tkldev-setup: build the bootstrap locally when it cannot be downloaded, verify the right file #1

Merged

marcos-mendez merged 9 commits from fix/build-missing-bootstrap into master

2026-09-26 06:24:59 -03:00

marcos-mendez commented

2026-09-26 06:15:40 -03:00

(Migrated from github.com)

Diagnosis: the closing bracket of a dirname call had moved (78e7142 upstream), so signature-verify received /turnkey/fab/bootstraps/- and its .hash, which do not exist; and the script had no fallback when the tarball or its .hash cannot be downloaded.

Fix: verify the tarball, not its directory; when the download fails, clone or update turnkeylinux/bootstrap next to FAB_PATH and 'make install' it, as bt-bootstrap does (default: warn and build; --strict: fail as before; --transition: warn and skip, without verifying files that were never downloaded). The script now defines its functions first, returns early when sourced, and takes TKLBAM_PATH like BT_PATH and FAB_PATH so a run can be pointed at a scratch tree. The last commit makes tests/coverage.sh read COVERAGE_THRESHOLD, the variable the reusable workflow exports.

Tests: 63 bats with git, wget, apt-get, make, lsb_release, turnkey-version, dpkg, id and signature-verify stubbed on PATH; tests/coverage.sh under kcov: tkldev-setup 185/186 lines (99.46 percent; the missing line is the continuation of a two-line warning call). On a TKLDev 19.0 VM with the trixie bootstrap removed: default builds and installs it in 81 s, --strict exits 1, --transition skips; a bookworm download verifies and unpacks.

Serves BRIEF section 8 (the build host must build from the organization) and the M0 gate of docs/m0-gate.md.

Problem: on a fresh TKLDev 19.0 the 40tkldev first-boot hook (tkldev-setup core) died with a 404 because bootstrap-trixie-amd64.tar.gz was never published on the mirror, and nothing could be built; with a mirror that has the tarball (bookworm) the download aborted on signature-verify because it was pointed at the bootstrap directory instead of the tarball. Diagnosis: the closing bracket of a dirname call had moved (78e7142 upstream), so signature-verify received /turnkey/fab/bootstraps/<codename>-<arch> and its .hash, which do not exist; and the script had no fallback when the tarball or its .hash cannot be downloaded. Fix: verify the tarball, not its directory; when the download fails, clone or update turnkeylinux/bootstrap next to FAB_PATH and 'make install' it, as bt-bootstrap does (default: warn and build; --strict: fail as before; --transition: warn and skip, without verifying files that were never downloaded). The script now defines its functions first, returns early when sourced, and takes TKLBAM_PATH like BT_PATH and FAB_PATH so a run can be pointed at a scratch tree. The last commit makes tests/coverage.sh read COVERAGE_THRESHOLD, the variable the reusable workflow exports. Tests: 63 bats with git, wget, apt-get, make, lsb_release, turnkey-version, dpkg, id and signature-verify stubbed on PATH; tests/coverage.sh under kcov: tkldev-setup 185/186 lines (99.46 percent; the missing line is the continuation of a two-line warning call). On a TKLDev 19.0 VM with the trixie bootstrap removed: default builds and installs it in 81 s, --strict exits 1, --transition skips; a bookworm download verifies and unpacks. Serves BRIEF section 8 (the build host must build from the organization) and the M0 gate of docs/m0-gate.md.