V1: audit repository CLI semantics and remove overloaded obsolete-package

forge commented

2026-09-22 12:11:21 +00:00

Part of #24

Configurable retirement and KDL policy — 2026-09-22

Latest maintainer direction:

Retirement must be enable/disable configurable, and its timing must be configurable rather than hard-coded to three months. The maintainer subsequently set the default policy interval to 12 months, superseding the earlier three-month default. Both inactivity and post-hide grace intervals default to 12 months and remain configurable. Earlier three-month references below are historical and superseded.
The import policy file uses KDL, superseding earlier text/JSON alternatives. Regex exclusions and exact-FMRI keep exceptions remain the intended rules: import unmatched packages, explicit keeps override exclusions, invalid patterns or unresolved protected-dependency conflicts fail preflight. Provide explicit proposed exceptions for the operator to add to the KDL file.
Remaining design mechanics are delegated to engineering; do not repeatedly seek maintainer approval for schema spelling, parser choices, CLI spelling or ordinary implementation details. Preserve all agreed semantics.

Engineering defaults/constraints to carry into the design (defaults selected here under that delegation, not independently quoted maintainer decisions): retirement is opt-in/disabled by default; disabling pauses policy-driven retirement without purging content or automatically restoring hidden versions. Continue serving hidden exact-FMRI content. Keep access tracking separately durable. Manual purge remains an explicit operator action with retention, snapshot and dependency checks; enabling retirement must never enable automatic purge. Document configuration effects and validate durations/rules before any mutation.

Still require evidence rather than assumptions: actual local pkg5 behavior, snapshot dependency closure, safe catalog replacement, and historical-client compatibility. No implementation or runtime validation is claimed by this decision update.

Access to hidden versions — 2026-09-22

Maintainer decision: a qualifying access to a hidden version resets its purge eligibility clock but leaves it hidden. It must not automatically reappear in catalogs or search. Restoring catalog/search visibility requires an explicit local restore/unretire command; exact CLI spelling remains part of the command review. Access qualification and snapshot/dependency protection continue to apply. This is a required behavior, not an implementation-complete claim.

V1 administration boundary — 2026-09-22

Maintainer decision: the public HTTP interface is read-only in v1. Imports, retirement/purge and repository administration are available through local commands only. Remote publication and OIDC/RBAC remain deferred.

Apply this boundary to actual registered routes and any web UI: do not expose repository-mutating or administrative operations publicly in v1. Read-only package serving/search remain available. ACME HTTP-01 challenge serving remains supported and is not a repository administration endpoint. Document the local operator/CI script workflow and validate that public HTTP cannot mutate repository state. This records required behavior, not a claim that current routes already enforce it.

Required before release

Review the shipped command set against actual implementation and local OpenIndiana pkg5 semantics; do not trust existing help/docs as proof of correctness.
Remove the current overloaded obsolete-package command before v1. It stores a manifest in obsoleted storage, removes the original and rebuilds the catalog; repository retirement must have a separate verb and must not overload pkg.obsolete semantics.
Audit the related list/show/search/restore/export/import/cleanup-obsoleted commands and underlying storage/catalog behavior. Decide deliberately which are genuine obsoletion tools, retirement tools, redundant or unsafe; this is not a blanket instruction to delete valid obsoletion support.
Inventory commands, side effects, exact-FMRI handling, output/exit contracts and destructive operations. Preserve protocol-visible pkg5 obsolete behavior and distinguish retirement from purge.
Reconcile help, docs, generated references and illumos-style man pages with the approved command set (#9, #30).
Validate obsolete-package compatibility using local OpenIndiana/pkg5 code and native tests, not Oracle Solaris documentation alone.

Source: maintainer grilling, 2026-09-22. Requirements only; no implementation or validation claimed.

