Name the deb822 TurnKey sources a 19.0 appliance really has #1

Merged

marcos-mendez merged 1 commit from deb822-turnkey-sources into main

2026-09-26 15:50:33 -03:00

marcos-mendez commented

2026-09-26 15:48:42 -03:00

(Migrated from github.com)

Problem

The test bench, a container built from the stock upstream
turnkey-core-19.0-trixie-amd64.iso, has no
/etc/apt/sources.list.d/turnkey.list at all.

Diagnosis

BRIEF section 7 names that file because it is what an appliance of the
18.x lineage carries. A 19.0 installation puts its upstream archive in
deb822 files, and puts it in the same file as the Debian stanzas:

$ cat /etc/apt/sources.list.d/sources.sources
Types: deb
URIs: http://archive.turnkeylinux.org/debian
Suites: trixie
Components: main
Signed-By: /usr/share/keyrings/tkl-archive-keyring.gpg

Types: deb
URIs: http://deb.debian.org/debian
Suites: trixie
Components: main non-free-firmware

security.sources.sources is the same shape. Renaming one of those
would disable Debian along with TurnKey, which is worse than doing
nothing. What the tool must not do is stay silent: before this change,
the survey of a stock 19.0 printed no upstream list on this machine,
which reads as "this appliance has no upstream archive configured" and
is false.

Fix

turnkey_sources finds the deb822 files carrying an
archive.turnkeylinux.org stanza, and every phase names them, says why
they were left enabled, and says that the origin pin at 1001 is what
makes the Keel archive win over them. That last part is true: the pin is
on the Origin of the Release, so it applies whatever else is in
sources.list.d.

The rename of turnkey.list stays exactly as specified, for the
appliances that have one. Disabling a single stanza inside a shared
deb822 file is a different change with a different risk, and it needs a
decision note before it is made.

Test plan

98 bats tests, 100 percent of 332 measured lines (tests/coverage.sh)
two new tests for turnkey_sources (found, none, directory gone)
two new tests for the survey output (named, and silent when there is none)
shellcheck -S warning clean
run on the bench container, stock Core 19.0

Serves BRIEF section 7.

## Problem The test bench, a container built from the stock upstream `turnkey-core-19.0-trixie-amd64.iso`, has no `/etc/apt/sources.list.d/turnkey.list` at all. ## Diagnosis BRIEF section 7 names that file because it is what an appliance of the 18.x lineage carries. A 19.0 installation puts its upstream archive in deb822 files, and puts it in the *same file* as the Debian stanzas: ``` $ cat /etc/apt/sources.list.d/sources.sources Types: deb URIs: http://archive.turnkeylinux.org/debian Suites: trixie Components: main Signed-By: /usr/share/keyrings/tkl-archive-keyring.gpg Types: deb URIs: http://deb.debian.org/debian Suites: trixie Components: main non-free-firmware ``` `security.sources.sources` is the same shape. Renaming one of those would disable Debian along with TurnKey, which is worse than doing nothing. What the tool must not do is stay silent: before this change, the survey of a stock 19.0 printed `no upstream list on this machine`, which reads as "this appliance has no upstream archive configured" and is false. ## Fix `turnkey_sources` finds the deb822 files carrying an `archive.turnkeylinux.org` stanza, and every phase names them, says why they were left enabled, and says that the origin pin at 1001 is what makes the Keel archive win over them. That last part is true: the pin is on the `Origin` of the `Release`, so it applies whatever else is in `sources.list.d`. The rename of `turnkey.list` stays exactly as specified, for the appliances that have one. Disabling a single stanza inside a shared deb822 file is a different change with a different risk, and it needs a decision note before it is made. ## Test plan - [x] 98 bats tests, 100 percent of 332 measured lines (`tests/coverage.sh`) - [x] two new tests for `turnkey_sources` (found, none, directory gone) - [x] two new tests for the survey output (named, and silent when there is none) - [x] `shellcheck -S warning` clean - [x] run on the bench container, stock Core 19.0 Serves BRIEF section 7.

marcos-mendez commented

2026-09-26 16:01:22 -03:00

(Migrated from github.com)

Acceptance run on the bench (decisions 0003 point 4 and 0004 point 4)

Container tkl-core-bench, built on the build host from the stock upstream
turnkey-core-19.0-trixie-amd64.iso (sha256 and the TurnKey trixie image
signature both verified), macvlan on eth0, native systemd, no other
runtime. Both .deb files built with the apt tooling's bin/build-package,
which detected the source as native.

ii  keel                 0.1.0  all
ii  keel-archive-keyring 0.1.0  all
ii  keel-transition      0.1.0  all

Survey. Wrote /etc/keel/instance.yaml (hostname, both interfaces
dhcp on each family, managed_by: host from the LXC marker, three
nameservers, security.updates: force, timezone, lang) and the report:
14 inferred, 5 not inferred, 1 of them required (instance.fqdn: /etc/hosts
has no qualified name and hostname -f answered core). Exit 3.
/etc/apt unchanged.

