docs(tracking): 2026-06-01 — #436 chain closed (v2.13.5→v2.13.10) + rpi400 kiosk verified

The kiosk regression filed 2026-05-31 (#433 → #436) is closed. Five back-to-back PRs (#437/#438/#439/#440/#441) and six tags (v2.13.5 → v2.13.10) to make `--kiosk` actually produce a working image. The v2.13.10 rpi400 image was downloaded from the workflow artifact (Release didn't publish due to orthogonal arch failures), flashed, and every kiosk artefact verified on the SD. HISTORY entry documents the table of (tag, PR, failure exposed, fix) plus the lessons learned about debootstrap+qemu chroots : - bind /run from host → systemctl needs SYSTEMD_OFFLINE=1 wrapper - policy-rc.d 101 to block invoke-rc.d daemon starts - mountpoint primitive : self-bind, NOT tmpfs (preserves postinst writes through teardown) - `[[ -e symlink ]]` follows target → use relative symlinks WIP : marks the 5 PRs done, lists remaining orthogonal arch builds + pending #434 (kiosk lockdown) + PR #429 (NC dashboard). TODO : v2.13.10 added to GREEN line, #433 marked closed, espressobin / live-amd64 / mochabin builds queued for separate investigation.
2026-07-29 09:14:00 +00:00 · 2026-06-01 16:16:19 +02:00 · 2026-06-01 16:16:19 +02:00 · 04ab1dee61
commit 04ab1dee61
parent 5b68fc403f
3 changed files with 127 additions and 12 deletions
--- a/.claude/HISTORY.md
+++ b/.claude/HISTORY.md
@ -3,6 +3,70 @@

 ---

+## 2026-06-01 — kiosk-on-rpi400 actually ships : the #436 chain (PRs #437–#441)
+
+Closing the kiosk regression discovered the day before. Five back-to-back PRs,
+six tags (v2.13.5 → v2.13.10) to make `--kiosk` actually produce a working
+image. The previous day's PR #435 made the assertion fail-loud, this day made
+it pass.
+
+### The full chain
+
+| Tag | PR | Issue | Failure exposed | Fix |
+|-----|-----|-------|-----------------|-----|
+| v2.13.5 | #435 (D-1) | #433 | `[OK] Kiosk installed` lied | fail-loud + pre-rsync assertion |
+| v2.13.6 | #437 | #436 | `Failed to connect to bus: Host is down` (cascade through secubox-* postinsts) | systemctl wrapper exports `SYSTEMD_OFFLINE=1`; `policy-rc.d` blocks invoke-rc.d; tmpfs at `/boot/firmware` (64M) |
+| v2.13.7 | #438 | #436 | ENOSPC on tmpfs + `findmnt: can't read /proc/mounts` | tmpfs 64M → 512M + bind-mount `/proc`,`/sys` into chroot |
+| v2.13.8 | #439 | #436 | `secubox-kiosk.service not in graphical.target.wants/` (SYSTEMD_OFFLINE doesn't always materialise WantedBy symlinks) | explicit `ln -sf` of the WantedBy symlink |
+| v2.13.9 | #440 | #436 | assertion still failed on the symlink — symlink target was absolute, host `[[ -e ]]` couldn't follow | switch to relative target (`../secubox-kiosk.service`) |
+| **v2.13.10** | **#441** | #436 | Step 7 : `config.txt: No such file` — tmpfs at `/boot/firmware` discarded raspi-firmware's writes on umount | tmpfs → `mount --bind ${ROOTFS}/boot/firmware ${ROOTFS}/boot/firmware` (self-bind preserves writes) |
+
+### Verification
+
+* `secubox-rpi-arm64-bookworm.img.gz` v2.13.10 downloaded from the
+  build-live-usb workflow artifact (1940 MB) — the GitHub release didn't
+  publish (`create-release` failed on the OTHER arch jobs that are
+  still broken : x64 live, mochabin live, espressobin-v7, espressobin-ultra)
+  but the rpi400 image itself built clean.
+* sha256sum matched.
+* Flashed `/dev/mmcblk0` (28.8 G microSD), 8.6 GB written at 37.8 MB/s.
+* Mounted p2 read-only and verified EVERY artefact :
+  - `/var/lib/secubox/boot-mode` = `kiosk` ✓
+  - `/etc/systemd/system/default.target` → `/lib/systemd/system/graphical.target` ✓
+  - `/etc/systemd/system/secubox-kiosk.service` (434 bytes) ✓
+  - `/etc/systemd/system/graphical.target.wants/secubox-kiosk.service` → `../secubox-kiosk.service` (relative) ✓
+  - `/usr/bin/chromium` ✓
+  - `/usr/share/secubox/kiosk/secubox-kiosk.sh` ✓
+
+### What this teaches about debootstrap+qemu chroots
+
+* `/run/systemd/system` being bind-mounted from the host makes systemctl
+  believe systemd is running, which breaks every offline operation. The
+  wrapper-with-SYSTEMD_OFFLINE pattern is the standard fix.
+* `policy-rc.d` returning 101 is the OTHER half — blocks invoke-rc.d
+  from trying to actually start daemons during apt operations.
+* For mountpoints needed by build-time hooks (raspi-firmware checks
+  `mountpoint -q /boot/firmware`), **bind-mount on self** is the right
+  primitive — NOT tmpfs. tmpfs throws away the postinst's writes ;
+  self-bind preserves them in the underlying directory.
+* `[[ -e symlink ]]` follows the symlink target. From the build host's
+  perspective, absolute symlinks created inside `${ROOTFS}` point to
+  paths outside `${ROOTFS}`. Use relative symlinks (matches systemctl's
+  own convention anyway).
+
+### Open follow-ups (non-blocking)
+
+* `build-live-usb` x64 amd64 — preexisting failure, separate from this chain.
+* `build-mochabin-live-usb` — same.
+* `build-image espressobin-v7` / `-ultra` — preexisting hardware-profile
+  issues, separate.
+* Release `create-release` job will keep failing as long as those four are
+  red. APT publish for v2.13.10 is therefore not present — rpi-arm64 +
+  amd64 .debs are still available from v2.13.4's APT repo, which is the
+  current install path.
+
+---
+
 ## 2026-05-31 — v2.13.3 → v2.13.4 cross-build finally green + media + kiosk regressions

