admin
2344589a5e
gates / gates (push) Successful in 33s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
52 lines
2.4 KiB
Markdown
52 lines
2.4 KiB
Markdown
# Golden 0.289.1 bake (2026-10-03)
|
||
|
||
Baked in the drill VM on DooPlex per `documentation/runbooks/RUNBOOK-manual-build.md` §4.0 and §4.1
|
||
steps 1–4. Step 5 (vouching in the hub) was NOT done here.
|
||
|
||
- Controller image: `gitea.dooplex.hu/admin/felhom-controller:0.289.1`
|
||
- Build script: `felhom-agent/configs/build-golden.sh` v3.0.0 at agent `main` d766666 (clean tree,
|
||
equal to origin/main); sha256 `e4c9ede772e777efacdbc6a2bfb3b15d181d2e96bb82b40cee557b5bbe068834`,
|
||
identical on DooPlex and inside the VM.
|
||
- Template: `debian-13-standard_13.6-1_amd64.tar.zst` (from `pveam available`, filtered on `_amd64`).
|
||
- Drill VM: `pve-manager/9.2.2`.
|
||
|
||
**GOLDEN_VERSION=0.289.1**
|
||
**GOLDEN_SHA256=59fa7beadbb17fbcd30524c47e34806d3122f57fb8c5e2618727b6781e874512**
|
||
Package: `https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/0.289.1/golden.tar.zst`
|
||
(652929857 bytes).
|
||
|
||
## Pass markers, quoted from `bake.log`
|
||
|
||
```
|
||
82: docker OK (overlay2; data-root /var/lib/docker)
|
||
313:INFO: including mount point rootfs ('/') in backup
|
||
314:INFO: including mount point mp0 ('/var/lib/felhom') in backup
|
||
319:[golden] pre-delete existing: HTTP 404 (404/204 expected)
|
||
320:[golden] upload OK (HTTP 201)
|
||
```
|
||
|
||
`grep -c -E 'excluding|FATAL' bake.log` = `0`. No `mp1` line (none expected since v3.0.0).
|
||
|
||
## Token handling
|
||
|
||
- Token copied file → file (`scp`); the bake ran from a runner script inside the VM that reads the
|
||
token itself (`systemd-run --unit=golden-bake --collect`).
|
||
- `systemctl show golden-bake -p Environment -p ExecStart | grep -c -F <token>` = `0`;
|
||
positive control (same output with the token appended) = `1`.
|
||
- Leak grep on THIS saved `bake.log` (the committed copy): `0`. Positive control (a throwaway copy
|
||
with the token appended) = `1`; the copy was `shred -u`'d.
|
||
|
||
## Teardown state
|
||
|
||
- `pct destroy 9100 --purge` — rc 0, both LVs removed.
|
||
- `/root/.gitea-token`, `/root/bake-run.sh`, `/root/bake.log` in the VM — `shred -u`, confirmed absent.
|
||
- VM powered off; qemu process gone (no `qemu-system-x86` in `ps`).
|
||
- `qemu-img snapshot -a virgin drill.qcow2` — OK; snapshot `virgin` still listed.
|
||
|
||
## Deviations from the runbook
|
||
|
||
- `pveam update` was run before `pveam available` (the virgin snapshot's template index is stale);
|
||
the runbook's step 2 does not list it.
|
||
- The published package was not re-downloaded to verify its sha256; the evidence is the script's
|
||
`upload OK (HTTP 201)` and its printed `GOLDEN_SHA256`.
|