V1: IPS/SMF deployment with direct TLS, proxy mode and ACME

forge commented

2026-09-22 12:11:25 +00:00

Part of #24

V1 administration boundary — 2026-09-22

Maintainer decision: the public HTTP interface is read-only in v1. Imports, retirement/purge and repository administration are available through local commands only. Remote publication and OIDC/RBAC remain deferred.

Apply this boundary to actual registered routes and any web UI: do not expose repository-mutating or administrative operations publicly in v1. Read-only package serving/search remain available. ACME HTTP-01 challenge serving remains supported and is not a repository administration endpoint. Document the local operator/CI script workflow and validate that public HTTP cannot mutate repository state. This records required behavior, not a claim that current routes already enforce it.

Deployment and load clarification — 2026-09-22

Maintainer-provided target: oirepo6, a zone on the same existing host as oirepo, behind the same reverse proxy. Neither zone has explicit resource limits. This describes the intended deployment; no live host/resource inspection has yet been performed.

The intended eventual role is the main repository host. V1 qualification still uses the separate depot; this does not authorize production cutover. It must serve the existing client population comfortably, with performance comparable to the current service. Traffic is predominantly a few requests at a time, accumulating substantial volume over time, rather than large simultaneous bursts.

For #31/#5, use the current service as the comparative baseline and representative low-concurrency sustained traffic as the workload. Actual request-rate/concurrency distribution and resource consumption still need measurement; no numerical latency/RSS/duration budget has been agreed. Include service behavior during imports/catalog maintenance. Absence of zone caps is not an allocation of the shared host's resources; establish a safe test budget before load generation.

Required v1 deployment

Deliver an OpenIndiana IPS package and SMF service; preserve operator configuration through upgrades.
Support reverse-proxy TLS termination and built-in TLS.
Direct TLS includes ACME HTTP-01 plus DNS-01 using Cloudflare and Gandi, with unattended renewal.
Exactly one certificate owner: proxy mode delegates TLS/ACME to the reverse proxy and disables depot ACME; direct mode delegates both to pkg6depotd.
Document, package and test both modes, certificate issuance/renewal/reload and provider-specific credential configuration without exposing secrets.

Still to specify

Service account/privilege design, filesystem locations, renewal failure/expired-certificate behavior, ACME library and staging tests, provider API integration, and exact deployment host/resources. Do not assume these were decided by the feature requirement.

Source: maintainer grilling, 2026-09-22. Requirements only; no implementation or validation claimed.

Part of #24 ## V1 administration boundary — 2026-09-22 Maintainer decision: the public HTTP interface is read-only in v1. Imports, retirement/purge and repository administration are available through local commands only. Remote publication and OIDC/RBAC remain deferred. Apply this boundary to actual registered routes and any web UI: do not expose repository-mutating or administrative operations publicly in v1. Read-only package serving/search remain available. ACME HTTP-01 challenge serving remains supported and is not a repository administration endpoint. Document the local operator/CI script workflow and validate that public HTTP cannot mutate repository state. This records required behavior, not a claim that current routes already enforce it. ## Deployment and load clarification — 2026-09-22 Maintainer-provided target: `oirepo6`, a zone on the same existing host as `oirepo`, behind the same reverse proxy. Neither zone has explicit resource limits. This describes the intended deployment; no live host/resource inspection has yet been performed. The intended eventual role is the main repository host. V1 qualification still uses the separate depot; this does not authorize production cutover. It must serve the existing client population comfortably, with performance comparable to the current service. Traffic is predominantly a few requests at a time, accumulating substantial volume over time, rather than large simultaneous bursts. For #31/#5, use the current service as the comparative baseline and representative low-concurrency sustained traffic as the workload. Actual request-rate/concurrency distribution and resource consumption still need measurement; no numerical latency/RSS/duration budget has been agreed. Include service behavior during imports/catalog maintenance. Absence of zone caps is not an allocation of the shared host's resources; establish a safe test budget before load generation. ## Required v1 deployment - Deliver an OpenIndiana IPS package and SMF service; preserve operator configuration through upgrades. - Support reverse-proxy TLS termination and built-in TLS. - Direct TLS includes ACME HTTP-01 plus DNS-01 using Cloudflare and Gandi, with unattended renewal. - Exactly one certificate owner: proxy mode delegates TLS/ACME to the reverse proxy and disables depot ACME; direct mode delegates both to pkg6depotd. - Document, package and test both modes, certificate issuance/renewal/reload and provider-specific credential configuration without exposing secrets. ## Still to specify Service account/privilege design, filesystem locations, renewal failure/expired-certificate behavior, ACME library and staging tests, provider API integration, and exact deployment host/resources. Do not assume these were decided by the feature requirement. Source: maintainer grilling, 2026-09-22. Requirements only; no implementation or validation claimed.

