fix: the project packages come from the Keel archive, not the build host staging #23

Merged

marcos-mendez merged 4 commits from fix/keel-archive-not-staging into main

2026-10-07 20:17:44 -03:00

marcos-mendez commented

2026-10-07 19:35:13 -03:00

(Migrated from github.com)

Supersedes #21 (its two commits are included).

Staging gone. The Makefile no longer copies the build host's trixie-staging into the bootstrap, conf.d/main no longer pins it at 1001, and bin/keel-archive-check goes. That distribution holds inithooks 2.3.6+keel5, confconsole keel2 and keel 0.3.5; pinned at 1001 the upgrade would have downgraded the layer to them.
Keel archive. inithooks, confconsole and keel come from archive.keellinux.org through the source and 990 pin the parent layer carries (common#30), trixie-testing included with KEEL_APT_TRACK=testing (common#32). conf.d/main runs apt-get update, upgrades the three, then runs bin/keel-project-packages (copied into the tree in root.patched/pre, removed by conf.d/main): each must be installed at apt's candidate, and the candidate must be the Keel archive's in the track's suite. It replaces the version floors.
Overlay (from #21): no keel.sources, no 1001 pin.

Tests: tests/apt-files.bats (no staging source, pin, keyring or archive copy anywhere; the upgrade then the check; the check in and out of the tree; mutation-checked), tests/project-packages.bats (6 tests against apt 3 policy output). Coverage: keel-project-packages 100 percent; the suite at threshold 95 passes locally.

appliance / boot-published-layer cannot pass: no mariadb layer is published (the old one was withdrawn); the maintainer bypasses it.

Supersedes #21 (its two commits are included). - **Staging gone.** The Makefile no longer copies the build host's `trixie-staging` into the bootstrap, conf.d/main no longer pins it at 1001, and `bin/keel-archive-check` goes. That distribution holds inithooks 2.3.6+keel5, confconsole keel2 and keel 0.3.5; pinned at 1001 the upgrade would have downgraded the layer to them. - **Keel archive.** inithooks, confconsole and keel come from archive.keellinux.org through the source and 990 pin the parent layer carries (common#30), trixie-testing included with `KEEL_APT_TRACK=testing` (common#32). conf.d/main runs `apt-get update`, upgrades the three, then runs `bin/keel-project-packages` (copied into the tree in `root.patched/pre`, removed by conf.d/main): each must be installed at apt's candidate, and the candidate must be the Keel archive's in the track's suite. It replaces the version floors. - **Overlay** (from #21): no `keel.sources`, no 1001 pin. Tests: `tests/apt-files.bats` (no staging source, pin, keyring or archive copy anywhere; the upgrade then the check; the check in and out of the tree; mutation-checked), `tests/project-packages.bats` (6 tests against apt 3 policy output). Coverage: `keel-project-packages` 100 percent; the suite at threshold 95 passes locally. `appliance / boot-published-layer` cannot pass: no mariadb layer is published (the old one was withdrawn); the maintainer bypasses it.