diff options
Diffstat (limited to 'docs/GUIX.txt')
| -rw-r--r-- | docs/GUIX.txt | 112 |
1 files changed, 50 insertions, 62 deletions
diff --git a/docs/GUIX.txt b/docs/GUIX.txt index 05aa572..89f4c9a 100644 --- a/docs/GUIX.txt +++ b/docs/GUIX.txt @@ -37,9 +37,8 @@ BUILD LOCAL binaries, browser assets and saved images. No compilation on recovery host. Podman info smoke test is not clean-host/container lifecycle proof. - Ordinary pack uses canonical /gnu/store. Former -RR wrapper creates one-ID - user namespace; privileged helpers cannot map host subordinate IDs there. - Builder's canonical store could bypass relocation and hide this defect. + Ordinary pack uses canonical /gnu/store. Relocatable -RR wrappers create a + one-ID user namespace incompatible with required subordinate UID mappings. https://guix.gnu.org/manual/devel/en/html_node/Invoking-guix-pack.html https://guix.gnu.org/manual/devel/en/html_node/Replicating-Guix.html https://raw.githubusercontent.com/containers/podman/main/docs/tutorials/rootless_tutorial.md @@ -48,7 +47,7 @@ MAKE CARRY FILE Production: create consistent encrypted export; copy and verify it locally: - ./bin/stack backup --include-images + ./bin/run backup --include-images Bundle a trusted freshly checked release with that export: @@ -132,23 +131,19 @@ CHECKS; DEPLOYMENT GATE No strict Rust/Clippy/Rustdoc, typed ESLint, LibreJS or crypto gate weakened. Existing documented lint/dependency exceptions remain unchanged. - Clean-host test exposed missing distro container signature policy. Image load - now supplies a temporary policy: reject by default; accept local Docker/OCI - archives only. Export supplies a separate temporary policy accepting only - containers-storage; registry transport remains rejected. Verified archive - manifests and architecture/layer/image-ID locks - still gate startup. Registry transport is not accepted by this load policy; - global host policy stays unchanged. Policies are generated by AGPL Rust code; - the foreign schema rejects comment/legal metadata, so no headerless source file - is added. The initial failed VM retained decrypted data and pending intent. - - A second clean-host check found legacy backups had collapsed Caddy's /data - and /config into one caddy/ tree. After manifest verification, backup restore - moves credentials into data/caddy and autosave into config/caddy; bytes and - permissions are retained. Conflicting old/new layouts are refused before - publishing a destination. New exports copy /data/. and /config/. separately. - - Before production, in order: + Image import supplies a temporary reject-by-default policy accepting local + Docker/OCI archives only. Export separately accepts containers-storage. + Manifest, architecture/layer/image-ID locks still gate startup; global host + policy stays unchanged. Generated protocol JSON cannot contain legal metadata; + its AGPL Rust generator carries the notice. POLICY.txt. + + Legacy backups may have a collapsed Caddy caddy/ tree. Verified backup restore + moves credentials to data/caddy and autosave to config/caddy, preserving bytes + and permissions. Conflicting layouts are refused before publication. Current + exports copy /data/. and /config/. separately. Keep this compatibility path + while retained backups depend on it. + + For each release, before production: 1. Full checked release with real Guix runtime and source/binary pair. 2. Fresh host without Guix/distro Podman/Git/GPG: offline bootstrap/restore; four services, exact images, detached UID/network helpers. @@ -160,48 +155,41 @@ CHECKS; DEPLOYMENT GATE 6. Fresh verified independent production backup; deploy only prebuilt release; verify public routes/state, retain prior release/runtime and encrypted export. - Rollback: stop new containers before old runtime binds production ports. - Keep .env/var/data; never delete closure entries used by running processes. - -VERIFIED — 2026-11-01 - - Offline KVM guest: official Debian 12 x86_64 image, no initial /gnu, Guix, - Podman, Git or GPG. Host supplies only documented kernel/account prerequisites. - Network restricted before bootstrap; readonly carry file plus separately - forwarded GPG agent; no private key copied. Bootstrap and one restore command - loaded four saved images and started all services without source builds. - - Strict HTTPS verified all four domains using original certificates; both WKD - routes matched the original key. All 651 immutable