forge added this to the Release 1 (server only) milestone

2026-09-22 12:11:25 +00:00

forge added the

Kind/Feature

wayfinder:task

labels

2026-09-22 12:11:25 +00:00

forge referenced this issue

2026-09-22 12:11:35 +00:00

Define what 'v1.0 server release' must include and its acceptance criteria #25

forge referenced this issue

2026-09-22 12:11:57 +00:00

Document the server #6

forge referenced this issue

2026-09-22 12:13:05 +00:00

Wayfinder map: Release 1 (server only) #24

forge added a new dependency

2026-09-22 12:13:28 +00:00

#25 Define what 'v1.0 server release' must include and its acceptance criteria

forge referenced this issue

2026-09-23 07:16:40 +00:00

WIP: Build tagged release candidates and an illumos IPS depot package #43

forge commented

2026-09-23 07:26:20 +00:00

Author

Progress: draft PR #43 (head 4cd8aad) adds the tagged release pipeline, IPS manifest, SMF service, sample KDL and pkg6depotd(8). The native OpenIndiana manifest-to-p5p dry run passed with placeholder binaries. Solstice PR run 8945 has passed its illumos build and 140 workspace tests. The tag-only live package install/upgrade/uninstall gate and direct TLS/ACME are still outstanding; this ticket remains open.

Progress: draft PR #43 (head 4cd8aad) adds the tagged release pipeline, IPS manifest, SMF service, sample KDL and pkg6depotd(8). The native OpenIndiana manifest-to-p5p dry run passed with placeholder binaries. Solstice PR run 8945 has passed its illumos build and 140 workspace tests. The tag-only live package install/upgrade/uninstall gate and direct TLS/ACME are still outstanding; this ticket remains open.

forge referenced this issue

2026-09-23 08:41:30 +00:00

WIP: Serve depot HTTPS with ACME HTTP and DNS challenges #47

forge commented

2026-09-23 08:41:48 +00:00

Author

TLS/ACME implementation is in draft PR #47 at 4031e6a, stacked on package/release PR #43. It serves direct HTTPS from files or ACME HTTP-01/DNS-01 with Cloudflare and Gandi, validates config and certificates before listening, reloads atomically, and persists challenge cleanup and backoff state. The IPS sample, SMF refresh method, README and pkg6depotd(8) are updated. Local depot suite: 67/67 passed with mock CA/providers; independent Opus review found no release blocker after official Gandi endpoint verification. Native CI, live SMF package and staging CA/provider verification remain open.

TLS/ACME implementation is in draft PR #47 at 4031e6a, stacked on package/release PR #43. It serves direct HTTPS from files or ACME HTTP-01/DNS-01 with Cloudflare and Gandi, validates config and certificates before listening, reloads atomically, and persists challenge cleanup and backoff state. The IPS sample, SMF refresh method, README and pkg6depotd(8) are updated. Local depot suite: 67/67 passed with mock CA/providers; independent Opus review found no release blocker after official Gandi endpoint verification. Native CI, live SMF package and staging CA/provider verification remain open.

forge commented

2026-09-23 12:41:35 +00:00

Author

RC2 tagged release run 8960 passed all 407 native release-profile tests and built the .p5p, but the throwaway-VM package test failed at its first pkg install. Solstice's authoritative step log identifies the exact collision: both package/pkg6/depotd@1.0.0,5.11-0.3.2 and the VM's existing developer/pkgtree@1.1,5.11-2023.0.0.5 deliver usr/bin/pkgtree. pkg5 refuses to install them together. The relevant 30-line step log is preserved in logs/solstice/2026-09-23-rc2-job22756-package-test.log (SHA-256 efbd32c2ea4bf7a6f776d595bf20fd8a6189fcb55c24805d5adbd756e3d0a17a). Forgejo's forwarded job log omitted this later step, so the failure was verified against Solstice's own job-log store.

RC3 work is in progress: omit the ancillary pkgtree binary from the server IPS package, while retaining it in platform tarballs and leaving pkg6repo/pkg6recv in the IPS package. This ticket remains open until the same tag pipeline passes real package install, SMF, upgrade and uninstall, and TLS deployment acceptance is addressed. No production installation was attempted.

RC2 tagged release run [8960](https://code.aopc.cloud/OpenIndiana/ips/actions/runs/20) passed all 407 native release-profile tests and built the `.p5p`, but the throwaway-VM package test failed at its first `pkg install`. Solstice's authoritative step log identifies the exact collision: both `package/pkg6/depotd@1.0.0,5.11-0.3.2` and the VM's existing `developer/pkgtree@1.1,5.11-2023.0.0.5` deliver `usr/bin/pkgtree`. pkg5 refuses to install them together. The relevant 30-line step log is preserved in `logs/solstice/2026-09-23-rc2-job22756-package-test.log` (SHA-256 `efbd32c2ea4bf7a6f776d595bf20fd8a6189fcb55c24805d5adbd756e3d0a17a`). Forgejo's forwarded job log omitted this later step, so the failure was verified against Solstice's own job-log store. RC3 work is in progress: omit the ancillary `pkgtree` binary from the server IPS package, while retaining it in platform tarballs and leaving pkg6repo/pkg6recv in the IPS package. This ticket remains open until the same tag pipeline passes real package install, SMF, upgrade and uninstall, and TLS deployment acceptance is addressed. No production installation was attempted.

forge referenced this issue

2026-09-23 12:42:01 +00:00

Define what 'v1.0 server release' must include and its acceptance criteria #25

forge referenced this issue

2026-09-23 12:43:25 +00:00

v1 deployable pkg6 depot: pkg5 imports, retention, TLS, telemetry and release pipeline #46

forge commented

2026-09-23 12:57:50 +00:00

Author

RC3 preflight on oibldofgate now exercises the exact RC1/RC2 conflict condition without changing a live image. From source ebcc192 (the later a5d3cc5 commit changes only upgrade-test logic), the native optimized build and real .p5p build passed. A fresh alternate Hipster image first installed developer/pkgtree, then installed package/pkg6/depotd from the RC3 archive with no conflicting actions; pkg verify passed for both. The package manifest no longer delivers usr/bin/pkgtree; Hipster's developer/pkgtree still owns it. Evidence: logs/oibldofgate/ips-rc3-preflight/.

