admin
832218dca4
gates / gates (push) Successful in 20s
Uploaded with env-only credentials and verified by ROUND TRIP: the downloaded bytes checksum to a4cd9b6d…, identical to the built file, and the checksum file is served. 1.27.1 stays in the bucket; nothing was overwritten. The download page now names 1.28.0 with the published checksum (BOM preserved, site gates green). R-535 closes with an honest caveat: the new banner ships byte-identical to repo HEAD and the string is in the published payload, but it was never seen on a screen — the box bound itself while the walk was headless. Also corrected: the 1.27.1 heading still said NOT PUBLISHED although it went out on the big night. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
90 lines
6.4 KiB
Plaintext
90 lines
6.4 KiB
Plaintext
## 2026-09-16T15:07:32Z ISO release gate — mechanical criteria, run against the EXACT file to be uploaded
|
|
file: /mnt/5_hdd/felhom.eu/felhom-iso/out/felhom-installer-1.28.0-pve9.2-1.iso
|
|
size: 1705322496 B sha256: a4cd9b6ddcb55bae3700ab307084d2b699330cc20710688d5816318f04f6d635
|
|
extracted to a scratch dir: 1.6G
|
|
G1 no answer.toml: 0 hit(s) [must be 0]
|
|
G2 no root password/hash: 0 file(s) [must be 0]
|
|
G3 no SSH key baked: 0 file(s) [must be 0]
|
|
G4 no customer identity: 0 file(s) [must be 0]
|
|
G6 boot menu entries: 2 ; timeout: set timeout=15
|
|
G7 felhom package present: felhom-bootstrap_1.28.0_all.deb
|
|
positive control (the ISO really is unpacked): 1 kernel file(s), expect 1
|
|
scratch dir kept for the remaining manual criteria: /tmp/claude-1000/isogate.5cI4
|
|
## 2026-09-16T15:08:24Z ISO release gate — payload identity and console strings
|
|
package: felhom-bootstrap_1.28.0_all.deb
|
|
files the package ships:
|
|
usr/local/sbin/felhom-bootstrap.sh
|
|
lib/systemd/system/felhom-bootstrap.service
|
|
G9 payload vs repo HEAD (byte-for-byte):
|
|
felhom-bootstrap.sh: IDENTICAL to repo HEAD
|
|
G15/G16 console strings in the shipped payload (ASCII fragments, both controls):
|
|
'ssze van k' (the NEW bound banner, R-535): 2 hit(s) [expect >=1]
|
|
'ros' + 'kod' pairing banner still present: 2 hit(s) [expect 1 — the waiting state still needs it]
|
|
NEGATIVE control, a string that must NOT be there: 0 hit(s) [expect 0]
|
|
admin URL 8006 on the console path: 1 hit(s) [expect 0]
|
|
G8 postinst present and ends exit 0: exit 0
|
|
## The one `8006` hit, explained rather than waved away (G15):
|
|
## scripts/iso/felhom-bootstrap.sh:103 is a COMMENT — it quotes what pvebanner WOULD print
|
|
## („connect to https://<ip>:8006/") to explain why the unit masks that service. It is not printed
|
|
## to any console. Verified by reading the line, not by counting it.
|
|
## 2026-09-16T15:10:29Z ISO release gate — remaining mechanical criteria
|
|
G5 credential enumeration across the whole tree (patterns searched, so 'no hits' means searched):
|
|
PRIVATE KEY -> 0 hit(s)
|
|
password= -> 0 hit(s)
|
|
passphrase -> 0 hit(s)
|
|
Bearer -> 0 hit(s)
|
|
api[_-]token -> 0 hit(s)
|
|
felhom_op -> 0 hit(s)
|
|
G10 build inputs committed (git status of the iso sources):
|
|
0 uncommitted file(s) under scripts/iso [must be 0]
|
|
HEAD=c033b3b origin/main=c033b3b
|
|
G13 directories the payload writes into, present in the package:
|
|
ships: usr/local/sbin/felhom-bootstrap.sh lib/systemd/system/felhom-bootstrap.service
|
|
/etc/felhom is created by the script at runtime: 0 call(s)
|
|
G11 checksum file beside the image: 1 [expect 1]
|
|
G12 bucket stays private — not re-tested here; the 2026-09-15 publication proved it and nothing about the bucket changed.