snapshot files matched - after legacy Caddy path normalization: 18 active TLS keys, 16 certificates. - All 126 release source/binary files matched. Original .env, owner fingerprint - and every canonical SQLite table matched. Production snapshot contained zero - conversations/messages; original real-message decryption therefore untestable. - Disposable Chromium/Firefox tests verified both participant identities, - 54-message history, encrypted snapshots/recovery and GNU LibreJS 7.21.1. - - Full local release gates passed live npm/Rust advisory checks, strict fmt, - Clippy, Rustdoc, typed ESLint and both TypeScript compilers; no suppressions. - Required OpenSSL 3.6.5 hybrid suites, protected OpenPGP v6 identity, wrong-pass - and tamper controls passed. Synthetic shell tests cover bootstrap collisions, - interrupted recovery/retry, lock exclusion and child descriptor closure. - - Runtime: 500687877 bytes, SHA256: + Retain a verified independent export and complete original worktree, + binary/launcher, installed unit, var/state.json, image-lock.json, images.tar + and engine storage. Activation replaces public source and image metadata. + Stop/cancel the new unit and stop Guix containers before rollback; confirm + inactivity before moving engine trees. Retain the new tree, restore old engine + path/metadata/worktree/launcher/unit and reload the user manager. For a Guix + rollback use the restored prior bin/run, which selects its matching runtime. + Only a host-tools release uses host PATH with Guix overrides unset. + Preserve CURRENT .env/var/data; never extract retained copies over live data. + Old releases do not remove newer Guix launcher/runtime files automatically. + Never delete store entries still used by retained/running tools. + +DEPLOYED BASELINE — 2026-11-01 + + Signed commit 9349a2d deployed packed Podman 5.7.0 and four rootless services. + Production .env, owner, every SQLite table and all 34 TLS key/certificate files + matched. All 126 release source/binary files, public HTTPS/WKD, search and + packed conmon paths verified. Only two ACME renewal retry timestamps changed. + + A fresh Debian 12 x86_64 KVM guest had no Guix/Podman/Git/GPG. Network was + restricted before readonly-carry bootstrap/restore; GPG used a restricted + forwarded agent, never a copied secret key. Restore, export/second recovery + and final VM reboot passed; all 651 immutable snapshot files matched. + Production-host reboot was not performed. The production database had zero + conversations/messages; real historical-message decryption was untestable. + Disposable browser tests recovered 54-message history with both identities; + Firefox GNU LibreJS 7.21.1 rejected its unlicensed control. + + Tested runtime SHA256: c5c7b849da152ee7a98b01602a1e91285ce4e3a80021a9cecb5f1e594dfc7810 - Guix channel 230aa373f315f247852ee07dff34146e9b480aec; 113 store entries. - Git 2.52.0, GnuPG 2.4.7, Podman 5.7.0, conmon 2.1.13, crun 1.25.1. - Empty helper lists force PATH lookup, selecting packed conmon/crun. Ordinary - host config stays unchanged. Rootless cleanup handles immutable user-owned - temporary trees without changing symlink targets or the published pack. + Its channel provenance is included in bin/guix-channels.scm. New source/packs + require their own checks. Empty helper lists select Guix tools through PATH; + ordinary host configuration stays unchanged. https://github.com/containers/podman/blob/v5.7.0/vendor/go.podman.io/common/pkg/config/config.go#L849-L875 https://github.com/containers/podman/blob/v5.7.0/cmd/podman/images/save.go#L91-L94 - Deployment gate above still applies to each carried artifact. Retain complete - original worktree, binary/launcher, installed user unit and engine storage - independently before activation. Reload the installed unit after switching to - bin/run. For rollback stop Guix containers first, retain their engine tree, - restore prior engine path, binary/launcher and unit; invoke prior activation - with host PATH and Guix CONTAINERS_CONF overrides unset. Keep current .env and - var/data. An old release alone does not remove a newer Guix launcher/runtime. - Private evidence: var/guix-*.log and .tools/guix-production/. These are ignored - and include private state hashes; do not publish them with public source. + Private evidence: var/guix-*.log and .tools/guix-production/; these include + private state hashes and stay ignored. Do not publish them with source. |