HOMELAB-2479: fix(ghostty-ssh-fixture): re-sync vendored sshd-fixture.sh to app live 26eca1a4 #885

Merged

pi-landing merged 1 commit from plane/HOMELAB-2479-fixture-resync into live 2026-11-07 02:36:18 +00:00

Conversation 2 Commits 1 Files changed 3 +28 -14

pi-landing commented 2026-11-07 00:58:29 +00:00

Collaborator

Copy link

What

The pinned FIXTURE_IMAGE for the android-emu lane still carries
com.ghostty.fixture-script.sha256=7ad2dfee…aed9 — the GITS-364 sync. The
ghostty-in-the-shell live script has moved since:

object	field	value
ghostty-in-the-shell commit 26eca1a4a0ef41ad4dfab5688b7a2aa714a67d48	fixtures/sshd-fixture.sh sha256	922a1bd930f64ab819883baafa34fb3aa4d9d50b81d7798c29e122440d7ddac2
ghostty-in-the-shell live tip d2b1d7cbb0b069382ae9f08b9c8fe8c0a3ca7012	fixtures/sshd-fixture.sh sha256	922a1bd930f64ab819883baafa34fb3aa4d9d50b81d7798c29e122440d7ddac2
Harbor platform/ghostty-ssh-fixture:3e59ad7	OCI label com.ghostty.fixture-script.sha256	7ad2dfeebae106b9d033f5843378d49dfb7241e14f0c08134f0d21f83264aed9

Both hashes are the same object (git rev-parse 26eca1a4:fixtures/sshd-fixture.sh
→ blob 838a4cd8986cd62ba24fd51beb3ddad0e4abf94e, 36309 bytes) and the commit is
an ancestor of the live tip, so this rebuild targets one script, not a moving
target. The delta between the vendored 7ad2dfee copy and 922a1bd9 is the
GITS-499 fix only: drop a stale $HOME/.config/herdr/sessions/<sess>/herdr.sock
before launching the session server, and retry the readiness probe within a
bounded ~10 s window instead of a single poll.

Change (the three GITS-364 lockstep pins, moved together)

1. platform/ghostty-ssh-fixture/fixtures/sshd-fixture.sh — byte-identical
   copy of ghostty-in-the-shell 26eca1a4:fixtures/sshd-fixture.sh
   (blob 838a4cd8, sha256 922a1bd9…d7ddac2, 36309 bytes).
2. platform/ghostty-ssh-fixture/Dockerfile — ARG FIXTURE_SCRIPT_SHA256
   default → 922a1bd9…d7ddac2; header comment records the new sync point.
   COPY … /fixture/bin/sshd-fixture.sh (the spec'd install path) and the
   com.ghostty.fixture-script.sha256="${FIXTURE_SCRIPT_SHA256}" label are
   unchanged, so the label follows the pin.
3. .forgejo/workflows/emu-images.yaml — build-fixture verify-step
   FIXTURE_SCRIPT_SHA256 env pin → 922a1bd9…d7ddac2.

No fixture-entrypoint.sh, no emulator path, no secret/material change.

Self-test contract (unchanged, fail-capable in this PR's CI)

The RUN-stage self-test inside the Dockerfile still has to pass on the new
script, and each check can fail the build:

• sha256sum --check --strict of /fixture/bin/sshd-fixture.sh against the pin
• herdr --version == herdr 0.9.1
• sshd-fixture.sh start --session default exits non-zero and prints
  refusing session name 'default' (the name policy is untouched by the delta)
• a real start + /usr/sbin/sshd -t + stop round-trip

The workflow re-prints those against the finished image and additionally proves
the runtime control API (add-key + a real ssh login), the keystore scan with
its planted negative, and that wrong HERDR_SHA256 / FIXTURE_SCRIPT_SHA256
build-args each fail the build.

Proof surface and promotion

The build-fixture job on this PR head is the build+verify proof (PRs never
receive registry credentials — the Push to Harbor step is
if: github.event_name != 'pull_request'). On the push to live that run
publishes harbor.aaron.reynoza.org/platform/ghostty-ssh-fixture:<merge-short-sha>
and prints crane digest; consumers pin that immutable digest.

Ref: HOMELAB-2479, GITS-364 (previous sync, infra-core #709), GITS-499.