A second alternate-image preflight upgraded the actual RC3 package from branch 0.3.3 to 0.3.3.1 using ordinary pkg5 publication and a version selector without the stale timestamp. The edited operator KDL survived, the new default was delivered as .kdl.new, pkg5 verification passed, and developer/pkgtree remained installed. Evidence: logs/oibldofgate/ips-rc3-upgrade-preflight/. An earlier tiny-package probe proved and corrected two test-script assumptions about rewritten publication timestamps and pkg5's short pkg list -v output. The branch-head upgrade-test fix is a5d3cc5, and exact-head CI run 8962 is in progress.

These alternate-root checks do not run SMF actions, service restart or live uninstall. Keep this ticket open until the RC3 tag pipeline proves those on its disposable VM. No production installation or cutover was attempted.

RC3 preflight on `oibldofgate` now exercises the exact RC1/RC2 conflict condition without changing a live image. From source `ebcc192` (the later `a5d3cc5` commit changes only upgrade-test logic), the native optimized build and real `.p5p` build passed. A fresh alternate Hipster image first installed `developer/pkgtree`, then installed `package/pkg6/depotd` from the RC3 archive with no conflicting actions; `pkg verify` passed for both. The package manifest no longer delivers `usr/bin/pkgtree`; Hipster's `developer/pkgtree` still owns it. Evidence: `logs/oibldofgate/ips-rc3-preflight/`. A second alternate-image preflight upgraded the actual RC3 package from branch `0.3.3` to `0.3.3.1` using ordinary pkg5 publication and a version selector without the stale timestamp. The edited operator KDL survived, the new default was delivered as `.kdl.new`, pkg5 verification passed, and `developer/pkgtree` remained installed. Evidence: `logs/oibldofgate/ips-rc3-upgrade-preflight/`. An earlier tiny-package probe proved and corrected two test-script assumptions about rewritten publication timestamps and pkg5's short `pkg list -v` output. The branch-head upgrade-test fix is `a5d3cc5`, and exact-head CI run 8962 is in progress. These alternate-root checks do not run SMF actions, service restart or live uninstall. Keep this ticket open until the RC3 tag pipeline proves those on its disposable VM. No production installation or cutover was attempted.

forge commented

2026-09-23 13:37:55 +00:00

Author

RC3 tag v1.0.0-rc.3 (commit a5d3cc5, release run 8963) passed Linux and the OpenIndiana release-profile suite (407/407). The native job built the .p5p, installed package/pkg6/depotd@1.0.0-0.3.3 into its disposable VM's live IPS image, and pkg verify passed. This confirms the RC1/RC2 /usr/bin/pkgtree package collision is resolved.

The native job then failed in the test harness at === account and files: the unprivileged runner could not traverse the intentionally restricted /etc/pkg6depotd directory to stat pkg6depotd.kdl. No package or service failure was established by that result. The RC3 release was not published.

Commit 2ff3e08 fixes protected-path checks in the live package test while retaining assertions for the restrictive mode and unprivileged denial; it also fixes the analogous post-uninstall repository check and bumps the release to RC4. An independent Opus review found no blockers; local release-script tests passed 362/362. Immutable tag v1.0.0-rc.4 is running the same release workflow in run 8965. Live SMF/upgrade/uninstall verification and a published .p5p remain pending that job's result. Production oirepo6 cutover has not occurred.

RC3 tag `v1.0.0-rc.3` (commit `a5d3cc5`, release run 8963) passed Linux and the OpenIndiana release-profile suite (407/407). The native job built the `.p5p`, installed `package/pkg6/depotd@1.0.0-0.3.3` into its disposable VM's live IPS image, and `pkg verify` passed. This confirms the RC1/RC2 `/usr/bin/pkgtree` package collision is resolved. The native job then failed in the *test harness* at `=== account and files`: the unprivileged runner could not traverse the intentionally restricted `/etc/pkg6depotd` directory to stat `pkg6depotd.kdl`. No package or service failure was established by that result. The RC3 release was not published. Commit `2ff3e08` fixes protected-path checks in the live package test while retaining assertions for the restrictive mode and unprivileged denial; it also fixes the analogous post-uninstall repository check and bumps the release to RC4. An independent Opus review found no blockers; local release-script tests passed 362/362. Immutable tag `v1.0.0-rc.4` is running the same release workflow in run 8965. Live SMF/upgrade/uninstall verification and a published `.p5p` remain pending that job's result. Production `oirepo6` cutover has not occurred.

forge commented

2026-09-23 14:15:37 +00:00

Author

RC4 tag v1.0.0-rc.4 (commit 2ff3e08, release run 8965) passed Linux and all 407 OpenIndiana release-profile tests. Its .p5p installed successfully into the disposable VM's live image; pkg verify, account/mode checks, and installed binaries passed. The test then reached its manual-page rendering check and stopped because the minimal Solstice VM did not have man installed (man: command not found). This is another CI prerequisite gap, not evidence that the pkg6 IPS payload is invalid. RC4 was not published.