|
|
G13 CORRECTED — my first check listed only FILES, so a shipped DIRECTORY could not appear:
|
|
directories in the package: usr lib etc usr/local lib/systemd etc/felhom usr/local/sbin lib/systemd/system
|
|
/etc/felhom shipped? YES
|
|
(ISO 1.26.1 shipped it for exactly this reason — the bootstrap writes its state there.)
|
|
## VERDICT — the mechanical criteria, run against the exact file that would be uploaded
|
|
## G1 no answer.toml .............. PASS (0)
|
|
## G2 no root password or hash .... PASS (0)
|
|
## G3 no SSH key baked ............ PASS (0)
|
|
## G4 no customer identity ........ PASS (0) — searched for enkicsifelhom/enkisfelhom/tester-1/demo-hp
|
|
## G5 credential enumeration ...... PASS (0 for every pattern; the patterns are listed above, so
|
|
## "no hits" means "searched and absent", not "nothing occurred to me")
|
|
## G6 boot menu ................... PASS — 2 interactive entries, timeout 15
|
|
## G7 package at a recorded version PASS — felhom-bootstrap_1.28.0_all.deb
|
|
## G8 postinst ends exit 0 ........ PASS
|
|
## G9 payload matches repo HEAD ... PASS — felhom-bootstrap.sh byte-identical to c033b3b
|
|
## G10 build inputs committed ..... PASS — 0 uncommitted files under scripts/iso, HEAD == origin/main
|
|
## G11 checksum beside the image .. PASS (the round trip is only possible after publication)
|
|
## G12 bucket stays private ....... NOT RE-TESTED — nothing about the bucket changed since the
|
|
## 2026-09-15 publication that proved it. Stated, not implied.
|
|
## G13 dirs the payload writes into PASS — /etc/felhom is shipped (my first check was wrong: it
|
|
## listed only files, so a directory could not appear)
|
|
## G15/G16 console strings ........ PASS — the new bound banner is in the shipped payload; the
|
|
## pairing banner remains for the waiting state; the single `8006`
|
|
## hit is a COMMENT explaining why pvebanner is masked, not output.
|
|
## STILL OWED BEFORE PUBLICATION: the proof install from THIS image on BOTH menu entries. That is
|
|
## Part E's install, and the operator's yes comes after it.
|
|
## G6 PROVEN VISUALLY on the built image, from the machine's own console (screens/e1-01-bootmenu.png):
|
|
## The menu is Felhom's, in Hungarian, with exactly TWO interactive entries and a human timeout:
|
|
## „Felhom telepítés" (highlighted default)
|
|
## „Felhom telepítés (szöveges mód)"
|
|
## „Indítás 14 másodperc múlva..." (the 15 s countdown, running)
|
|
## No Proxmox entry, no automated/answer-file entry, no admin URL. This is the proof-install half of
|
|
## the release gate beginning; the install itself follows on the same image.
|
|
|
|
## PUBLISHED 2026-09-16T18:2xZ, on the operator's explicit yes (the one STOP of this task).
|
|
## uploaded: felhom-installer-1.28.0-pve9.2-1.iso (1 705 322 496 B) to the private bucket via the
|
|
## env-only rclone container (no credential file is ever written; the credentials were read
|
|
## file→file, never `source`d — sourcing that file leaks hyphenated keys as shell errors).
|
|
## ROUND TRIP — the published bytes, not the local file:
|
|
## downloaded 1 705 322 496 B, sha256 a4cd9b6ddcb55bae3700ab307084d2b699330cc20710688d5816318f04f6d635
|
|
## built 1 705 322 496 B, sha256 a4cd9b6ddcb55bae3700ab307084d2b699330cc20710688d5816318f04f6d635
|
|
## checksum file beside it: HTTP 200
|
|
## The bytes a stranger receives are the bytes that were gate-checked and installed tonight.
|
|
## 1.27.1 stays in the bucket; nothing was overwritten or removed.
|