The four recipes carry the same build time archive block, and it should be one shared thing #8

New issue

Open

opened 2026-09-27 17:28:35 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-09-27 17:28:35 -03:00

(Migrated from github.com)

Raised from tracker#7, which is the second defect that had to be fixed four times. The first was the stale bootstrap copy of the project archive (bin/keel-archive-check, fixed in keel-nodebb and keel-wordpress and missing in keel-mariadb and keel-postgresql until tonight). The second was verification: [trusted=yes] with no keyring, in all four.

What is duplicated today

keel-nodebb, keel-mariadb, keel-postgresql and keel-wordpress each carry:

the bootstrap/post and root.patched/pre block in Makefile, with
KEEL_APT_REPO, KEEL_APT_DIST, KEEL_APT_KEYRING,
KEEL_APT_KEYRING_PATH, KEEL_APT_KEY and KEEL_STAGING_LIST, about 40
lines including the comment;
bin/keel-archive-check, byte for byte identical, 142 lines;
tests/archive-check.bats, byte for byte identical, 27 tests;
an --include-pattern entry and a COVERAGE.md row for it, four times.

The fingerprint of the staging signing subkey is written down in four
Makefiles. A key rotation is therefore a four repository change, and a build
that reads the archive without verifying it is four edits away from coming
back.

Where it should live

keel-linux/common, the fab tree every recipe already includes through
$(FAB_PATH)/common/mk/turnkey.mk, and which is already the home of the
other half of this: common/removelists-final/turnkey, which takes the copy,
the source entry and the keyring back out of the image for every recipe at
once. Concretely:

common/mk/keel/staging-archive.mk with the variables and the two hooks, so
a recipe includes one line instead of copying forty;
common/bin/keel-archive-check, one copy, named from that mk file;
common/tests/archive-check.bats, measured by common/tests/coverage.sh,
whose threshold is already 100.

The four recipes then drop bin/, tests/archive-check.bats, their include
patterns and their COVERAGE.md rows, and the staging key fingerprint is written
down once.

Why it was not done tonight

tracker#7 was urgent: the published mariadb layer carried keel 0.2.1 and the
two node replication gate on keel-mariadb#10 could not pass. Moving the block
into the shared tree in the same pass would have put a five repository
refactoring, and a common deployment the four recipes then depend on, in front
of a rebuild that was already blocking a merge. The defect is fixed in all four
and the duplication is recorded here instead.

The cost of waiting is bounded and known: one more four way edit if the staging
key rotates before this lands.

Raised from tracker#7, which is the second defect that had to be fixed four times. The first was the stale bootstrap copy of the project archive (`bin/keel-archive-check`, fixed in keel-nodebb and keel-wordpress and missing in keel-mariadb and keel-postgresql until tonight). The second was verification: `[trusted=yes]` with no keyring, in all four. ## What is duplicated today keel-nodebb, keel-mariadb, keel-postgresql and keel-wordpress each carry: * the `bootstrap/post` and `root.patched/pre` block in `Makefile`, with `KEEL_APT_REPO`, `KEEL_APT_DIST`, `KEEL_APT_KEYRING`, `KEEL_APT_KEYRING_PATH`, `KEEL_APT_KEY` and `KEEL_STAGING_LIST`, about 40 lines including the comment; * `bin/keel-archive-check`, byte for byte identical, 142 lines; * `tests/archive-check.bats`, byte for byte identical, 27 tests; * an `--include-pattern` entry and a COVERAGE.md row for it, four times. The fingerprint of the staging signing subkey is written down in four Makefiles. A key rotation is therefore a four repository change, and a build that reads the archive without verifying it is four edits away from coming back. ## Where it should live `keel-linux/common`, the fab tree every recipe already includes through `$(FAB_PATH)/common/mk/turnkey.mk`, and which is already the home of the other half of this: `common/removelists-final/turnkey`, which takes the copy, the source entry and the keyring back out of the image for every recipe at once. Concretely: * `common/mk/keel/staging-archive.mk` with the variables and the two hooks, so a recipe includes one line instead of copying forty; * `common/bin/keel-archive-check`, one copy, named from that mk file; * `common/tests/archive-check.bats`, measured by `common/tests/coverage.sh`, whose threshold is already 100. The four recipes then drop `bin/`, `tests/archive-check.bats`, their include patterns and their COVERAGE.md rows, and the staging key fingerprint is written down once. ## Why it was not done tonight tracker#7 was urgent: the published `mariadb` layer carried keel 0.2.1 and the two node replication gate on keel-mariadb#10 could not pass. Moving the block into the shared tree in the same pass would have put a five repository refactoring, and a common deployment the four recipes then depend on, in front of a rebuild that was already blocking a merge. The defect is fixed in all four and the duplication is recorded here instead. The cost of waiting is bounded and known: one more four way edit if the staging key rotates before this lands.