docs: TASK-27 gitea pipeline audit
Scoped from what was measured today. The finding that matters: rootfs-overlay is not a package, so overlay fixes reach a running phone only via reprovision — which costs Casey his live system. Two fixes are already stuck behind it. Also recorded: there is no `primary` branch despite ci.yml triggering on it (public is the de facto release branch, proven by the phone's installed package matching public's head); kernel.yml's fourth blocker, the config-blueline move that breaks PKGBUILD:53; and that the archdev aarch64 sysroot was half-updated and silently lies about which ABI a cross build targeted, which makes every recent cross-built artifact suspect.
This commit is contained in:
Fimeg
parent
c304e9760b
commit
0083c6d79f
2 changed files with 98 additions and 0 deletions
97
docs/tasks/27-gitea-pipeline-audit.md
Normal file
97
docs/tasks/27-gitea-pipeline-audit.md
Normal file
|
|
@ -0,0 +1,97 @@
|
|||
# TASK 27 — Gitea pipeline audit
|
||||
|
||||
**Status:** scoped 2026-07-25, not started. Findings below are measured, not
|
||||
assumed. **Size:** one session for the audit itself; the fixes are separate.
|
||||
|
||||
The goal is the one Casey stated: everything built in `~/Projects` ships as a
|
||||
signed package through Gitea, so the phone updates with `pacman -Syu` and its
|
||||
integrity is provable. TASK-25 owns the design. This task is the audit — what
|
||||
is actually wired today, and where a change silently fails to reach the device.
|
||||
|
||||
## The gap that matters most: not everything is a package
|
||||
|
||||
Three delivery mechanisms are in play and only one of them is auditable.
|
||||
|
||||
| What | How it reaches the phone | Auditable |
|
||||
|---|---|---|
|
||||
| `souveraine`, `-secrets`, `-machined`, `-sessiond`, `upower-souveraine` | CI → signed pkg → `pacman -Syu` | yes |
|
||||
| `rootfs-overlay/`, `overlays/` (units, scripts, hypr config) | copied at **provision time** by `provision-rootfs.sh` | **no** |
|
||||
| kernel, hyprgrass, squeekboard, stevia, firefox-arm, culver, player | hand-carried `pacman -U`, or `hyprpm`, or nothing | **no** |
|
||||
|
||||
**The overlay is not a package.** A fix committed to `rootfs-overlay/` reaches
|
||||
a running phone only via a reprovision — which costs Casey his live system, so
|
||||
it effectively never happens. Two fixes are stuck behind this right now:
|
||||
`blueline-hexagonrpcd-sdsp.service` (`Restart=always` + the readiness gate) and
|
||||
`blueline-proximity-lock`. Both are committed in Pixel3Arch `557c8e1` and
|
||||
neither is on the device.
|
||||
|
||||
Deciding what owns the overlay — a `blueline-rootfs` package, or per-component
|
||||
packages that each own their own units — is the first real decision here.
|
||||
|
||||
## Findings, measured 2026-07-25
|
||||
|
||||
1. **There is no `primary` branch.** `souveraine`'s `ci.yml` triggers on
|
||||
`[primary, public]`; `git ls-remote` shows only `main`, `public`,
|
||||
`experimental/session-trust-phase1`, `archive/main-mit-0.1.0`. So half the
|
||||
trigger is dead and **`public` is the de facto release branch** — confirmed
|
||||
by the phone's installed `souveraine 0.1.r218.g91c0cf800bf6` matching
|
||||
`public`'s head exactly. Either create `primary` or drop it from the
|
||||
trigger; a branch name in CI that does not exist is a trap.
|
||||
|
||||
2. **`kernel.yml` has never once passed.** 11 runs, 11 failures, none since
|
||||
Jul 14. `kernel-latest` is a 404. Blockers, in order (three from TASK-25,
|
||||
the fourth found by Casey 2026-07-25):
|
||||
- the last credential fix (`9c51f3f`) was never re-run and may already work
|
||||
- `pkgver` is static `7.1.1`, so `-Syu` can never see an upgrade
|
||||
- a bare `.g<sha>` sorts as hex and is **non-monotonic** — use
|
||||
`7.1.1.r<count>.g<sha>`
|
||||
- `kernel/config-blueline.aarch64` had been moved to `archive/` while
|
||||
`kernel/PKGBUILD:53` still copies it from `$startdir` — breaks the build
|
||||
outright. Restored.