## What The pinned `FIXTURE_IMAGE` for the android-emu lane still carries `com.ghostty.fixture-script.sha256=7ad2dfee…aed9` — the GITS-364 sync. The `ghostty-in-the-shell` live script has moved since: | object | field | value | |---|---|---| | `ghostty-in-the-shell` commit `26eca1a4a0ef41ad4dfab5688b7a2aa714a67d48` | `fixtures/sshd-fixture.sh` sha256 | `922a1bd930f64ab819883baafa34fb3aa4d9d50b81d7798c29e122440d7ddac2` | | `ghostty-in-the-shell` live tip `d2b1d7cbb0b069382ae9f08b9c8fe8c0a3ca7012` | `fixtures/sshd-fixture.sh` sha256 | `922a1bd930f64ab819883baafa34fb3aa4d9d50b81d7798c29e122440d7ddac2` | | Harbor `platform/ghostty-ssh-fixture:3e59ad7` | OCI label `com.ghostty.fixture-script.sha256` | `7ad2dfeebae106b9d033f5843378d49dfb7241e14f0c08134f0d21f83264aed9` | Both hashes are the same object (`git rev-parse 26eca1a4:fixtures/sshd-fixture.sh` → blob `838a4cd8986cd62ba24fd51beb3ddad0e4abf94e`, 36309 bytes) and the commit is an ancestor of the live tip, so this rebuild targets one script, not a moving target. The delta between the vendored `7ad2dfee` copy and `922a1bd9` is the GITS-499 fix only: drop a stale `$HOME/.config/herdr/sessions/<sess>/herdr.sock` before launching the session server, and retry the readiness probe within a bounded ~10 s window instead of a single poll. ## Change (the three GITS-364 lockstep pins, moved together) 1. `platform/ghostty-ssh-fixture/fixtures/sshd-fixture.sh` — byte-identical copy of `ghostty-in-the-shell` `26eca1a4:fixtures/sshd-fixture.sh` (blob `838a4cd8`, sha256 `922a1bd9…d7ddac2`, 36309 bytes). 2. `platform/ghostty-ssh-fixture/Dockerfile` — `ARG FIXTURE_SCRIPT_SHA256` default → `922a1bd9…d7ddac2`; header comment records the new sync point. `COPY … /fixture/bin/sshd-fixture.sh` (the spec'd install path) and the `com.ghostty.fixture-script.sha256="${FIXTURE_SCRIPT_SHA256}"` label are unchanged, so the label follows the pin. 3. `.forgejo/workflows/emu-images.yaml` — `build-fixture` verify-step `FIXTURE_SCRIPT_SHA256` env pin → `922a1bd9…d7ddac2`. No `fixture-entrypoint.sh`, no emulator path, no secret/material change. ## Self-test contract (unchanged, fail-capable in this PR's CI) The RUN-stage self-test inside the Dockerfile still has to pass on the new script, and each check can fail the build: - `sha256sum --check --strict` of `/fixture/bin/sshd-fixture.sh` against the pin - `herdr --version` == `herdr 0.9.1` - `sshd-fixture.sh start --session default` exits non-zero and prints `refusing session name 'default'` (the name policy is untouched by the delta) - a real `start` + `/usr/sbin/sshd -t` + `stop` round-trip The workflow re-prints those against the finished image and additionally proves the runtime control API (`add-key` + a real ssh login), the keystore scan with its planted negative, and that wrong `HERDR_SHA256` / `FIXTURE_SCRIPT_SHA256` build-args each fail the build. ## Proof surface and promotion The `build-fixture` job on this PR head is the build+verify proof (PRs never receive registry credentials — the `Push to Harbor` step is `if: github.event_name != 'pull_request'`). On the push to `live` that run publishes `harbor.aaron.reynoza.org/platform/ghostty-ssh-fixture:<merge-short-sha>` and prints `crane digest`; consumers pin that immutable digest. Ref: HOMELAB-2479, GITS-364 (previous sync, infra-core #709), GITS-499.

pi-landing added 1 commit 2026-11-07 00:58:30 +00:00

HOMELAB-2479: fix(ghostty-ssh-fixture): re-sync vendored sshd-fixture.sh to app live 26eca1a4 ... d9fe5ccbee

The pinned FIXTURE_IMAGE label still carries 7ad2dfee (the GITS-364 sync).
ghostty-in-the-shell live tip d2b1d7cb ships fixtures/sshd-fixture.sh
922a1bd9 (GITS-499: stale herdr session-socket removal + bounded readiness
retry), so the emu drift gate in .forgejo/workflows/emu.yaml compares the
image label against a script that no longer matches.

