admin
ff1db11db4
gates / gates (push) Successful in 29s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
61 lines
3.3 KiB
Markdown
61 lines
3.3 KiB
Markdown
# Golden 0.293.0 — bake + publish, 2026-10-04
|
||
|
||
Procedure: `documentation/runbooks/RUNBOOK-manual-build.md` §4.0 and §4.1 steps 1–4, in the drill VM on DooPlex.
|
||
Step 5 (vouching in the hub, the floor) was **not** done here — it is the main session's act.
|
||
|
||
| | Previous (`../golden-0.292.0-2026-10-04-rebake/`) | This bake |
|
||
|---|---|---|
|
||
| `build-golden.sh` | v3.1.0 | **v3.2.0** (agent `dc9164c`, sha256 `645b3b659cba…`; VM copy matched) |
|
||
| Controller | `felhom-controller:0.292.0` | **`felhom-controller:0.293.0`** (MinAgent 0.131.0, unchanged) |
|
||
| Docker engine | pinned, approved set | same pinned set: the operator-approved release `os-docker-20261004-142842` (stays in force) |
|
||
| Guest packages | template | template — `GOLDEN_GUEST_PKGS` deliberately EMPTY (see below) |
|
||
|
||
**Why the guest list is empty.** The only guest release, `os-guest-20261004-123933`, was approved under a TEST wait;
|
||
hub v0.133.0 (R-859) cancels it at start. No guest release is in force tonight, so the bake installs no guest fixes,
|
||
and the box's first night installs whatever release is approved then. The bake reported **49 pending Debian upgrades**
|
||
in the baked guest — what a future approval may bring, NOT what the first night installs (a ring-1 box installs only
|
||
an approved release; with none in force, 0).
|
||
|
||
## Launch
|
||
|
||
- Drill VM reverted to `virgin`, cold-booted per §4.0; `pveversion` = `pve-manager/9.2.2`.
|
||
- `pveam update` → `update successful`; template `debian-13-standard_13.6-1_amd64.tar.zst` (the only `_amd64`
|
||
debian-13 entry), downloaded, checksum verified.
|
||
- `/root/bake-run.sh` in the VM reads the token from the file and exports `GOLDEN_DOCKER_PKGS` (the six approved
|
||
versions) and `GOLDEN_GUEST_PKGS=""`; launched as transient unit `golden-bake`.
|
||
- Token copied file → file (`scp`). `systemctl show golden-bake -p Environment -p ExecStart | grep -c -F <token>` =
|
||
**0** (control with the token appended = **1**).
|
||
|
||
## Pass markers (from `bake.log`)
|
||
|
||
```
|
||
[golden] Docker engine set PINNED to the approved release: containerd.io=2.3.6-1~debian.13~trixie … docker-ce=5:29.8.2-1~debian.13~trixie …
|
||
[golden] no approved guest release given - the template versions stay; first-night count vs an approved release: n/a
|
||
[golden] pending Debian upgrades in the baked guest (what a FUTURE approval may bring): 49
|
||
docker OK (overlay2; data-root /var/lib/docker)
|
||
live-restore: on
|
||
INFO: including mount point rootfs ('/') in backup
|
||
INFO: including mount point mp0 ('/var/lib/felhom') in backup
|
||
[golden] upload OK (HTTP 201)
|
||
GOLDEN_VERSION=0.293.0
|
||
GOLDEN_SHA256=e7966872abeb38db320e7b26bd9baf6527e87270ed2faf3f0e53763bfc4764b7
|
||
```
|
||
|
||
No `excluding` and no `FATAL` in the log. Pre-delete before upload: HTTP 404 (a new version, nothing replaced).
|
||
|
||
## Round trip
|
||
|
||
Anonymous GET of `…/generic/felhom-golden/0.293.0/golden.tar.zst`: HTTP 200, **648135998 bytes**, sha256
|
||
`e7966872abeb38db320e7b26bd9baf6527e87270ed2faf3f0e53763bfc4764b7` = the printed sha (`02-round-trip.txt`).
|
||
|
||
## Secrets
|
||
|
||
Saved-log leak grep for the literal token: **0**; positive control (a throwaway copy with the token appended): **1**,
|
||
copy shredded.
|
||
|
||
## Teardown
|
||
|
||
`pct destroy 9100 --purge`; `shred -u` of the token, the runner script and the log in the VM (log copied off first);
|
||
`poweroff`; qemu gone (`ps -eo comm | grep -c qemu-system-x86` = 0); `qemu-img snapshot -a virgin`. Host: nothing
|
||
provisioned. Hub: not touched.
|