Commit Graph
44 Commits
Author SHA1 Message Date
jschoubben e65c8c8961 issue 1841/S13: describe the package view, the runs, the round, the root helper and the health read from the bus in pacman's README 2026-10-22 17:39:52 +02:00
jschoubben ea8e0def6e issue 1841/S12: prove the round on a real bus with two made-up nodes, so the second node is seen to start only after the first passed and never after a failed check 2026-10-22 17:39:15 +02:00
jschoubben f8ac498d64 issue 1841/S11: judge the upgrades' health from the runs, rounds and held kernels on the bus, so a node that slept through a run is judged by what happened, not by a unit's age (folds issue 1579) 2026-10-22 17:38:08 +02:00
jschoubben 276422a85b issue 1841/S8: join the round to the keeper's loop, so a node starts the moment the node before it passed and a pass is answered from the operator's channel 2026-10-22 17:35:36 +02:00
jschoubben 28ef6e9e27 issue 1841/S9: carry out the upgrade's root acts through a root helper on a socket only the keeper opens, so no sudo rule lets the keeper's account run anything as root (ADR 0510) 2026-10-22 17:34:20 +02:00
jschoubben f339d0aab7 Merge branch 'feat/upgrade-safety' into p2
# Conflicts:
#	modules/pacman/cmd/pacman-tools/main.go
#	modules/pacman/cmd/pacman-tools/transaction.go
#	modules/pacman/module.json
2026-10-22 14:44:41 +02:00
jschoubben 43fccb843c issue 1841/S10: return a node to a run's record, saying first what each package goes back to and from where
pacman_rollback plans from the bus: each package now -> record from the node's cache, else the archive's
exact version, else the archive's repository on the record's date; added packages listed and removed only
when asked; foreign packages untouched. apply is an ask the node's keeper runs as a rollback run through the
root helper's new Rollback act (RootActs, upgrades.go), with rollback.started, rollback.finished and the
after-upgrade check (TakeAsk's rollback case, transaction.go).
2026-10-22 14:44:24 +02:00
jschoubben f550f1c6b2 issue 1841/S8: upgrade the nodes one at a time in a weekly round in upgrade-order, stopping at a failure and passing a node only on the operator's Approve, so one bad upgrade never reaches every machine 2026-10-22 14:44:17 +02:00
jschoubben 71f47c3291 issue 1841/S5: refuse the root helper's new maps act too until its client is built in 2026-10-22 14:40:09 +02:00
jschoubben dc703d1511 Merge branch 'feat/upgrade-safety' into p2 2026-10-22 14:40:00 +02:00
jschoubben d70135bf08 issue 1841/S5: join the upgrade parts to the keeper's loop, so a node's log, records, unfinished runs and asks are taken up by its own keeper
At its start the keeper reads the log into runs once, prunes old records and carries unfinished runs on;
after every released lock it carries them on again; it takes each ask at <node>.* and prunes records daily.
The root helper's client is a constructor (newRootActs) the helper replaces; until then every act is
refused, named.
2026-10-22 14:39:59 +02:00
jschoubben ff0f43ea2f Merge branch 'feat/upgrade-safety' into p1 2026-10-22 14:39:29 +02:00
jschoubben 2b2517e4a5 issue 1841/S7: name the processes still mapping a replaced file and fail the check on a DKMS module not built for an installed kernel, so a machine is never left unable to load its drivers unnoticed 2026-10-22 14:39:29 +02:00
jschoubben b7a4a1a6b0 Merge branch 'feat/upgrade-safety' into p2 2026-10-22 14:38:05 +02:00
jschoubben c1a9ad2abc issue 1840/S6: take the SDK's process delete for the not-current mark, now that the process state has one 2026-10-22 14:38:02 +02:00
jschoubben c93f77ac19 Merge branch 'feat/upgrade-safety' into p2
# Conflicts:
#	modules/pacman/go.mod
2026-10-22 14:37:59 +02:00
jschoubben 75f3f52589 Merge branch 'feat/upgrade-safety' into p1 2026-10-22 14:37:58 +02:00
jschoubben 900a2da3e3 issue 1841/S6: check after every upgrade the files it left, the news since the last one, units newly failed and a restart needed, so the operator sees what an upgrade asks of them 2026-10-22 14:37:58 +02:00
jschoubben b7f3664839 issue 1840/S10: run the keeper whole against a real bus, so its key, its event and another instance's view are proved together
Written and compiled under the integration tag; the merge check runs it.
2026-10-22 14:37:45 +02:00
jschoubben 9511074f40 Take the SDK whose process can delete a key (issue 1840/S1) 2026-10-22 14:37:28 +02:00
jschoubben 9651a8b2da issue 1840/S9: prove pacman's output puts no command line or environment on the bus
A fixture of pacman and checkupdates output holding command lines, environment variables and messages
leaves only names, versions and repositories in installed, updates and package.changed, and no command
the keeper runs names a package, a foreign one least of all.
2026-10-22 14:37:00 +02:00
jschoubben 32c66a98c1 Merge branch 'feat/upgrade-safety' into p2 2026-10-22 14:36:14 +02:00
jschoubben 62437f8964 issue 1840/S8: answer the package view from the bus, so every node is read at once and none is asked
pacman_packages answers one package on every node, or each node's counts, its explicit packages no module
declares and its foreign ones apart, the versions that differ and the packages on some nodes only, with a
node over the bus's cap marked not current. pacman_updates, pacman_installed and pacman_foreign read the
keeper's states instead of the machine; pacman_updates says when each node's list last changed.
