": "vikunja/vikunja:2.6.0" + }, + "installed_images": { + "vikunja": "vikunja/vikunja:2.6.0" + }, + "catalog_images": null, + "live_compose_image_lines": [ + "image: vikunja/vikunja:2.6.0@sha256:417ada6f94e81f0267aa2f007d0a811fc82d38dd2aa58351e3ea520ca01c2ea5" + ], + "docker_inspect": [ + "vikunja vikunja/vikunja:2.6.0@sha256:417ada6f94e81f0267aa2f007d0a811fc82d38dd2aa58351e3ea520ca01c2ea5 running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "seed": "read_back", + "drill_commit": "6a83d2d3e657", + "sync_waited_s": 5.0, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-10-27T13:37:33Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 3.1, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 4.2, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 8.2, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 12.4, + "phase": "starting", + "label": "Indítás az új verzióval…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 13.4, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 18.5, + "phase": "done", + "label": "Frissítve", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 18.5, + "final_phase": "done", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "vikunja": "vikunja/vikunja:2.7.1" + }, + "installed_images": { + "vikunja": "vikunja/vikunja:2.7.1" + }, + "catalog_images": { + "vikunja": "vikunja/vikunja:2.7.1" + }, + "live_compose_image_lines": [ + "image: vikunja/vikunja:2.7.1" + ], + "docker_inspect": [ + "vikunja vikunja/vikunja:2.7.1 running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.", + "text": "Naprakész" + } + ], + "en": [ + { + "title": "This app is running the newest version available.", + "text": "Up to date" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "vikunja": "sha256:f7dc8428d10aef17f3075886d3c1c022f566ec456f88985f02c137f4fc534576" + }, + "four_observables": { + "pinned": { + "vikunja": "vikunja/vikunja:2.7.1" + }, + "installed": { + "vikunja": "vikunja/vikunja:2.7.1" + }, + "catalog": { + "vikunja": "vikunja/vikunja:2.7.1" + }, + "live_compose": [ + "vikunja/vikunja:2.7.1" + ] + }, + "seed_read_after": true, + "setup_gate_after": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "memory": { + "soak_s": 600, + "interval_s": 10, + "samples": 60, + "containers": { + "vikunja": { + "samples": 60, + "anon_peak_bytes": 34652160, + "limit_bytes": 268435456, + "anon_peak_pct": 12.9, + "cgroup_peak_pct": 17.2, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-a32b17337a2b0af0cc3f8f1cbe12743a9d24189e23dec56b76497175015018d7.scope" + } + }, + "oom_kills": 0, + "restarts": 0, + "peak_pct": 12.9 + }, + "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back", + "log": [ + "14:36:44 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "14:37:11 [1] deployed, controller state=running, pinned={'vikunja': 'vikunja/vikunja:2.6.0'}", + "14:37:11 gate: tasks is gated — passed as the household (cookie set)", + "14:37:15 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}", + "14:37:15 vikunja: register http=200", + "14:37:15 vikunja: create project http=201", + "14:37:15 vikunja: readback of the seeded project http=200 ok=True", + "14:37:16 [5] drill commit 6a83d2d3e657: vikunja vikunja/vikunja:2.6.0 -> vikunja/vikunja:2.7.1 (push rc=0)", + "14:37:28 [5] the box's drill mirror now at 6a83d2d3", + "14:37:33 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "14:37:33 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "14:37:36 + 3.