OpenIndiana packages /usr/bin/man in system/man and /usr/bin/col in system/extended-system-utilities (verified against the installed package database on oibldofgate). Commit ef92cee adds those two packages to the disposable release test VM before the live script, leaving the server package's runtime dependencies and payload unchanged. Independent Opus review found no blockers; local release-script tests passed 362/362 and native-link tests 40/40. Immutable tag v1.0.0-rc.5 is running the shared release workflow in run 8966. Live manual-page rendering, SMF, pkg5 serving, upgrade/uninstall and published .p5p remain pending its result.

RC4 tag `v1.0.0-rc.4` (commit `2ff3e08`, release run 8965) passed Linux and all 407 OpenIndiana release-profile tests. Its `.p5p` installed successfully into the disposable VM's live image; `pkg verify`, account/mode checks, and installed binaries passed. The test then reached its manual-page rendering check and stopped because the minimal Solstice VM did not have `man` installed (`man: command not found`). This is another CI prerequisite gap, not evidence that the pkg6 IPS payload is invalid. RC4 was not published. OpenIndiana packages `/usr/bin/man` in `system/man` and `/usr/bin/col` in `system/extended-system-utilities` (verified against the installed package database on `oibldofgate`). Commit `ef92cee` adds those two packages to the *disposable release test VM* before the live script, leaving the server package's runtime dependencies and payload unchanged. Independent Opus review found no blockers; local release-script tests passed 362/362 and native-link tests 40/40. Immutable tag `v1.0.0-rc.5` is running the shared release workflow in run 8966. Live manual-page rendering, SMF, pkg5 serving, upgrade/uninstall and published `.p5p` remain pending its result.

forge commented

2026-09-23 14:43:13 +00:00

Author

RC5 tag v1.0.0-rc.5 (commit ef92cee, release run 8966) passed Linux and all 407 OpenIndiana release-profile tests. The disposable VM installed the manual-reader prerequisites, installed and verified package/pkg6/depotd@1.0.0-0.3.5, and passed the account/mode/binary checks. Its installed pkg6depotd(8) page rendered successfully with a visible NAME section, but the harness's echo "$out" | grep -q '^NAME' assertion falsely failed: with pipefail, grep -q closes a long pipe early and echo receives SIGPIPE. The Solstice step log (job 22768) shows both the false failure and the actual NAME heading. RC5 was not published.

Pending RC6 fixes all three captured-output echo | grep -q assertions in the live package script with here-strings, retaining their patterns; the corresponding release self-test was updated and passes 362/362. A long-output local reproduction demonstrated the old false failure and the corrected check. No production package payload or manpage content changed. Independent review and a new immutable RC tag are next. Live SMF, pkg5 serving, upgrade/uninstall and published .p5p remain unproven by a tagged job.

RC5 tag `v1.0.0-rc.5` (commit `ef92cee`, release run 8966) passed Linux and all 407 OpenIndiana release-profile tests. The disposable VM installed the manual-reader prerequisites, installed and verified `package/pkg6/depotd@1.0.0-0.3.5`, and passed the account/mode/binary checks. Its installed `pkg6depotd(8)` page rendered successfully with a visible `NAME` section, but the harness's `echo "$out" | grep -q '^NAME'` assertion falsely failed: with `pipefail`, `grep -q` closes a long pipe early and `echo` receives SIGPIPE. The Solstice step log (job 22768) shows both the false failure and the actual `NAME` heading. RC5 was not published. Pending RC6 fixes all three captured-output `echo | grep -q` assertions in the live package script with here-strings, retaining their patterns; the corresponding release self-test was updated and passes 362/362. A long-output local reproduction demonstrated the old false failure and the corrected check. No production package payload or manpage content changed. Independent review and a new immutable RC tag are next. Live SMF, pkg5 serving, upgrade/uninstall and published `.p5p` remain unproven by a tagged job.

forge commented

2026-09-23 15:20:11 +00:00

Author

RC6 tag v1.0.0-rc.6 (commit 6df21d2, release run 8968) passed Linux and all 407 OpenIndiana release-profile tests. Its .p5p installed and verified in the disposable VM; account, binary and all installed manpage checks passed. SMF started the depot, and the missing-config check correctly put the instance in maintenance. The next live check exposed a real SMF fault: for a readable malformed KDL, the daemon logged parse errors and repeated failed starts, but svcs remained online* instead of entering maintenance after 90 seconds (Solstice job 22772 package-test log saved in the workspace). RC6 was not published.

The packaged start method currently checks only readability before exec-ing the daemon. Pending RC7 runs pkg6depotd --config ... config-test under the same SMF credentials first; on rejection, the start method exits SMF_EXIT_ERR_CONFIG (96), which should put the instance in maintenance. A local stub test now covers valid, malformed and missing config; release-script tests pass 370/370. Independent review and tagged live verification are pending. The rest of the live pkg5 serving, upgrade/uninstall and asset publication remains unproven until that tag job completes.

