d6d22c6e56
Follow-up to fc4c87c, which committed the pool files themselves. This records
the .gitignore rule that stops excluding built/pool/ and the two assertions that
keep it that way: the suite now fails if either the bundle's pool/ or its index
becomes gitignored, because a cloning device receives nothing but what the
repository tracks.
Verified: check-offline-repo-static.sh 140/140 with the pool committed.
75 lines
2.6 KiB
Text
75 lines
2.6 KiB
Text
.directory
|
||
|
||
# Local agent/plan state — never committed
|
||
.hermes/
|
||
|
||
# Scratch scripts and build experiments (package collection, pin extraction).
|
||
# Nothing here ships; the reviewed tooling lives in provisioning/offline-repo/.
|
||
/tmp/
|
||
|
||
# Python bytecode caches. Every .pyc is regenerated on import, so tracking them
|
||
# only produces noisy diffs and a stale artifact in the checkout.
|
||
__pycache__/
|
||
*.py[cod]
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Field OS build artifacts.
|
||
# These are large, generated, and reproducible from a verified upstream ISO.
|
||
# The upstream ISO itself is NOT stored in git (2.9 GB); its SHA256 is recorded
|
||
# in the release manifest instead. See docs/26 and docs/30.
|
||
# ---------------------------------------------------------------------------
|
||
.build-lab/
|
||
dist/
|
||
*.iso
|
||
*.iso.sha256
|
||
*.iso.boot-report.txt
|
||
|
||
# Offline APT repository.
|
||
#
|
||
# IMPORTANT: the built bundle IS committed on purpose. The whole point of this
|
||
# repository is that an operator installing a field device never downloads
|
||
# anything: the packages travel with the repo. `provisioning/offline-repo/built/`
|
||
# is therefore allowed through the rules below, while a scratch bundle built
|
||
# anywhere else stays untracked.
|
||
provisioning/offline-repo/out/
|
||
provisioning/offline-repo/pool/
|
||
Packages
|
||
Packages.gz
|
||
packages.lock.tsv
|
||
# ...but never inside the committed bundle.
|
||
!provisioning/offline-repo/built/
|
||
!provisioning/offline-repo/built/**
|
||
#
|
||
# The bundle's pool/ IS committed, deliberately. blueforce-install.sh resolves
|
||
# every pinned package as "<bundle>/pool/<source>" (its lock rows carry
|
||
# "pool/<file>.deb"), so a device that clones the repository needs those files
|
||
# on disk. Excluding them left the installer with an index but no packages and
|
||
# it stopped with "Kilitte yazılı paket depoda yok". The same blobs also live
|
||
# under packages/, which is the intake directory the maintainer commits from;
|
||
# Git LFS stores one object per content hash, so the duplication is a path, not
|
||
# a second copy of the bytes.
|
||
|
||
# Documentation site (generated)
|
||
docs-site/node_modules/
|
||
docs-site/build/
|
||
docs-site/.docusaurus/
|
||
docs-site/docs/
|
||
fetched-logs/
|
||
|
||
# Secrets must never be committed — belt and braces alongside the secret scan
|
||
# in tests/. Any private key, token file, or credential store belongs in a
|
||
# root-owned path on the host, never in this repository.
|
||
*.key
|
||
*.pem
|
||
*.p12
|
||
*.pfx
|
||
id_rsa*
|
||
id_ed25519*
|
||
*credentials*
|
||
*[-_.]token*
|
||
*.secret
|
||
|
||
# Credential files delivered by `admin/bf-creds --fetch` (<dealer-number>.txt).
|
||
# They live only in the checkout that runs the delivery, are root-owned on the
|
||
# device (mode 0600 inside a mode 0700 directory), and are never committed.
|
||
admin/secrets/
|