Skip to content

m1vm/bake: the apt source census, and clean proves every build proxy setting gone (BAKE-APT-CENSUS + BAKE-BUILD-PROXY) - #133

Merged
rappdw merged 6 commits into
m1/c-8a515c10from
bake-apt-census
Oct 31, 2026
Merged

m1vm/bake: the apt source census, and clean proves every build proxy setting gone (BAKE-APT-CENSUS + BAKE-BUILD-PROXY)#133
rappdw merged 6 commits into
m1/c-8a515c10from
bake-apt-census

Conversation

@rappdw

@rappdw rappdw commented Oct 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Two units in one PR, so there is one CI run and one merge go:

  • BAKE-APT-CENSUS (PIN-RESIDUAL-3-CENSUS; rulings BAKE-APT-CENSUS-R2, -R3, -R4): the bake's apt step proves, before the first fetch, that apt reads only the sources it checked.
  • BAKE-BUILD-PROXY (rulings BAKE-BUILD-PROXY, -B): the clean step deletes every build proxy setting and proves each one gone.

Changes m1vm/bake.py and tests/test_m1vm_bake.py only.

Binding

  • Approved head: 6a6e6fcdd39538bead4d3fc9e0d1c0a7aba16404, tree f619386e2ce5ca47267043b77018b640d96967ee; m1vm/bake.py sha256 505be3ba48f3329d7a061262ef1db93575aab9f595b1129a61a208cb1751154a. Dual APPROVE of the combined head: Codex b45735ea, Opus 3f6c2277.
  • BAKE-APT-CENSUS: 6aba74f8 (r1) → 734276e3 (r2) → 35265d9b (r3) → 777fb4d4 (r4, dual APPROVE: Codex 7905ebce, Opus 0f4593a2).
  • BAKE-BUILD-PROXY: r1 153aac2b and r2 8ee76b40 (dual APPROVE: Codex a39176a0, Opus aa7aedd1), replayed on 777fb4d4 as 4e9ad64 and 6a6e6fcd.
  • How the two were combined:
    • bake.py is byte-identical to git's clean three-way merge of the two approved heads.
    • The test file is the union of both units' changes, plus PEP 8 separation: two blank lines before PROXY_PATHS.
  • Base: m1/c-8a515c10 at 81109309. This repo squash-merges; the binding is the tree.

What step_apt proves, before any fetch

  • /etc/apt/sources.list.d holds exactly m1-snapshot.list and ubuntu.sources, as regular files.
  • ubuntu.sources has the sha256 named by a new closed PIN field, apt.ubuntu_sources_sha256.
  • /etc/apt/sources.list is proven absent: the test must print exactly absent.
  • Every apt-get (update, install, purge) runs under env -u APT_CONFIG with -o overrides that pin Dir::Etc, the source list and the source-parts directory. apt-config shell must resolve exactly those paths.
  • The full apt-config dump must show those three bindings as exact lines (format MEASURED on apt 3.0.3), and must hold no APT::Sources::With entry under any scope or case.

What step_clean does

It rm -fs NET's apt and daemon proxy files, and the Docker client configs of the op account and root. Then it proves each one absent before MAN, with the same exact absent test. The seal re-checks them (SS-14, SS-15, SS-18).

Notes

  • The PIN schema changes: apt gains ubuntu_sources_sha256. The PIN's deploy commit becomes this PR's squash commit.
  • This changes bake.py's sha, so bake_script_sha is rebound at the squash commit (owed BAKE-SCRIPT-SHA-REBIND).
  • Tests: all eight m1vm modules pass locally at this head, with 47 bake tests. Mutants: 35/35 killed.
  • Merge: squash, only on the operator's typed go at the exact head, after CI is green per job.

🤖 Generated with Claude Code

rappdw and others added 6 commits October 31, 2026 10:42
@rappdw @claude
m1vm/bake: step_apt's source census before any fetch (PIN-RESIDUAL-3-…
6aba74f 
…CENSUS)

Unit BAKE-APT-CENSUS. The controller's amended ruling makes bake.py's step_apt
the census's carrier, since NET's wrapper never reads profile.guest_read_paths
(NET 1e689870).

After step_apt writes m1-snapshot.list and removes the legacy list, and before
apt-get update, bake requires:
- /etc/apt/sources.list.d holds exactly m1-snapshot.list and ubuntu.sources at
  depth 1, both regular files;
- ubuntu.sources' sha256 equals PIN apt.ubuntu_sources_sha256, a new closed
  field (NET's deb822 bytes carry the cut's snapshot timestamp, so a constant
  in bake.py cannot bind them);
- /etc/apt/sources.list is absent.
Any difference is a BakeFail before the first fetch.

