From 741cf90d3aacda1c3a27a2dfa7c2ef0ad58175c7 Mon Sep 17 00:00:00 2001 From: navigator Date: Fri, 2 Oct 2026 18:14:38 +0000 Subject: [PATCH 1/2] build: KEEL_APT_TRACK picks the Keel track; the plan drops TurnKey's backup and DNS A Keel image installs from Debian and the Keel archive alone since #30, but the bootstrap had no Keel source, so the plan could not install keel-archive-keyring, inithooks and the rest from it. conf/bootstrap_apt now writes keel.sources into the bootstrap too, naming the armored public key mk/turnkey.mk copies in from keys/ (the key the archive publishes at its root; the package installs the same one as a binary keyring, and the overlay replaces the file). KEEL_APT_TRACK, a conf variable, says which track the build installs from: stable (default) reads trixie alone, testing also enables trixie-testing, where every package lands first, for an image of the testing channel (handbook decision 0043). The conf script keel-apt makes such an image follow the testing track and removes the bootstrap's key copy; any other value stops the build in both places. plans/turnkey/base no longer installs tklbam, hubdns and webmin-tklbam (backup is Keel Backup, decision 0040; DNS registration is Keel Cloud), which also drops turnkey-pypy2 and py3curl-wrapper, wanted by nothing else. mk/turnkey.mk no longer builds fab's release meta package (turnkey--): keel-core is the meta package (decision 0047); /etc/turnkey_version is still written (decision 0014). tests/apt-sources.bats: the bootstrap's keel.sources, the track decision for each value, the conf script on each track, and the plan. --- conf/bootstrap_apt | 33 +++++++++++++ conf/turnkey.d/keel-apt | 16 ++++++ keys/keel-archive-keyring.asc | 26 ++++++++++ mk/turnkey.mk | 16 ++++-- plans/turnkey/base | 7 ++- tests/apt-sources.bats | 92 ++++++++++++++++++++++++++++++++++- 6 files changed, 180 insertions(+), 10 deletions(-) create mode 100644 keys/keel-archive-keyring.asc diff --git a/conf/bootstrap_apt b/conf/bootstrap_apt index dcd23e45..ab680c06 100755 --- a/conf/bootstrap_apt +++ b/conf/bootstrap_apt @@ -195,6 +195,39 @@ Enabled: $debian_backports_enabled Signed-By: $DEBIAN_KEYRING EOF +# Keel: the archive every Keel package comes from, in the bootstrap too, so +# that the plan installs keel-archive-keyring, inithooks and the rest from it. +# The key is the armored public key mk/turnkey.mk copied into the bootstrap +# from common's keys/, which apt reads as it is; the package later installs +# the same key as a binary keyring, and overlays/turnkey.d/keel-apt replaces +# this file with the one an installed machine keeps. KEEL_APT_TRACK says which +# track the build installs from (handbook decision 0043): stable, the default, +# reads trixie alone; testing also enables trixie-testing, where a package +# lands first, for an image of the testing channel. +KEEL_KEYRING=/usr/share/keyrings/keel-archive-keyring.asc +case "${KEEL_APT_TRACK:-stable}" in + stable) keel_testing_enabled=no ;; + testing) keel_testing_enabled=yes ;; + *) fatal "KEEL_APT_TRACK must be 'stable' or 'testing', got '$KEEL_APT_TRACK'" ;; +esac +[[ -f "$KEEL_KEYRING" ]] \ + || fatal "'$KEEL_KEYRING' is missing - mk/turnkey.mk copies it into the bootstrap from common's keys/" +cat > $SOURCES_LIST/keel.sources <-) is no longer built: +# keel-core is the meta package of a Keel image (handbook decision 0047), +# and the compatibility file is written on its own. +# # The apt User-Agent is no longer written here. It used to carry the appliance # and its version to every archive the machine ever contacted; it is now a # fixed header naming the distribution and nothing else, shipped by @@ -54,12 +65,9 @@ bootstrap/post += $(_bootstrap/post) define _root.patched/post # - # tagging package management system with