1387186b03
Switches the operator path from bash-only to a Python console, keeps the bash
menu as a fallback, and makes the offline package set travel with the repository
so the person installing a device never downloads anything.
bfos/ (stdlib only, no textual/rich: those would need a download, which defeats
the offline goal):
- simple mode offers three choices (Kur / Durum / Çıkış); the detailed mode with
all 21 fleet operations and the local installer is reachable from the menu or
with --full, so a first-time operator is not buried in options
- gate parity with the bash console: scope read from the playbook file and
refused on mismatch, production needs a typed token plus a separate approval,
release-gated runs need their wave name typed, destructive runs need a second
approval, "all" walks wave by wave and stops at the first failure
- Turkish throughout; audit log at /var/log/blueforce-console.log (600, falls
back to the user state dir) with a single redaction choke point
- bfos/ui_gui.py adds an optional tkinter window over the same operations layer;
headless and missing-tkinter cases explain themselves in Turkish
admin/bf-bootstrap.sh: links the Python console as `bf` (primary) and keeps
`bf-menu` (fallback), reports both, and recommends `sudo bf`.
Offline packages are committable now (this was the blocking contradiction):
- .gitignore ignored `Packages`, `Packages.gz` and `packages.lock.tsv` everywhere,
so a built bundle could never be committed and the installer would always have
been told to download. provisioning/offline-repo/built/ is now allowed through
while scratch output stays untracked
- provisioning/offline-repo/{add-packages.sh,build-index.sh,repo-manifest.yaml}
plus a Turkish step-by-step README for the repository owner
- the over-broad `*token*` ignore rule is narrowed to `*[-_.]token*` so ordinary
filenames are not silently excluded while token files still are
Tests: run-all.sh now runs the Python suites too (previously it collected only
*.sh, so 212 Python assertions were silently skipped) and executes from the repo
root. 11/11 pass, exit 0.
Two test expectations were corrected rather than the code: a read-only
wave-scoped report legitimately asks for no gate token (the bash console never
did either), so that assertion now checks the command carries operation_wave and
operation_confirmed, and a new test asserts release-gated runs still require
their token. The bootstrap completion contract moved from `sudo bf-menu` to
`sudo bf`.
57 lines
1.7 KiB
Text
57 lines
1.7 KiB
Text
.directory
|
|
|
|
# Local agent/plan state — never committed
|
|
.hermes/
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Field OS build artifacts.
|
|
# These are large, generated, and reproducible from a verified upstream ISO.
|
|
# The upstream ISO itself is NOT stored in git (2.9 GB); its SHA256 is recorded
|
|
# in the release manifest instead. See docs/26 and docs/30.
|
|
# ---------------------------------------------------------------------------
|
|
.build-lab/
|
|
dist/
|
|
*.iso
|
|
*.iso.sha256
|
|
*.iso.boot-report.txt
|
|
|
|
# Offline APT repository.
|
|
#
|
|
# IMPORTANT: the built bundle IS committed on purpose. The whole point of this
|
|
# repository is that an operator installing a field device never downloads
|
|
# anything: the packages travel with the repo. `provisioning/offline-repo/built/`
|
|
# is therefore allowed through the rules below, while a scratch bundle built
|
|
# anywhere else stays untracked.
|
|
provisioning/offline-repo/out/
|
|
provisioning/offline-repo/pool/
|
|
Packages
|
|
Packages.gz
|
|
packages.lock.tsv
|
|
# ...but never inside the committed bundle.
|
|
!provisioning/offline-repo/built/
|
|
!provisioning/offline-repo/built/**
|
|
|
|
# Documentation site (generated)
|
|
docs-site/node_modules/
|
|
docs-site/build/
|
|
docs-site/.docusaurus/
|
|
docs-site/docs/
|
|
fetched-logs/
|
|
|
|
# Secrets must never be committed — belt and braces alongside the secret scan
|
|
# in tests/. Any private key, token file, or credential store belongs in a
|
|
# root-owned path on the host, never in this repository.
|
|
*.key
|
|
*.pem
|
|
*.p12
|
|
*.pfx
|
|
id_rsa*
|
|
id_ed25519*
|
|
*credentials*
|
|
*[-_.]token*
|
|
*.secret
|
|
|
|
# Credential files delivered by `admin/bf-creds --fetch` (<dealer-number>.txt).
|
|
# They live only in the checkout that runs the delivery, are root-owned on the
|
|
# device (mode 0600 inside a mode 0700 directory), and are never committed.
|
|
admin/secrets/
|