felhom.eu/documentation/tests/golden-0.289.1-2026-10-03/README.md

Golden 0.289.1 bake (2026-10-03)

Baked in the drill VM on DooPlex per documentation/runbooks/RUNBOOK-manual-build.md §4.0 and §4.1 steps 1–4. Step 5 (vouching in the hub) was NOT done here.

• Controller image: gitea.dooplex.hu/admin/felhom-controller:0.289.1
• Build script: felhom-agent/configs/build-golden.sh v3.0.0 at agent main d766666 (clean tree, equal to origin/main); sha256 e4c9ede772e777efacdbc6a2bfb3b15d181d2e96bb82b40cee557b5bbe068834, identical on DooPlex and inside the VM.
• Template: debian-13-standard_13.6-1_amd64.tar.zst (from pveam available, filtered on _amd64).
• Drill VM: pve-manager/9.2.2.

GOLDEN_VERSION=0.289.1 GOLDEN_SHA256=59fa7beadbb17fbcd30524c47e34806d3122f57fb8c5e2618727b6781e874512 Package: https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/0.289.1/golden.tar.zst (652929857 bytes).

Pass markers, quoted from bake.log

82:  docker OK (overlay2; data-root /var/lib/docker)
313:INFO: including mount point rootfs ('/') in backup
314:INFO: including mount point mp0 ('/var/lib/felhom') in backup
319:[golden]   pre-delete existing: HTTP 404 (404/204 expected)
320:[golden]   upload OK (HTTP 201)

grep -c -E 'excluding|FATAL' bake.log = 0. No mp1 line (none expected since v3.0.0).

Token handling

• Token copied file → file (scp); the bake ran from a runner script inside the VM that reads the token itself (systemd-run --unit=golden-bake --collect).
• systemctl show golden-bake -p Environment -p ExecStart | grep -c -F <token> = 0; positive control (same output with the token appended) = 1.
• Leak grep on THIS saved bake.log (the committed copy): 0. Positive control (a throwaway copy with the token appended) = 1; the copy was shred -u'd.

Teardown state

• pct destroy 9100 --purge — rc 0, both LVs removed.
• /root/.gitea-token, /root/bake-run.sh, /root/bake.log in the VM — shred -u, confirmed absent.
• VM powered off; qemu process gone (no qemu-system-x86 in ps).
• qemu-img snapshot -a virgin drill.qcow2 — OK; snapshot virgin still listed.

Deviations from the runbook

• pveam update was run before pveam available (the virgin snapshot's template index is stale); the runbook's step 2 does not list it.
• The published package was not re-downloaded to verify its sha256; the evidence is the script's upload OK (HTTP 201) and its printed GOLDEN_SHA256.