feat: keel-pve 0.1.0, signed Keel templates on a Proxmox VE host #1

Merged

marcos-mendez merged 1 commit from feat/keel-pve into main

2026-10-03 11:08:31 -03:00

marcos-mendez commented

2026-10-03 10:41:20 -03:00

(Migrated from github.com)

First code of keel-pve, the Proxmox VE host package of handbook docs/proxmox-distribution.md (point 2).

What it does

keel-pve update: fetches aplinfo.dat.gz and .asc from releases.keellinux.org/pve, verifies with sqv --keyring /usr/share/keyrings/keel-archive-keyring.gpg <asc> <dat> (the same call PVE::APLInfo makes with its own keyring), parses every record with pveam's rules, then stores both under /var/lib/keel-pve/. A refused update keeps the previous index.
keel-pve available: lists the stored index, re-verified first.
keel-pve download STORAGE TEMPLATE: package name (newest version) or file name; destination from pvesm status --content vztmpl and pvesm path STORAGE:vztmpl/<file>, never guessed and never created; download into a mktemp -d directory made there (no fixed temp name, no symlink written through), sha512 against the signed index, rename only on a match. Locations must be https; curl has connect and transfer time limits.
keel-pve list: Keel volumes in every vztmpl storage.
/etc/apt/preferences.d/keel-pve (conffile): the Keel archive gives the host only keel-pve and keel-archive-keyring, everything else -1.
keel-pve-update.timer, daily, shipped disabled. No pve-manager file is touched; purge removes /var/lib/keel-pve only.

.tar.zst on PVE 9

Accepted. Checked today against current sources: pve-storage Storage.pm VZTMPL_EXT_RE_1 includes tar.zst (and Plugin.pm lists/parses vztmpl volumes with it); pve-container LXC/Create.pm maps .zst to tar --zstd.

Signature

The live index is signed by the archive key's current signing subkey 0304 1024 F4B2 C0C2 F42D DDEA 0490 6EAB 7751 3310 (primary AD09 64BE ... 3180), so keel-archive-keyring (>= 0.1.1) is the trust root; verified with sqv against the live files.

Test plan

69 bats tests (symlink planting, http and .. Locations, stalled transfers, lock wait, apt policy of the pin), fake pvesm, local index signed by a throwaway key, real sqv and curl over file://; kcov 100 percent, gate 95
dpkg-buildpackage and lintian --pedantic --fail-on error,warning clean locally
Live index and real keyring, fake pvesm: update, available, download of keel-web 19.0-3 (sha512 matched, zstd -t OK), list
Real PVE host (pve-manager 9.2.11, locally built .debs, before the review fixes): install with the timer disabled; update; available; download local keel-web (7 s, sha512 matched, re-run says already present); unknown storage refused; list also found a Keel template on cephfs; pveam list local, pvesm list and the API the web UI's template selector calls (/nodes/<node>/storage/local/content?content=vztmpl) all show local:vztmpl/debian-13-keel-web_19.0-3_amd64.tar.zst, format tzst; keel-pve-update.service runs under its hardening; purge left nothing; pve-manager's trustedkeys.gpg and APLInfo.pm unchanged
Not run: creating a container from it (pct create has no dry-run, and no container could be created on that host) and opening the web UI dialog itself
CI: tests / coverage, package / changelog, build / trixie

First code of `keel-pve`, the Proxmox VE host package of handbook `docs/proxmox-distribution.md` (point 2). ## What it does - `keel-pve update`: fetches `aplinfo.dat.gz` and `.asc` from `releases.keellinux.org/pve`, verifies with `sqv --keyring /usr/share/keyrings/keel-archive-keyring.gpg <asc> <dat>` (the same call `PVE::APLInfo` makes with its own keyring), parses every record with pveam's rules, then stores both under `/var/lib/keel-pve/`. A refused update keeps the previous index. - `keel-pve available`: lists the stored index, re-verified first. - `keel-pve download STORAGE TEMPLATE`: package name (newest version) or file name; destination from `pvesm status --content vztmpl` and `pvesm path STORAGE:vztmpl/<file>`, never guessed and never created; download into a `mktemp -d` directory made there (no fixed temp name, no symlink written through), sha512 against the signed index, rename only on a match. Locations must be https; curl has connect and transfer time limits. - `keel-pve list`: Keel volumes in every vztmpl storage. - `/etc/apt/preferences.d/keel-pve` (conffile): the Keel archive gives the host only keel-pve and keel-archive-keyring, everything else -1. - `keel-pve-update.timer`, daily, shipped disabled. No pve-manager file is touched; purge removes `/var/lib/keel-pve` only. ## .tar.zst on PVE 9 Accepted. Checked today against current sources: pve-storage `Storage.pm` `VZTMPL_EXT_RE_1` includes `tar.zst` (and `Plugin.pm` lists/parses vztmpl volumes with it); pve-container `LXC/Create.pm` maps `.zst` to `tar --zstd`. ## Signature The live index is signed by the archive key's current signing subkey `0304 1024 F4B2 C0C2 F42D DDEA 0490 6EAB 7751 3310` (primary `AD09 64BE ... 3180`), so `keel-archive-keyring (>= 0.1.1)` is the trust root; verified with sqv against the live files. ## Test plan - [x] 69 bats tests (symlink planting, http and `..` Locations, stalled transfers, lock wait, apt policy of the pin), fake `pvesm`, local index signed by a throwaway key, real sqv and curl over `file://`; kcov 100 percent, gate 95 - [x] `dpkg-buildpackage` and `lintian --pedantic --fail-on error,warning` clean locally - [x] Live index and real keyring, fake `pvesm`: update, available, download of keel-web 19.0-3 (sha512 matched, `zstd -t` OK), list - [x] Real PVE host (pve-manager 9.2.11, locally built .debs, before the review fixes): install with the timer disabled; `update`; `available`; `download local keel-web` (7 s, sha512 matched, re-run says already present); unknown storage refused; `list` also found a Keel template on cephfs; `pveam list local`, `pvesm list` and the API the web UI's template selector calls (`/nodes/<node>/storage/local/content?content=vztmpl`) all show `local:vztmpl/debian-13-keel-web_19.0-3_amd64.tar.zst`, format `tzst`; `keel-pve-update.service` runs under its hardening; purge left nothing; pve-manager's `trustedkeys.gpg` and `APLInfo.pm` unchanged - [ ] Not run: creating a container from it (`pct create` has no dry-run, and no container could be created on that host) and opening the web UI dialog itself - [x] CI: `tests / coverage`, `package / changelog`, `build / trixie`