Skip to content

fix: align LP7 proof volume permissions #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Sythos merged 2 commits into from
Aug 27, 2026
Merged

fix: align LP7 proof volume permissions #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9613578
fix: align LP7 proof volume permissions
Sythos Aug 27, 2026
f295807
fix: preserve LP7 DAV continuity signature
Sythos Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,9 @@ RUN set -eux; \
/var/lib/gulogulo/runtime \
/var/lib/gulogulo/dav \
/var/lib/gulogulo/mail \
/var/lib/gulogulo/backups
/var/lib/gulogulo/backups \
/var/lib/gulogulo/queue \
/var/lib/gulogulo/lp7

WORKDIR /app

Expand Down
2 changes: 1 addition & 1 deletion compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1241,7 +1241,7 @@ services:
platform: ${GULOGULO_LP7_COMPOSE_PLATFORM:-linux/amd64}
profiles: ["lp7-check"]
command: ["node", "--experimental-strip-types", "scripts/lp7-proof-check.ts"]
user: "0:0"
user: "10001:10001"
environment:
LP7_BLUE_BASE_URL: http://gulogulo-lp7-blue:8080
LP7_GREEN_BASE_URL: http://gulogulo-lp7-green:8080
Expand Down
4 changes: 4 additions & 0 deletions scripts/lp7-compose-audit.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,10 @@ for (const [name, section] of [['blue', blue], ['green', green]] as const) {
for (const marker of ['gulogulo-lp7-blue:', 'gulogulo-lp7-green:', 'LP7_BLUE_BASE_URL:', 'LP7_GREEN_BASE_URL:', 'LP7_BLUE_DIGEST:', 'LP7_GREEN_DIGEST:']) {
requireText(checker, marker, `LP7 checker marker ${marker}`);
}
requireText(checker, 'user: "10001:10001"', 'LP7 checker unprivileged UID');
const checkerSource = await readFile(resolve(root, 'scripts/lp7-proof-check.ts'), 'utf8');
requireText(checkerSource, 'saved.signature === continuitySignature', 'LP7 continuity signature comparison');
if (checkerSource.includes('JSON.stringify(saved.signature)')) fail('LP7 checker double-serializes the saved continuity signature');
for (const marker of ['gulogulo-lp7-blue:', 'gulogulo-lp7-green:']) {
requireText(checker, marker, `LP7 checker dependency ${marker}`);
}
Expand Down
2 changes: 1 addition & 1 deletion scripts/lp7-proof-check.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,7 +207,7 @@ await ensureSentinel('proof', join(stateDirectories.proof, 'lp7-proof-sentinel.j
const savedContinuityPath = join(proofStateDirectory, 'lp7-dav-continuity.json');
try {
const saved = await readJson(savedContinuityPath, 'saved DAV continuity state');
assert(JSON.stringify(saved.signature) === continuitySignature, 'DAV continuity changed across the replacement rehearsal');
assert(saved.signature === continuitySignature, 'DAV continuity changed across the replacement rehearsal');
} catch (error) {
if (!isMissingFile(error)) throw error;
await writeJson(savedContinuityPath, { schemaVersion: 1, milestone: 'LP7', signature: continuitySignature });
Expand Down