e28783e563
The package pool was committed but the installer still stopped at "no local package repository": it requires the compiled bundle (Packages, Packages.gz, packages.lock.tsv, SHA256SUMS), and building that had never run. The bundle - 1321 packages, 884 MiB, Ubuntu 26.04 amd64, built with apt-ftparchive on the fleet's own release so the closure matches the devices. - built/pool/ is gitignored: those .deb files are already tracked once under provisioning/offline-repo/packages/, and the same ~890 MB does not need a second path. What the installer reads from the bundle is the index. - The output directory is chmod 0755: mktemp -d created it 0700 and left it so, which made a valid bundle unreadable to the installer's probe. dpkg-deb output was parsed wrong in four places - `dpkg-deb -f <file> Package Version` prints "<Field>: <value>", and the callers kept the whole line, so the value carried its label. build-index.sh therefore accepted no package at all and reported an empty pool; add-packages.sh rejected every real .deb as an invalid name, missed version conflicts, and copied a duplicate; build-offline-repo.sh never matched a pin. - The test suite could not see any of this: its dpkg-deb stub emitted bare values. The stub now prints the labels exactly as the real tool does, which is what surfaced the remaining three sites. Tests - The secret scan covers the files we author, not apt-ftparchive's index over third-party packages: polkit's own description reads "...asked for their password:", which is prose in the packages, not a leak. Any secret reaching a manifest, README or tool is still caught. - The "test build must not touch the bundle" assertion now compares the directory before and after instead of demanding it be empty, so a maintainer's real build is not reported as test spill.
63 lines
2.8 KiB
Text
63 lines
2.8 KiB
Text
# Blueforce Field OS - offline APT pin manifest: base system packages
|
|
#
|
|
# Target release : Ubuntu 26.04 LTS, architecture amd64 (LAB confirms both)
|
|
# Format : one exact pin per line -> package=version ("#" starts a comment)
|
|
# Consumed by : scripts/install/blueforce-install.sh --offline, which refuses to
|
|
# run any package module unless every pin here is present in the
|
|
# bundle lock file <repo>/packages.lock.tsv.
|
|
#
|
|
# UNPINNED is a sentinel, not a version. Fill it in LAB:
|
|
# 1. acquire the reviewed .deb for the package into one local pool directory
|
|
# 2. read the exact version: dpkg-deb -f <file>.deb Package Version
|
|
# 3. replace UNPINNED with that version, keeping the line shape:
|
|
# openssh-server=<exact version reported by dpkg-deb>
|
|
# 4. verify with the static plan: ../build-offline-repo.sh --dry-run-plan
|
|
# (it must print PLAN READY before --check or a real build is attempted)
|
|
#
|
|
# Rules enforced by the tooling: lower-case package names, exactly one pin per
|
|
# package across all manifests, no inline comments, no whitespace around "=",
|
|
# no placeholder/replace/todo tokens. Adding or removing a package is a contract
|
|
# change: update manifests/requirements.tsv in the same edit or the plan fails.
|
|
|
|
# --- base tooling (installer module 02-system.sh, BASE_PKGS) ---
|
|
curl=8.18.0-1ubuntu2.5
|
|
wget=1.25.0-2ubuntu4.4
|
|
ca-certificates=20260601~26.04.1
|
|
gnupg=2.4.8-4ubuntu3.1
|
|
lsb-release=12.1-2build1
|
|
# Transitional dummy on apt >= 2.0 (https is built into apt). Kept for air-gapped
|
|
# parity with the reference build; the LAB may drop it after review.
|
|
apt-transport-https=3.2.0
|
|
|
|
# --- remote shell and encrypted transport (modules 07-ssh.sh, 06-wireguard.sh) ---
|
|
openssh-server=1:10.2p1-2ubuntu3.6
|
|
wireguard-tools=1.0.20250521-1ubuntu1
|
|
|
|
# --- field diagnostics: SMART disk health evidence ---
|
|
# Consumed by scripts/diagnostics/bf-diagnostics and bf-hardware-inventory.sh.
|
|
smartmontools=7.5-2
|
|
|
|
# --- firewall baseline (module 13-firewall.sh) ---
|
|
ufw=0.36.2-9build1
|
|
iptables=1.8.11-2ubuntu3
|
|
|
|
# --- operator GUI (bfos/ui_gui.py; module 18-final-check.sh) ---
|
|
# tkinter ships as its own package on Ubuntu, so a minimal image has Python but
|
|
# no GUI. Without it the operator application cannot open its window at all --
|
|
# and the fleet has no network to fetch it from.
|
|
python3-tk=3.14.3-0ubuntu2
|
|
# python3-tk's own dependency closure. Pinned explicitly because the installer
|
|
# resolves nothing from a remote source: whatever the pin does not name must
|
|
# already be on the image.
|
|
python3.14-tk=3.14.4-1ubuntu0.2
|
|
libtk8.6=8.6.17-1build1
|
|
libreadline8t64=8.3-4
|
|
readline-common=8.3-4
|
|
libffi8=3.5.2-4
|
|
libsqlite3-0=3.46.1-9ubuntu0.2
|
|
libbrotli1=1.2.0-3build1
|
|
openssl=3.5.5-1ubuntu3.5
|
|
|
|
# --- monitoring (module 12-monitoring.sh) ---
|
|
# The textfile collector ships inside this package; no extra dependency is needed.
|
|
prometheus-node-exporter=1.10.2-1
|