feat: update more

.gitignore

@@ -1,6 +1,6 @@
 .spread-worker-lock
 .spread-worker-num
-.spread-reuse.yaml
+.spread-reuse*.yaml
 .stamp/
 cache/
 __pycache__/

README.md

@@ -11,7 +11,11 @@ because it rhymes 🤷🏻‍♀️
 
 prebuilt docker images + ready-to-use spread yamls so you can drop Canonical [`spread`](https://github.com/canonical/spread) into any project without writing a backend or maintaining test infra. images live on ghcr as multiarch manifests; per-version yamls live as github release assets.
 
-here is this project's pet bread:
+
+> [!WARNING]
+> This project has many footguns. The test containers are run with no authentication and in --privileged mode. Make sure you know what you are doing.
+
+anyway, here is this project's pet bread:
 
 ```
 ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣴⣶⣿

images/Dockerfile.bread-chisel-releases-24.04

@@ -16,10 +16,12 @@ RUN apt-get update && \
         skopeo iproute2 && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
 
-COPY cache/binaries/chisel-${BUILD_ARCH}        /usr/local/bin/chisel
 COPY cache/binaries/chisel-hacked-${BUILD_ARCH} /usr/local/bin/chisel-hacked
 COPY cache/binaries/docker-${BUILD_ARCH}        /usr/local/bin/docker
-RUN chmod +x /usr/local/bin/chisel /usr/local/bin/chisel-hacked /usr/local/bin/docker
+# NOTE: ship only the hacked chisel; `chisel` is a symlink to it so bare
+# `chisel` invocations (e.g. the spread install-slices lib) pick up CHISEL_HACKS.
+RUN chmod +x /usr/local/bin/chisel-hacked /usr/local/bin/docker && \
+    ln -s chisel-hacked /usr/local/bin/chisel
 
 # Lazy-apt shim: auto-runs apt-get update on first non-update apt/apt-get call,
 # then self-destructs so subsequent calls hit real apt directly.

images/Dockerfile.bread-chisel-releases-25.10

@@ -16,10 +16,12 @@ RUN apt-get update && \
         skopeo iproute2 && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
 
-COPY cache/binaries/chisel-${BUILD_ARCH}        /usr/local/bin/chisel
 COPY cache/binaries/chisel-hacked-${BUILD_ARCH} /usr/local/bin/chisel-hacked
 COPY cache/binaries/docker-${BUILD_ARCH}        /usr/local/bin/docker
-RUN chmod +x /usr/local/bin/chisel /usr/local/bin/chisel-hacked /usr/local/bin/docker
+# NOTE: ship only the hacked chisel; `chisel` is a symlink to it so bare
+# `chisel` invocations (e.g. the spread install-slices lib) pick up CHISEL_HACKS.
+RUN chmod +x /usr/local/bin/chisel-hacked /usr/local/bin/docker && \
+    ln -s chisel-hacked /usr/local/bin/chisel
 
 # Lazy-apt shim: auto-runs apt-get update on first non-update apt/apt-get call,
 # then self-destructs so subsequent calls hit real apt directly.

images/Dockerfile.bread-chisel-releases-26.04

@@ -16,10 +16,12 @@ RUN apt-get update && \
         skopeo iproute2 && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
 
-COPY cache/binaries/chisel-${BUILD_ARCH}        /usr/local/bin/chisel
 COPY cache/binaries/chisel-hacked-${BUILD_ARCH} /usr/local/bin/chisel-hacked
 COPY cache/binaries/docker-${BUILD_ARCH}        /usr/local/bin/docker
-RUN chmod +x /usr/local/bin/chisel /usr/local/bin/chisel-hacked /usr/local/bin/docker
+# NOTE: ship only the hacked chisel; `chisel` is a symlink to it so bare
+# `chisel` invocations (e.g. the spread install-slices lib) pick up CHISEL_HACKS.
