b6247f837d
mesh-build-go: push each done archive to the artifact store from its own process and answer its reference (issue 1587, S1-S4, ADR 0498 §1 §2, lead decision L9)
jschoubben2026-10-22 18:22:13 +02:00
9c5b7e14e1
mesh-build-go: fold the siblings' commits into every digest and echo them, and test and digest the integration level under integration,isolation (lead decision L5, the checker's agreement; issue 1309)
jschoubben2026-10-22 18:18:03 +02:00
c0873728e2
Replace the deleted manifest reads check by each build module's state announcement (ADR 0495 §4-§5, issue 1790)
jschoubben2026-10-22 18:17:04 +02:00
86ba54b06e
Take the SDK at the milestone's mesh-sdk head 8892a117 in pacman, which holds main's SDK and the milestone's (issue 1840)
jschoubben2026-10-22 18:14:25 +02:00
af91a7e660
Merge remote-tracking branch 'origin/main' into feat/upgrade-safety
jschoubben2026-10-22 18:14:16 +02:00
d45767bb2f
Keep another module's path out of i3's fixture (issue 1814, S2)
jschoubben2026-10-22 18:13:58 +02:00
d108487396
mesh-build-go: read a pinned release compressed with xz as the build agent does, so betterbird's archive gets a done key (issue 1590)
jschoubben2026-10-22 18:13:45 +02:00
027ea030fa
Qualify a short base image name before buildah reads it (issue 1824)
jschoubben2026-10-22 18:13:09 +02:00
6eb9eb53de
Commit the lock files of mssql, mongodb, model-usage and mesh-catalog, and refuse a Node module without one (issue 1868, ADR 0469 §5)
jschoubben2026-10-22 18:12:32 +02:00
eed6be0f4a
mesh-build-go: run go test, go build and go list in bubblewrap, so a change's code reaches no key, login or network (issue 1309, S1-S6, ADR 0448)
jschoubben2026-10-22 18:12:01 +02:00
51900367a0
mesh-build-go: announce the states it keeps from its code, so readers are granted from its word (issue 1790, ADR 0495 §2 §5)
jschoubben2026-10-22 18:12:01 +02:00
77596f37a3
mesh-build-image: announce the states it keeps from its code, so readers are granted from its word (issue 1790, ADR 0495 §2 §5)
jschoubben2026-10-22 18:12:01 +02:00
56f842c3af
mesh-build-node: run the type-check, the test script, tsc and esbuild in bubblewrap, so a change's code reaches no key, login or network (issue 1309, S1 S7 S8 S9, ADR 0448)
jschoubben2026-10-22 18:08:12 +02:00
075b61901c
mesh-build-node: announce the states it keeps from its code, so readers are granted from its word (issue 1790, ADR 0495 §2 §5)
jschoubben2026-10-22 18:08:06 +02:00
0270027bf9
Take the SDK at the milestone's mesh-sdk head f8b8f3a6 in pacman, which the delivery group's members must pin exactly (issue 1840)
jschoubben2026-10-22 18:07:40 +02:00
835bf22b7d
Merge pull request 'only-office: stop declaring the old lib directory (issue 1854)' (#449) from fix/1854-drop-old-lib into main
mesh-tools2026-10-22 16:06:46 +00:00
e85b7da63b
Let i3's contribution test read its fixture, not the siblings' manifests (issue 1814, S2, ADR 0495 §1)
jschoubben2026-10-22 18:05:04 +02:00
c112df0c1c
Announce the states the forge module keeps (issue 1790, ADR 0495 §2 §5)
jschoubben2026-10-22 18:03:06 +02:00
8e791896f1
Announce the states the delivery gate keeps (issue 1790, ADR 0495 §2 §5)
jschoubben2026-10-22 18:02:11 +02:00
b07a101caf
Answer each named path's git object id from gitea_commit_trees (issue 1758, S1-S2, ADR 0499 §3)
jschoubben2026-10-22 17:59:23 +02:00
72effa1fb1
Copy an upstream artifact into the artifact store by its pinned digest (issue 1587, S11-S13, ADR 0498 §4)
jschoubben2026-10-22 17:56:27 +02:00
e53ac973e9
mesh-delivery-gate: stop asking the controller's forget-checks (issue 1318, the gate's part)
feat/r4e-gate
jschoubben2026-10-22 17:49:47 +02:00
f1f18bf2bd
mesh-delivery-gate: read mesh/check alone on a base that requires it (issue 1302, S1-S10)
jschoubben2026-10-22 17:49:41 +02:00
c41c968086
gitea: judge and write only the statuses a base requires, so merges go on mesh/check (issue 1301, S5-S7)
jschoubben2026-10-22 17:37:07 +02:00
939475cb63
gitea: only the forge bridge writes mesh/check, through a tool of its own (issue 1301, S4)
jschoubben2026-10-22 17:30:39 +02:00
5e24deb0f1
