From 8092f93f0b367b2accc9f8e6b3f53d7a1ddd6615 Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Tue, 12 May 2026 09:41:11 +0200 Subject: [PATCH] docs: Update WIP/HISTORY for Session 152 - APT public repo staging (ref #80) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Session 152 delivered the 10-task staging pipeline: - scripts/{build-packages.sh --filter, lib/tier-manifest.sh, stage-gpg-bootstrap.sh, stage-apt-repo.sh, render-deploy-artifacts.sh, validate-staged-repo.sh} - Output: output/repo/ with InRelease GPG-signed (31848880ED89...) - 9 packages published end-to-end (base + tier-lite × arm64+amd64) - All four validation gates pass including chroot apt-update smoke Co-Authored-By: Claude Opus 4.7 (1M context) --- .claude/HISTORY.md | 65 ++++++++++++++++++++++++++++++++++++++++++++++ .claude/WIP.md | 29 ++++++++++++++++++++- 2 files changed, 93 insertions(+), 1 deletion(-) diff --git a/.claude/HISTORY.md b/.claude/HISTORY.md index 93b2061d..e49ef001 100644 --- a/.claude/HISTORY.md +++ b/.claude/HISTORY.md @@ -4,6 +4,71 @@ --- ## 2026-05-12 +### Session 152 — APT Public Repo Staging Pipeline (Issue #80) + +**Goal:** Stage a complete signed APT repo at `output/repo/` for `bookworm` × {arm64, amd64}, validated end-to-end. User pushes to `apt.secubox.in` out-of-band. + +**Spec & plan:** +- Design: `docs/superpowers/specs/2026-05-12-apt-public-repo-staging-design.md` +- Plan: `docs/superpowers/plans/2026-05-12-apt-public-repo-staging.md` + +**Delivered (10 tasks, 9 commits — merged via PR #82, plus `0f1907df` chroot fix):** + +| Component | Commit | Purpose | +|-----------|--------|---------| +| `scripts/build-packages.sh --filter` + `--dry-run` | `ce82e13d` | Tier-driven build filtering via JSON manifest | +| `scripts/lib/tier-manifest.sh` + hardening | `6f59de25`, `52463db1` | Resolve `base/tier-lite/tier-standard/tier-pro` → JSON package list | +| `scripts/stage-gpg-bootstrap.sh` | `3b99bcf4` | Persistent GPG key at `~/.gnupg/secubox/`, writes `FINGERPRINT.txt` | +| `scripts/stage-apt-repo.sh` | `5f7b8474` | Main orchestrator (GPG → reprepro init → tier loop → check gate) | +| `scripts/render-deploy-artifacts.sh` | `d6fe14d5` | nginx vhost + DEPLOY.md + install.sh + CMSD-1.0 license copies | +| `scripts/validate-staged-repo.sh` + chroot fix | `bb58789b`, `0f1907df` | reprepro check + gpg verify + license cmp + chroot apt-update smoke | +| `.gitignore` for staging artifacts | `197eba63` | Ignore `output/repo/{db,pool,dists,conf,gpg}` and build logs | + +**Tooling used:** + +- `secubox gen --tier --board mochabin --out ` (existing Go CLI; emits `manifest.yaml`) +- `reprepro` with persistent `~/.gnupg/secubox/` keyring (SignWith fingerprint) +- `dpkg-buildpackage` + `crossbuild-essential-arm64` (already installed) +- `python3-yaml` (for parsing `secubox gen` output) + +**End-to-end validation (base + tier-lite × arm64+amd64):** + +- 9 packages published, all `Architecture: all` +- `reprepro check` clean +- `gpg --verify InRelease` → Good signature, fingerprint `31848880ED89C1722677D75A25C9E32645166DB9` +- License files byte-match project root +- `chroot apt-get update` against `file://output/repo/` succeeds (sees SecuBox repo) + +**Important finding (arch:all dominance):** + +| Architecture field | Count | +|--------------------|-------| +| `all` | 130 | +| `any` | 2 (`secubox-daemon`, `zkp-hamiltonian`) | + +130/132 SecuBox packages are `Architecture: all` — the cross-arch (arm64 vs amd64) split is mostly cosmetic. The two `Architecture: any` packages