jason.woltje
c515273db7
Lands Darkwing's round 1 candidate, manifest 573ece95a4a9 (ad1b23ab2on darkwing/row240-r3, basec771a36f4), approved by Filbert (29945, rev 2696). Nine paths: scripts/case1-hostcheck.sh (new), scripts/case1-pins.sh (new), packages/cli/systemd/mosaic-hostcheck.service (new), packages/cli/tests/case1-hostcheck.test.mjs (new), scripts/stack-upgrade.sh, packages/cli/tests/stack-upgrade.test.mjs, docs/guides/host-run-sheet.md, docs/TOOLS.md and agents/darkwing/work/queue-240/BUILD.md. File modes match the candidate. case1-hostcheck.sh and stack-upgrade.sh are 100755. case1-pins.sh is 100644, because the host check sources it. Evidence: Darkwing's first slot run failed one test, the N1 test's after hook (ENOENT once the fixture had removed its root). The fixb45852daais test-only. The second run onb45852daawas green: singles 37/0, mutants M1-M8 8 of 8 killed, cli 639/0, scripts 585/0. Sincec771a36f4no commit touches the nine paths. Sage's gate on060a17b54plus the nine paths (06:45:05Z to 06:56:21Z): packages/cli 639 pass, 0 fail, and all ten scripts/test-*.sh 585 pass, 0 fail (out/, run.log). `queue review verify-commit 240` matches the manifest on all 9 paths. Filbert's notes: N1 (the boot unit orders only mosaic-bus@mosaic-stack) and N2 (the run sheet writes the apt hook before the first --check) are in docs/plans/DEFERRED.md. N3, repeated DRIFT lines after bwrap is closed, is by design and is noted with N2.
13 lines
846 B
Bash
13 lines
846 B
Bash
# Row 240 (I4, #1746): the Case 1 host pins, sourced by case1-hostcheck.sh, which is installed as
|
|
# /usr/local/lib/mosaic-stack/hostcheck.sh with this file beside it. r6 B2
|
|
# (agents/darkwing/work/queue-195/DESIGN.md at b7239bb66). Changing a pin is a reviewed commit and
|
|
# its own round.
|
|
#
|
|
# The AppArmor profile 2a' installs as /etc/apparmor.d/bwrap-userns-restrict, taken from
|
|
# /usr/share/apparmor/extra-profiles/bwrap-userns-restrict in this apparmor-profiles version.
|
|
PIN_PROFILES_VERSION=4.0.1really4.0.1-0ubuntu0.24.04.9
|
|
PIN_PROFILE_SHA256=11d39094f044f0cda0febb3ad517b830301da6b2ce929664af09ee9e4dd264f9
|
|
# The bubblewrap version 2a' installs. An install pin, not a drift item: a security update keeps the
|
|
# statoverride, and the profile attaches by path. hostcheck prints a line when they differ.
|
|
PIN_BUBBLEWRAP_VERSION=0.9.0-1ubuntu0.3
|