e28783e563
The package pool was committed but the installer still stopped at "no local package repository": it requires the compiled bundle (Packages, Packages.gz, packages.lock.tsv, SHA256SUMS), and building that had never run. The bundle - 1321 packages, 884 MiB, Ubuntu 26.04 amd64, built with apt-ftparchive on the fleet's own release so the closure matches the devices. - built/pool/ is gitignored: those .deb files are already tracked once under provisioning/offline-repo/packages/, and the same ~890 MB does not need a second path. What the installer reads from the bundle is the index. - The output directory is chmod 0755: mktemp -d created it 0700 and left it so, which made a valid bundle unreadable to the installer's probe. dpkg-deb output was parsed wrong in four places - `dpkg-deb -f <file> Package Version` prints "<Field>: <value>", and the callers kept the whole line, so the value carried its label. build-index.sh therefore accepted no package at all and reported an empty pool; add-packages.sh rejected every real .deb as an invalid name, missed version conflicts, and copied a duplicate; build-offline-repo.sh never matched a pin. - The test suite could not see any of this: its dpkg-deb stub emitted bare values. The stub now prints the labels exactly as the real tool does, which is what surfaced the remaining three sites. Tests - The secret scan covers the files we author, not apt-ftparchive's index over third-party packages: polkit's own description reads "...asked for their password:", which is prose in the packages, not a leak. Any secret reaching a manifest, README or tool is still caught. - The "test build must not touch the bundle" assertion now compares the directory before and after instead of demanding it be empty, so a maintainer's real build is not reported as test spill.
45 lines
4.9 KiB
Text
45 lines
4.9 KiB
Text
# Manifest audit table - the contract behind manifests/*.txt
|
|
#
|
|
# Four TAB-separated columns, one row per required package:
|
|
# manifest <TAB> package <TAB> required-by <TAB> why
|
|
#
|
|
# build-offline-repo.sh --dry-run-plan fails on drift in either direction:
|
|
# * a row whose package is not pinned in that manifest -> MISSING PACKAGES
|
|
# * a pin in a manifest with no row here -> PLAN ERROR (rogue pin)
|
|
#
|
|
# scripts/install/blueforce-install.sh never reads this file: it is the audit
|
|
# trail for humans and for the dry-run plan. Kernel modules and other artifacts
|
|
# that are not shipped as .deb files are out of scope.
|
|
base-packages.txt curl scripts/install/installer/modules/02-system.sh BASE_PKGS: HTTPS transfers for installer tooling
|
|
base-packages.txt wget scripts/install/installer/modules/02-system.sh BASE_PKGS: downloader expected by field runbooks
|
|
base-packages.txt ca-certificates scripts/install/installer/modules/02-system.sh BASE_PKGS: root store for TLS verification
|
|
base-packages.txt gnupg scripts/install/installer/modules/02-system.sh BASE_PKGS: signature handling for reviewed artifacts
|
|
base-packages.txt lsb-release scripts/install/installer/modules/02-system.sh BASE_PKGS: distribution identification
|
|
base-packages.txt apt-transport-https scripts/install/installer/modules/02-system.sh BASE_PKGS-adjacent: transitional dummy on apt >= 2.0, kept for parity
|
|
base-packages.txt openssh-server scripts/install/installer/modules/07-ssh.sh managed SSH access channel
|
|
base-packages.txt wireguard-tools scripts/install/installer/modules/06-wireguard.sh wg command for the WireGuard tunnel
|
|
base-packages.txt smartmontools scripts/diagnostics/bf-diagnostics SMART disk health evidence for field reports
|
|
base-packages.txt ufw scripts/install/installer/modules/13-firewall.sh host firewall baseline
|
|
base-packages.txt iptables scripts/install/installer/modules/13-firewall.sh rule backends used by the firewall module
|
|
base-packages.txt prometheus-node-exporter scripts/install/installer/modules/12-monitoring.sh node exporter including the textfile collector
|
|
base-packages.txt python3-tk scripts/install/installer/modules/18-final-check.sh tkinter is a separate package on Ubuntu; without it the operator GUI cannot start
|
|
base-packages.txt python3.14-tk scripts/install/installer/modules/18-final-check.sh python3-tk dependency closure; the installer resolves nothing from a remote source
|
|
base-packages.txt libtk8.6 scripts/install/installer/modules/18-final-check.sh python3-tk dependency closure; the installer resolves nothing from a remote source
|
|
base-packages.txt libreadline8t64 scripts/install/installer/modules/18-final-check.sh python3-tk dependency closure; the installer resolves nothing from a remote source
|
|
base-packages.txt readline-common scripts/install/installer/modules/18-final-check.sh python3-tk dependency closure; the installer resolves nothing from a remote source
|
|
base-packages.txt libffi8 scripts/install/installer/modules/18-final-check.sh python3-tk dependency closure; the installer resolves nothing from a remote source
|
|
base-packages.txt libsqlite3-0 scripts/install/installer/modules/18-final-check.sh python3-tk dependency closure; the installer resolves nothing from a remote source
|
|
base-packages.txt libbrotli1 scripts/install/installer/modules/18-final-check.sh python3-tk dependency closure; the installer resolves nothing from a remote source
|
|
base-packages.txt openssl scripts/install/installer/modules/18-final-check.sh python3-tk dependency closure; the installer resolves nothing from a remote source
|
|
remote-access.txt rustdesk scripts/install/installer/modules/09-rustdesk.sh pinned vendor .deb; not in the Ubuntu archive
|
|
remote-access.txt libxdo3 scripts/install/installer/modules/09-rustdesk.sh rustdesk 1.4.9 Depends; pulled explicitly because the vendor .deb is installed with dpkg, not from an APT source
|
|
remote-access.txt libva-x11-2 scripts/install/installer/modules/09-rustdesk.sh rustdesk 1.4.9 Depends; pulled explicitly because the vendor .deb is installed with dpkg, not from an APT source
|
|
remote-access.txt xrdp scripts/install/installer/modules/08-rdp.sh RDP access channel
|
|
remote-access.txt xorgxrdp scripts/install/installer/modules/08-rdp.sh X11 backend recommended by xrdp for the GNOME session
|
|
remote-access.txt gnome-session scripts/install/installer/modules/08-rdp.sh session started by xRDP logins
|
|
remote-access.txt ubuntu-desktop-minimal scripts/install/installer/modules/16-gui.sh minimal desktop stack for the field device
|
|
docker.txt docker-ce scripts/install/installer/modules/10-docker.sh container engine
|
|
docker.txt docker-ce-cli scripts/install/installer/modules/10-docker.sh docker CLI used by modules and diagnostics
|
|
docker.txt containerd.io scripts/install/installer/modules/10-docker.sh runtime bundled with Docker CE
|
|
docker.txt docker-buildx-plugin scripts/install/installer/modules/10-docker.sh buildx plugin requested by the offline install path
|
|
docker.txt docker-compose-plugin scripts/install/installer/modules/10-docker.sh compose v2 plugin for the field stack
|