From f790734ec2e9ab66b2e215ac0d129e5ce3912df0 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 5 Oct 2026 21:24:38 +0200 Subject: [PATCH] R-274: the BYO disclosure names the golden it reuses; the local-golden check is pinned The check itself shipped with R-297 (golden_local_matches_manifest: sha256 or controller version against the hub manifest; mismatch re-fetches, a named --golden is refused). This adds the disclosure line the row also asked for and tests that pin the check's place before the adopt. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- scripts/felhom-host-install.sh | 3 +++ scripts/test_hostinstall.py | 17 ++++++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/scripts/felhom-host-install.sh b/scripts/felhom-host-install.sh index b5b43d9a..9b2f784c 100644 --- a/scripts/felhom-host-install.sh +++ b/scripts/felhom-host-install.sh @@ -1881,6 +1881,9 @@ EOF else echo " guest: the provisioned Felhom LXC (vmid ${VMID}, capped ${CPU_CORES} cores / ${MEM_MIB} MiB) + its volumes" echo " + the golden vzdump imported onto storage '${ARCHIVE_STORAGE}'" + # R-274: the disclosure names what the install REUSES, not only what it creates. + echo " reuse: a golden already on '${ARCHIVE_STORAGE}' is used only if its sha256 or its controller version" + echo " matches the hub's vouched golden; otherwise the vouched one is fetched (a --golden you name is refused)" fi echo " update: operator-signed self-update authority: ${RESOLVED_OP_ID:-NONE (self-update stays dormant)}" echo " NOT touched in byo mode: root@pam (no break-glass), host DNS (:53), OOB sshd." diff --git a/scripts/test_hostinstall.py b/scripts/test_hostinstall.py index fd05f305..91d33fcd 100644 --- a/scripts/test_hostinstall.py +++ b/scripts/test_hostinstall.py @@ -11,7 +11,7 @@ functions act on are variables the test points into the temp directory. Nothing Where behaviour cannot be isolated, a STATIC test checks the wiring (the function is CALLED, from the right place) — a helper defined and never called is the seam-built-never-wired shape. -Rows: R-275, R-276, R-881 (uninstall residue); R-306 (--preflight-only writes no state); R-130 (lvm minimum wording); R-180 (archive storage outside the ACL set); R-179 (NAS units); R-310 (golden refusal wording, the uninstall's terminal). +Rows: R-275, R-276, R-881 (uninstall residue); R-306 (--preflight-only writes no state); R-130 (lvm minimum wording); R-180 (archive storage outside the ACL set); R-179 (NAS units); R-310 (golden refusal wording, the uninstall's terminal); R-274 (local golden reuse). Run: python3 scripts/test_hostinstall.py """ import os @@ -588,6 +588,21 @@ def test_require_tty_guards_the_uninstall_prompt(): assert g > 0 and g < r, "the vmid confirmation is not guarded by _require_tty" +# ── R-274: a local golden is checked against the manifest, and the disclosure says it is reused ── +def test_local_golden_is_checked_before_use(): + body = func("step_golden") + chk = body.find('golden_local_matches_manifest "$GOLDEN_VOLID"') + use = body.find('log_skip " using local golden') + assert 0 < chk < use, "step_golden adopts a local golden without checking it against the manifest" + g = func("golden_local_matches_manifest") + assert "ART_GOLDEN_SHA" in g and "ART_GOLDEN_VER" in g, "the check no longer compares sha256 and version" + + +def test_byo_disclosure_names_the_golden_reuse(): + body = func("_byo_disclosure_ack") + assert re.search(r"reuse:.*golden.*vouched", body, re.S), "the BYO disclosure does not say a local golden is reused (R-274)" + + def main(): tests = [(n, f) for n, f in sorted(globals().items()) if n.startswith("test_") and callable(f)] fails = 0