mirror of
https://github.com/openglow-org/forgefirm.git
synced 2026-10-19 02:51:42 -07:00
5036517e2273fe388d31be0d4939ef3544ec3b5a
8
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 ScottW514
|
5036517e22 |
Pin grblHAL 0.1.22, forgeext 0.1.5, forgectrl 0.1.34 and forgefirm-app 0.1.33 on the pushed heads, and meta-openglow in the kas lock
- grblhal-glowforge badc832 -> e159720 (0.1.21 -> 0.1.22): a soft reset
during motion gets the kernel's ramp and the position is read back
from the kernel's step counters, a reset that lands after the core's
own idle still gets the stop, the owed step is taken only between
callbacks, a position that stays lost pins the lens and tells the
sender, the homing cycle masks are pinned so a write cannot drop the
lens hold, the test hooks (GF_SWITCH_DEV included) are honored only in
a null-sink run through one gate, the underrun fail-safe log line
names its entry, and the latch_test and serial_test cases that hold
each.
- forgeext bb75b23 -> ebd9592 (0.1.4 -> 0.1.5): the storage quota counts
entries (one per 4 KiB) and the unlinked files a service holds open or
mapped, bounded, every 10 s; a quarantine the host could not write is
kept under the run directory, taken up at the next start or the first
turn the state reads, and dropped by the write or the lift; the root's
prepare turns current back to the state's version, drops only a
versioned tree, and leaves a package it cannot turn refused while the
host runs the others; a manifest that cannot be read holds its package
out by name; the required-holds marker directory is one literal.
- forgectrl 6c2bb38 -> b235be3 (0.1.33 -> 0.1.34): a diagnostic start
the cooling engine refuses goes once more a second later, canceled by
a later press or the Abort, which clears its text; the sysfs root, the
switch device and the run directory are honored only in a host-test
run through one gate (src/testhook.h, with its HOST_TESTED row here);
test_routes holds the panel's retry text to the daemon's and the
environment scan reads secure_getenv; the operator's texts say Grbl
sender; holds_wire_test holds the required-holds directory to
forgeext's and a marker alone holds.
- forgefirm-app 0f59c54 -> 6fb146a (0.1.32 -> 0.1.33): the shared
AGENTS.md block names a Grbl sender; nothing it installs changes.
- kas lock: meta-openglow b7626be -> c542ce6, the head that pins the
kernel module dab378d, python3-gfhardware 6fb146a and gfutilities
b9e74b8.
Proof: the four repositories' CI runs on the pushed heads are green
(grblHAL-glowforge 39170662884, forgeext 39170677776, forgectrl
39168946865 on its second attempt, python3-gfhardware 39168949407), and forgefirm's own
forgetest-ci on
|
||
|
ScottW514
|
56aa164708 |
Pin forgeext 0.1.4 on the pushed head
- forgeext e09f7b8 -> bb75b23 (0.1.3 -> 0.1.4): sandbox_test opens the machine's own files from inside the sandbox - /dev/glowforge, /data/forgefirm/forgefirm.conf, /data/forgefirm/setup.json - and requires EACCES of each (ENOENT is no pass; a file the host lacks is made for the run, readable by every account, and removed after). Test-only; nothing the image installs changes. Proof: forgeext's CI run on bb75b23 (38780750106) is green on a kernel with Landlock ABI 7; its log shows the three files made for the run and each open refused with EACCES (sandbox_test, 0 failures). bitbake -c fetch forgeext from this pin succeeds (2 tasks). |
||
|
ScottW514
|
df5ae151ab |
Pin forgeext 0.1.3 on the pushed head
- forgeext 31cdb40 -> e09f7b8 (0.1.2 -> 0.1.3): run_test's last phase runs the host under init/forgeext.init's own wrapper; a SIGKILL of the host takes its service with it at once, the wrapper starts the host again, and the service runs again under a new pid. Test-only; nothing the image installs changes. Proof: forgeext's CI run on e09f7b8 (38777839870) is green on a kernel with Landlock ABI 7, and the phase's six checks passed in it (run_test, 0 failures). bitbake -c fetch forgeext from this pin succeeds (2 tasks). |
||
|
ScottW514
|
c177aabefa |
Pin forgeext 0.1.2 on the pushed head
