Fimeg/souveraine
Watch
1
0
Fork
You've already forked souveraine
 0
Code Releases Activity

packaging: bring machined's user with it

Browse source 
The development recipe installed the sysusers declaration; the CI package that devices consume quietly dropped it. Ship the machine-tier souveraine account in the prebuilt package and assert the file is present before publishing.\n\nThis account belongs to machined. Souvie gets her own principal through agent admission.
This commit is contained in:
Fimeg 2026-08-17 12:36:53 -04:00
commit af60d9e401
2 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.gitea/workflows/ci.yml
View file

@ -410,6 +410,7 @@ jobs:
packaging/souveraine-machined.service \
packaging/souveraine-sessiond.service \
packaging/souveraine-sensord.service LICENSE "$PKG_WORK/"
cp packaging/arch/souveraine.sysusers "$PKG_WORK/"
# Phone-only reporters and surfaces remain aarch64-only.
if [ "$ARCH" = aarch64 ]; then
cp "souveraine-usb-kvm-$ARCH" "$PKG_WORK/souveraine-usb-kvm-binary"
@ -440,6 +441,7 @@ jobs:
bsdtar -tf "$PKG" | grep -qx 'usr/lib/systemd/user/souveraine-sessiond.service'
bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine-sensord'
bsdtar -tf "$PKG" | grep -qx 'etc/pam.d/souveraine-sessiond'
bsdtar -tf "$PKG" | grep -qx 'usr/lib/sysusers.d/souveraine.conf'
if [ "$ARCH" = aarch64 ]; then
bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine-usb-kvm'
fi

8
packaging/arch/PKGBUILD.prebuilt
View file

@ -16,6 +16,7 @@ backup=('etc/pam.d/souveraine-stepup' 'etc/pam.d/souveraine-sessiond')
source=('souveraine-binary' 'souveraine.service'
'souveraine-secrets-binary' 'souveraine-secrets.service'
'souveraine-machined-binary' 'souveraine-machined.service'
'souveraine.sysusers'
'souveraine-sessiond-binary' 'souveraine-sessiond.service'
'souveraine-sensord-binary' 'souveraine-sensord.service'
'souveraine-sessiond.pam'
@ -23,7 +24,7 @@ source=('souveraine-binary' 'souveraine.service'
'souveraine-stepup.pam' 'org.souveraine.stepup.policy'
'LICENSE')
sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP'
'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
# sessiond is built and packaged for both supported architectures. Installing
# its user unit does not enable or start it; activation remains target-owned.
if [ "$CARCH" = aarch64 ]; then
@ -96,6 +97,11 @@ package() {
install -Dm755 "$srcdir/souveraine-machined-binary" "$pkgdir/usr/bin/souveraine-machined"
install -Dm644 "$srcdir/souveraine-machined.service" \
"$pkgdir/usr/lib/systemd/system/souveraine-machined.service"
# This is the machine-tier daemon account, not Souvie's agent principal.
# The development recipe already shipped it; keep the CI package—the
# artifact devices install—on the same contract.
install -Dm644 "$srcdir/souveraine.sysusers" \
"$pkgdir/usr/lib/sysusers.d/souveraine.conf"
# Verifies the forensic trail's hash chain. Ships with the daemon that
# writes it, not in the rootfs overlay: the overlay only reaches a device