Fail on a failed build and audit the package state #4

Merged

marcos-mendez merged 2 commits from fix/layer-build-audit into 19.x

2026-09-26 15:57:36 -03:00

marcos-mendez commented

2026-09-26 15:37:34 -03:00

(Migrated from github.com)

Problem: bt-layer published a layer built from a failed build. Diagnosis: the make status was discarded by || true under pipefail, and the only remaining guard was the stamp, which says nothing about whether the packages inside are configured. The nodebb layer shipped with confconsole unpacked but unconfigured, and the appliance built from it was missing those files. Fix: capture the make status and make it fatal, and add layer_audit_packages, which reads the rootfs dpkg status and refuses any package not in the installed state. Verified against the real layers on the build host: nodebb refused naming confconsole, core clean. Tests for both outcomes.

Problem: bt-layer published a layer built from a failed build. Diagnosis: the make status was discarded by `|| true` under pipefail, and the only remaining guard was the stamp, which says nothing about whether the packages inside are configured. The nodebb layer shipped with confconsole unpacked but unconfigured, and the appliance built from it was missing those files. Fix: capture the make status and make it fatal, and add layer_audit_packages, which reads the rootfs dpkg status and refuses any package not in the installed state. Verified against the real layers on the build host: nodebb refused naming confconsole, core clean. Tests for both outcomes.