Part of #24 ## Configurable retirement and KDL policy — 2026-09-22 Latest maintainer direction: - Retirement must be enable/disable configurable, and its timing must be configurable rather than hard-coded to three months. The maintainer subsequently set the default policy interval to 12 months, superseding the earlier three-month default. Both inactivity and post-hide grace intervals default to 12 months and remain configurable. Earlier three-month references below are historical and superseded. - The import policy file uses KDL, superseding earlier text/JSON alternatives. Regex exclusions and exact-FMRI keep exceptions remain the intended rules: import unmatched packages, explicit keeps override exclusions, invalid patterns or unresolved protected-dependency conflicts fail preflight. Provide explicit proposed exceptions for the operator to add to the KDL file. - Remaining design mechanics are delegated to engineering; do not repeatedly seek maintainer approval for schema spelling, parser choices, CLI spelling or ordinary implementation details. Preserve all agreed semantics. Engineering defaults/constraints to carry into the design (defaults selected here under that delegation, not independently quoted maintainer decisions): retirement is opt-in/disabled by default; disabling pauses policy-driven retirement without purging content or automatically restoring hidden versions. Continue serving hidden exact-FMRI content. Keep access tracking separately durable. Manual purge remains an explicit operator action with retention, snapshot and dependency checks; enabling retirement must never enable automatic purge. Document configuration effects and validate durations/rules before any mutation. Still require evidence rather than assumptions: actual local pkg5 behavior, snapshot dependency closure, safe catalog replacement, and historical-client compatibility. No implementation or runtime validation is claimed by this decision update. ## Access to hidden versions — 2026-09-22 Maintainer decision: a qualifying access to a hidden version resets its purge eligibility clock but leaves it hidden. It must not automatically reappear in catalogs or search. Restoring catalog/search visibility requires an explicit local restore/unretire command; exact CLI spelling remains part of the command review. Access qualification and snapshot/dependency protection continue to apply. This is a required behavior, not an implementation-complete claim. ## V1 administration boundary — 2026-09-22 Maintainer decision: the public HTTP interface is read-only in v1. Imports, retirement/purge and repository administration are available through local commands only. Remote publication and OIDC/RBAC remain deferred. Apply this boundary to actual registered routes and any web UI: do not expose repository-mutating or administrative operations publicly in v1. Read-only package serving/search remain available. ACME HTTP-01 challenge serving remains supported and is not a repository administration endpoint. Document the local operator/CI script workflow and validate that public HTTP cannot mutate repository state. This records required behavior, not a claim that current routes already enforce it. ## Required before release - Review the shipped command set against actual implementation and local OpenIndiana pkg5 semantics; do not trust existing help/docs as proof of correctness. - Remove the current overloaded obsolete-package command before v1. It stores a manifest in obsoleted storage, removes the original and rebuilds the catalog; repository retirement must have a separate verb and must not overload pkg.obsolete semantics. - Audit the related list/show/search/restore/export/import/cleanup-obsoleted commands and underlying storage/catalog behavior. Decide deliberately which are genuine obsoletion tools, retirement tools, redundant or unsafe; this is not a blanket instruction to delete valid obsoletion support. - Inventory commands, side effects, exact-FMRI handling, output/exit contracts and destructive operations. Preserve protocol-visible pkg5 obsolete behavior and distinguish retirement from purge. - Reconcile help, docs, generated references and illumos-style man pages with the approved command set (#9, #30). - Validate obsolete-package compatibility using local OpenIndiana/pkg5 code and native tests, not Oracle Solaris documentation alone. Source: maintainer grilling, 2026-09-22. Requirements only; no implementation or validation claimed.

forge added this to the Release 1 (server only) milestone

2026-09-22 12:11:21 +00:00

forge added the

Kind/Enhancement

wayfinder:task

labels

2026-09-22 12:11:21 +00:00

forge referenced this issue

2026-09-22 12:11:35 +00:00

Define what 'v1.0 server release' must include and its acceptance criteria #25

forge referenced this issue

2026-09-22 12:12:03 +00:00

Document Repo management CLI's (pkg6repo and pkg6recv) #9

forge referenced this issue

2026-09-22 12:13:05 +00:00

Wayfinder map: Release 1 (server only) #24

forge added a new dependency

2026-09-22 12:13:23 +00:00

#25 Define what 'v1.0 server release' must include and its acceptance criteria

forge added a new dependency

2026-09-22 12:13:39 +00:00

#9 Document Repo management CLI's (pkg6repo and pkg6recv)

forge referenced this issue

2026-09-23 07:16:40 +00:00

WIP: Build tagged release candidates and an illumos IPS depot package #43

forge commented

2026-09-23 09:26:16 +00:00

Author

Implementation in draft PR #48: pkg6depotd now exposes only working start and config-test operations; unsupported depot/client operations fail non-zero. pkg6 client list, publisher, install-license and refresh cases no longer report false success, and publisher names are checked before catalog path deletion. Focused pkg6/pkg6depotd/libips tests passed; independent Opus review found no server-package blocker. The v1 IPS package does not deliver the pkg6 client, whose multi-publisher image catalog limitation remains out of release scope. The separate pkg6repo/pkg6recv command audit is in progress and will be integrated before the RC tag. Keeping this ticket open until the integrated exact-head CI and package tests pass.

