fix(os): guard the loop-partition race and the debug->release update trap - #827
Merged
Merged
Conversation
…trap Two image-tooling fixes, one surface each: mkimage.sh raced losetup -P against udev publishing the partition nodes — mkfs.vfat hit /dev/loopNp1 before it existed, likeliest exactly when the release box is busiest. One guarded wait (udevadm settle + a bounded poll for both nodes) before the first mkfs, mirrored in verify-image.sh which opens the image the same way. The build variant (debug = SSH baked, release = shell-less) is now stamped where tooling can read it after the build: /etc/pithead-variant in the rootfs — so every image, installed slot and running system carries it — and [meta.pithead] variant= in the update bundle manifest, read from the rootfs the bundle actually ships. `pithead os-update BUNDLE` wraps rauc install and refuses to move a debug system onto a non-debug bundle without confirmation: that install removes the SSH channel driving it, which happened live on the bench and ended in a stick reinstall. verify-image asserts the stamp matches its mode (--test expects debug, release otherwise). Covered at the owning tiers: the gate, stamp parsing and the wrapped install run in tests/stack (19 new assertions, rauc stubbed); the artifact stamp is a verify-image check. Docs: a variants section in appliance-release.md, and M7 now goes through os-update. Closes #818 Closes #819 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…rink) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ror names the wrong culprit Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two os-image tooling fixes.
losetup -P race (#818)
os/rauc/mkimage.shranmkfs.vfaton/dev/loopNp1before udev published the node — the retry-clears failure seen cutting RC20 beside a running KVM battery. Now one guarded wait afterlosetup -P:udevadm settleplus a bounded poll (25 × 0.2 s) for both partition nodes, with a hard error if they never appear.tests/os/verify-image.shopens the image the same way, so it gets the same wait (its first check counts partitions immediately).Variant stamp + install guard (#819)
The SSH bake step defines the variant, so it stamps it:
/etc/pithead-variant(debug|release) written byos/rootfs/Containerfile— travels in the rootfs tarball into the image, every installed slot (pithead-installcopies the running slot) and the bundle payload.[meta.pithead] variant=in the bundle manifest, written byos/rauc/mkbundle.shfrom the rootfs the bundle ships, so the metadata cannot drift from the payload.Guard surface: a new
pithead os-update BUNDLE [-y]subcommand. There is no pithead-owned install wrapper today — the only channels are the manualrauc install(doc M7) and the KVM harness. A RAUC pre-install handler would guard every channel but cannot ask a question (it runs daemon-side, no tty), and the requested behaviour is warn-and-confirm. So the wrapper is the smallest honest surface: it reads both stamps, and when the running system isdebugand the bundle is not (releaseor unstamped — an old bundle without the stamp is shell-less too), it warns that the install removes the SSH channel driving it and requires y/N or--yes. Everything else installs unprompted. M7 now points at it; a barerauc installstill works and the docs say what skipping the guard costs.verify-imageasserts the stamp matches its mode:--testexpectsdebug, release mode expectsrelease(a debug image stampedreleasewould defeat the guard).Tests
tests/stack/run.sh: 19 new assertions — the confirmation gate matrix, stamp-file andrauc infoJSON parsing (nesting-tolerant, garbage →unknown), and the command end to end with a stubbedrauc: refused non-interactively with no--yes, proceeds with it, release→release unprompted,rauc installprovably not reached on refusal. Suite: 1900 passed, 0 failed.tests/os/verify-image.sh: variant-stamp assertion in both modes (battery not run — bench-tier).make lintandmake testgreen (shellcheck, shfmt, docs voice, operator strings).Bench should verify via a real A/B cycle: build a debug image + a release bundle, confirm
rauc infoshows the meta section on trixie's RAUC, confirmpithead os-updatewarns and that--yesinstalls; then a debug→debug update installs unprompted and verify-image passes in both modes.Closes #818
Closes #819
🤖 Generated with Claude Code