57fbccd4d0
The field installer needs no network at all, which means the packages have to travel with the repository. This adds the resolved pool and pins every package to the exact version the pool carries. Package pool - 1312 .deb files (884 MB), resolved on Ubuntu 26.04 in a container so the closure matches the release the fleet runs: a .deb built against another glibc cannot be installed on the devices. - Tracked through Git LFS (*.deb), so history stays navigable while the working tree keeps the real files the installer reads from disk. - Two RustDesk dependencies (libxdo3, libva-x11-2) were missing: the vendor .deb is installed with dpkg, so nothing else pulls them in and `dpkg -i rustdesk` would have left the package unconfigured on a device. - Every file validated in the same release: 1312/1312 readable, 0 corrupt, 0 foreign architecture, and the pool satisfies all 24 pins (PLAN READY). Pins - All 24 UNPINNED sentinels replaced with the versions read from the packages themselves (dpkg-deb), with requirements.tsv updated in the same change so the contract has no drift. build-index.sh: stop destroying the shipped record - The repository record next to this script is the reviewed contract template (state: UNBUILT, packages: []) that documents the schema. Its default record destination pointed at that same file, so any default-path run overwrote the template with BUILT rows -- which happened twice, once from a hand run and once while this change was being developed. - The record now defaults to <output>/repo-manifest.yaml, and pointing it at the template is refused before any work starts. The template header documents this. Tests - The unpinned-pin and missing-pin cases read the sentinel out of the real manifests, so they became no-ops the moment the contract was filled instead of failing. They now set up the condition explicitly, and the fixture manifests carry the synthetic versions their pool is built from. - check-provisioning-static required packages/.gitkeep; the pool is what keeps that directory in git now, so it asserts a populated pool directory instead.
36 lines
3.5 KiB
Text
36 lines
3.5 KiB
Text
# Manifest audit table - the contract behind manifests/*.txt
|
|
#
|
|
# Four TAB-separated columns, one row per required package:
|
|
# manifest <TAB> package <TAB> required-by <TAB> why
|
|
#
|
|
# build-offline-repo.sh --dry-run-plan fails on drift in either direction:
|
|
# * a row whose package is not pinned in that manifest -> MISSING PACKAGES
|
|
# * a pin in a manifest with no row here -> PLAN ERROR (rogue pin)
|
|
#
|
|
# scripts/install/blueforce-install.sh never reads this file: it is the audit
|
|
# trail for humans and for the dry-run plan. Kernel modules and other artifacts
|
|
# that are not shipped as .deb files are out of scope.
|
|
base-packages.txt curl scripts/install/installer/modules/02-system.sh BASE_PKGS: HTTPS transfers for installer tooling
|
|
base-packages.txt wget scripts/install/installer/modules/02-system.sh BASE_PKGS: downloader expected by field runbooks
|
|
base-packages.txt ca-certificates scripts/install/installer/modules/02-system.sh BASE_PKGS: root store for TLS verification
|
|
base-packages.txt gnupg scripts/install/installer/modules/02-system.sh BASE_PKGS: signature handling for reviewed artifacts
|
|
base-packages.txt lsb-release scripts/install/installer/modules/02-system.sh BASE_PKGS: distribution identification
|
|
base-packages.txt apt-transport-https scripts/install/installer/modules/02-system.sh BASE_PKGS-adjacent: transitional dummy on apt >= 2.0, kept for parity
|
|
base-packages.txt openssh-server scripts/install/installer/modules/07-ssh.sh managed SSH access channel
|
|
base-packages.txt wireguard-tools scripts/install/installer/modules/06-wireguard.sh wg command for the WireGuard tunnel
|
|
base-packages.txt smartmontools scripts/diagnostics/bf-diagnostics SMART disk health evidence for field reports
|
|
base-packages.txt ufw scripts/install/installer/modules/13-firewall.sh host firewall baseline
|
|
base-packages.txt iptables scripts/install/installer/modules/13-firewall.sh rule backends used by the firewall module
|
|
base-packages.txt prometheus-node-exporter scripts/install/installer/modules/12-monitoring.sh node exporter including the textfile collector
|
|
remote-access.txt rustdesk scripts/install/installer/modules/09-rustdesk.sh pinned vendor .deb; not in the Ubuntu archive
|
|
remote-access.txt libxdo3 scripts/install/installer/modules/09-rustdesk.sh rustdesk 1.4.9 Depends; pulled explicitly because the vendor .deb is installed with dpkg, not from an APT source
|
|
remote-access.txt libva-x11-2 scripts/install/installer/modules/09-rustdesk.sh rustdesk 1.4.9 Depends; pulled explicitly because the vendor .deb is installed with dpkg, not from an APT source
|
|
remote-access.txt xrdp scripts/install/installer/modules/08-rdp.sh RDP access channel
|
|
remote-access.txt xorgxrdp scripts/install/installer/modules/08-rdp.sh X11 backend recommended by xrdp for the GNOME session
|
|
remote-access.txt gnome-session scripts/install/installer/modules/08-rdp.sh session started by xRDP logins
|
|
remote-access.txt ubuntu-desktop-minimal scripts/install/installer/modules/16-gui.sh minimal desktop stack for the field device
|
|
docker.txt docker-ce scripts/install/installer/modules/10-docker.sh container engine
|
|
docker.txt docker-ce-cli scripts/install/installer/modules/10-docker.sh docker CLI used by modules and diagnostics
|
|
docker.txt containerd.io scripts/install/installer/modules/10-docker.sh runtime bundled with Docker CE
|
|
docker.txt docker-buildx-plugin scripts/install/installer/modules/10-docker.sh buildx plugin requested by the offline install path
|
|
docker.txt docker-compose-plugin scripts/install/installer/modules/10-docker.sh compose v2 plugin for the field stack
|