RC6 tag `v1.0.0-rc.6` (commit `6df21d2`, release run 8968) passed Linux and all 407 OpenIndiana release-profile tests. Its `.p5p` installed and verified in the disposable VM; account, binary and all installed manpage checks passed. SMF started the depot, and the missing-config check correctly put the instance in maintenance. The next live check exposed a real SMF fault: for a *readable malformed KDL*, the daemon logged parse errors and repeated failed starts, but `svcs` remained `online*` instead of entering maintenance after 90 seconds (Solstice job 22772 package-test log saved in the workspace). RC6 was not published. The packaged start method currently checks only readability before exec-ing the daemon. Pending RC7 runs `pkg6depotd --config ... config-test` under the same SMF credentials first; on rejection, the start method exits `SMF_EXIT_ERR_CONFIG` (96), which should put the instance in maintenance. A local stub test now covers valid, malformed and missing config; release-script tests pass 370/370. Independent review and tagged live verification are pending. The rest of the live pkg5 serving, upgrade/uninstall and asset publication remains unproven until that tag job completes.

forge commented

2026-09-23 15:54:19 +00:00

Author

RC7 (55cb6a0, Solstice tag run 8970) passed the Linux job, all 407 OpenIndiana release-profile tests, live IPS installation and verification, the packaged SMF checks including malformed readable KDL, and a native local pkg5 client smoke that installed and verified a package through the new depot. The live package test then failed at its upgrade command because pkg5's default policy requested a backup boot environment and the disposable Solstice VM could not clone it (pkg: Unable to clone the current boot environment.). Evidence: native job 22776, package-test log SHA-256 4e0cf8b26a1f6a2cadb29a5d5d4c75f4e262b6ae5544718bbe4ab6879df54067 in the local workspace logs.

The local OpenIndiana pkg5 implementation and its manpage confirm pkg update --no-backup-be suppresses that backup while updating the live image. RC8 (3371770, tag v1.0.0-rc.8, Solstice run 8973) contains only this focused harness fix and the version bump. Local syntax, metadata/format checks, and 370 release-script checks pass; an independent local Opus review found no blocker. RC8 native install/upgrade/uninstall and asset publication are pending CI. Historical 2020 client/ISO validation remains separate and awaits the NFS source access agreed with the maintainer.

RC7 (`55cb6a0`, Solstice tag run 8970) passed the Linux job, all 407 OpenIndiana release-profile tests, live IPS installation and verification, the packaged SMF checks including malformed readable KDL, and a native local pkg5 client smoke that installed and verified a package through the new depot. The live package test then failed at its upgrade command because pkg5's default policy requested a backup boot environment and the disposable Solstice VM could not clone it (`pkg: Unable to clone the current boot environment.`). Evidence: native job 22776, package-test log SHA-256 `4e0cf8b26a1f6a2cadb29a5d5d4c75f4e262b6ae5544718bbe4ab6879df54067` in the local workspace logs. The local OpenIndiana pkg5 implementation and its manpage confirm `pkg update --no-backup-be` suppresses that backup while updating the live image. RC8 (`3371770`, tag `v1.0.0-rc.8`, Solstice run 8973) contains only this focused harness fix and the version bump. Local syntax, metadata/format checks, and 370 release-script checks pass; an independent local Opus review found no blocker. RC8 native install/upgrade/uninstall and asset publication are pending CI. Historical 2020 client/ISO validation remains separate and awaits the NFS source access agreed with the maintainer.

forge commented

2026-09-23 16:33:53 +00:00

Author

RC8 (3371770, tag run 8973) passed Linux, all 407 OpenIndiana native tests, IPS install/verify and SMF checks, the local pkg5 client smoke, and a live pkg5 upgrade. The upgrade explicitly planned Create boot environment: No and Create backup boot environment: No; it installed the newer FMRI, retained the operator-edited config, delivered .kdl.new, and kept the depot online. The job then exited silently before running pkg uninstall: the test harness called find /var/pkg/lost+found on a fresh image where that directory did not yet exist, and set -euo pipefail terminated on the resulting status 1. Native job 22782 package-test log SHA-256: 45c046a47527bf9584d5b221389df82b15c7afc5a84629d13bd80c6bcb595be7 in local workspace logs.

RC9 (ce82d70, tag v1.0.0-rc.9, run 8975) handles an absent lost+found as an empty baseline while keeping real find errors visible and preserving the repository-content assertion. Five new targeted script checks were added; local release-script suite: 375 passed, 0 failed. Independent Opus review found no blocker. The tagged Solstice run must still pass uninstall and publish the IPS asset before this delivery ticket is accepted. Historical 2020 client/ISO validation stays open separately under #42 pending NFS source access.