Moves the three lockstep pins together, exactly as GITS-364 established:
  platform/ghostty-ssh-fixture/fixtures/sshd-fixture.sh
    byte-identical copy of app repo 26eca1a4:fixtures/sshd-fixture.sh
    (git blob 838a4cd8, sha256 922a1bd9...d7ddac2)
  platform/ghostty-ssh-fixture/Dockerfile
    ARG FIXTURE_SCRIPT_SHA256 default -> 922a1bd9...
  .forgejo/workflows/emu-images.yaml
    build-fixture verify-step FIXTURE_SCRIPT_SHA256 -> 922a1bd9...

The RUN-stage self-test contract is unchanged and still satisfied: the CLI
surface (start/env/stop/add-key) and the 'default' refusal are untouched by
the delta; the change only drops a stale herdr session socket before launch
and retries readiness within a bounded 10s window.

ld-reviewer commented 2026-11-07 01:28:45 +00:00

Collaborator

Copy link

Verdict: APPROVE — exact-head review of the fixture resync

head d9fe5ccbee

model: omniroute/deepseek-flash
session: 01a1b399-a65a-7055-9162-9a142dded6ee

Classification: DANGEROUS CLASS (one of two required seats)

The changed set includes .forgejo/workflows/emu-images.yaml, which matches the oversight path .forgejo/** in DEFAULT_LANDING_POLICY.dangerousPaths (forgejo/landing.ts, defaults block). FORGEJO_DANGEROUS_PATHS and FORGEJO_LANDING_REVIEWERS were both unset in this session, so the default list applies verbatim; the repo owner (Homelab) is not in legacyPanelOwners (jesus, Sendrast), so the standard rule governs: this head needs TWO approvals from TWO INDEPENDENT reviewer sessions, one of them premium tier. This seat is one of the two; it is NOT sufficient on its own.

Evidence, from primary sources

(a) Spec sha, computed by me from the head, not copied from the body: git show d9fe5ccbeef46dde7869b461f9ad28a8eb4a42c2:platform/ghostty-ssh-fixture/fixtures/sshd-fixture.sh piped to sha256sum gives 922a1bd930f64ab819883baafa34fb3aa4d9d50b81d7798c29e122440d7ddac2, 36309 bytes, blob 838a4cd898. Same sha256, same length and same blob id as ghostty-in-the-shell 26eca1a4a0ef41ad4dfab5688b7a2aa714a67d48:fixtures/sshd-fixture.sh, and the same object is still the app repo's live tip (d2b1d7cbb0b069382ae9f08b9c8fe8c0a3ca7012). This equals the acceptance value exactly.

(b) Dockerfile at the head: ARG FIXTURE_SCRIPT_SHA256 defaults to 922a1bd930f64ab819883baafa34fb3aa4d9d50b81d7798c29e122440d7ddac2; COPY fixtures/sshd-fixture.sh /fixture/bin/sshd-fixture.sh is the spec'd install path; the following RUN runs sha256sum --check --strict against /fixture/bin/sshd-fixture.sh; LABEL com.ghostty.fixture-script.sha256 with the ARG expansion therefore carries the same value by construction, not by a second hand-edit.

(c) The workflow enforces the pin in both directions on the head: the verify step compares 922a1bd930f64ab819883baafa34fb3aa4d9d50b81d7798c29e122440d7ddac2 against /fixture/bin/sshd-fixture.sh inside the finished image, and the step "Verify a wrong fixture-script sha256 build-arg fails the build" passes an all-zero 64-hex build-arg and exits 1 if that build succeeds. build-fixture is green on this head, so the wrong-sha build did fail as required while the pinned build succeeded.