+RUN chmod +x /usr/local/bin/chisel-hacked /usr/local/bin/docker && \
+    ln -s chisel-hacked /usr/local/bin/chisel
 
 # Lazy-apt shim: auto-runs apt-get update on first non-update apt/apt-get call,
 # then self-destructs so subsequent calls hit real apt directly.

images/Dockerfile.bread-chisel-releases-26.10

@@ -16,10 +16,12 @@ RUN apt-get update && \
         skopeo iproute2 && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
 
-COPY cache/binaries/chisel-${BUILD_ARCH}        /usr/local/bin/chisel
 COPY cache/binaries/chisel-hacked-${BUILD_ARCH} /usr/local/bin/chisel-hacked
 COPY cache/binaries/docker-${BUILD_ARCH}        /usr/local/bin/docker
-RUN chmod +x /usr/local/bin/chisel /usr/local/bin/chisel-hacked /usr/local/bin/docker
+# NOTE: ship only the hacked chisel; `chisel` is a symlink to it so bare
+# `chisel` invocations (e.g. the spread install-slices lib) pick up CHISEL_HACKS.
+RUN chmod +x /usr/local/bin/chisel-hacked /usr/local/bin/docker && \
+    ln -s chisel-hacked /usr/local/bin/chisel
 
 # Lazy-apt shim: auto-runs apt-get update on first non-update apt/apt-get call,
 # then self-destructs so subsequent calls hit real apt directly.

inlined/bread-chisel-releases-24.04.yaml

@@ -6,7 +6,10 @@ environment:
   PROJECT_PATH: /chisel-releases
   SHARED_LIBRARIES: $PROJECT_PATH/tests/spread/lib
   PATH: /snap/bin:$PATH:$SHARED_LIBRARIES
-  CHISEL_HACKS: "1"
+  # NOTE: empty by default; opt in per-run with `CHISEL_HACKS=1 spread ...`.
+  # $(HOST:...) forwards the host env var into the remote (spread sends only
+  # vars declared here, not the ambient host env).
+  CHISEL_HACKS: "$(HOST: echo $CHISEL_HACKS)"
 
 exclude:
   - .git

inlined/bread-chisel-releases-25.10.yaml

@@ -6,7 +6,10 @@ environment:
   PROJECT_PATH: /chisel-releases
   SHARED_LIBRARIES: $PROJECT_PATH/tests/spread/lib
   PATH: /snap/bin:$PATH:$SHARED_LIBRARIES
-  CHISEL_HACKS: "1"
+  # NOTE: empty by default; opt in per-run with `CHISEL_HACKS=1 spread ...`.
+  # $(HOST:...) forwards the host env var into the remote (spread sends only
+  # vars declared here, not the ambient host env).
+  CHISEL_HACKS: "$(HOST: echo $CHISEL_HACKS)"
 
 exclude:
   - .git

inlined/bread-chisel-releases-26.04.yaml

@@ -6,7 +6,10 @@ environment:
   PROJECT_PATH: /chisel-releases
   SHARED_LIBRARIES: $PROJECT_PATH/tests/spread/lib
   PATH: /snap/bin:$PATH:$SHARED_LIBRARIES
-  CHISEL_HACKS: "1"
+  # NOTE: empty by default; opt in per-run with `CHISEL_HACKS=1 spread ...`.
+  # $(HOST:...) forwards the host env var into the remote (spread sends only
+  # vars declared here, not the ambient host env).
+  CHISEL_HACKS: "$(HOST: echo $CHISEL_HACKS)"
 
 exclude:
   - .git

inlined/bread-chisel-releases-26.10.yaml

@@ -6,7 +6,10 @@ environment:
   PROJECT_PATH: /chisel-releases
   SHARED_LIBRARIES: $PROJECT_PATH/tests/spread/lib
   PATH: /snap/bin:$PATH:$SHARED_LIBRARIES
-  CHISEL_HACKS: "1"
+  # NOTE: empty by default; opt in per-run with `CHISEL_HACKS=1 spread ...`.
+  # $(HOST:...) forwards the host env var into the remote (spread sends only
+  # vars declared here, not the ambient host env).