gitea: require mesh/check in place of the two old statuses on every main the gate judges (issue 1301, S1-S3)
jschoubben2026-10-22 17:27:15 +02:00
76a0a726f0
issue 1841/S15: put the booted kernel first when GRUB's menu is generated again, so the fallback kernel, sorted first by version, never becomes the default entry (ADR 0508 §9)
jschoubben2026-10-22 17:49:21 +02:00
df821c8a4a
only-office: stop declaring the old lib directory, emptied on the operator's word (issue 1854)
jochen2026-10-22 17:49:08 +02:00
f40269caec
issue 1841/S2: leave the login manager's configuration path out of pacman's captured log, which the paths check refuses in another module's fixture
jschoubben2026-10-22 17:45:29 +02:00
2149d8f3e7
Merge remote-tracking branch 'origin/main' into feat/upgrade-safety
jschoubben2026-10-22 17:40:30 +02:00
e65c8c8961
issue 1841/S13: describe the package view, the runs, the round, the root helper and the health read from the bus in pacman's README
jschoubben2026-10-22 17:39:52 +02:00
ea8e0def6e
issue 1841/S12: prove the round on a real bus with two made-up nodes, so the second node is seen to start only after the first passed and never after a failed check
jschoubben2026-10-22 17:39:15 +02:00
f8ac498d64
issue 1841/S11: judge the upgrades' health from the runs, rounds and held kernels on the bus, so a node that slept through a run is judged by what happened, not by a unit's age (folds issue 1579)
jschoubben2026-10-22 17:38:08 +02:00
276422a85b
issue 1841/S8: join the round to the keeper's loop, so a node starts the moment the node before it passed and a pass is answered from the operator's channel
jschoubben2026-10-22 17:35:36 +02:00
28ef6e9e27
issue 1841/S9: carry out the upgrade's root acts through a root helper on a socket only the keeper opens, so no sudo rule lets the keeper's account run anything as root (ADR 0510)
jschoubben2026-10-22 17:34:20 +02:00
49caf17ff5
Merge pull request 'only-office: keep its working directories under a root-only box (issue 1843)' (#448) from fix/1843-private-box into main
mesh-tools2026-10-22 15:33:32 +00:00
cac09a4e20
Merge pull request 'Ask a check the build queue lost again, and take a recheck from proposed when no check of its head is held (issue 1274)' (#447) from fix/1274-ask-a-lost-check-again into main
mesh-tools2026-10-22 15:27:42 +00:00
29b4c02709
only-office: keep its working directories under a root-only box (issue 1843)
jochen2026-10-22 17:24:05 +02:00
c3d3194bc8
Merge pull request 'nextcloud: keep onlyoffice's jwt off argv, and re-check a failed connection every tick (issues 1831, 1832)' (#446) from fix/onlyoffice-followups into main
mesh-tools2026-10-22 14:51:59 +00:00
d0463fb510
Merge pull request 'Fetch a Go pin only a pull request carries from its pull head, so a group member pinning its mesh-sdk head builds (issue 1148)' (#445) from fix/1148-pull-head-pins into main
mesh-tools2026-10-22 14:40:56 +00:00
6bf054b982
Take issue 1843's owner change back out: giving the converter the module root opens a link swap to root (review), so 1843 needs its own design
jochen2026-10-22 16:37:35 +02:00
fbbf28d21c
mesh-delivery-gate: read the queue's state word as the controller says it, in flight (issue 1274)
jschoubben2026-10-22 16:36:23 +02:00
fb89990e2b
mesh-delivery-gate: ask a check the build queue lost again, and take a recheck from proposed when none is held (issue 1274)
jschoubben2026-10-22 16:34:33 +02:00
d0a3784be2
only-office: bar every account but the converter from the state root (issue 1843)
jochen2026-10-22 16:34:06 +02:00
555ed4963a
Read the pinned placement at its new path in the pin integration test (issue 1148)
jschoubben2026-10-22 16:29:37 +02:00
edb6d3b7d3
nextcloud: keep checking onlyoffice's connection while the last check failed (issue 1832)
jochen2026-10-22 16:28:35 +02:00
8928e6f972
nextcloud: keep onlyoffice's jwt_secret off every argv (issue 1831)
jochen2026-10-22 16:27:15 +02:00
2d8c8f6d75
Share one placement per repository and commit for pins on pull heads; say a pin is on no pull request head and what go said (issue 1148)
jschoubben2026-10-22 16:24:18 +02:00