- forgeext 2d0391e -> 31cdb40 (0.1.1 -> 0.1.2): machine_host_token() opens FORGEEXT_HOST_TOKEN_FILE when it is set and not empty, and /run/forgefirm/ext-host.token otherwise (ebdbf59); the rest is host tests (run_test's sender claim, event stream, storage quota and memory.max; install_test's served page; the trimmed kit, ffx and allowlist cases). Proof: the recipe's forgeext, built from 31cdb40 (bitbake forgeext through an untracked externalsrc overlay; packaged /usr/bin/forgeext sha256 15ca6003b59f69fb9eadf686094430fbbd25e7cc177230a0417738484fe3427e), replaced /usr/bin/forgeext on the bench reference's image 20261015101725 and ran with no FORGEEXT_HOST_TOKEN_FILE in its environment. exthost.platform, exthost.service, motion.jog-roundtrip and exthost.motion-job passed on it, in campaign c-20261015103714-0c91: the package's job reached the machine as job:org.forgetest.reference through the host's credential read from the default token file, 6 lines sent and acknowledged, the head moved, the latch locked and no emission throughout. The flashed binary was put back after the run. bitbake -c fetch forgeext resolves this pin. |
||
|
ScottW514
|
66b39c6f2b |
Pin forgectrl 0.1.29, forgeext 0.1.1, grblHAL-glowforge 0.1.20 on the pushed heads, and meta-openglow in the kas lock
The work since the last pins, pushed to each component's default branch, is what the recipes now fetch: - forgectrl 4b39663 (0.1.28 -> 0.1.29): the manual home offset and the gantry stops by name in the panel, the Extensions tab and ui.background, the Grbl sender keep-out, the head camera for local viewers and live video on a package's page, the display units in the bridge's self answer, the crumb tray's switch and offset, the Lens card's fields saved, the listener's cipher order (ChaCha20-Poly1305 first), and the camera pipeline (coherent capture buffers on the GPU path, the two-pass NV12 render, the frame gate, the /cam/status timing, one switch fd). - forgeext 2d0391e (0.1.0 -> 0.1.1): ui.background, sender.keep_out and live video in the SDK, a package removed and installed again started from the new install, and the same ffx archive for the same input. - grblHAL-glowforge b34636f (0.1.19 -> 0.1.20): the manual home offset, the gantry stops by name, the controller port's sender out and in with the keep-out, and the crumb tray's M103 P0 and P1. - kas lock: meta-openglow f1f7f58 -> f012d8e, kernel TLS with the NEON crypto and the TX records in cache lines of their own (patch 0016). Proof: bitbake -c fetch of forgectrl, forgeext, grblhal-glowforge, linux-fslc and kernel-module-glowforge from these pins succeeds (10 tasks), with kas moving layers/meta-openglow to f012d8e. The tree manifest from these pins holds forgectrl at 4b39663 (217 files), forgeext at 2d0391e (90) and the driver at b34636f (177), and the coverage lint over it finds no uncovered path and no empty entry (127 tests). Acceptance: the same trees, through the externalsrc overlay and the mirrored meta-openglow at f012d8e, are image 20260928182434, on which all 127 tests are satisfied (the unattended campaign and the attended tests the operator ran). The meta-openglow move is a platform change; the image built from these pins alone is next. |
||
|
ScottW514
|
9f7744b459 |
Pin forgectrl 0.1.28, forgeext 0.1.0, grblHAL-glowforge 0.1.19, forgefirm-app 0.1.31 on the pushed heads, and meta-openglow in the kas lock
The extensions work, merged into each component's default branch and pushed, is what the recipes now fetch: - forgectrl 55bfae9 (0.1.27 -> 0.1.28): the machine lease, the job runner, the controller port client and motion routes, scoped tokens, the event stream, the built-in registry, the operator's door to extension packages and the Extension packages card, the catalog from its own repository, and privacy advisory revision 4. - forgeext 711f099 (first pin, 0.1.0): the extension host, and ffx new making a package's repository. - grblHAL-glowforge 0da0fe6 (0.1.18 -> 0.1.19): manual homing, the X and Y motor release, the controller port, custom M-codes, the envelope rule, and the homing runner's report secret. - forgefirm-app 021323d (0.1.30 -> 0.1.31): the report secret, and a homing motion cut short failing the home. - kas lock: meta-openglow 71fad52 -> 2978522, the kernel's sandbox options (NF_TABLES, LANDLOCK, MEMCG, the cgroup scheduler) and their notes. Proof: bitbake -c fetch of forgectrl, forgeext, grblhal-glowforge, python3-gfhardware, gfhome, gfcloud and python3-ffmachine from these pins succeeds (14 tasks), with kas moving layers/meta-openglow to 2978522. The tree manifest from these pins holds forgectrl at 55bfae9 (211 files), forgeext at 711f099 (90) and the driver at 0da0fe6 (175), and the coverage lint over it finds no uncovered path (124 tests). Acceptance: the meta-openglow move is a platform change, so the whole catalog runs again on the image built from these pins. |
||
|