aren't in `build-packages.sh`'s `PACKAGES=` list, so the `arm64` pool count is currently 0. Adding them is separate work. + +**GPG signing key:** + +- UID: `SecuBox Package Signing Key (apt.secubox.in) ` +- Fingerprint: `31848880ED89C1722677D75A25C9E32645166DB9` +- Home: `~/.gnupg/secubox/` (persistent across rebuilds) +- Public key: `output/repo/secubox-keyring.gpg` (ASCII-armored) + `.bin` + +**Open item (not blocking):** + +- TLS cert for `apt.secubox.in` shows `ERR_TLS_CERT_ALTNAME_INVALID` — must be re-issued by certbot for the exact SAN. Recipe is in `output/repo/DEPLOY.md`. + +**Next steps (user):** + +1. Optional: full pipeline run with `bash scripts/stage-apt-repo.sh` (no flags = all four tiers, 30-90 min). +2. rsync to `apt.secubox.in` per `output/repo/DEPLOY.md` (excludes `db/`, `gpg/`, `conf/`). +3. certbot --nginx for cert; verify SAN includes `apt.secubox.in`. +4. Smoke-test from clean client: `curl -fsSL https://apt.secubox.in/install.sh | sudo bash && sudo apt-get update`. +5. Close issue #80 on success. + +--- + ### Session 151 — Fix Sidebar Mobile Mode False-Positive on Touch Desktops **Goal:** Sidebar of secubox-hub forced mobile mode (hamburger + hidden sidebar) on Firefox PC because the detection logic used `isTouchDevice() || isNarrowViewport()` — any touch signal (touchscreen laptop, Firefox `pointer: coarse`, `maxTouchPoints > 0`) triggered mobile UX at desktop widths. diff --git a/.claude/WIP.md b/.claude/WIP.md index 8c46b300..515a4fad 100644 --- a/.claude/WIP.md +++ b/.claude/WIP.md @@ -1,5 +1,32 @@ # WIP — Work In Progress -*Mis à jour : 2026-05-12 (Session 149)* +*Mis à jour : 2026-05-12 (Session 152)* + +--- + +## ✅ Session 152: APT Public Repo Staging Pipeline (Issue #80) + +### Objective +Stage a signed APT repo at `output/repo/` for bookworm × {arm64, amd64}, validated end-to-end. User pushes to `apt.secubox.in` out-of-band. + +### Completed +- Brainstormed design → `docs/superpowers/specs/2026-05-12-apt-public-repo-staging-design.md` +- Implementation plan → `docs/superpowers/plans/2026-05-12-apt-public-repo-staging.md` +- All 10 tasks delivered. Pipeline runs end-to-end on base + tier-lite × arm64+amd64; 9 packages published; all four validation gates pass (`reprepro check`, `gpg --verify InRelease`, license byte-match, chroot `apt-get update`). +- GPG fingerprint: `31848880ED89C1722677D75A25C9E32645166DB9` (persistent in `~/.gnupg/secubox/`) +- Deploy artifacts ready: `output/repo/{nginx-apt.conf, DEPLOY.md, install.sh, LICENCE-CMSD-1.0.md, LICENSE-CMSD-1.0.en.md, secubox-keyring.gpg, FINGERPRINT.txt, MANIFEST.txt}` + +### Key finding +130/132 SecuBox packages are `Architecture: all`. Only `secubox-daemon` and `zkp-hamiltonian` are `Architecture: any`, and neither is in `scripts/build-packages.sh`'s PACKAGES list. So the arm64-specific pool is currently empty; adding those two to the build list is separate work. + +### Next steps (pending user action) +1. Optional: full pipeline (`bash scripts/stage-apt-repo.sh`) for all four tiers (30-90 min). +2. rsync staged tree to `apt.secubox.in` per `output/repo/DEPLOY.md`. +3. certbot --nginx; verify SAN includes `apt.secubox.in` (fixes the current `ERR_TLS_CERT_ALTNAME_INVALID`). +4. Validate from clean client: `curl -fsSL https://apt.secubox.in/install.sh | sudo bash && sudo apt-get update`. +5. Close issue #80. + +### Commits (merged via PR #82, plus `0f1907df` follow-up) +`ce82e13d` `6f59de25` `52463db1` `3b99bcf4` `5f7b8474` `d6fe14d5` `bb58789b` `197eba63` `0f1907df` ---