9194e15072
Fetch a Go pin on a pull request's head: place it beside the workspace and hand it to Go by a modfile replace (issue 1148)
jschoubben2026-10-22 16:19:23 +02:00
77578a882f
Merge pull request 'Hold a delivery's problem messages until it settles, and say a refusal only when its fresh check did not cure it (ADR 0505)' (#444) from feat/quiet-deliveries into main
mesh-tools2026-10-22 14:01:19 +00:00
3f9081d00e
Merge pull request 'Let nginx through only-office's lib directory, so OnlyOffice serves converted documents instead of answering 403 (issue 1837)' (#443) from fix/1837-lib-traverse into main
mesh-tools2026-10-22 13:44:06 +00:00
7842001c53
Merge pull request 'A tool verifies the bus's snapshot, so an upgrade or a restore is checked without a docker exec (issue 1842)' (#442) from fix/1842-bus-snapshot-verify into main
mesh-tools2026-10-22 13:08:47 +00:00
09e749bc1a
Format the ADR 0505 test file, so the repository check passes
jschoubben2026-10-22 15:00:37 +02:00
f339d0aab7
Merge branch 'feat/upgrade-safety' into p2
jschoubben2026-10-22 14:44:41 +02:00
43fccb843c
issue 1841/S10: return a node to a run's record, saying first what each package goes back to and from where
jschoubben2026-10-22 14:44:24 +02:00
f550f1c6b2
issue 1841/S8: upgrade the nodes one at a time in a weekly round in upgrade-order, stopping at a failure and passing a node only on the operator's Approve, so one bad upgrade never reaches every machine
jschoubben2026-10-22 14:44:17 +02:00
71f47c3291
issue 1841/S5: refuse the root helper's new maps act too until its client is built in
jschoubben2026-10-22 14:40:09 +02:00
dc703d1511
Merge branch 'feat/upgrade-safety' into p2
jschoubben2026-10-22 14:40:00 +02:00
d70135bf08
issue 1841/S5: join the upgrade parts to the keeper's loop, so a node's log, records, unfinished runs and asks are taken up by its own keeper
jschoubben2026-10-22 14:39:59 +02:00
ea8692b08f
Say a message two walks held once, in the message of the walk whose limit is due (ADR 0505 §7)
jschoubben2026-10-22 14:39:35 +02:00
ff0f43ea2f
Merge branch 'feat/upgrade-safety' into p1
jschoubben2026-10-22 14:39:29 +02:00
2b2517e4a5
issue 1841/S7: name the processes still mapping a replaced file and fail the check on a DKMS module not built for an installed kernel, so a machine is never left unable to load its drivers unnoticed
jschoubben2026-10-22 14:39:29 +02:00
b7a4a1a6b0
Merge branch 'feat/upgrade-safety' into p2
jschoubben2026-10-22 14:38:05 +02:00
c1a9ad2abc
issue 1840/S6: take the SDK's process delete for the not-current mark, now that the process state has one
jschoubben2026-10-22 14:38:02 +02:00
c93f77ac19
Merge branch 'feat/upgrade-safety' into p2
jschoubben2026-10-22 14:37:59 +02:00
75f3f52589
Merge branch 'feat/upgrade-safety' into p1
jschoubben2026-10-22 14:37:58 +02:00
900a2da3e3
issue 1841/S6: check after every upgrade the files it left, the news since the last one, units newly failed and a restart needed, so the operator sees what an upgrade asks of them
jschoubben2026-10-22 14:37:58 +02:00
b7f3664839
issue 1840/S10: run the keeper whole against a real bus, so its key, its event and another instance's view are proved together
jschoubben2026-10-22 14:37:45 +02:00
9511074f40
Take the SDK whose process can delete a key (issue 1840/S1)
jschoubben2026-10-22 14:37:28 +02:00
9651a8b2da
issue 1840/S9: prove pacman's output puts no command line or environment on the bus
jschoubben2026-10-22 14:37:00 +02:00
3cf75580b5
Never hold a message past its first hold's limit, so a fault on a machine walk after walk touches still reaches the operator (ADR 0505 §7)
jschoubben2026-10-22 14:36:35 +02:00
32c66a98c1
Merge branch 'feat/upgrade-safety' into p2
jschoubben2026-10-22 14:36:14 +02:00
62437f8964
issue 1840/S8: answer the package view from the bus, so every node is read at once and none is asked
jschoubben2026-10-22 14:36:11 +02:00
ac4d156cb7
Merge branch 'feat/upgrade-safety' into p1
jschoubben2026-10-22 14:35:22 +02:00
95e69276c3
Carry out an upgrade as an ask its node's keeper takes, through the root helper, and follow a run to its end after a restart, so a hand upgrade is a recorded, checked run like any other (issue 1841/S5)
