admin
999b0a35f8
gates / gates (push) Successful in 22s
GOLDEN_SHA256=8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849 Round-trip verified on the served bytes. Not vouched - that is the operator's.
57 lines
2.6 KiB
Markdown
57 lines
2.6 KiB
Markdown
# Golden bake 0.211.0 — 2026-08-10
|
|
|
|
Baked in the drill VM on DooPlex per `RUNBOOK-manual-build.md` §4.0/§4.1. Reverted to `virgin`
|
|
before and after; build guest 9100 destroyed `--purge`.
|
|
|
|
| | |
|
|
|---|---|
|
|
| `GOLDEN_VERSION` | **0.211.0** |
|
|
| `GOLDEN_SHA256` | **8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849** |
|
|
| controller baked | `gitea.dooplex.hu/admin/felhom-controller:0.211.0` |
|
|
| `MinAgent` (from the controller CHANGELOG header) | **0.127.0** |
|
|
| archive | `local:backup/vzdump-lxc-9100-2026_08_10-14_13_46.tar.zst`, 625 MB |
|
|
| published | `…/generic/felhom-golden/0.211.0/golden.tar.zst`, 656 141 689 B, `upload OK (HTTP 201)` |
|
|
| template | `debian-13-standard_13.6-1_amd64.tar.zst` (checksum verified on download) |
|
|
| drill VM | `pve-manager/9.2.2`, kernel 7.0.2-6-pve |
|
|
|
|
## Acceptance markers — counted, not eyeballed
|
|
|
|
| marker | count |
|
|
|---|---|
|
|
| `docker OK (overlay2` | 1 |
|
|
| `including mount point rootfs` | 1 |
|
|
| `including mount point mp0` | 1 (there is no mp1 — R-165 collapsed the two data volumes) |
|
|
| `upload OK (HTTP 201)` | 1 |
|
|
| `FATAL` | 0 |
|
|
| `excluding` | 0 |
|
|
|
|
A first attempt at two of these greps broke on shell quoting and returned `0` for markers that were
|
|
in fact present. They were re-run with `grep -F` and correct quoting — **a 0 from a broken instrument
|
|
is not a measurement**, which is the same class this runbook's own R-233 note is about.
|
|
|
|
## Fetchability — verified on the SERVED bytes, not the local file
|
|
|
|
```
|
|
curl -fsSL …/generic/felhom-golden/0.211.0/golden.tar.zst
|
|
downloaded: 656141689 bytes
|
|
sha256: 8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849
|
|
```
|
|
|
|
Matches `GOLDEN_SHA256` exactly. The controller image was independently confirmed retrievable from
|
|
the registry (`docker manifest inspect …:0.211.0` → schemaVersion 2); note that an anonymous
|
|
`/v2/.../tags/list` returns **401**, which is an auth response and NOT evidence of absence.
|
|
|
|
## Secret handling
|
|
|
|
Token copied file→file (`scp`), read inside the VM by a runner script, never on a command line.
|
|
`systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "<token>"` = **0**.
|
|
Token-leak grep on the **committed** log = **0**, and that 0 is believable because the grep was first
|
|
shown to work: a throwaway copy with the token appended grepped **1**, then was shredded.
|
|
Token, bake script, runner and log all `shred -u`'d inside the VM; `/root` residue check empty.
|
|
|
|
## NOT DONE
|
|
|
|
**The Day-0 vouch has not been made** — that is the operator's, and this session deliberately did not
|
|
make it. Vouching is a THREE-field change: `golden_version` 0.211.0, `agent_version` 0.128.0,
|
|
`min_agent` 0.127.0.
|