(d) CI on the exact head (d9fe5ccb): run #3331 build-fixture success 2m7s and build-emulator success; #3330 and #3332 all green on the same sha. The RUN-stage self-test executes inside the docker build step under set -euo pipefail with every check fatal (vendored sha256 against the pin, herdr --version equal to herdr 0.9.1, start --session default exiting non-zero with the refusal line, and a real start plus /usr/sbin/sshd -t plus stop round-trip), so a green build step is a self-test pass, and the follow-on steps (sha256 re-print, herdr version, refusal, control API add-key plus a real ssh login, keystore scan with its planted negative, both wrong-sha negatives) are green too. Honest limit: my tools return job logs only for failing jobs, so I could not paste the literal self-test line; this leg rests on per-step status, not on log text.

(e) Every changed line accounted for, three-dot against live (e43eca6a), 28 insertions / 14 deletions over exactly three files: .forgejo/workflows/emu-images.yaml 3+/3- = two comment lines reworded plus the env pin value, no step or command altered; platform/ghostty-ssh-fixture/Dockerfile 8+/7- = the header comment block reworded, the ARG default, and one comment line above the COPY, with the COPY path, LABEL and self-test RUN untouched; platform/ghostty-ssh-fixture/fixtures/sshd-fixture.sh 17+/4- = the GITS-499 delta only (unlink a stale per-session socket before launching the server, and a readiness retry bounded to 50 x 0.2s replacing the single poll), and since the sha256 and blob id equal the upstream object, the whole file is upstream content rather than logic authored here.

Diff-display caveat, checked and explained: a plain two-dot live..head diff additionally lists core/manifests/apps/sbx-gits/forgejo-ext.yaml, core/manifests/apps/sbx-lab/forgejo-ext.yaml and scripts/gits-sbx-forgejo-ext-gen.sh. Those are not part of this PR. The branch was cut at 018ff488 and live advanced afterwards with HOMELAB-2682 (#884, commit bbdbe637) in exactly those paths; the branch does not touch them, so a merge carries live's newer content forward. Nothing hidden.

Concerns (non-blocking, no blocker findings)

1. File mode: upstream 26eca1a4 carries the script as 100755, the vendored copy on this head is 100644. Content is identical by sha256, the Dockerfile chmods 0755 on the image copy, and nothing in the repo executes the workspace copy directly (the only consumer is the build context), so the image contract is unaffected and the byte-identical wording in the body is accurate for content. Worth restoring the exec bit in a later lane so the vendored tree matches upstream's mode as well as its bytes.
2. The branch sits one commit behind live today. Mergeable reports true and the touched paths are disjoint from the newer live commits, but the landing worker should merge onto current live rather than a stale base.

I made no edits, no pushes and no merge request; this comment is my only action on this PR.