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "14:37:37 + 4.2s phase=pulling label=Új verzió letöltése… err=None hold=None", + "14:37:41 + 8.2s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "14:37:45 + 12.4s phase=starting label=Indítás az új verzióval… err=None hold=None", + "14:37:46 + 13.4s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "14:37:51 + 18.5s phase=done label=Frissítve err=None hold=None", + "14:38:10 vikunja: readback of the seeded project http=200 ok=True", + "14:38:11 [7] memory soak 600 s …", + "14:48:16 [7] soak: peak 12.9% of the limit (anon), kills 0, restarts 0" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/vikunja/drill-back.txt b/documentation/audits/security-app-updates-2026-10-27/walks/vikunja/drill-back.txt new file mode 100644 index 00000000..998af6f9 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/vikunja/drill-back.txt @@ -0,0 +1,3 @@ +14:48:59 [5] drill commit ac9662494204: vikunja vikunja/vikunja:2.7.1 -> vikunja/vikunja:2.6.0 (push rc=0) +14:49:08 [5] the box's drill mirror now at ac9662494 +ac9662494204 diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/vikunja/walk.txt b/documentation/audits/security-app-updates-2026-10-27/walks/vikunja/walk.txt new file mode 100644 index 00000000..58bcc77b --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/vikunja/walk.txt @@ -0,0 +1,25 @@ +14:36:44 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +14:37:11 [1] deployed, controller state=running, pinned={'vikunja': 'vikunja/vikunja:2.6.0'} +14:37:11 gate: tasks is gated — passed as the household (cookie set) +14:37:15 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}} +14:37:15 vikunja: register http=200 +14:37:15 vikunja: create project http=201 +14:37:15 vikunja: readback of the seeded project http=200 ok=True +14:37:16 [5] drill commit 6a83d2d3e657: vikunja vikunja/vikunja:2.6.0 -> vikunja/vikunja:2.7.1 (push rc=0) +14:37:28 [5] the box's drill mirror now at 6a83d2d3 +14:37:33 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +14:37:33 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +14:37:36 + 3.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +14:37:37 + 4.2s phase=pulling label=Új verzió letöltése… err=None hold=None +14:37:41 + 8.2s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +14:37:45 + 12.4s phase=starting label=Indítás az új verzióval… err=None hold=None +14:37:46 + 13.4s phase=verifying label=Működés ellenőrzése… err=None hold=None +14:37:51 + 18.5s phase=done label=Frissítve err=None hold=None +14:38:10 vikunja: readback of the seeded project http=200 ok=True +14:38:11 [7] memory soak 600 s … +14:48:16 [7] soak: peak 12.9% of the limit (anon), kills 0, restarts 0 +14:48:16 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/vikunja/verdict.json +14:48:16 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back +14:48:17 [X] stop -> 200 {'ok': True, 'message': 'Stack vikunja stop completed'} +14:48:49 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'vikunja', 'volumes_removed': ['vikunja_vikunja_data', 'vikunja_vikunja_db'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [ +14:48:57 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/vikunja/writer-drill.txt b/documentation/audits/security-app-updates-2026-10-27/walks/vikunja/writer-drill.txt new file mode 100644 index 00000000..c52d98ba --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/vikunja/writer-drill.txt @@ -0,0 +1,3 @@ +STEP vikunja: the superseded step {'vikunja': 'vikunja/vikunja:2.6.0'} keeps its definition at steps/0648126b21eeb5a0.yml +STEP vikunja: … and its .felhom.yml at steps/0648126b21eeb5a0.felhom.yml +WROTE vikunja: {'vikunja': 'vikunja/vikunja:2.6.0'} -> {'vikunja': 'vikunja/vikunja:2.7.1'} peak 12.9% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False} diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/wishlist/box-verdict-wishlist.json b/documentation/audits/security-app-updates-2026-10-27/walks/wishlist/box-verdict-wishlist.json new file mode 100644 index 00000000..230f52cb --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/wishlist/box-verdict-wishlist.json @@ -0,0 +1,232 @@ +{ + "app": "wishlist", + "walk": "security", + "box_walk_version": 1, + "verdict": "proven", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.67.1" + }, + "to": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.69.0" + }, + "observables_before": { + "pinned_images": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.67.1" + }, + "installed_images": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.67.1" + }, + "catalog_images": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.67.1" + }, + "live_compose_image_lines": [ + "image: ghcr.io/cmintey/wishlist:v0.67.1@sha256:4b89bfb5b57ffb087c33978d21b09048e5c37f4506326e9ccd2705a0a1d86548" + ], + "docker_inspect": [ + "wishlist ghcr.io/cmintey/wishlist:v0.67.1@sha256:4b89bfb5b57ffb087c33978d21b09048e5c37f4506326e9ccd2705a0a1d86548 running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "seed": "read_back", + "drill_commit": "e3a0b476111c", + "sync_waited_s": 38.1, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-10-27T13:32:28Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 3.1, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 5.2, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 39.6, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 52.9, + "phase": "starting", + "label": "Indítás az új verzióval…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 53.9, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 69.3, + "phase": "done", + "label": "Frissítve", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 69.3, + "final_phase": "done", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.69.0" + }, + "installed_images": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.69.0" + }, + "catalog_images": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.69.0" + }, + "live_compose_image_lines": [ + "image: ghcr.io/cmintey/wishlist:v0.69.0" + ], + "docker_inspect": [ + "wishlist ghcr.io/cmintey/wishlist:v0.69.0 running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.", + "text": "Naprakész" + } + ], + "en": [ + { + "title": "This app is running the newest version available.", + "text": "Up to date" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "wishlist": "sha256:a3c0482c5d55155a3aa96c4cbb63d2aa379f02ae3bbeb76909ffed2b15980f36" + }, + "four_observables": { + "pinned": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.69.0" + }, + "installed": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.69.0" + }, + "catalog": { + "wishlist": "ghcr.io/cmintey/wishlist:v0.69.0" + }, + "live_compose": [ + "ghcr.io/cmintey/wishlist:v0.69.0" + ] + }, + "seed_read_after": true, + "setup_gate_after": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "memory": { + "soak_s": 600, + "interval_s": 10, + "samples": 60, + "containers": { + "wishlist": { + "samples": 60, + "anon_peak_bytes": 112017408, + "limit_bytes": 536870912, + "anon_peak_pct": 20.9, + "cgroup_peak_pct": 45.0, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-14b42ef775c4c2763194268b18f36e2a35e4308e873fa5507be8687b0b7eb805.scope" + } + }, + "oom_kills": 0, + "restarts": 0, + "peak_pct": 20.9 + }, + "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back", + "log": [ + "14:25:17 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "14:26:32 [1] deployed, controller state=running, pinned={'wishlist': 'ghcr.io/cmintey/wishlist:v0.67.1'}", + "14:26:32 gate: wishlist is gated — passed as the household (cookie set)", + "14:31:34 app never answered on wishlist/ (last rc=0 code=307)", + "14:31:38 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}", + "14:31:40 wishlist: /signup http=200 type=success", + "14:31:40 wishlist: sign-in as the seeded user type=success ok=True (wrong password refused)", + "14:31:41 [5] drill commit e3a0b476111c: wishlist ghcr.io/cmintey/wishlist:v0.67.1 -> ghcr.io/cmintey/wishlist:v0.69.0 (push rc=0)", + "14:31:50 [5] the box's drill mirror now at e3a0b476", + "14:32:28 [sync] the badge needed 38.1s and 4 sync+rescan rounds to catch up to ghcr.io/cmintey/wishlist:v0.69.0 — R-607's window, measured", + "14:32:29 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "14:32:29 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "14:32:32 + 3.