Repository navigation
test: add a preflight check to the factory-edge staging script - #5504
Merged
Merged
Conversation
--check verifies every prerequisite and starts nothing: a working mvmctl, the demo home, the cached image, enough free disk, and that every granted destination resolves, since a grant is resolved to addresses when its workload is admitted and the demo therefore needs working DNS. Staging runs the same checks first. The runbook now says to stage shortly before presenting, because each lookup a staged workload makes is a signed chain entry, and that staged machines do not survive a reboot.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #5495.
scripts/factory-edge-stage.sh --checkverifies every prerequisite and starts nothing: a workingmvmctl, the demo home, the cached image, enough free disk, and that every granted destination resolves. A grant is resolved to addresses when its workload is admitted, so the demo needs working DNS, and a flaky network at presentation time would otherwise fail during staging. Normal staging runs the same checks first, andDNS_CHECK=0skips the DNS check (the hermetic test uses it so it needs no network).The runbook now says to stage shortly before presenting, about ten minutes, because every lookup a staged workload makes is a signed audit-chain entry and the chain, with the cost of
explainandtrust audit verify, grows for as long as the workloads run; and that staged machines do not survive a reboot while the demo home, the installed release and the cached image do.Verification: the hermetic test passes (it now also checks that
--checkstarts nothing and that an unresolvable grant is caught). A live rehearsal of the whole presenter sequence against the v0.28.0-rc.2 release on HVF passed:--checkabout 3 s, staging 18 s, demo 28 s with all 11 checks, and a clean--downwith no processes left. Spec hygiene and overclaim gates pass.