Write the store's superuser secret where the postgres module now keeps it, and read the bus's release from its upstream image (issues 1873, 1875) #130

2026-10-22T19:54:10Z

mesh-tools commented

2026-10-22 19:54:10 +00:00

Delivery group with mesh-catalog fix/1873-system-state-dirs (same branch); merges with it.

de809d7, issue 1873: genesis writes the store's superuser secret to /var/lib/mesh/postgres/superuser.secret, where the catalogue's postgres module now keeps its own secrets (it was /var/lib/postgres, the postgresql package's directory). makeCredentialDir makes missing parents 0755 and only the credential's own directory 0700 (before, a fresh machine's /var/lib/mesh would have become 0700). store_layout_test substitutes ${dir:data}. New TestTheStoreSuperuserFileLiesInTheModulesOwnDirectory failed first.
8c0bb9d, issue 1875: TestTheBundlesBusRunsTheReleaseTheModulesImageIsBuiltOn read build.on NATS_BASE, which the nats module no longer has since issue 1641 (it takes the bus as an upstream image pinned by digest); every mesh-host check failed on it. The test now reads the nats module's server upstream artifact. No mesh-host code reads NATS_BASE; genesis pins the bus image in its lock.

A try reads the catalogue's main beside it, where the postgres module still says ${dir:state}, so TestTheBundleRaisesTheStoreAsTheCataloguesPostgresModuleDeclaresIt fails there; with the group's catalogue head beside it the whole suite passes (verified by the reviewer). The group must merge as one (ADR 0418).

Try build-1792698404407133534 (fails only that store test, as explained).

Reviewed-by: review-1873@shanks at 8c0bb9d453

Delivery group with mesh-catalog fix/1873-system-state-dirs (same branch); merges with it. - de809d7, issue 1873: genesis writes the store's superuser secret to /var/lib/mesh/postgres/superuser.secret, where the catalogue's postgres module now keeps its own secrets (it was /var/lib/postgres, the postgresql package's directory). makeCredentialDir makes missing parents 0755 and only the credential's own directory 0700 (before, a fresh machine's /var/lib/mesh would have become 0700). store_layout_test substitutes ${dir:data}. New TestTheStoreSuperuserFileLiesInTheModulesOwnDirectory failed first. - 8c0bb9d, issue 1875: TestTheBundlesBusRunsTheReleaseTheModulesImageIsBuiltOn read build.on NATS_BASE, which the nats module no longer has since issue 1641 (it takes the bus as an upstream image pinned by digest); every mesh-host check failed on it. The test now reads the nats module's `server` upstream artifact. No mesh-host code reads NATS_BASE; genesis pins the bus image in its lock. A try reads the catalogue's main beside it, where the postgres module still says ${dir:state}, so TestTheBundleRaisesTheStoreAsTheCataloguesPostgresModuleDeclaresIt fails there; with the group's catalogue head beside it the whole suite passes (verified by the reviewer). The group must merge as one (ADR 0418). Try build-1792698404407133534 (fails only that store test, as explained). Reviewed-by: review-1873@shanks at 8c0bb9d4531d45121b7d0dd37bdbc4441c8d4f40

mesh-tools added 2 commits 2026-10-22 19:54:10 +00:00

Keep the store's superuser file in the postgres module's own directory, not in /var/lib/postgres (issue 1873) de809d7e0a

The postgres module's own secrets move from /var/lib/postgres, the postgresql
package's directory, to its directory under /var/lib/mesh (mesh-catalog,
fix/1873-system-state-dirs). Genesis writes the store's superuser file at the
module's own-secret path, so the store it raises is the one the module adopts in
place: StoreSuperuserFile follows, to /var/lib/mesh/postgres/superuser.secret.

A directory genesis makes on the way is 0755, the mode of the mesh's directories,
and only the credential's own is 0700: MkdirAll at 0700 would have closed
/var/lib/mesh on a machine that had none yet.

Read the bus's release from the nats module's pinned server image, not a NATS_BASE build argument (issue 1875)

mesh/repo-check head 8c0bb9d4531d merged into trunk 4065b45ae84f beside mesh-catalog#453@e0bf87c2 — pass: its merge-check.sh passed

Details

mesh/merge-gate head 8c0bb9d4531d merged into trunk 4065b45ae84f — pass: group fix/1873-system-state-dirs composed: every machine composes with the change …

Details

mesh/delivery delivered

Details

mesh/delivery-group group fix/1873-system-state-dirs delivered: every member is delivered

Details

mesh/check failed: unit: github.com/novox/mesh-host/internal/bootstrap.TestGenesisInstallsTheCataloguesBuildAgent: builder_test.go:180: mesh-controlle…

8c0bb9d453

The nats module takes its server as an upstream artifact, pinned by digest
(issue 1641), and builds no image on a NATS_BASE argument any more. The test of
the bundle's bus read that argument, found none, and failed every mesh-host check
against the catalogue's main. Bootstrap's own code never read it: the bundle's
bus image comes from the bundle, so genesis was not affected. The test now
compares the bundle's image with the module's server by repository and digest.

mesh-tools commented

2026-10-22 19:54:17 +00:00

Delivery novox/mesh-host@8c0bb9d4531d — delivered since 2026-10-22T20:04:34Z

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Group fix/1873-system-state-dirs: novox/mesh-catalog@e0bf87c2e3, novox/mesh-host@8c0bb9d453

composed together: pass — every machine composes with the change as it did without (4 of 4 compose)

Transitions

2026-10-22 19:54 (new) → proposed (announced): novox/mesh-host#130's head announced
2026-10-22 19:56 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-22 19:56 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-22 20:04 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-22 20:04 published → delivered (done): nothing for a walk to move

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-host@8c0bb9d4531d` — **delivered** since 2026-10-22T20:04:34Z **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Group** `fix/1873-system-state-dirs`: novox/mesh-catalog@e0bf87c2e3da, novox/mesh-host@8c0bb9d4531d - composed together: pass — every machine composes with the change as it did without (4 of 4 compose) **Transitions** - 2026-10-22 19:54 (new) → proposed (announced): novox/mesh-host#130's head announced - 2026-10-22 19:56 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-22 19:56 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-22 20:04 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-22 20:04 published → delivered (done): nothing for a walk to move The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools merged commit 59e6a6fa2a into main

2026-10-22 20:04:32 +00:00

mesh-tools deleted branch fix/1873-system-state-dirs

2026-10-22 20:04:33 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#130