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "14:32:34 + 5.2s phase=pulling label=Új verzió letöltése… err=None hold=None", + "14:33:08 + 39.6s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "14:33:21 + 52.9s phase=starting label=Indítás az új verzióval… err=None hold=None", + "14:33:22 + 53.9s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "14:33:38 + 69.3s phase=done label=Frissítve err=None hold=None", + "14:33:57 wishlist: sign-in as the seeded user type=success ok=True (wrong password refused)", + "14:33:57 [7] memory soak 600 s …", + "14:44:04 [7] soak: peak 20.9% of the limit (anon), kills 0, restarts 0" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/wishlist/drill-back.txt b/documentation/audits/security-app-updates-2026-10-27/walks/wishlist/drill-back.txt new file mode 100644 index 00000000..13087000 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/wishlist/drill-back.txt @@ -0,0 +1,3 @@ +14:44:47 [5] drill commit 09c778f4c42a: wishlist ghcr.io/cmintey/wishlist:v0.69.0 -> ghcr.io/cmintey/wishlist:v0.67.1 (push rc=0) +14:44:55 [5] the box's drill mirror now at 09c778f4c +09c778f4c42a diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/wishlist/walk.txt b/documentation/audits/security-app-updates-2026-10-27/walks/wishlist/walk.txt new file mode 100644 index 00000000..4de39dd9 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/wishlist/walk.txt @@ -0,0 +1,26 @@ +14:25:17 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +14:26:32 [1] deployed, controller state=running, pinned={'wishlist': 'ghcr.io/cmintey/wishlist:v0.67.1'} +14:26:32 gate: wishlist is gated — passed as the household (cookie set) +14:31:34 app never answered on wishlist/ (last rc=0 code=307) +14:31:38 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}} +14:31:40 wishlist: /signup http=200 type=success +14:31:40 wishlist: sign-in as the seeded user type=success ok=True (wrong password refused) +14:31:41 [5] drill commit e3a0b476111c: wishlist ghcr.io/cmintey/wishlist:v0.67.1 -> ghcr.io/cmintey/wishlist:v0.69.0 (push rc=0) +14:31:50 [5] the box's drill mirror now at e3a0b476 +14:32:28 [sync] the badge needed 38.1s and 4 sync+rescan rounds to catch up to ghcr.io/cmintey/wishlist:v0.69.0 — R-607's window, measured +14:32:29 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +14:32:29 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +14:32:32 + 3.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +14:32:34 + 5.2s phase=pulling label=Új verzió letöltése… err=None hold=None +14:33:08 + 39.6s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +14:33:21 + 52.9s phase=starting label=Indítás az új verzióval… err=None hold=None +14:33:22 + 53.9s phase=verifying label=Működés ellenőrzése… err=None hold=None +14:33:38 + 69.3s phase=done label=Frissítve err=None hold=None +14:33:57 wishlist: sign-in as the seeded user type=success ok=True (wrong password refused) +14:33:57 [7] memory soak 600 s … +14:44:04 [7] soak: peak 20.9% of the limit (anon), kills 0, restarts 0 +14:44:04 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/wishlist/verdict.json +14:44:04 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back +14:44:04 [X] stop -> 200 {'ok': True, 'message': 'Stack wishlist stop completed'} +14:44:36 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'wishlist', 'volumes_removed': ['wishlist_wishlist_data', 'wishlist_wishlist_uploads'], 'hdd_paths_removed': [], 'hdd_paths_pre +14:44:44 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-app-updates-2026-10-27/walks/wishlist/writer-drill.txt b/documentation/audits/security-app-updates-2026-10-27/walks/wishlist/writer-drill.txt new file mode 100644 index 00000000..3669a955 --- /dev/null +++ b/documentation/audits/security-app-updates-2026-10-27/walks/wishlist/writer-drill.txt @@ -0,0 +1,3 @@ +STEP wishlist: the superseded step {'wishlist': 'ghcr.io/cmintey/wishlist:v0.67.1'} keeps its definition at steps/33a677d99c540590.yml +STEP wishlist: … and its .felhom.yml at steps/33a677d99c540590.felhom.yml +WROTE wishlist: {'wishlist': 'ghcr.io/cmintey/wishlist:v0.67.1'} -> {'wishlist': 'ghcr.io/cmintey/wishlist:v0.69.0'} peak 21.6% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}