RC8 (`3371770`, tag run 8973) passed Linux, all 407 OpenIndiana native tests, IPS install/verify and SMF checks, the local pkg5 client smoke, and a live pkg5 upgrade. The upgrade explicitly planned `Create boot environment: No` and `Create backup boot environment: No`; it installed the newer FMRI, retained the operator-edited config, delivered `.kdl.new`, and kept the depot online. The job then exited silently before running `pkg uninstall`: the test harness called `find /var/pkg/lost+found` on a fresh image where that directory did not yet exist, and `set -euo pipefail` terminated on the resulting status 1. Native job 22782 package-test log SHA-256: `45c046a47527bf9584d5b221389df82b15c7afc5a84629d13bd80c6bcb595be7` in local workspace logs. RC9 (`ce82d70`, tag `v1.0.0-rc.9`, run 8975) handles an absent lost+found as an empty baseline while keeping real find errors visible and preserving the repository-content assertion. Five new targeted script checks were added; local release-script suite: 375 passed, 0 failed. Independent Opus review found no blocker. The tagged Solstice run must still pass uninstall and publish the IPS asset before this delivery ticket is accepted. Historical 2020 client/ISO validation stays open separately under #42 pending NFS source access.

forge commented

2026-09-23 17:28:41 +00:00

Author

RC9 (ce82d70, tag run 8975) passed the Linux release job, all 407 native release-profile tests, .p5p build and live install/verify, manpage rendering, packaged SMF checks, native local pkg5 client smoke, and live upgrade with edited KDL retained. It reached pkg uninstall, which planned no new or backup BE, but pkg5's disable_fmri actuator failed because svcadm disable -s reported svc:/system/svc/restarter:default lacks its restarter property group and the depot's restarter is unavailable. The package must retain disable_fmri; dropping it would leave a running daemon behind on uninstall. A read-only check on oibldofgate found the master restarter's expected NONPERSISTENT group and online state. Solstice's database briefly became unreachable during the job, causing Forgejo to mark it failed before the runner continued; the runner's final uninstall failure is independently recorded. Native job 22786 package-test log SHA-256: 57390cc14a2f96b10a92e465d8d4b4a7155187c57035d86ef03c8a9e511b5122 in local workspace logs.

RC10 (f8c456f, tag v1.0.0-rc.10, Solstice run 8977) changes only the disposable-VM lifecycle test and version. It checks master-restarter state before install, after install, after the malformed-config exercise, after pkg5 smoke, and before uninstall, with bounded diagnostics on failure. The live uninstall remains mandatory. Local release-script checks: 384 passed, 0 failed; independent Opus review found no blocker. A fresh tagged VM run will tell whether the restarter problem recurs and when it begins. No package asset or v1 acceptance is claimed yet; historical 2020 validation remains open under #42 pending NFS sources.

RC9 (`ce82d70`, tag run 8975) passed the Linux release job, all 407 native release-profile tests, `.p5p` build and live install/verify, manpage rendering, packaged SMF checks, native local pkg5 client smoke, and live upgrade with edited KDL retained. It reached `pkg uninstall`, which planned no new or backup BE, but pkg5's `disable_fmri` actuator failed because `svcadm disable -s` reported `svc:/system/svc/restarter:default` lacks its `restarter` property group and the depot's restarter is unavailable. The package must retain `disable_fmri`; dropping it would leave a running daemon behind on uninstall. A read-only check on oibldofgate found the master restarter's expected NONPERSISTENT group and online state. Solstice's database briefly became unreachable during the job, causing Forgejo to mark it failed before the runner continued; the runner's final uninstall failure is independently recorded. Native job 22786 package-test log SHA-256: `57390cc14a2f96b10a92e465d8d4b4a7155187c57035d86ef03c8a9e511b5122` in local workspace logs. RC10 (`f8c456f`, tag `v1.0.0-rc.10`, Solstice run 8977) changes only the disposable-VM lifecycle test and version. It checks master-restarter state before install, after install, after the malformed-config exercise, after pkg5 smoke, and before uninstall, with bounded diagnostics on failure. The live uninstall remains mandatory. Local release-script checks: 384 passed, 0 failed; independent Opus review found no blocker. A fresh tagged VM run will tell whether the restarter problem recurs and when it begins. No package asset or v1 acceptance is claimed yet; historical 2020 validation remains open under #42 pending NFS sources.

forge commented

2026-09-23 18:02:34 +00:00

Author

RC10 (f8c456f, tag run 8977) has isolated the remaining package-test blocker to the Solstice Hipster VM before the pkg6 package is installed. Its native release job 22790 passed tag/provenance, 384 release-script checks, all 407 OpenIndiana release-profile tests, and .p5p construction. The new first lifecycle checkpoint then failed: svcprop -p restarter/state svc:/system/svc/restarter:default reported no restarter property group. Bounded diagnostics show the master instance with state -, svc:/system/svc/global:default disabled, and svc.startd/svc.configd processes running. The test exited before pkg install. Package-test log SHA-256: 314cfcf2415408ff8a7e58e4598bd8d2b4add72d67fe31cb2a8cc4bcd82b463e in local workspace logs. The stable oibldofgate VM reports the expected NONPERSISTENT group and online state.

This confirms RC9's svcadm disable failure came from an already incomplete Solstice VM SMF state, not from pkg6's install, config exercise, or upgrade. The package retains disable_fmri so uninstall stops a running depot. The RC9 job previously proved live install/verify, manual rendering, SMF config failure handling, native pkg5 client smoke, and live upgrade; it could not complete uninstall on that VM. No tagged IPS asset was published, and this ticket stays open. Next acceptance step, when infrastructure work is resumed: repair the disposable OpenIndiana VM image's master SMF restarter state, then rerun the same tag pipeline on a fresh immutable candidate and verify live uninstall plus published .p5p assets. Historical 2020/NFS validation remains separate under #42.