+  CHISEL_HACKS: "$(HOST: echo $CHISEL_HACKS)"
 
 exclude:
   - .git

makefile

@@ -26,6 +26,11 @@ SELECTED_VERS   := $(if $(strip $(VER)),$(VER),$(VERSIONS))
 SELECTED_ARCHES := $(if $(strip $(ARCH)),$(ARCH),$(ARCHES))
 SELECTED_VER_ARCH := $(foreach v,$(SELECTED_VERS),$(foreach a,$(SELECTED_ARCHES),$(v)-$(a)))
 
+# Host-arch detection (uname -m -> docker arch name). SELECTED_ARCH defaults to
+# the host arch but honours an explicit ARCH=... override.
+HOST_ARCH   := $(shell uname -m | sed -e 's/^x86_64$$/amd64/' -e 's/^aarch64$$/arm64/')
+SELECTED_ARCH := $(if $(strip $(ARCH)),$(ARCH),$(HOST_ARCH))
+
 # Full (non-narrowed) matrix used by `clean` so it nukes everything.
 FULL_VER_ARCH := $(foreach v,$(VERSIONS),$(foreach a,$(ARCHES),$(v)-$(a)))
 
@@ -60,6 +65,23 @@ build-bread-chisel-releases: $(CHISEL_STAMPS)  ## Build bread-chisel-releases im
 .PHONY: build-bread-test
 build-bread-test: $(BREAD_TEST_STAMPS)  ## Build the bread-test (26.04 only, both arches) test-host image
 
+# Run the contract/integration spread suite (tests/spread.yaml). Builds the
+# test-host image + inlined yamls first. Pass extra spread args via SPREAD_ARGS,
+# e.g. make test SPREAD_ARGS='-debug'.
+SPREAD_ARGS ?=
+# The contract-bread-chisel-releases run task allocates the per-version
+# bread-chisel-releases:<ver>-<arch> images via the host docker socket, so all
+# four versions (host arch) must exist before the suite runs.
+# List the bread base stamps explicitly (not just via the chisel-releases
+# prereq) so make builds them as direct goals -- the .stamp/bread-% pattern
+# also matches bread-chisel-releases-%, so chained-implicit base builds are
+# unreliable.
+TEST_STAMPS := .stamp/bread-test-26.04-$(SELECTED_ARCH) \
+	$(foreach v,$(VERSIONS),.stamp/bread-$(v)-$(SELECTED_ARCH) .stamp/bread-chisel-releases-$(v)-$(SELECTED_ARCH))
+.PHONY: test
+test: $(TEST_STAMPS) inlined-yaml-files  ## Run the spread test suite (host arch; ARCH=... to override, SPREAD_ARGS=... for flags)
+	cd tests && spread $(SPREAD_ARGS) outer:ubuntu-26.04-$(SELECTED_ARCH)
+
 .PHONY: check-base
 check-base:  ## Report upstream ubuntu base-image digest drift (non-zero exit on drift)
 	@hack/check_base.sh --check
@@ -120,15 +142,16 @@ inlined/%.yaml: templates/%.yaml.in hack/inline_scripts.rb $(SCRIPTS)
 	@mkdir -p inlined
 	ruby hack/inline_scripts.rb $< $@
 
-# Host-arch detection for `make shell` (uname -m -> docker arch name).
-HOST_ARCH  := $(shell uname -m | sed -e 's/^x86_64$$/amd64/' -e 's/^aarch64$$/arm64/')
-SHELL_ARCH := $(if $(strip $(ARCH)),$(ARCH),$(HOST_ARCH))
-
 .PHONY: shell
-shell: .stamp/bread-26.04-$(SHELL_ARCH)  ## Drop into a bread:26.04 shell (host arch). Override via ARCH=...
+shell: .stamp/bread-26.04-$(SELECTED_ARCH)  ## Drop into a bread:26.04 shell (host arch). Override via ARCH=...