release package # setting /etc/turnkey_version # @if [ -f ./changelog ]; then \ - echo $(FAB_SHARE_PATH)/make-release-deb.py ./changelog $O/root.patched; \ - $(FAB_SHARE_PATH)/make-release-deb.py ./changelog $O/root.patched; \ turnkey_version=$$($(FAB_SHARE_PATH)/turnkey-version.py --dist=$(CODENAME) --tag=$(VERSION_TAG) ./changelog $(FAB_ARCH)); \ echo $$turnkey_version > $O/root.patched/etc/turnkey_version; \ else \ diff --git a/plans/turnkey/base b/plans/turnkey/base index ea948a1b..117ba02d 100644 --- a/plans/turnkey/base +++ b/plans/turnkey/base @@ -35,9 +35,9 @@ dbus /* dbus installed by default since v18.x */ // in early boot (especially useful when live booting). jitterentropy-rngd -tklbam /* depends on pypy2 for now */ - -hubdns +/* tklbam, hubdns and webmin-tklbam are not installed: backup is Keel Backup + (handbook decision 0040) and DNS registration is Keel Cloud, and neither + turnkey-pypy2 nor py3curl-wrapper, which only they pulled in, is wanted */ inithooks turnkey-sysinfo turnkey-version @@ -70,7 +70,6 @@ webmin-custom webmin-fdisk webmin-raid webmin-lvm -webmin-tklbam webmin-updown webmin-filemin webmin-logviewer diff --git a/tests/apt-sources.bats b/tests/apt-sources.bats index 65548417..a2ee75a0 100644 --- a/tests/apt-sources.bats +++ b/tests/apt-sources.bats @@ -72,11 +72,24 @@ render() { local debian_backports_enabled=no local debian_components=(main non-free-firmware) local DEBIAN_KEYRING=/usr/share/keyrings/debian-archive-keyring.pgp + local KEEL_KEYRING=/usr/share/keyrings/keel-archive-keyring.asc + local keel_testing_enabled="${KEEL_TESTING_ENABLED:-no}" eval "cat <&2; return 1; } + KEEL_APT_TRACK="$1" bash -c "fatal() { echo \"fatal: \$*\" >&2; exit 1; } +$block +echo \"\$keel_testing_enabled\"" +} + # the names of the files conf/bootstrap_apt writes into sources.list.d, # but Sury's PHP source, which it writes only for a recipe that sets # PHP_VERSION. The \$ is sed's, not the shell's. @@ -110,10 +123,35 @@ fetch_hosts() { # ------------------------------------------------- what the image fetches -@test "the bootstrap writes debian, security and backports, and no TurnKey file" { +@test "the bootstrap writes debian, security, backports and keel, and no TurnKey file" { run bootstrap_files [ "$status" -eq 0 ] - [ "$output" = "$(printf 'debian.sources\nsecurity.sources\ndebian-backports.sources')" ] + [ "$output" = "$(printf 'debian.sources\nsecurity.sources\ndebian-backports.sources\nkeel.sources')" ] +} + +@test "the bootstrap gives the plan the Keel archive, stable on and testing off by default" { + run render keel.sources + [ "$status" -eq 0 ] + [ "$(awk '/^URIs:/ { print $2 }' <<< "$output" | sort -u)" = https://archive.keellinux.org ] + [ "$(awk '/^Suites:/ { print $2 }' <<< "$output" | tr '\n' ' ')" = "trixie trixie-testing " ] + [ "$(awk '/^Enabled:/ { print $2 }' <<< "$output" | tr '\n' ' ')" = "yes no " ] + [ "$(awk '/^Signed-By:/ { print $2 }' <<< "$output" | sort -u)" = /usr/share/keyrings/keel-archive-keyring.asc ] + # the key that file names is the one mk/turnkey.mk copies in from keys/ + grep -q 'keys/keel-archive-keyring.asc \$O/bootstrap/usr/share/keyrings/keel-archive-keyring.asc' "$REPO/mk/turnkey.mk" + gpg --batch --quiet --show-keys --with-colons "$REPO/keys/keel-archive-keyring.asc" \ + | grep -q '^fpr:::::::::AD0964BE3F09DED469A3B6B2148E951314703180:' + grep -q '^CONF_VARS += KEEL_APT_TRACK$' "$REPO/mk/turnkey.mk" +} + +@test "KEEL_APT_TRACK picks the track: stable or unset keeps testing off, testing turns it on, anything else stops the build" { + [ "$(track_decision "")" = no ] + [ "$(track_decision stable)" = no ] + [ "$(track_decision testing)" = yes ] + run track_decision nightly + [ "$status" -ne 0 ] + [[ "$output" == *"KEEL_APT_TRACK must be 'stable' or 'testing', got 