 Major release-pipeline day. The arm64 publish path that's been broken since
--- a/.claude/TODO.md
+++ b/.claude/TODO.md
@ -1,18 +1,31 @@
 # TODO — SecuBox-DEB Backlog
-*Mis à jour : 2026-05-31*
+*Mis à jour : 2026-06-01*

 ---

 ## 🔥 P0 — Immediate (in flight)

-### Release pipeline ✅ v2.13.4 GREEN
+### Release pipeline ✅ v2.13.4 APT GREEN + v2.13.10 rpi400 image GREEN

 - [x] **v2.13.4** taggé, Release CI vert, **APT publish OK pour la 1ʳᵉ fois
  depuis v2.13.0**. 153 release assets dont 5 arm64. Chaîne complète : #425
  (`dh_shlibdeps -X`) + #427/PR #428 (`-a matrix.arch`) + #431/PR #432
  (`binutils-aarch64-linux-gnu`).
+- [x] **v2.13.10** rpi400 image build SUCCESS via PRs #437/#438/#439/#440/#441
+  (#436 closed). Image téléchargée depuis le workflow artifact (Release n'a
+  pas publié à cause des autres archs cassées), flashée + kiosk artefacts
+  tous vérifiés. **Boot test physique Pi 400 à faire**.

-### Issues filées 2026-05-31 (à traiter post-v2.13.4)
+### Espressobin / live-amd64 / mochabin builds (à traiter séparément)
+
+- [ ] `build-live-usb x64 amd64` failure préexistante depuis v2.13.x — bloque
+  la publication GH Release sur tous les tags.
+- [ ] `build-mochabin-live-usb` failure préexistante.
+- [ ] `build-image espressobin-v7` / `-ultra` failure préexistante.
+
+Ces 4 jobs sont distincts du chain kiosk #436. À investiguer un par un.
+
+### Issues ouvertes filées 2026-05-31 (post-v2.13.4)

 - [ ] **PR #429** à OUVRIR : branche `feature/429-secubox-nextcloud-dashboard-api-renvoie`
  pushée (commit `b715c0e4`), fix déployé live sur gk2 mais pas encore mergé
@ -25,14 +38,8 @@
  `/api/v1/nextcloud/federation/trusted-servers`, test d'intégration avec
  une seconde LXC NC factice.