ScottW514
|
1e98b37e45 |
forgeext on the image, and the tests of the host and of the consent
The image installs forgeext beside forgefirm-sandbox. The recipe installs the init script from forgeext's own tree (start 91, after forgectrl at 90, whose read-only routes the host takes the machine's state from; stop 9, down before it). The host runs nothing while ext_enabled is 0, the default. setup.extensions-consent (takeover): the Extensions advisory is served and is no first-run document; ext_enabled=1 is refused without the advisory's hash, with a stale one, without the phrase, with the phrase in another case, and whole beside a write the daemon refuses, each leaving the setting and the record on disk untouched; with the hash and the phrase it is accepted, recorded under on_demand.extensions, and the data directory gains the search bit and nothing else. The setting, the directory's mode, and the record are put back, the record under a forgectrl restart. exthost.service (takeover): a reference package built on the board, signed with a key made there and added as an owner key. It is unverified before the key is the owner's and community after; the install is refused without the consent. Turned on over the advisory, the service is looked at from outside (account, no_new_privs, seccomp, group, limits, chain) and from inside (what it can read, write, dial, and open), its first line is looked for in the forgeext logger's file, safe mode stops it, a host killed with the service in its quiet loop takes it along within 2 s and comes back, and ext_enabled=0 leaves no group and no chain. The package, the key, the setting, the mode, and the record are put back, and the extension root is compared with how it was found. The reference package exists only while the test runs: no image carries it, and no image trusts its key. Proven. forgetest's unit suite: 422 tests pass, 0 undefined names. On the bench reference, image 20260920211625 with the cross-built forgectrl and host from /tmp: setup.extensions-consent PASS and, against the image's own daemon, FAIL at its first request; exthost.service PASS and, with the init wrapper's kill taken out, FAIL at the killed-host check. The first runs of exthost.service found what the host tests could not: /data/forgefirm is 0700 on the bench reference, and the service ended with EACCES on its own entry point until forgectrl opened the directory for search with the consent. Acceptance. Both tests are new. exthost.service covers forgeext whole and forgectrl's src/main.c and src/logs.*; setup.extensions-consent covers forgectrl's consent path. The recipe, the image line, and the init script's install are layer content, in the platform identity of every fingerprint. forgeext joins scripts/manifest-from-tree.py with its first pin. |
||
|
ScottW514
|
5ad7ee6faa |
forgeext: the recipe, and the extension-signing key in the keyring
forgeext is the extension host, a component of its own: recipe recipes-forgefirm/forgeext (cmake, pkgconfig, forgefirm-manifest, so it is a manifest component with its own pin file). It links jansson, libarchive, and libsodium, and runs with fwup, the keyring, and forgefirm-sandbox. libarchive and jansson are on the image already; libsodium comes with it. The pin is all zeros because the repository has no pushed commit to name: the recipe builds from a working tree through externalsrc, and a build from pins cannot fetch it until the first push sets the pin. It is not in the image's install list. forgefirm-keys installs a third trust anchor, /etc/forgefirm/keys/ext/forgefirm-ext.pub: the OpenGlow extension-signing public key, the official tier of extension packages. It is a different key from the release key on purpose: it signs more often, and its loss must not sign firmware. forgeext refuses an extension archive whose only valid signature is the release key's or a factory key's. Proven. The recipe cross-builds forgeext from the working tree, and that binary ran the verify-and-install cases on the bench reference (image 20260920211625, from /tmp, with the board's own fwup 1.16.0 and the image's keyring) with the results of the host test. forgefirm-keys builds and packages the key 0644 under ext/ (0755), byte-identical to the file here; it is 32 key bytes and is not the release key. Acceptance. No catalog test reads either yet: forgeext's tests are the exthost suite that comes with its daemon, and the key is layer content, in the platform identity of every fingerprint. |