'nightly'"* ]] + KEEL_TESTING_ENABLED=yes run render keel.sources + [ "$(awk '/^Enabled:/ { print $2 }' <<< "$output" | tr '\n' ' ')" = "yes yes " ] } # the \$ in the patterns are grep's, not the shell's @@ -192,6 +230,17 @@ fetch_hosts() { run ! grep -qE '^turnkey-keys' "$REPO/plans/turnkey/base" } +@test "the base plan installs none of TurnKey's backup and DNS services, and no release meta package is built" { + local name + for name in tklbam hubdns webmin-tklbam turnkey-pypy2 py3curl-wrapper; do + run ! grep -qE "^$name([[:space:]]|\$)" "$REPO/plans/turnkey/base" + done + run ! grep -q 'make-release-deb' "$REPO/mk/turnkey.mk" + # the compatibility file is still written (decision 0014) + grep -q 'turnkey_version=.*turnkey-version.py' "$REPO/mk/turnkey.mk" + grep -q '> \$O/root.patched/etc/turnkey_version' "$REPO/mk/turnkey.mk" +} + # ------------------------------------------------ the security-only upgrade @test "security.sources alone, as the upgrade reads it, is Debian security only" { @@ -365,6 +414,45 @@ run_conf() { [ ! -e "$BATS_TEST_TMPDIR/dpkg.calls" ] } +@test "the conf script leaves the stable track alone by default and drops the bootstrap's key copy" { + conf_tree + echo "armored copy" > "$APTROOT/usr/share/keyrings/keel-archive-keyring.asc" + local before + before="$(cat "$SOURCES/keel.sources")" + run_conf + [ "$status" -eq 0 ] + [ "$(cat "$SOURCES/keel.sources")" = "$before" ] + [ "$(sed -n '/^Suites: trixie-testing$/,/^$/p' "$SOURCES/keel.sources" | awk '/^Enabled:/ { print $2 }')" = no ] + [ ! -e "$APTROOT/usr/share/keyrings/keel-archive-keyring.asc" ] + [ -f "$APTROOT/usr/share/keyrings/keel-archive-keyring.gpg" ] +} + +@test "KEEL_APT_TRACK=testing makes the image follow the testing track, and changes nothing else" { + conf_tree + local before + before="$(grep -v '^Enabled:' "$SOURCES/keel.sources")" + KEEL_APT_TRACK=testing run_conf + [ "$status" -eq 0 ] + [ "$(grep -v '^Enabled:' "$SOURCES/keel.sources")" = "$before" ] + [ "$(sed -n '/^Suites: trixie$/,/^$/p' "$SOURCES/keel.sources" | awk '/^Enabled:/ { print $2 }')" = yes ] + [ "$(sed -n '/^Suites: trixie-testing$/,/^$/p' "$SOURCES/keel.sources" | awk '/^Enabled:/ { print $2 }')" = yes ] + run fetch_uris + grep -q '^https://archive\.keellinux\.org/dists/trixie-testing/main/' <<< "$output" + grep -q '^https://archive\.keellinux\.org/dists/trixie/main/' <<< "$output" +} + +@test "the conf script refuses an unknown KEEL_APT_TRACK, and testing without a stanza to enable" { + conf_tree + KEEL_APT_TRACK=nightly run_conf + [ "$status" -eq 1 ] + [[ "$output" == *"KEEL_APT_TRACK must be 'stable' or 'testing', got 'nightly'"* ]] + conf_tree + sed -i '/^Suites: trixie-testing$/,/^$/d' "$SOURCES/keel.sources" + KEEL_APT_TRACK=testing run_conf + [ "$status" -eq 1 ] + [[ "$output" == *"no trixie-testing stanza to enable"* ]] +} + @test "the conf script refuses an image without the Keel keyring" { conf_tree rm "$APTROOT/usr/share/keyrings/keel-archive-keyring.gpg" From 217d1f42deb21e9704fc8df802b8095b64eda200 Mon Sep 17 00:00:00 2001 From: navigator Date: Fri, 2 Oct 2026 18:32:18 +0000 Subject: [PATCH 2/2] conf: the stable arm of the track case runs a command, so the gate counts it --- conf/turnkey.d/keel-apt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conf/turnkey.d/keel-apt b/conf/turnkey.d/keel-apt index e25bb610..df99f164 100755 --- a/conf/turnkey.d/keel-apt +++ b/conf/turnkey.d/keel-apt @@ -89,7 +89,7 @@ bad="$(grep -v ": $KEEL_PIN_PRIORITY\$" <<< "$pins" || true)" # --- the track the image follows (KEEL_APT_TRACK, as conf/bootstrap_apt read it) case "${KEEL_APT_TRACK:-stable}" in - stable) ;; + stable) : ;; testing) # an image built from the testing track follows it: the stanza the # overlay ships off is turned on, nothing else in the file changes