Implementation in draft PR #48: pkg6depotd now exposes only working `start` and `config-test` operations; unsupported depot/client operations fail non-zero. pkg6 client list, publisher, install-license and refresh cases no longer report false success, and publisher names are checked before catalog path deletion. Focused pkg6/pkg6depotd/libips tests passed; independent Opus review found no server-package blocker. The v1 IPS package does not deliver the pkg6 client, whose multi-publisher image catalog limitation remains out of release scope. The separate pkg6repo/pkg6recv command audit is in progress and will be integrated before the RC tag. Keeping this ticket open until the integrated exact-head CI and package tests pass.

forge commented

2026-09-23 09:37:11 +00:00

Author

The repository-tool half of the command review is now draft PR #49. It removes the destructive cleanup-obsoleted and misleading archive/import-archive commands, rejects ignored URI/TLS/filter options, preserves pkg5 pkg.obsolete catalog semantics, and makes pkg6recv fail before mutation for empty/missing/ambiguous requested packages. The legacy export now writes atomically without replacing an existing file. Focused pkg6repo (28), pkg6recv (9), and libips export tests passed; an independent Opus review found no code blocker. The integration line still needs manpage packaging, test-inventory gates, and exact-head CI before closing this ticket.

The repository-tool half of the command review is now draft PR #49. It removes the destructive `cleanup-obsoleted` and misleading archive/import-archive commands, rejects ignored URI/TLS/filter options, preserves pkg5 `pkg.obsolete` catalog semantics, and makes `pkg6recv` fail before mutation for empty/missing/ambiguous requested packages. The legacy export now writes atomically without replacing an existing file. Focused `pkg6repo` (28), `pkg6recv` (9), and libips export tests passed; an independent Opus review found no code blocker. The integration line still needs manpage packaging, test-inventory gates, and exact-head CI before closing this ticket.

toasterson commented

2026-09-26 22:39:23 +00:00

Owner

CLI review finding from the oirepo6 migration: the old 0.5 pkg6repo has import-pkg5 and import-archive, but no bare import. Git history added import-pkg5 in c3ff6ac; ADR-009 retained it for atomic CI .p5p imports and removed import-archive. RC13 commit f6691a0 added import-historical plan|run|publish|status under ADR-014 because a 2.1M-manifest V3 source cannot fit the 10,000-manifest/64-MiB whole-batch budget, and publishing every bounded batch separately would be quadratic. That separate safety path is justified, but historical describes age rather than behavior: a small historical source uses import-pkg5, and a large current directory would need import-historical. Before v1, review a unified pkg6repo import command family with clearly named atomic and staged modes, preserving the distinct backend contracts and updating CI, tests and illumos manpages together. No CLI rename is made by this comment.

CLI review finding from the oirepo6 migration: the old 0.5 `pkg6repo` has `import-pkg5` and `import-archive`, but no bare `import`. Git history added `import-pkg5` in `c3ff6ac`; ADR-009 retained it for atomic CI `.p5p` imports and removed `import-archive`. RC13 commit `f6691a0` added `import-historical plan|run|publish|status` under ADR-014 because a 2.1M-manifest V3 source cannot fit the 10,000-manifest/64-MiB whole-batch budget, and publishing every bounded batch separately would be quadratic. That separate safety path is justified, but `historical` describes age rather than behavior: a small historical source uses `import-pkg5`, and a large current directory would need `import-historical`. Before v1, review a unified `pkg6repo import` command family with clearly named atomic and staged modes, preserving the distinct backend contracts and updating CI, tests and illumos manpages together. No CLI rename is made by this comment.

toasterson referenced this issue

2026-09-27 13:13:18 +00:00

V1: unify pkg6repo import commands into import archive and import source #55

toasterson commented

2026-09-27 13:14:10 +00:00

Owner

The rename question raised above is decided (ADR-015 item 4): one pkg6repo import family with import archive (atomic) and import source plan|run|publish|status (staged), before the v1.0.0 tag. Build ticket: #55.

The rename question raised above is decided (ADR-015 item 4): one `pkg6repo import` family with `import archive` (atomic) and `import source plan|run|publish|status` (staged), before the `v1.0.0` tag. Build ticket: #55.

toasterson referenced this issue

2026-09-27 13:14:15 +00:00

Wayfinder map: Release 1 (server only) #24

Rows
Columns

V1: audit repository CLI semantics and remove overloaded obsolete-package #40

Configurable retirement and KDL policy — 2026-09-22

Access to hidden versions — 2026-09-22

V1 administration boundary — 2026-09-22

Required before release