|
||||
|
||||
3. **The `edge` release clobbers other producers.** `ci.yml` deletes and
|
||||
recreates the release and tag, uploading only its own `pacman-repo` after
|
||||
`rm -rf`. Anything another job published there is erased on the next
|
||||
souveraine push. Casey chose the **additive** shape 2026-07-25: stop
|
||||
delete-and-recreate, read-modify-write `souveraine-<arch>.db` under a shared
|
||||
archdev flock, each producer deleting only its own superseded assets.
|
||||
|
||||
4. **Unowned files are still the standing risk.** 5,624 under
|
||||
`/usr /etc /opt /boot`. `/var/cache/hyprpm` was one of them, and that is how
|
||||
a routine `hyprutils` 0.13.1 → 0.14.0 upgrade killed every touch gesture
|
||||
with nothing reporting it. hyprgrass is now a package (Pixel3Arch
|
||||
`pkgs/hyprgrass`, `557c8e1`) — but **no pipeline delivers it**, because
|
||||
finding 2 blocks the same last mile the kernel needs.
|
||||
|
||||
5. **`no-ai-attribution` fails on two old commits** (`a7e909d`, `bc6ee12`)
|
||||
carrying co-author trailers. Fixing means a history rewrite. Casey's call,
|
||||
still pending.
|
||||
|
||||
6. **Build-host integrity is unaudited, and it lies.** The archdev aarch64
|
||||
sysroot was half-updated: extracting packages unprivileged silently skips
|
||||
every file that already exists root-owned, so `hyprland.pc` read
|
||||
`Version: 0.56.0` while the headers were still 0.55's layout. A cross build
|
||||
against that sysroot compiles happily against a mixed ABI. **Anything
|
||||
cross-built on archdev in the past few weeks is suspect and worth
|
||||
rebuilding.** `pkgs/hyprgrass/build-cross.sh` now refreshes as root and
|
||||
asserts `SONAME == NEEDED`; that assertion, or an equivalent, belongs in
|
||||
every cross build. A signed package built from a poisoned sysroot is still
|
||||
a broken package — signing proves origin, not correctness.
|
||||
|
||||
## Acceptance
|
||||
|
||||
- Every repo in `~/Projects` that ships anything to the phone has a CI job
|
||||
ending in `repo-add --include-sigs --sign` into `souveraine-{arch}`.
|
||||
- No CI trigger names a branch that does not exist.
|
||||
- `pacman -Syu` on the phone installs kernel, hyprgrass, squeekboard, stevia,
|
||||
souveraine and the overlay content. Nothing is hand-carried.
|
||||
- A reprovision restores repo wiring from `rootfs-overlay/` with no manual steps.
|
||||
- Unowned files under `/usr /etc /opt /boot` trend to zero, and the count is
|
||||
reported by a job rather than discovered during an outage.
|
||||
- Cross builds fail loudly on an ABI mismatch instead of shipping one.
|
||||
|
||||
## Connects to
|
||||
|
||||
TASK-25 (the design and the archive shape), TASK-26 (`blueline-proximity-lock`
|
||||
as an unowned second authority — now demoted to a reporter, still unpackaged),
|
||||
`Pixel3Arch/PAF/build.md`, `souveraine/packaging/arch/`.
|
||||
|
|
@ -27,6 +27,7 @@ plus open threads from the 2026-07-17 session.
|
|||
| 18 | [Selection/highlight action menu](18-selection-menu.md) | open | design captured 07-21; component-first, Read Aloud gated on TTS server |
|
||||
| 19 | [First-party Settings control center](19-settings-control-center.md) | in progress | guarded standalone launch + owned pages |
|
||||
| 20 | [Souveraine Player video + agent control](20-player-video-agent.md) | open | video/snapshot/manifest; preserve music |
|
||||
| 27 | [Gitea pipeline audit](27-gitea-pipeline-audit.md) | open | overlay is not a package; no `primary` branch; poisoned build sysroot |
|
||||
|
||||
Archived (see `archive/`): 05 crash reporter — done 2026-07-21,
|
||||
CrashReporter.qml in-shell watcher, kill-test verified on device;
|
||||
|
|
|
|||
Loading…
Reference in a new issue