Refusal. --apply against https://archive.keellinux.org:

keel-transition: refusing --apply: there is no InRelease and no Release.gpg at
  https://archive.keellinux.org/dists/trixie: that archive is unsigned today
keel-transition: an archive nothing signs would let whatever answers for that
  name install code as root here, so it is never enabled silently.
keel-transition: nothing was changed. Re-run with --force-unsigned to accept
  that risk explicitly.
exit=4

diff -r against a copy of the whole /etc/apt tree taken beforehand:
identical.

Force-unsigned against the build host's reprepro staging tree, over
IPv6, then apt-get update run by hand because the tool does not run it:

fab:
  Candidate: 1.1.1+keel1
     1.1.1+keel1 1001
       1001 http://[...]:8081 trixie-staging/main amd64 Packages
     1.1.1 999
        999 http://archive.turnkeylinux.org/debian trixie/main amd64 Packages

Same shape for keel, inithooks and confconsole: the origin pin puts
the project's packages at 1001 over TurnKey's 999.

Rollback. diff -r identical again, and the sha256 of the sha256 sums of
every file under /etc/apt matches the pre-apply value
(eed5ec97...4f9bab). A second --rollback exits 0 and changes nothing.

The rename, on an appliance that has a turnkey.list. A file was put at
that path to stand in for an 18.x lineage appliance; --apply renamed it to
turnkey.list.disabled-by-keel, --rollback renamed it back, and its sha256
was unchanged (ea98dbaf...5eebac).

No package was installed, upgraded or removed by the tool in any phase. The
container is left stopped, not destroyed: lxc-start -n tkl-core-bench.

## Acceptance run on the bench (decisions 0003 point 4 and 0004 point 4) Container `tkl-core-bench`, built on the build host from the stock upstream `turnkey-core-19.0-trixie-amd64.iso` (sha256 and the TurnKey trixie image signature both verified), macvlan on `eth0`, native systemd, no other runtime. Both `.deb` files built with the apt tooling's `bin/build-package`, which detected the source as native. ``` ii keel 0.1.0 all ii keel-archive-keyring 0.1.0 all ii keel-transition 0.1.0 all ``` **Survey.** Wrote `/etc/keel/instance.yaml` (hostname, both interfaces dhcp on each family, `managed_by: host` from the LXC marker, three nameservers, `security.updates: force`, timezone, lang) and the report: 14 inferred, 5 not inferred, 1 of them required (`instance.fqdn`: `/etc/hosts` has no qualified name and `hostname -f` answered `core`). Exit 3. `/etc/apt` unchanged. **Refusal.** `--apply` against `https://archive.keellinux.org`: ``` keel-transition: refusing --apply: there is no InRelease and no Release.gpg at https://archive.keellinux.org/dists/trixie: that archive is unsigned today keel-transition: an archive nothing signs would let whatever answers for that name install code as root here, so it is never enabled silently. keel-transition: nothing was changed. Re-run with --force-unsigned to accept that risk explicitly. exit=4 ``` `diff -r` against a copy of the whole `/etc/apt` tree taken beforehand: identical. **Force-unsigned against the build host's reprepro staging tree**, over IPv6, then `apt-get update` run by hand because the tool does not run it: ``` fab: Candidate: 1.1.1+keel1 1.1.1+keel1 1001 1001 http://[...]:8081 trixie-staging/main amd64 Packages 1.1.1 999 999 http://archive.turnkeylinux.org/debian trixie/main amd64 Packages ``` Same shape for `keel`, `inithooks` and `confconsole`: the origin pin puts the project's packages at 1001 over TurnKey's 999. **Rollback.** `diff -r` identical again, and the sha256 of the sha256 sums of every file under `/etc/apt` matches the pre-apply value (`eed5ec97...4f9bab`). A second `--rollback` exits 0 and changes nothing. **The rename, on an appliance that has a `turnkey.list`.** A file was put at that path to stand in for an 18.x lineage appliance; `--apply` renamed it to `turnkey.list.disabled-by-keel`, `--rollback` renamed it back, and its sha256 was unchanged (`ea98dbaf...5eebac`). No package was installed, upgraded or removed by the tool in any phase. The container is left stopped, not destroyed: `lxc-start -n tkl-core-bench`.