This changes the PIN schema (apt gains one field) and bake.py's sha.
bake_script_sha is not yet bound; NET binds it at the commit that lands this.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@rappdw @claude
m1vm/bake: every apt-get reads only the census's paths (BAKE-APT-CENS…
734276e 
…US-R2)

Unit BAKE-APT-CENSUS, r2 (ruling BAKE-APT-CENSUS-R2). apt reads the paths its
configuration resolves, and apt.conf, apt.conf.d or an inherited APT_CONFIG
can redirect them past the census (Opus MEASURED on apt 3.0.3).

- Every apt-get (update, install, and step_quiet's purge) carries
  -o Dir::Etc=/etc/apt/ -o Dir::Etc::sourcelist=/etc/apt/sources.list
  -o Dir::Etc::sourceparts=/etc/apt/sources.list.d/, which apt applies last.
- APT_ENV unsets APT_CONFIG, and update now runs under APT_ENV.
- Before the first fetch, apt-config shell under the same env and flags
  must print exactly L='/etc/apt/sources.list' and
  P='/etc/apt/sources.list.d/'.
- The legacy list is tested with [ -e ] || [ -L ], so a dangling link counts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@rappdw @claude
m1vm/bake: refuse APT::Sources::With; the legacy test must print "abs…
35265d9 
…ent" (BAKE-APT-CENSUS-R3)

Unit BAKE-APT-CENSUS, r3 (ruling BAKE-APT-CENSUS-R3). An apt.conf.d entry
APT::Sources::With (a list a drop-in appends to, also under a Binary::apt-get
scope) gives apt-get install a source that no -o clears and the apt-config
shell assert does not show (Opus MEASURED on apt 3.0.3).

- Before the first fetch, the full `apt-config dump`, under the same APT_ENV
  and APT_DIRS, must hold no line containing "sources::with",
  case-insensitively.
- The legacy-list test prints "absent" when the list is gone, and only that
  exact output passes, so an sh that errs fails closed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@rappdw @claude
m1vm/bake: the apt-config dump must show APT_DIRS' own bindings (BAKE…
777fb4d 
…-APT-CENSUS-R4)

Unit BAKE-APT-CENSUS, r4 (ruling BAKE-APT-CENSUS-R4). An empty or
whitespace-only dump had no sources::with line and passed (Codex r3 AMEND,
Opus r3 note 1). The dump is captured once and, before its scan, must hold
the three command-line bindings as apt prints them (MEASURED, apt 3.0.3):
Dir::Etc "/etc/apt/";
Dir::Etc::sourcelist "/etc/apt/sources.list";
Dir::Etc::sourceparts "/etc/apt/sources.list.d/";
Any missing binding is a BakeFail before the first fetch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@rappdw @claude
m1vm/bake: step_clean deletes <op>'s Docker client config (BAKE-BUILD…
4e9ad64 
…-PROXY)

Unit BAKE-BUILD-PROXY (ruling BAKE-BUILD-PROXY). sandy forwards no proxy
variable into its docker builds (sandy READ at 8dc03e12), so its RUN steps
reach proxy 207 only through the docker CLI's injection from <op>'s
~/.docker/config.json "proxies", which NET's 208 user-data writes.
step_clean deletes it with NET's other two proxy files, before MAN. The seal
already requires it absent in every home (sealspec SS-18).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@rappdw @claude
m1vm/bake: clean deletes root's Docker client config too and proves e…
6a6e6fc 
…ach proxy setting gone (BAKE-BUILD-PROXY r2)

Unit BAKE-BUILD-PROXY, r2 (ruling BAKE-BUILD-PROXY-B). step_clean deletes
/root/.docker/config.json as well as <op>'s, so whether the router builds need
NET's client proxy does not matter to the bake. After each rm -f, which
tolerates an absent file, the same exact absence test as the census
(`absent`, or a BakeFail) proves every proxy setting gone before MAN.

Known fragility, unchanged: sandy's host preflight curls each URL with a 5 s
timeout (sandy:15035), so a slow CONNECT through proxy 207 fails the build,
closed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@rappdw rappdw changed the title m1vm/bake: the apt source census before any fetch (BAKE-APT-CENSUS) m1vm/bake: the apt source census, and clean proves every build proxy setting gone (BAKE-APT-CENSUS + BAKE-BUILD-PROXY) Oct 31, 2026
@rappdw
rappdw marked this pull request as ready for review October 31, 2026 17:35
@rappdw
rappdw merged commit f25a438 into m1/c-8a515c10 Oct 31, 2026
3 checks passed
@rappdw
rappdw deleted the bake-apt-census branch October 31, 2026 18:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rappdw