 	$(DOCKER) run --rm -it \
-		--platform "linux/$(SHELL_ARCH)" \
-		bread:26.04-$(SHELL_ARCH) bash
+		--platform "linux/$(SELECTED_ARCH)" \
+		bread:26.04-$(SELECTED_ARCH) bash
+
+.PHONY: nuke-spread
+nuke-spread:  ## Kill stray spread processes + force-remove bread containers
+	-pkill spread
+	-$(DOCKER) ps | grep bread | cut -d' ' -f1 | xargs -r $(DOCKER) rm --force
 
 .PHONY: clean
 clean:  ## Remove built images, stamps, generated inlined yamls, cached binaries

templates/bread-chisel-releases-24.04.yaml.in

@@ -6,7 +6,10 @@ environment:
   PROJECT_PATH: /chisel-releases
   SHARED_LIBRARIES: $PROJECT_PATH/tests/spread/lib
   PATH: /snap/bin:$PATH:$SHARED_LIBRARIES
-  CHISEL_HACKS: "1"
+  # NOTE: empty by default; opt in per-run with `CHISEL_HACKS=1 spread ...`.
+  # $(HOST:...) forwards the host env var into the remote (spread sends only
+  # vars declared here, not the ambient host env).
+  CHISEL_HACKS: "$(HOST: echo $CHISEL_HACKS)"
 
 exclude:
   - .git

templates/bread-chisel-releases-25.10.yaml.in

@@ -6,7 +6,10 @@ environment:
   PROJECT_PATH: /chisel-releases
   SHARED_LIBRARIES: $PROJECT_PATH/tests/spread/lib
   PATH: /snap/bin:$PATH:$SHARED_LIBRARIES
-  CHISEL_HACKS: "1"
+  # NOTE: empty by default; opt in per-run with `CHISEL_HACKS=1 spread ...`.
+  # $(HOST:...) forwards the host env var into the remote (spread sends only
+  # vars declared here, not the ambient host env).
+  CHISEL_HACKS: "$(HOST: echo $CHISEL_HACKS)"
 
 exclude:
   - .git

templates/bread-chisel-releases-26.04.yaml.in

@@ -6,7 +6,10 @@ environment:
   PROJECT_PATH: /chisel-releases
   SHARED_LIBRARIES: $PROJECT_PATH/tests/spread/lib
   PATH: /snap/bin:$PATH:$SHARED_LIBRARIES
-  CHISEL_HACKS: "1"
+  # NOTE: empty by default; opt in per-run with `CHISEL_HACKS=1 spread ...`.
+  # $(HOST:...) forwards the host env var into the remote (spread sends only
+  # vars declared here, not the ambient host env).
+  CHISEL_HACKS: "$(HOST: echo $CHISEL_HACKS)"
 
 exclude:
   - .git

templates/bread-chisel-releases-26.10.yaml.in

@@ -6,7 +6,10 @@ environment:
   PROJECT_PATH: /chisel-releases
   SHARED_LIBRARIES: $PROJECT_PATH/tests/spread/lib
   PATH: /snap/bin:$PATH:$SHARED_LIBRARIES
-  CHISEL_HACKS: "1"
+  # NOTE: empty by default; opt in per-run with `CHISEL_HACKS=1 spread ...`.
+  # $(HOST:...) forwards the host env var into the remote (spread sends only
+  # vars declared here, not the ambient host env).
+  CHISEL_HACKS: "$(HOST: echo $CHISEL_HACKS)"
 
 exclude:
   - .git

tests/_inner-bread-chisel-releases/contract/task.yaml

@@ -22,8 +22,9 @@ execute: |
       exit 1
   fi
 
-  # chisel pinned to v1.4.1 by the chisel-releases-bread Dockerfile.
-  chisel --version | grep -q "v1\.4\.1" || {
+  # only the hacked chisel is shipped; `chisel` is a symlink to chisel-hacked,
+  # so `chisel --version` also reports the -hacked suffix (pinned v1.4.1).
+  chisel --version | grep -q "v1\.4\.1-hacked" || {
       echo "chisel binary missing or wrong version"
       chisel --version || true
       exit 1