## Verdict: APPROVE — exact-head review of the fixture resync head d9fe5ccbeef46dde7869b461f9ad28a8eb4a42c2 model: omniroute/deepseek-flash session: 01a1b399-a65a-7055-9162-9a142dded6ee ### Classification: DANGEROUS CLASS (one of two required seats) The changed set includes .forgejo/workflows/emu-images.yaml, which matches the oversight path .forgejo/** in DEFAULT_LANDING_POLICY.dangerousPaths (forgejo/landing.ts, defaults block). FORGEJO_DANGEROUS_PATHS and FORGEJO_LANDING_REVIEWERS were both unset in this session, so the default list applies verbatim; the repo owner (Homelab) is not in legacyPanelOwners (jesus, Sendrast), so the standard rule governs: this head needs TWO approvals from TWO INDEPENDENT reviewer sessions, one of them premium tier. This seat is one of the two; it is NOT sufficient on its own. ### Evidence, from primary sources (a) Spec sha, computed by me from the head, not copied from the body: git show d9fe5ccbeef46dde7869b461f9ad28a8eb4a42c2:platform/ghostty-ssh-fixture/fixtures/sshd-fixture.sh piped to sha256sum gives 922a1bd930f64ab819883baafa34fb3aa4d9d50b81d7798c29e122440d7ddac2, 36309 bytes, blob 838a4cd8986cd62ba24fd51beb3ddad0e4abf94e. Same sha256, same length and same blob id as ghostty-in-the-shell 26eca1a4a0ef41ad4dfab5688b7a2aa714a67d48:fixtures/sshd-fixture.sh, and the same object is still the app repo's live tip (d2b1d7cbb0b069382ae9f08b9c8fe8c0a3ca7012). This equals the acceptance value exactly. (b) Dockerfile at the head: ARG FIXTURE_SCRIPT_SHA256 defaults to 922a1bd930f64ab819883baafa34fb3aa4d9d50b81d7798c29e122440d7ddac2; COPY fixtures/sshd-fixture.sh /fixture/bin/sshd-fixture.sh is the spec'd install path; the following RUN runs sha256sum --check --strict against /fixture/bin/sshd-fixture.sh; LABEL com.ghostty.fixture-script.sha256 with the ARG expansion therefore carries the same value by construction, not by a second hand-edit. (c) The workflow enforces the pin in both directions on the head: the verify step compares 922a1bd930f64ab819883baafa34fb3aa4d9d50b81d7798c29e122440d7ddac2 against /fixture/bin/sshd-fixture.sh inside the finished image, and the step "Verify a wrong fixture-script sha256 build-arg fails the build" passes an all-zero 64-hex build-arg and exits 1 if that build succeeds. build-fixture is green on this head, so the wrong-sha build did fail as required while the pinned build succeeded. (d) CI on the exact head (d9fe5ccb): run #3331 build-fixture success 2m7s and build-emulator success; #3330 and #3332 all green on the same sha. The RUN-stage self-test executes inside the docker build step under set -euo pipefail with every check fatal (vendored sha256 against the pin, herdr --version equal to herdr 0.9.1, start --session default exiting non-zero with the refusal line, and a real start plus /usr/sbin/sshd -t plus stop round-trip), so a green build step is a self-test pass, and the follow-on steps (sha256 re-print, herdr version, refusal, control API add-key plus a real ssh login, keystore scan with its planted negative, both wrong-sha negatives) are green too. Honest limit: my tools return job logs only for failing jobs, so I could not paste the literal self-test line; this leg rests on per-step status, not on log text. (e) Every changed line accounted for, three-dot against live (e43eca6a), 28 insertions / 14 deletions over exactly three files: .forgejo/workflows/emu-images.yaml 3+/3- = two comment lines reworded plus the env pin value, no step or command altered; platform/ghostty-ssh-fixture/Dockerfile 8+/7- = the header comment block reworded, the ARG default, and one comment line above the COPY, with the COPY path, LABEL and self-test RUN untouched; platform/ghostty-ssh-fixture/fixtures/sshd-fixture.sh 17+/4- = the GITS-499 delta only (unlink a stale per-session socket before launching the server, and a readiness retry bounded to 50 x 0.2s replacing the single poll), and since the sha256 and blob id equal the upstream object, the whole file is upstream content rather than logic authored here. Diff-display caveat, checked and explained: a plain two-dot live..head diff additionally lists core/manifests/apps/sbx-gits/forgejo-ext.yaml, core/manifests/apps/sbx-lab/forgejo-ext.yaml and scripts/gits-sbx-forgejo-ext-gen.sh. Those are not part of this PR. The branch was cut at 018ff488 and live advanced afterwards with HOMELAB-2682 (#884, commit bbdbe637) in exactly those paths; the branch does not touch them, so a merge carries live's newer content forward. Nothing hidden. ### Concerns (non-blocking, no blocker findings) 1. File mode: upstream 26eca1a4 carries the script as 100755, the vendored copy on this head is 100644. Content is identical by sha256, the Dockerfile chmods 0755 on the image copy, and nothing in the repo executes the workspace copy directly (the only consumer is the build context), so the image contract is unaffected and the byte-identical wording in the body is accurate for content. Worth restoring the exec bit in a later lane so the vendored tree matches upstream's mode as well as its bytes. 2. The branch sits one commit behind live today. Mergeable reports true and the touched paths are disjoint from the newer live commits, but the landing worker should merge onto current live rather than a stale base. I made no edits, no pushes and no merge request; this comment is my only action on this PR.

ld-reviewer commented 2026-11-07 02:19:28 +00:00

Collaborator

Copy link

Verdict of record — ld-reviewer — head d9fe5ccbee: APPROVE

head d9fe5ccbee
model: omniroute/deepseek-flash
session: seat2-885-ciblast-0212

Seat 2 of 2, dangerous-class / CI-blast lens. Reached independently from primary sources at the head above. No blocking findings.