- [ ] **#433** `build-rpi-usb.sh --kiosk` silently fails : malgré le log
-  `[OK] Kiosk mode installed and enabled`, l'image v2.13.4 ne contient ni
-  chromium/X/openbox ni `secubox-kiosk.service` ni `boot-mode=kiosk`.
-  Cause partielle : `chroot apt-get install ...` foire en qemu-arm64
-  (broken deps), `|| warn` swallow le fail. Le `cat > .service` heredoc
-  devrait quand même produire le fichier mais il n'y est pas. Fix :
-  fail-loud sur apt + assertion build-time pré-rsync vérifiant que les
-  artefacts kiosk sont bien dans `${ROOTFS}`.
+- [x] **#433** `build-rpi-usb.sh --kiosk` silently fails — closed by PR #435
+  (fail-loud + assertion). Subsequent #436 chain made the assertion pass.

 - [ ] **#434** kiosk login lockdown après N attempts (CSPN hardening) :
  frontend kiosk login switch vers template `<lockdown />` après N fails
--- a/.claude/WIP.md
+++ b/.claude/WIP.md
@ -1,5 +1,49 @@
 # WIP — Work In Progress
-*Mis à jour : 2026-05-31*
+*Mis à jour : 2026-06-01*
+
+---
+
+## 🔄 2026-06-01 : kiosk-on-rpi400 actually ships (#436 closed)
+
+### ✅ Done
+
+* **5 PRs / 6 tags v2.13.5 → v2.13.10** pour faire passer `--kiosk` du stub
+  au vrai. Voir HISTORY.md 2026-06-01 pour la table complète des failures
+  exposées à chaque itération.
+* **#436 chain résolu** :
+  - PR #437 (v2.13.6) — chroot safety net (systemctl wrapper exporte
+    `SYSTEMD_OFFLINE=1`, `policy-rc.d` retourne 101, tmpfs 64M `/boot/firmware`).
+  - PR #438 (v2.13.7) — tmpfs 64M → 512M (ENOSPC sur initrd) + bind `/proc` et
+    `/sys` (raspi-firmware utilise findmnt).
+  - PR #439 (v2.13.8) — force `graphical.target.wants/secubox-kiosk.service`
+    symlink (SYSTEMD_OFFLINE ne le matérialise pas toujours).
+  - PR #440 (v2.13.9) — symlink relatif au lieu d'absolu (host `[[ -e ]]`
+    ne peut suivre un chemin absolu hors `${ROOTFS}`).
+  - PR #441 (v2.13.10) — tmpfs → `mount --bind ${ROOTFS}/boot/firmware
+    ${ROOTFS}/boot/firmware` (tmpfs jetait les fichiers raspi-firmware au
+    umount, self-bind les préserve).
+* **Image v2.13.10 rpi400 téléchargée depuis le workflow artifact**
+  (build-live-usb-rpi400 = SUCCESS, le Release n'a pas publié à cause des
+  autres archs cassées). 1940 MB compressé, sha256 ✓.
+* **SD `/dev/mmcblk0` flashée** v2.13.10 — 8.6 GB en 227s @ 37.8 MB/s.
+* **Tous les artefacts kiosk vérifiés** sur la SD :
+  boot-mode=kiosk, default.target → graphical.target,
+  secubox-kiosk.service présent, WantedBy symlink relatif OK,
+  chromium installé, `/usr/share/secubox/kiosk/secubox-kiosk.sh` présent.
+
+### ⬜ Next up / carry-overs
+
+* **Boot test physique** Pi 400 avec la SD v2.13.10 — confirmer que le
+  kiosk chromium s'affiche bien sur HDMI au 1er boot.
+* Release `create-release` job rouge à cause de :
+  - `build-live-usb x64 amd64` (préexistant)
+  - `build-mochabin-live-usb` (préexistant)
+  - `build-images espressobin-v7` / `-ultra` (préexistant)
+  À traiter séparément du chain kiosk.
+* **#434** kiosk lockdown design (frontend + backend rate-limit + admin unlock).
+* **PR #429** NC dashboard fix encore à ouvrir (branche pushée).
+* **#421** sockets `/run/secubox/*.sock` + `#422` vm-x64 cascade.
+* **cloud.gk2.secubox.in** pas dans `nextcloud.conf` server_name.

 ---