50 lines
2.8 KiB
Markdown
50 lines
2.8 KiB
Markdown
# REPORT — installer golden gate + golden 0.211.0 bake (2026-08-10)
|
|
|
|
Commits `eb60087` (R-297 installer) and `999b0a3` (bake evidence). CI run **299** → `success`.
|
|
All eight `repo_gates.py` gates OK, including `golden-currency`, which this run took from RED to GREEN.
|
|
**`--no-verify` was not used at any point** — the currency gate refused an earlier push and that
|
|
refusal was respected until the bake made it true.
|
|
|
|
## R-297 — an install takes the golden you approved
|
|
|
|
`felhom-host-install.sh` v1.26.0. Step 7 short-circuited on ANY local archive: no version compare,
|
|
no digest, no warning, so the manifest's sha256 — which vouches from a different trust root than the
|
|
code host — was consulted only on the fetch path. Discovery is `sort | tail -1`: correct by recency,
|
|
never by verification.
|
|
|
|
`golden_local_matches_manifest()` compares digest first (a match means it IS the vouched artifact),
|
|
then the controller tag baked at `/etc/felhom-controller-image`. Auto-discovered mismatch → ignore
|
|
and fetch the vouched one; operator-named (`--golden`) mismatch → REFUSE, never silently substitute;
|
|
unreadable manifest → refuse rather than pass.
|
|
|
|
**Measured on real hardware:** three goldens sit on `demo-hp` carrying controller **0.153.0** and
|
|
**0.210.0**, and nothing compared either to the vouched version before use.
|
|
|
|
**NOT PUBLISHED.** The task asked that a fresh install be watched taking a stale local golden on
|
|
`drill-r50` BEFORE the fix. That was not done, so `installer-v1.26.0` is deliberately not cut and
|
|
`webpage.yaml` is untouched — pushing to `main` publishes nothing (R-110). Publishing an unobserved
|
|
change to the one artifact that runs as root on a virgin box is the failure this project keeps
|
|
writing rules about.
|
|
|
|
## Golden 0.211.0 — baked, published, round-trip verified
|
|
|
|
Full evidence: `documentation/tests/golden-0.211.0-2026-08-10/` (`bake.log` + `RESULT.md`).
|
|
|
|
- `GOLDEN_SHA256=8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849`
|
|
- Served bytes re-downloaded and hashed → identical. 656 141 689 B.
|
|
- All six acceptance markers counted (two initially returned a false `0` through broken shell
|
|
quoting and were re-run with `grep -F` — a 0 from a broken instrument is not a measurement).
|
|
- Token never on a command line; leak grep on the committed log = 0, and that 0 was made believable
|
|
by first proving the grep finds a planted token.
|
|
- Drill VM reverted to `virgin` before and after; build guest destroyed `--purge`; `/root` residue empty.
|
|
|
|
## Registers
|
|
|
|
R-295 (PARTIAL — hub half open), R-296, R-297, R-298 filed. Ceiling moved R-294 → **R-298**.
|
|
|
|
## NOT DONE
|
|
|
|
- **The Day-0 vouch** — the operator's, deliberately not made here.
|
|
- **Part 2** (uninstall leaves `dnsmasq` bound to :53) — dropped first, per the task's drop order.
|
|
- **Part 4a** (hub half of the code naming, and its emails) — dropped second, filed as R-295 PARTIAL.
|