admin
238954405c
gates / gates (push) Successful in 23s
GOLDEN_SHA256=4b0a7dacc503c38732ed0a44949398639248c7fbd90758a1e4a047c21a7a15d8 Round-trip verified on the served bytes. Not vouched - the operator's.
53 lines
2.2 KiB
Markdown
53 lines
2.2 KiB
Markdown
# Golden bake 0.212.0 — 2026-08-12
|
|
|
|
Baked in the drill VM on DooPlex per `RUNBOOK-manual-build.md` §4.0/§4.1. Reverted to `virgin` before
|
|
and after; build guest 9100 destroyed `--purge`; `/root` residue check empty.
|
|
|
|
| | |
|
|
|---|---|
|
|
| `GOLDEN_VERSION` | **0.212.0** |
|
|
| `GOLDEN_SHA256` | **4b0a7dacc503c38732ed0a44949398639248c7fbd90758a1e4a047c21a7a15d8** |
|
|
| controller baked | `gitea.dooplex.hu/admin/felhom-controller:0.212.0` |
|
|
| `MinAgent` (from the controller CHANGELOG header) | **0.127.0** |
|
|
| archive | `local:backup/vzdump-lxc-9100-2026_08_12-13_56_29.tar.zst` |
|
|
| published | `…/generic/felhom-golden/0.212.0/golden.tar.zst`, 656 611 277 B, `upload OK (HTTP 201)` |
|
|
| template | `debian-13-standard_13.6-1_amd64.tar.zst` |
|
|
| drill VM | `pve-manager/9.2.2`, kernel 7.0.2-6-pve |
|
|
|
|
## Acceptance markers — counted with `grep -F` from the start
|
|
|
|
| marker | count |
|
|
|---|---|
|
|
| `docker OK (overlay2` | 1 |
|
|
| `including mount point rootfs` | 1 |
|
|
| `including mount point mp0` | 1 (there is no mp1 — R-165 collapsed the two data volumes) |
|
|
| `upload OK (HTTP 201)` | 1 |
|
|
| `FATAL` | 0 |
|
|
| `excluding` | 0 |
|
|
|
|
The 0.211.0 run had two of these return a false `0` through shell quoting; this run used `grep -F`
|
|
with a quoted loop variable throughout, which is why the counts are trustworthy without a re-run.
|
|
|
|
## Fetchability — verified on the SERVED bytes
|
|
|
|
```
|
|
downloaded: 656611277 bytes
|
|
sha256: 4b0a7dacc503c38732ed0a44949398639248c7fbd90758a1e4a047c21a7a15d8
|
|
```
|
|
|
|
Identical to `GOLDEN_SHA256`. The controller image was independently confirmed retrievable
|
|
(`docker manifest inspect …:0.212.0`).
|
|
|
|
## Secret handling
|
|
|
|
Token copied file→file, read inside the VM by a runner script, never on a command line.
|
|
`systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "<token>"` = **0**.
|
|
Leak grep on the **committed** log = **0**, believable because the grep was first shown to work: a
|
|
throwaway copy with the token appended grepped **1**, then was shredded. Token, bake script, runner
|
|
and log all `shred -u`'d in the VM.
|
|
|
|
## NOT DONE
|
|
|
|
**The Day-0 vouch has not been made** — the operator's. Three fields together:
|
|
`golden_version` 0.212.0, `agent_version` 0.128.0, `min_agent` 0.127.0.
|