RC10 (`f8c456f`, tag run 8977) has isolated the remaining package-test blocker to the Solstice Hipster VM *before the pkg6 package is installed*. Its native release job 22790 passed tag/provenance, 384 release-script checks, all 407 OpenIndiana release-profile tests, and `.p5p` construction. The new first lifecycle checkpoint then failed: `svcprop -p restarter/state svc:/system/svc/restarter:default` reported no `restarter` property group. Bounded diagnostics show the master instance with state `-`, `svc:/system/svc/global:default` disabled, and `svc.startd`/`svc.configd` processes running. The test exited before `pkg install`. Package-test log SHA-256: `314cfcf2415408ff8a7e58e4598bd8d2b4add72d67fe31cb2a8cc4bcd82b463e` in local workspace logs. The stable oibldofgate VM reports the expected NONPERSISTENT group and `online` state. This confirms RC9's `svcadm disable` failure came from an already incomplete Solstice VM SMF state, not from pkg6's install, config exercise, or upgrade. The package retains `disable_fmri` so uninstall stops a running depot. The RC9 job previously proved live install/verify, manual rendering, SMF config failure handling, native pkg5 client smoke, and live upgrade; it could not complete uninstall on that VM. No tagged IPS asset was published, and this ticket stays open. Next acceptance step, when infrastructure work is resumed: repair the disposable OpenIndiana VM image's master SMF restarter state, then rerun the *same* tag pipeline on a fresh immutable candidate and verify live uninstall plus published `.p5p` assets. Historical 2020/NFS validation remains separate under #42.

forge commented

2026-09-23 19:19:28 +00:00

Author

Native OpenIndiana fast-loop evidence for PR #46 (current head a1d715b3db46d94c8963c3f2d046bbc26443883f):

From the immutable v1.0.0-rc.10 tag (f8c456f2cd5a7e7d88b7c9f8785257e5a9b05fb2), an isolated checkout on oibuild built the release workspace at -j2 in 16m 01s and produced pkg6depotd-1.0.0-rc.10-illumos-x86_64.p5p with the native pkg5 tools. Archive SHA-256: 94d4e18c641a0ea37313d957b9e909e4dbe562e8e45e3a98e70a86de6004d6b7.
Focused native cargo nextest for pkg6repo and pkg6depotd: 155 passed, 0 skipped. The release-script checks passed (385 on tagged source; 398 locally after the new script).
The new unprivileged pkg5 smoke in a1d715b passed twice on oibuild: no-op reimport, pkg5 catalog and manifest reads, pkgrecv manifest/payload identity, and install/verify/uninstall of a dummy package in a user-owned alternate image. It leaves no scratch daemon or image. The reviewed run used the exact script now on the PR branch.
Commit a1d715b documents a repeatable pre-tag candidate-package command. This script is a fast shared-zone check; the tagged release workflow and disposable-VM live SMF test remain required.

The live package gate is still blocked before package installation on Solstice job 22790: the fresh VM lacks the master restarter's NONPERSISTENT restarter property group. No release asset was published, the RC10 tag was not moved, and live install/upgrade/uninstall acceptance remains open. The source and logs are recorded locally under notes/ips-v1-oibuild-rc10.md and logs/oibuild/.

Native OpenIndiana fast-loop evidence for PR #46 (current head `a1d715b3db46d94c8963c3f2d046bbc26443883f`): - From the immutable `v1.0.0-rc.10` tag (`f8c456f2cd5a7e7d88b7c9f8785257e5a9b05fb2`), an isolated checkout on `oibuild` built the release workspace at `-j2` in 16m 01s and produced `pkg6depotd-1.0.0-rc.10-illumos-x86_64.p5p` with the native pkg5 tools. Archive SHA-256: `94d4e18c641a0ea37313d957b9e909e4dbe562e8e45e3a98e70a86de6004d6b7`. - Focused native `cargo nextest` for `pkg6repo` and `pkg6depotd`: 155 passed, 0 skipped. The release-script checks passed (385 on tagged source; 398 locally after the new script). - The new unprivileged pkg5 smoke in `a1d715b` passed twice on `oibuild`: no-op reimport, pkg5 catalog and manifest reads, `pkgrecv` manifest/payload identity, and install/verify/uninstall of a dummy package in a user-owned alternate image. It leaves no scratch daemon or image. The reviewed run used the exact script now on the PR branch. - Commit `a1d715b` documents a repeatable pre-tag candidate-package command. This script is a fast shared-zone check; the tagged release workflow and disposable-VM live SMF test remain required. The live package gate is still blocked before package installation on Solstice job 22790: the fresh VM lacks the master restarter's NONPERSISTENT `restarter` property group. No release asset was published, the RC10 tag was not moved, and live install/upgrade/uninstall acceptance remains open. The source and logs are recorded locally under `notes/ips-v1-oibuild-rc10.md` and `logs/oibuild/`.

forge referenced this issue

2026-09-23 19:19:37 +00:00

v1 deployable pkg6 depot: pkg5 imports, retention, TLS, telemetry and release pipeline #46

forge commented

2026-09-24 17:53:14 +00:00

Author

RC11 IPS package is published at https://code.aopc.cloud/OpenIndiana/ips/releases/tag/v1.0.0-rc.11 . The published .p5p is pkg6depotd-1.0.0-rc.11-illumos-x86_64.p5p, SHA-256 dbeba8be6e4164d62645b31b1a89b6ff4b0554a54810dfc4a8506c32a57f32d1; Forgejo's downloaded bytes match the tagged oibuild artifact. The unprivileged native pkg5 catalog/download/install/verify/uninstall smoke in scratch images passed, as did 407/407 release-profile tests on oibuild and the Solstice illumos test step.

