lfg2025/archy
1
0
Fork 0
Code Issues 25 Pull Requests 4 Actions Packages Projects Releases 74 Wiki Activity

docs(release): curated v1.7.106-alpha changelog + What's New; pin ISO FIPS to v0.4.1

Browse Source 
The ISO built FIPS from an unpinned --depth 1 clone of upstream main, so
every build shipped whatever happened to be on main that day. Pin to
v0.4.1 via a FIPS_VERSION build arg — the version fips/config.rs renders
its typed config against, and the one validated in the field on .198 and
the thinkpad. The pin lands inside the STEP 1 recipe-hash range, so the
cached rootfs correctly invalidates on the next build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
archipelago
2026-07-20 15:09:03 -04:00
co-authored by Claude Fable 5
parent c91887a397
commit 50170b866e
3 changed files with 31 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
image-recipe/_archived/build-auto-installer-iso.sh
+9 -4
View File
@@ -269,11 +269,14 @@ if [ ! -f "$ROOTFS_TAR" ] || [ "${1:-}" == "--rebuild" ] || [ "$(cat "$ROOTFS_ST
# Create a Dockerfile for building the rootfs
cat > "$WORK_DIR/Dockerfile.rootfs" <<DOCKERFILE
# ─── Stage 1: Build the FIPS mesh daemon .deb from upstream main ─────────
# ─── Stage 1: Build the FIPS mesh daemon .deb at a pinned tag ────────────
#
# FIPS (github.com/jmcorgan/fips) is a fast Nostr-keyed mesh routing
# protocol archipelago uses as its preferred non-Tor transport. We track
# upstream main per project decision (2026-04) — v0.2.0 isn't stable yet.
# protocol archipelago uses as its preferred non-Tor transport.
# Pinned so the shipped version is knowable: an unpinned --depth 1 clone of
# main made every ISO carry whatever upstream happened to be that day.
# v0.4.1 is the version fips/config.rs renders its typed config against and
# the one validated in the field. Bump the two together.
# The .deb is rebuilt every ISO build; Docker layer caching keeps the
# incremental cost low. Failure here fails the ISO build on purpose:
# we don't want to ship an ISO that silently skips FIPS.
@@ -291,7 +294,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \\
clang libclang-dev libnftnl-dev libmnl-dev \\
&& rm -rf /var/lib/apt/lists/*
RUN cargo install --locked cargo-deb
RUN git clone --depth 1 https://github.com/jmcorgan/fips.git /src/fips
ARG FIPS_VERSION=v0.4.1
RUN git clone --depth 1 --branch "\$FIPS_VERSION" \\
https://github.com/jmcorgan/fips.git /src/fips
WORKDIR /src/fips
# fips-gateway is gated behind the `gateway` Cargo feature (depends on
# `rustables`). Without the feature, cargo doesn't build it, and