jschoubben2026-10-22 14:35:19 +02:00
56b285d3e8
issue 1840/S7: prove updates is read at start, after a transaction, after the mirrors and daily, and written only on change
jschoubben2026-10-22 14:33:20 +02:00
5cc401683c
Merge branch 'feat/upgrade-safety' into p2
jschoubben2026-10-22 14:32:13 +02:00
79ce72a7b7
issue 1840/S6: emit through the same EventSink as the upgrade parts, so one connection serves both
jschoubben2026-10-22 14:32:10 +02:00
a22fdd015b
Let nginx through only-office's lib directory, so it can serve the converted files the document service writes there instead of answering 403 (issue 1837)
jochen2026-10-22 14:32:06 +02:00
f40fa6e8e0
issue 1841/S4: format the gate's patterns as gofmt does, which the merge check requires
jschoubben2026-10-22 14:32:01 +02:00
b015576a13
Hold a kernel an installed DKMS module's own bound excludes, with its headers, so an upgrade never leaves a machine whose storage driver cannot load (issue 1841/S4)
jschoubben2026-10-22 14:31:53 +02:00
e4fb4cc793
Merge branch 'feat/upgrade-safety' into p2
jschoubben2026-10-22 14:31:39 +02:00
1de9a903c8
issue 1840/S6: keep the node's packages in installed, read at the keeper's start and at every released lock
jschoubben2026-10-22 14:31:33 +02:00
0bb6584437
Take the node's package record before a run and read it back, refusing a run whose packages are not current, so a rollback always has a true record to return to (issue 1841/S3)
jschoubben2026-10-22 14:30:34 +02:00
c0bc0d4826
Merge branch 'feat/upgrade-safety' into p1
jschoubben2026-10-22 14:29:29 +02:00
efac1b4856
Keep every upgrade as a run on the bus and read the log's past upgrades once, so pacman_upgrades answers every node's history without asking a machine (issue 1841/S2)
jschoubben2026-10-22 14:29:23 +02:00
bc77afa6bb
issue 1841/S16: kernel_boot answers the loader, entries, kernels, booted entry and the fallback
jschoubben2026-10-22 14:28:23 +02:00
e4373768af
issue 1841/S14: declare the fallback kernel and its headers after the boot-entries unit
jschoubben2026-10-22 14:27:24 +02:00
2cb2e27cdf
issue 1838: name the kernel module's fixtures by what they show (as in the fix's own branch)
jschoubben2026-10-22 14:27:15 +02:00
0f4e631cdd
issue 1841/S15: place the fallback kernel's boot entry from the loader the machine booted with
jschoubben2026-10-22 14:26:59 +02:00
dcf6e86d02
Merge pull request 'Refuse a node name of the mesh in the pacman and kernel modules (issue 1838)' (#441) from fix/1838-particulars into main
mesh-tools2026-10-22 12:24:35 +00:00
98ca97fc5b
Verify the bus's snapshot with a tool, sharing the snapshot program's archive code (issue 1842)
jschoubben2026-10-22 14:24:25 +02:00
802c72e4ed
Take the SDK that lets a process put, list and watch its states (issue 1840/S5)
jschoubben2026-10-22 14:23:43 +02:00
eb717cc514
Declare the pacman keeper and its bus shapes, so upgrades run as rounds on the bus instead of a weekly timer on every node at once (issue 1841/S1, with 1840/S5's manifest)
jschoubben2026-10-22 14:23:22 +02:00
db67a0e55e
Merge pull request 'Pin only-office's secure-link secret, so OnlyOffice's signed download links verify across restarts (issue 1837)' (#440) from fix/1837-secure-link into main
mesh-tools2026-10-22 12:20:22 +00:00
34277ef60f
Prove over the real bus that a refusal the gate answers is stalled only once its fresh check did not cure it (ADR 0505 §4)
jschoubben2026-10-22 14:18:33 +02:00
a3b51a9d9a
issue 1838: catch node names in paths, hyphenated and lowerCamel forms; test the exit codes
jschoubben2026-10-22 14:18:26 +02:00
e5608f7b00
Say in the gate's README when a refused or rejected merge reaches the operator (ADR 0505 §4, §5)
jschoubben2026-10-22 14:17:40 +02:00
5a18eb5f4a
Leave a delivery that needs a new head to its author for two hours, then name the author to the operator (ADR 0505 §5)
jschoubben2026-10-22 14:17:25 +02:00
138a1e1c4b
issue 1838: refuse a node name of this mesh in the pacman and kernel modules
jschoubben2026-10-22 14:15:53 +02:00