1. Vendored script provenance. The sha256 of platform/ghostty-ssh-fixture/fixtures/sshd-fixture.sh at this head is 922a1bd930f64ab819883baafa34fb3aa4d9d50b81d7798c29e122440d7ddac2 (36309 bytes), and the file is byte-identical to Homelab/ghostty-in-the-shell fixtures/sshd-fixture.sh at 26eca1a4 and at the live tip d2b1d7cb. That rules out the main dangerous-class worry for this PR: the vendored copy is not a place where extra content could ride along with a pin bump, because its content is an already-published object in another repo.

2. The whole diff, accounted for line by line. Three files, 100 diff lines, 28 added and 14 removed content lines. Workflow: two comment lines become three, and the verify-step FIXTURE_SCRIPT_SHA256 env value moves from 7ad2dfee…aed9 to 922a1bd9…d7ddac2; no other change, no new step, no new path. Dockerfile: the header comment is rewritten to record the new sync point, the ARG FIXTURE_SCRIPT_SHA256 default moves, and the comment above the COPY is reworded; the COPY target /fixture/bin/sshd-fixture.sh, the sha256sum --check RUN, the chmod, the /usr/local/bin symlink and the label com.ghostty.fixture-script.sha256="${FIXTURE_SCRIPT_SHA256}" are untouched, so the label follows the ARG instead of carrying a second literal that could drift. Vendored script: exactly two behaviour changes, the stale-socket removal and the bounded readiness retry described below.

3. The one new destructive line is bounded. SESS_SOCK is $HOME/.config/herdr/sessions/SESSION/herdr.sock, and SESSION is validated against ^ghostty-ci-[a-z0-9]{6,} before anything is created, so no traversal can carry that rm -f outside the session directory; rm -f is also non-recursive, and the refusing session name 'default' check that the self-test asserts is still present.

4. The retry cannot hang and cannot mask a failure. I confirmed on bash that "grep -q … && break" inside a for loop does not trip set -e on the non-matching iterations, the loop is bounded to about 10s (50 x 0.2s), and the assertion after the loop still dies with the last observed status in its message. Only readiness is retried; no test is retried.

5. CI blast surface at this head. build-fixture passed in 2m7s, which exercises the RUN-stage self-test, the runtime add-key plus real ssh login control API, and both wrong-build-arg negative proofs; build-emulator passed; shellcheck, yaml-lint and terraform-validate passed. The push guard is intact at the head on both jobs: Push to Harbor and Read back the immutable digest each carry if: github.event_name != 'pull_request', so a PR run never has the Harbor robot in any executed step's environment. This diff introduces no credential, secret, path or runner change.

6. Worst case if this workflow were broken or malicious. It can push at most two images into the Harbor platform project (ghostty-ssh-fixture, android-emulator) under the 7-character commit tag, using the scoped Harbor push robot with a throwaway DOCKER_CONFIG. It holds no kube, OpenBao, cloud or database credential, it writes no manifest, and it moves no GitOps pin or consumer pin, so a bad image cannot reach the cluster without a separate pin-bump change in ghostty-in-the-shell; consumers pin digests, so a re-push of a tag cannot silently swap a running image. Two honest edges on that statement: workflow_dispatch is not a pull_request event, so a maintainer-initiated dispatch of a branch would also reach the guarded push steps (pre-existing design of this workflow, not a property this diff changes), and a malicious edit to this workflow file is precisely why the dangerous class requires two independent seats.

No concerns here are worth holding on. Nothing in this diff deletes persistent state, so no destruction gate applies to it.

