feat/poudriere-agent-vault-tarsnap-0.15.1 #39

Merged

clawdie merged 9 commits from feat/poudriere-agent-vault-tarsnap-0.15.1 into main

2026-11-01 10:24:16 +01:00

clawdie commented

2026-11-01 10:24:09 +01:00

Owner

No description provided.

clawdie added 9 commits

2026-11-01 10:24:09 +01:00

feat(poudriere): add sysutils/agent-vault port, tarsnap pkg prerequisites, and build-time login-server 12ffb089ac

fix(agent-vault): provision avbroker account, wire stage helper, and lock 0.40.0 tarball distinfo 5210724bfe

fix(poudriere): use 0600 curl --config Basic auth and round-trip verify in distfile publisher f4404e7242

fix(ports): add BEFORE: colibri herdr rcorder header to agent_vault.in 213b1c43b5

- Match the verified Poudriere package built on valhala (agent-vault-0.40.0.pkg,
  SHA256 a1635283a9c7d55f4bc4bf23e78ec02a80222a42e87ea6ca70206655ce617811)
- Add regression assertion for '# BEFORE: colibri herdr' in agent-vault-port-test.sh

fix(ports,iso): remediate 3x3 service boundary audit across agent-vault, openviking, and sova 3094569622

- Fix P0 staged ownership bug where install_memory_clients (build.sh:3250) ran
  after configure_live_operator_session (build.sh:2083), leaving .openviking
  (0700) and ovcli.conf (0600) owned by root:wheel; enforce clawdie:clawdie and
  colibri:colibri ownership in both stage-memory-clients-iso.sh and build.sh
- Add package-time USERS/GROUPS and upstream-free UID/GID definitions for
  sysutils/openviking (openviking 810:810) and databases/oxigraph (sova 829:829)
- Ship @sample(root,openviking,0640) etc/openviking/ov.conf.sample with FreeBSD
  memory pathlock default and verify ov.conf readability as openviking via su -m
- Align rcorder across agent_vault.in, openviking.in, and sova.in to
  'BEFORE: colibri_daemon' (matching colibri_daemon.in PROVIDE: colibri_daemon)
- Export explicit HOME=/var/db/openviking and HOME=/var/db/sova, refuse
  symlinked parent directories, validate distinct numeric Agent Vault ports,
  probe both API (:14321) and proxy (:14322) in service agent_vault health, and
  fail closed (exit 65) on numeric UID/GID 830 collisions in stage-agent-vault-iso.sh
- Document honest loopback local-host trust boundary, clarify local file://
  consumption in poudriere-build.sh, and expand the 3 test suites (91/91 passing)

fix(openviking): pass OPENVIKING_CFG via env to su -m readability check 9a8257765e

refactor(ports): unify agent-vault, openviking, and sova on clawdie user with zero custom UIDs/GIDs 6bc0fa40b4

fix(ports): apply valhala build and runtime fixes for agent-vault and openviking 318f9c9c3e