admin
999b0a35f8
GOLDEN_SHA256=8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849 Round-trip verified on the served bytes. Not vouched - that is the operator's.
2.6 KiB
Golden bake 0.211.0 — 2026-08-10
Baked in the drill VM on DooPlex per RUNBOOK-manual-build.md §4.0/§4.1. Reverted to virgin
before and after; build guest 9100 destroyed --purge.
GOLDEN_VERSION |
0.211.0 |
GOLDEN_SHA256 |
8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849 |
| controller baked | gitea.dooplex.hu/admin/felhom-controller:0.211.0 |
MinAgent (from the controller CHANGELOG header) |
0.127.0 |
| archive | local:backup/vzdump-lxc-9100-2026_08_10-14_13_46.tar.zst, 625 MB |
| published | …/generic/felhom-golden/0.211.0/golden.tar.zst, 656 141 689 B, upload OK (HTTP 201) |
| template | debian-13-standard_13.6-1_amd64.tar.zst (checksum verified on download) |
| drill VM | pve-manager/9.2.2, kernel 7.0.2-6-pve |
Acceptance markers — counted, not eyeballed
| marker | count |
|---|---|
docker OK (overlay2 |
1 |
including mount point rootfs |
1 |
including mount point mp0 |
1 (there is no mp1 — R-165 collapsed the two data volumes) |
upload OK (HTTP 201) |
1 |
FATAL |
0 |
excluding |
0 |
A first attempt at two of these greps broke on shell quoting and returned 0 for markers that were
in fact present. They were re-run with grep -F and correct quoting — a 0 from a broken instrument
is not a measurement, which is the same class this runbook's own R-233 note is about.
Fetchability — verified on the SERVED bytes, not the local file
curl -fsSL …/generic/felhom-golden/0.211.0/golden.tar.zst
downloaded: 656141689 bytes
sha256: 8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849
Matches GOLDEN_SHA256 exactly. The controller image was independently confirmed retrievable from
the registry (docker manifest inspect …:0.211.0 → schemaVersion 2); note that an anonymous
/v2/.../tags/list returns 401, which is an auth response and NOT evidence of absence.
Secret handling
Token copied file→file (scp), read inside the VM by a runner script, never on a command line.
systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "<token>" = 0.
Token-leak grep on the committed log = 0, and that 0 is believable because the grep was first
shown to work: a throwaway copy with the token appended grepped 1, then was shredded.
Token, bake script, runner and log all shred -u'd inside the VM; /root residue check empty.
NOT DONE
The Day-0 vouch has not been made — that is the operator's, and this session deliberately did not
make it. Vouching is a THREE-field change: golden_version 0.211.0, agent_version 0.128.0,
min_agent 0.127.0.