2026-10-22 14:36:11 +02:00
jschoubben ac4d156cb7 Merge branch 'feat/upgrade-safety' into p1 2026-10-22 14:35:22 +02:00
jschoubben 95e69276c3 Carry out an upgrade as an ask its node's keeper takes, through the root helper, and follow a run to its end after a restart, so a hand upgrade is a recorded, checked run like any other (issue 1841/S5) 2026-10-22 14:35:19 +02:00
jschoubben 56b285d3e8 issue 1840/S7: prove updates is read at start, after a transaction, after the mirrors and daily, and written only on change
A failed read keeps the last list and says reachable false, so a list the node can no longer confirm is
never shown as current, and a first read that fails is never an empty list taken for an answer.
2026-10-22 14:33:20 +02:00
jschoubben 5cc401683c Merge branch 'feat/upgrade-safety' into p2 2026-10-22 14:32:13 +02:00
jschoubben 79ce72a7b7 issue 1840/S6: emit through the same EventSink as the upgrade parts, so one connection serves both 2026-10-22 14:32:10 +02:00
jschoubben f40fa6e8e0 issue 1841/S4: format the gate's patterns as gofmt does, which the merge check requires 2026-10-22 14:32:01 +02:00
jschoubben b015576a13 Hold a kernel an installed DKMS module's own bound excludes, with its headers, so an upgrade never leaves a machine whose storage driver cannot load (issue 1841/S4) 2026-10-22 14:31:53 +02:00
jschoubben e4fb4cc793 Merge branch 'feat/upgrade-safety' into p2 2026-10-22 14:31:39 +02:00
jschoubben 1de9a903c8 issue 1840/S6: keep the node's packages in installed, read at the keeper's start and at every released lock
The keeper reads pacman's database into installed.<node> and writes it only when it differs from the key,
says each change as package.changed, and keeps the last value when the list is over the bus's cap, marking
the node not current until it fits again; the health names the size. The loop runs over injected states,
events, clock, watch and machine, and leaves hooks (start, after a transaction, state watches, wakes) for the
upgrade parts of ADR 0508.
2026-10-22 14:31:33 +02:00
jschoubben 0bb6584437 Take the node's package record before a run and read it back, refusing a run whose packages are not current, so a rollback always has a true record to return to (issue 1841/S3) 2026-10-22 14:30:34 +02:00
jschoubben efac1b4856 Keep every upgrade as a run on the bus and read the log's past upgrades once, so pacman_upgrades answers every node's history without asking a machine (issue 1841/S2) 2026-10-22 14:29:23 +02:00
jschoubben 802c72e4ed Take the SDK that lets a process put, list and watch its states (issue 1840/S5) 2026-10-22 14:23:43 +02:00
jschoubben eb717cc514 Declare the pacman keeper and its bus shapes, so upgrades run as rounds on the bus instead of a weekly timer on every node at once (issue 1841/S1, with 1840/S5's manifest)
The keeper process runs under its own account with a bus account of its own,
keeps the six states and emits the nine events of ADR 0507 and ADR 0508; its
config (upgrade-order, record-days, round-start-minutes) lands in its config
file and restarts it. shapes.go fixes every key's value and event body as the
interface the keeper and the verbs share. The weekly timer and its service are
dropped, which the node-engine removes.
2026-10-22 14:23:22 +02:00
mesh-tools bd10ec4f0d Say a weekly upgrade that hangs past two hours, so a stuck pacman lock is loud (issue 1574, ADR 0477)
mesh/merge-gate head bd10ec4f0dbe merged into trunk 4bdacf38d2f0 — pass: builds pacman → ace, g14, novox, shanks; no bus step; every machine composes with …
mesh/repo-check head bd10ec4f0dbe merged into trunk 4bdacf38d2f0 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
mesh/delivery delivered
2026-10-21 08:08:04 +00:00
mesh-tools d4d1a1591b Name pacman_upgrade_health in the pacman README's tools (issue 1574) 2026-10-21 08:00:39 +00:00
mesh-tools 5123c1dd57 Say the weekly upgrade and its health in the pacman README (issue 1574, ADR 0477) 2026-10-21 08:00:30 +00:00
mesh-tools e3ac017c28 Test the weekly upgrade's timer and its health (issue 1574, ADR 0477) 2026-10-21 08:00:21 +00:00
mesh-tools 1f5046f47e Declare the weekly upgrade timer with its health, and serve pacman_upgrade_health (issue 1574, ADR 0477) 2026-10-21 07:59:55 +00:00
mesh-tools f12f87f1f9 The weekly upgrade's timer, service and health tool (issue 1574, ADR 0477) 2026-10-21 07:59:31 +00:00
mesh-tools 0260ae92f6 Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main 2026-10-16 09:42:45 +00:00
jochen d9336d11d0 pacman: the package manager's configuration, mirrors and cache as a module
Mirrors were generated once and never again and caches never cleaned. The
module holds node-package-manager (hq ADR 0207), declares pacman itself, owns
/etc/pacman.conf whole — [options] cannot take an appended block — with the
union of the enabled repositories and improved options, proven by pacman-conf
in its test, and enables reflector.timer (its config owned) and
paccache.timer. Fifteen tools from a Go bundle; transactions run as transient
units so a call's timeout never kills pacman mid-transaction (to-be 42).
2026-10-04 12:50:20 +02:00