| 1 | # Census overlay install-console-upgrade (claims install-console --upgrade --from <sha256>: replace a guard-armed box's protected console, found by platform-d8's harness rolling dev's console to v0.28.5), loaded LAST, after armed-box-updates. PROPOSED-install-console-upgrade, asked of the census owner; the proposal is docs/superpowers/notes/census-proposal-install-console-upgrade.md. |
| 2 | # Every row keeps its latest existing class and task (authority G,J4, as census-ruling-claim-step6-artifacts and -fix1 ruled for the installer and runSystemClaims); new units take their caller's. No accepted-legacy row, so the seal stands. No box agent, update, recovery or edge path reaches any changed unit. The 9B8 inventory is unchanged. |
| 3 | # Round 2 (Astra's review of da0a33b7, MERGE: block): F1 refuses a source aliasing console, console.prev or console.next, by path and by device and inode (readConsoleSource's read moves into readConsoleSourceFile); F2 fsyncs the directory before a non-dry Already; F3 refuses a slot over 512 MiB instead of hashing its prefix (consoleDigest, consoleCounter.Read). Same marker; the delta is asked to be re-ruled. |
| 4 | @coverage internal/host 558ba713ea71cd14d2856d8d2a0dd6cdeb44f22cd61185ca2681dd82fad38cc9 |
| 5 | @remove internal/host/activation_artifacts_linux.go consoleSlotHolds |
| 6 | @remove internal/host/activation_artifacts_linux.go readConsoleSource |
| 7 | internal/host/activation_command_linux.go runSystemClaims authority G,J4 rev3=census-ruling-install-console-upgrade;identity=explicit operator CLI uid 0;basis=as census-ruling-claim-step6-artifacts-fix1; install-console also takes --upgrade --from <sha256>, which upgradeFlagsRefused (no read site) admits only together and only for install-console, refusing them elsewhere as unknown flags were; without --upgrade the install path and its output are unchanged file:Read@1761 28f797267906832947199d7a1620345f036b6c4cb405b3b42ffab94c209a5e01 |
| 8 | internal/host/activation_artifacts_linux.go consoleSlotSHA authority G,J4 rev3=census-ruling-install-console-upgrade;identity=explicit box installer uid 0 (claims install-console --upgrade);basis=consoleSlotHolds's read moved here unchanged and tightened: a slot is absent, or a root:root 0755 regular file with one link, checked on the entry not followed and again on the descriptor (same device and inode) then hashed through consoleDigest, which refuses a slot over 512 MiB rather than hashing its prefix; anything else refuses. consoleSlotHolds (now no read site) compares the hash as before file:Fstat@597,file:Fstatat@91 c70ad73a0cb712b0be9d10fe32436c222983278706bde6530ffa0a2d8f34933d |
| 9 | internal/host/activation_artifacts_linux.go upgradeProtectedConsole authority G,J4 rev3=census-ruling-install-console-upgrade;identity=explicit box installer uid 0 (claims install-console --upgrade);basis=source verified against the published identity's console sha256 before the directory is opened; a source path in the console directory refuses, and under the lock so does a source whose descriptor has the device and inode of console, console.prev or console.next (round 2, F1); directory checked as consoleDir and never created; under its exclusive flock console must hash to --from (or be absent with console.prev hashing to --from, a run cut off between its renames), console.prev may hold anything of the same shape; console already the target is Already, after fsyncing the directory on a non-dry run (round 2, F2); a leftover console.next is removed only if a regular file; writes console.next, renames console to console.prev and console.next to console, fsyncs the directory, reads both back through hostfloor.OpenProtected and consoleDigest; dry run writes nothing file:Fstat@2622,file:Fstatat@1640,file:Fstatat@905 03605a615c7ee020f7deca032d2aeecde3fa43b8017c5dd91134374b701b05f4 |
| 10 | internal/host/activation_artifacts_linux.go writeConsoleTemp authority G,J4 rev3=census-ruling-install-console-upgrade;identity=explicit box installer uid 0 (claims install-console --upgrade);basis=exclusive no-follow create of console.next in the locked directory, writes the verified body, chmod 0755, requires root:root and one link on the descriptor, fsyncs file:Fstat@353 227c4d8eb65491d4ba0bbd1d91c90bfd82962b2c15f20e59d04f920f36e5d001 |
| 11 | internal/host/activation_artifacts_linux.go readConsoleSourceFile authority G,J4 rev3=census-ruling-install-console-upgrade;identity=explicit box installer uid 0 (claims install-console, with or without --upgrade);basis=readConsoleSource's read moved here unchanged (round 2, F1): the source opened with no symlink followed on its path, regular file with one link, at most 512 MiB, refused unless it hashes to the identity's console sha256; it also returns the descriptor's stat so an upgrade can refuse a source that is one of its own slots. readConsoleSource (now no read site) wraps it for the first install file:Fstat@220,file:OpenFile@109,file:ReadAll@302 353d920fac5dc3fab8d6512e5d4ecc19648258a7e580d66cb0e1321e37a8b6ff |
| 12 | internal/host/activation_artifacts_linux.go consoleDigest authority G,J4 rev3=census-ruling-install-console-upgrade;identity=explicit box installer uid 0 (claims install-console --upgrade) and the first install's slot checks through consoleSlotHolds;basis=round 2, F3: hashes a held console slot through EOF; refuses a size over 512 MiB by fstat and by the bytes read (consoleCounter), never hashing a prefix file:Fstat@80 2dadc9634701dbc006ed8f32e321562a0968af0e0b8433510327c6d7d010db64 |
| 13 | internal/host/activation_artifacts_linux.go consoleCounter.Read authority G,J4 rev3=census-ruling-install-console-upgrade;identity=explicit box installer uid 0 (claims install-console --upgrade);basis=round 2, F3: passes reads through from consoleDigest's bounded reader of a held slot and counts them; no path, no decision of its own file:Read@25,file:Read@66 08f4c255e542f87139c5addb173b18649c7266735b85165b3e63a69e7462755f |
| 14 | |
amadan