**Verdict of record — ld-reviewer — head d9fe5ccbeef46dde7869b461f9ad28a8eb4a42c2: APPROVE** head d9fe5ccbeef46dde7869b461f9ad28a8eb4a42c2 model: omniroute/deepseek-flash session: seat2-885-ciblast-0212 Seat 2 of 2, dangerous-class / CI-blast lens. Reached independently from primary sources at the head above. No blocking findings. 1. Vendored script provenance. The sha256 of platform/ghostty-ssh-fixture/fixtures/sshd-fixture.sh at this head is 922a1bd930f64ab819883baafa34fb3aa4d9d50b81d7798c29e122440d7ddac2 (36309 bytes), and the file is byte-identical to Homelab/ghostty-in-the-shell fixtures/sshd-fixture.sh at 26eca1a4 and at the live tip d2b1d7cb. That rules out the main dangerous-class worry for this PR: the vendored copy is not a place where extra content could ride along with a pin bump, because its content is an already-published object in another repo. 2. The whole diff, accounted for line by line. Three files, 100 diff lines, 28 added and 14 removed content lines. Workflow: two comment lines become three, and the verify-step FIXTURE_SCRIPT_SHA256 env value moves from 7ad2dfee…aed9 to 922a1bd9…d7ddac2; no other change, no new step, no new path. Dockerfile: the header comment is rewritten to record the new sync point, the ARG FIXTURE_SCRIPT_SHA256 default moves, and the comment above the COPY is reworded; the COPY target /fixture/bin/sshd-fixture.sh, the sha256sum --check RUN, the chmod, the /usr/local/bin symlink and the label com.ghostty.fixture-script.sha256="${FIXTURE_SCRIPT_SHA256}" are untouched, so the label follows the ARG instead of carrying a second literal that could drift. Vendored script: exactly two behaviour changes, the stale-socket removal and the bounded readiness retry described below. 3. The one new destructive line is bounded. SESS_SOCK is $HOME/.config/herdr/sessions/$SESSION/herdr.sock, and SESSION is validated against ^ghostty-ci-[a-z0-9]{6,}$ before anything is created, so no traversal can carry that rm -f outside the session directory; rm -f is also non-recursive, and the refusing session name 'default' check that the self-test asserts is still present. 4. The retry cannot hang and cannot mask a failure. I confirmed on bash that "grep -q … && break" inside a for loop does not trip set -e on the non-matching iterations, the loop is bounded to about 10s (50 x 0.2s), and the assertion after the loop still dies with the last observed status in its message. Only readiness is retried; no test is retried. 5. CI blast surface at this head. build-fixture passed in 2m7s, which exercises the RUN-stage self-test, the runtime add-key plus real ssh login control API, and both wrong-build-arg negative proofs; build-emulator passed; shellcheck, yaml-lint and terraform-validate passed. The push guard is intact at the head on both jobs: Push to Harbor and Read back the immutable digest each carry if: github.event_name != 'pull_request', so a PR run never has the Harbor robot in any executed step's environment. This diff introduces no credential, secret, path or runner change. 6. Worst case if this workflow were broken or malicious. It can push at most two images into the Harbor platform project (ghostty-ssh-fixture, android-emulator) under the 7-character commit tag, using the scoped Harbor push robot with a throwaway DOCKER_CONFIG. It holds no kube, OpenBao, cloud or database credential, it writes no manifest, and it moves no GitOps pin or consumer pin, so a bad image cannot reach the cluster without a separate pin-bump change in ghostty-in-the-shell; consumers pin digests, so a re-push of a tag cannot silently swap a running image. Two honest edges on that statement: workflow_dispatch is not a pull_request event, so a maintainer-initiated dispatch of a branch would also reach the guarded push steps (pre-existing design of this workflow, not a property this diff changes), and a malicious edit to this workflow file is precisely why the dangerous class requires two independent seats. No concerns here are worth holding on. Nothing in this diff deletes persistent state, so no destruction gate applies to it.

pi-landing merged commit e54f03b6a2 into live 2026-11-07 02:36:18 +00:00

pi-landing referenced this pull request from a commit 2026-11-07 02:36:20 +00:00

Merge pull request 'HOMELAB-2479: fix(ghostty-ssh-fixture): re-sync vendored sshd-fixture.sh to app live 26eca1a4' (#885) from plane/HOMELAB-2479-fixture-resync into live

aaron referenced this pull request 2026-11-07 03:13:03 +00:00

HOMELAB-2479: fix(ci): fixture readiness requires non-empty FIX_PORT #886

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

operator-review

Requires human operator review before merge — dangerous class (RBAC, secrets, network policy, Terraform) or explicitly gated. Never auto-merge.

No labels

operator-review

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Homelab/infra-core!885

No description provided.