e28783e563
The package pool was committed but the installer still stopped at "no local package repository": it requires the compiled bundle (Packages, Packages.gz, packages.lock.tsv, SHA256SUMS), and building that had never run. The bundle - 1321 packages, 884 MiB, Ubuntu 26.04 amd64, built with apt-ftparchive on the fleet's own release so the closure matches the devices. - built/pool/ is gitignored: those .deb files are already tracked once under provisioning/offline-repo/packages/, and the same ~890 MB does not need a second path. What the installer reads from the bundle is the index. - The output directory is chmod 0755: mktemp -d created it 0700 and left it so, which made a valid bundle unreadable to the installer's probe. dpkg-deb output was parsed wrong in four places - `dpkg-deb -f <file> Package Version` prints "<Field>: <value>", and the callers kept the whole line, so the value carried its label. build-index.sh therefore accepted no package at all and reported an empty pool; add-packages.sh rejected every real .deb as an invalid name, missed version conflicts, and copied a duplicate; build-offline-repo.sh never matched a pin. - The test suite could not see any of this: its dpkg-deb stub emitted bare values. The stub now prints the labels exactly as the real tool does, which is what surfaced the remaining three sites. Tests - The secret scan covers the files we author, not apt-ftparchive's index over third-party packages: polkit's own description reads "...asked for their password:", which is prose in the packages, not a leak. Any secret reaching a manifest, README or tool is still caught. - The "test build must not touch the bundle" assertion now compares the directory before and after instead of demanding it be empty, so a maintainer's real build is not reported as test spill.
73 lines
2.5 KiB
Text
73 lines
2.5 KiB
Text
.directory
|
|
|
|
# Local agent/plan state — never committed
|
|
.hermes/
|
|
|
|
# Scratch scripts and build experiments (package collection, pin extraction).
|
|
# Nothing here ships; the reviewed tooling lives in provisioning/offline-repo/.
|
|
/tmp/
|
|
|
|
# Python bytecode caches. Every .pyc is regenerated on import, so tracking them
|
|
# only produces noisy diffs and a stale artifact in the checkout.
|
|
__pycache__/
|
|
*.py[cod]
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Field OS build artifacts.
|
|
# These are large, generated, and reproducible from a verified upstream ISO.
|
|
# The upstream ISO itself is NOT stored in git (2.9 GB); its SHA256 is recorded
|
|
# in the release manifest instead. See docs/26 and docs/30.
|
|
# ---------------------------------------------------------------------------
|
|
.build-lab/
|
|
dist/
|
|
*.iso
|
|
*.iso.sha256
|
|
*.iso.boot-report.txt
|
|
|
|
# Offline APT repository.
|
|
#
|
|
# IMPORTANT: the built bundle IS committed on purpose. The whole point of this
|
|
# repository is that an operator installing a field device never downloads
|
|
# anything: the packages travel with the repo. `provisioning/offline-repo/built/`
|
|
# is therefore allowed through the rules below, while a scratch bundle built
|
|
# anywhere else stays untracked.
|
|
provisioning/offline-repo/out/
|
|
provisioning/offline-repo/pool/
|
|
Packages
|
|
Packages.gz
|
|
packages.lock.tsv
|
|
# ...but never inside the committed bundle.
|
|
!provisioning/offline-repo/built/
|
|
!provisioning/offline-repo/built/**
|
|
#
|
|
# Except the bundle's own pool/ copy of the .deb files: those packages are
|
|
# already tracked once under provisioning/offline-repo/packages/, and the same
|
|
# ~890 MB does not need a second path in the repository. What the installer
|
|
# needs from this directory is the index (Packages, Packages.gz,
|
|
# packages.lock.tsv, SHA256SUMS) plus repo-manifest.yaml.
|
|
provisioning/offline-repo/built/pool/
|
|
|
|
# Documentation site (generated)
|
|
docs-site/node_modules/
|
|
docs-site/build/
|
|
docs-site/.docusaurus/
|
|
docs-site/docs/
|
|
fetched-logs/
|
|
|
|
# Secrets must never be committed — belt and braces alongside the secret scan
|
|
# in tests/. Any private key, token file, or credential store belongs in a
|
|
# root-owned path on the host, never in this repository.
|
|
*.key
|
|
*.pem
|
|
*.p12
|
|
*.pfx
|
|
id_rsa*
|
|
id_ed25519*
|
|
*credentials*
|
|
*[-_.]token*
|
|
*.secret
|
|
|
|
# Credential files delivered by `admin/bf-creds --fetch` (<dealer-number>.txt).
|
|
# They live only in the checkout that runs the delivery, are root-owned on the
|
|
# device (mode 0600 inside a mode 0700 directory), and are never committed.
|
|
admin/secrets/
|