diff --git a/COVERAGE.md b/COVERAGE.md index 34a1c11..f3bc7c2 100644 --- a/COVERAGE.md +++ b/COVERAGE.md @@ -60,20 +60,32 @@ place: the first boot completes through `98finalize`, `[40nodebb] successfully completed`, port 80 answers 307 to https and port 443 answers 200 with `Home | NodeBB` over IPv6. -State of that check on 2026-09-26: **failing on a defect of the published -layer, so it is not a required status yet.** The `nodebb` layer on -the mirror (sha256 `40e3f4da`) carries the build time wrappers -`/usr/local/bin/systemctl` and `/usr/local/bin/service`, which call each other -in a loop outside a build chroot, so the first boot never gets past -`10regen-sshkeys`. The cause is the one pull request 1 fixed: the conffile -prompt failed the `root.patched` target, so fab never reached the step that -removes the build overlays, and `bt-layer` packed and published the tree -anyway (buildtasks issue 6). The recipe is fixed; the layer on the mirror is -not, because it has not been rebuilt. Once it is, this check goes green and is -added to the protection rule of `main`. Measured -before the failure, on the runner: `keel pull` of the three layers (598 MB) -7 s, `keel verify` exit 8, assemble 43 s, container started with a global -IPv6 address in 5 s. +State of that check on 2026-09-27: **green.** Run 36290439227 on `main`, +against the chain published that morning: + + keel verify exited 9: every layer matches + boot-test: assembling nodebb from https://mirror.keellinux.org/layers + boot-test: container address fc42:...:9e24 + boot-test: first boot finished + boot-test: http://[fc42:...:9e24]/ answered 307 https://[fc42:...:9e24]/ + boot-test: the forum answered 200, title 'Home | NodeBB' + keel diff: no drift + boot-test: nodebb boot test passed + +Measured on the runner: assemble 33 s, a global IPv6 address 5 s after the +start, first boot finished 50 s later, the whole job under two minutes once +the layers were pulled. It is a candidate for the protection rule of `main` +now that it passes. + +Four defects had to go first, each hidden by the one before it: the build +time `systemctl` and `service` wrappers that stopped the first boot at +`10regen-sshkeys` (pull request 1, and the layer rebuilt); the container's +missing apparmor profile, which kept `redis-server.service` from starting +with `status=226/NAMESPACE` (pull request 8); the unsubstituted +`ssl_ciphers 'ZZ_SSL_CIPHERS'`, which stopped nginx (buildtasks +`layer_needs_ssl_ciphers`, and the layer rebuilt again); and the first boot +writing to a `/dev/tty1` nobody reads, which blocked `./nodebb setup` in +`n_tty_write` forever (pull request 9). ### What the hook tests cover diff --git a/tests/README.md b/tests/README.md index 65d4691..9fea202 100644 --- a/tests/README.md +++ b/tests/README.md @@ -94,18 +94,17 @@ What it does, in order: Measured on the runner `keel-lxc-1` on 2026-09-26: `keel pull` of the three layers (598 MB) 7 s from the mirror on the same host, assemble 43 s. -### Known failure of the published layer - -The run of 2026-09-26 does not reach step 7: the first boot stops in -`10regen-sshkeys`. The `nodebb` layer on -the mirror (sha256 `40e3f4da`) carries the build time wrappers -`/usr/local/bin/systemctl` and `/usr/local/bin/service`, which call each other -in a loop outside a build chroot, so the first boot never gets past -`10regen-sshkeys`. The cause is the one pull request 1 fixed: the conffile -prompt failed the `root.patched` target, so fab never reached the step that -removes the build overlays, and `bt-layer` packed and published the tree -anyway (buildtasks issue 6). The recipe is fixed; the layer on the mirror is -not, because it has not been rebuilt. Once it is, this check goes green and is -added to the protection rule of `main`. Until then this test fails on the -mirror's `nodebb`, which is the gate reporting a real defect rather than a -problem with the test. +### The published layer, measured + +Run 36290439227 on `main`, 2026-09-27, against the chain on the mirror: +`keel verify` exit 9 (every layer matches), assemble 33 s, a global IPv6 +address 5 s after the start, first boot finished 50 s later, port 80 +answering 307 to https, port 443 answering 200 with the title +`Home | NodeBB`, and `keel diff` reporting no drift. The boot test passes. + +Earlier runs did not get that far, and each failure hid the next one: the +build time `systemctl` and `service` wrappers stopped the first boot at +`10regen-sshkeys`; then `redis-server.service` would not start in the +container without an apparmor profile; then nginx refused the unsubstituted +`ssl_ciphers 'ZZ_SSL_CIPHERS'`; then `./nodebb setup` blocked writing to a +`/dev/tty1` nobody reads. `COVERAGE.md` records which change fixed which.