Live-image IPS install, upgrade, uninstall and SMF lifecycle validation remains unproven. RC10's disposable VM lacked the SMF restarter property group; RC11's Solstice job was marked failed after the passing test step, but its log stops there, so the RC11 failure cannot be attributed to SMF from available evidence. The public RC11 body discloses this gap. PR #46/ADR-011 temporarily builds illumos release assets on oibuild and keeps release credentials off that shared host. Keep this issue open until the disposable live-image/SMF gate passes or its disposition is explicitly accepted.

RC11 IPS package is published at https://code.aopc.cloud/OpenIndiana/ips/releases/tag/v1.0.0-rc.11 . The published `.p5p` is `pkg6depotd-1.0.0-rc.11-illumos-x86_64.p5p`, SHA-256 `dbeba8be6e4164d62645b31b1a89b6ff4b0554a54810dfc4a8506c32a57f32d1`; Forgejo's downloaded bytes match the tagged oibuild artifact. The unprivileged native pkg5 catalog/download/install/verify/uninstall smoke in scratch images passed, as did 407/407 release-profile tests on oibuild and the Solstice illumos test step. Live-image IPS install, upgrade, uninstall and SMF lifecycle validation remains unproven. RC10's disposable VM lacked the SMF restarter property group; RC11's Solstice job was marked failed after the passing test step, but its log stops there, so the RC11 failure cannot be attributed to SMF from available evidence. The public RC11 body discloses this gap. PR #46/ADR-011 temporarily builds illumos release assets on oibuild and keeps release credentials off that shared host. Keep this issue open until the disposable live-image/SMF gate passes or its disposition is explicitly accepted.

toasterson commented

2026-09-27 13:14:03 +00:00

Owner

ADR-015 item 1 (2026-09-27): the disposable-VM install/upgrade/uninstall/SMF test is replaced as a v1.0 gate by evidence on oirepo6: tagged package installed and upgraded with pkg verify clean, packaged SMF service online, native pkg5 reads, and one verified reboot with the service back on the activated BE. Uninstall is proven once on a scratch BE on oibldofgate. The Solstice live-image job stays non-blocking until CloudNebulaProject/solstice-ci#8 is fixed. Still open here: the reboot and the scratch-BE uninstall.

ADR-015 item 1 (2026-09-27): the disposable-VM install/upgrade/uninstall/SMF test is **replaced** as a v1.0 gate by evidence on oirepo6: tagged package installed and upgraded with `pkg verify` clean, packaged SMF service online, native pkg5 reads, and **one verified reboot** with the service back on the activated BE. Uninstall is proven once on a scratch BE on oibldofgate. The Solstice live-image job stays non-blocking until CloudNebulaProject/solstice-ci#8 is fixed. Still open here: the reboot and the scratch-BE uninstall.

toasterson referenced this issue

2026-09-27 13:14:15 +00:00

Wayfinder map: Release 1 (server only) #24

toasterson commented

2026-09-27 14:35:57 +00:00

Owner

The RC14 tagged IPS package is installed and pkg verify passes on private oirepo6. svc:/application/pkg/pkg6depotd:default serves the existing private endpoint on port 8080. Named :legacy, :oi-sparc, and :unleashed instances are online from separate repository roots using direct SMF properties; each has an HTTP 200 /admin/health. The legacy instance is bound to private 10.1.0.13:8081 for a native pkg5 read/fetch test; the other two are loopback-only until import/routing. The public reverse proxy was not changed.

Package actuator syntax now addresses all instances on upgrade/removal. The automated live-image package lifecycle test remains NOT RUN because the Solstice illumos job failed before compilation; manual RC14 upgrade, package verification, and multi-instance runtime passed. See PR #56 and RC14.

The RC14 tagged IPS package is installed and `pkg verify` passes on private oirepo6. `svc:/application/pkg/pkg6depotd:default` serves the existing private endpoint on port 8080. Named `:legacy`, `:oi-sparc`, and `:unleashed` instances are online from separate repository roots using direct SMF properties; each has an HTTP 200 `/admin/health`. The `legacy` instance is bound to private 10.1.0.13:8081 for a native pkg5 read/fetch test; the other two are loopback-only until import/routing. The public reverse proxy was not changed. Package actuator syntax now addresses all instances on upgrade/removal. The automated live-image package lifecycle test remains NOT RUN because the Solstice illumos job failed before compilation; manual RC14 upgrade, package verification, and multi-instance runtime passed. See [PR #56](https://code.aopc.cloud/OpenIndiana/ips/pulls/56) and [RC14](https://code.aopc.cloud/OpenIndiana/ips/releases/tag/v1.0.0-rc.14).

Rows
Columns

V1: IPS/SMF deployment with direct TLS, proxy mode and ACME #41

V1 administration boundary — 2026-09-22

Deployment and load clarification — 2026-09-22

Required v1 deployment

Still to specify