Dev - #1
Merged
Merged
Dev#1
Conversation
Add tools/package to validate goreleaser output (one .deb/.rpm, checksums, artifact paths) and tools/package-check to preflight host capabilities (CGO, PAM headers, systemd-analyze) without assuming a distro package manager.
Debian: add libnss-systemd and init-system-helpers to dependencies; demote packagekit and packagekit-tools to recommends. RPM: demote PackageKit to recommends. Tako can fall back to the native package manager so PackageKit must not be a hard dependency.
…ipts Debian postinst now respects DPKG_ROOT and TAKO_SYSTEMD_RUNTIME_DIR, uses deb-systemd-helper unmask/was-enabled/enable/update-state to preserve admin disabled/masked state and repair legacy helper masks, starts tako-sessiond.socket before tako.socket on fresh install and on reinstall via package-removed marker, and on upgrade stops services before sockets, resets failed state and restarts dependency socket first. prerm/postrm stop without masking and only purge clears helper state. RPM post/preun/postun add runtime-dir guards, preserve stopped/disabled/masked/failed socket state and reuse the same ordered restart logic.
Add scripts/test.sh mock harness for deb/rpm postinst/prerm/postrm covering fresh install, disabled was-enabled, active/failed upgrade, admin masked preservation and offline roots. Add lifecycle-test.sh disposable-VM harness (TAKO_DISPOSABLE_HOST=1) exercising fresh install, remove/reinstall, active upgrade with trigger-limit check, disabled/stopped and masked preservation, and purge.
Verify socket enablement plus static UnitFileState for gateway and session services, leave sockets running after stopping services, and fail if either socket enters failed state.
Clarify C compiler/PAM linker requirements, package:check preflight, nFPM cross-format builds without dpkg-deb/rpmbuild, glibc compatibility caveat, demoted PackageKit recommends including libnss-systemd/init-system-helpers, socket activation ordering, disabled/masked and failed-state preservation via deb-systemd-helper/policy-rc.d, and updated smoke/lifecycle test seams.
Add tools/tako-go.sh to detect TAKO_DISTRO or /etc/os-release and inject the correct -tags value for all Nx Go targets. Update apps/backend/project.json to route go run/build/test/vet through the wrapper. Add distro/updates_tag_required.go guard that fails untagged production builds with a stable identifier.
Remove PackageKit D-Bus client (packagekit/*), the legacy autoupdates module and the PackageKit live watcher. Introduce the UpdateProvider interface and UpdateService (platform/updates.go) with bounded SSE progress/output replay, ANSI sanitization, plan fingerprinting and risky change detection. Add compile-time providers for apt, dnf, pacman and zypper behind distro build tags (distro/* + updateproviders/*) and rewrite platform tests to cover sanitization, exact-plan validation and stale-plan rejection. Update capabilities detection to probe the injected UpdateService and extend kpatch helper. BREAKING CHANGE: update backend no longer uses PackageKit D-Bus; builds require exactly one distro tag (debian, ubuntu, fedora, rhel, rocky, almalinux, archlinux, opensuse).
Inject distro.NewUpdateService() in cmd/tako (serve/sessiond/bridge + update-worker --job-file) and thread the service through hostRuntime, sessiond handlers and the bridge. Replace PackageKit-owned hostRuntime client/watcher with UpdateService.Snapshot/Refresh/Preview/Apply. Update auth host reads to alias UpdateObservation to platform.UpdateObservation, add PreviewUpdates and drop Cancel/AutoUpdates flows. Align app gateway (host_broker, app routes, update_jobs SSE live handler, jobs) to ValidateUpdateOperation with confirmed/riskAccepted and remove /updates/cancel and /updates/automatic endpoints. Remove updates_automatic and sessiond updates tests. BREAKING CHANGE: gateway and sessiond no longer expose auto-updates or cancel endpoints; live updates are now an SSE stream.
…ive stream UpdateOperation now requires expectedFingerprint + confirmed with optional riskAccepted instead of scope/packages/confirmation/preview. Preview returns structured UpdateChange[] with requiresRiskConfirmation and stale checks. UpdateResult reports backend + changes. Replace UpdateLive/ActionLog with UpdateProgress/Output/StreamEvent and change GET /updates/live to text/event-stream. Remove POST /updates/cancel and /updates/automatic endpoints and their schemas. BREAKING CHANGE: clients must rework update preview/apply and live subscription to the new full-system and SSE contract.
Remove auto-updates card and operation-controls (selected-scope workflow). Rewrite UpdateInventory to use EventSource on /api/v1/updates/live with UpdateProgress/Output types, single full-system preview with riskAccepted flow, and bounded output replay. Update live panel, package table and progress components to the new UpdateObservation shape. Regenerate embedded dashboard assets. BREAKING CHANGE: dashboard update flow drops scope/packages selection and polling live endpoint in favor of SSE progress/output events.
… branding and PAM Expand goreleaser from a single CGO build to eight tagged builds (debian, ubuntu, fedora, rhel, rocky, almalinux, archlinux, opensuse) and matching nFPM packages (2 deb, 5 rpm, 1 archlinux) each bundling exactly one /usr/share/tako/branding/<distro>.png and the correct PAM stack (tako.debian vs tako.redhat vs tako). Harden tools/package to validate all eight artifact IDs, formats, branding and PAM sources. Rename rockylinux.png to rocky.png and update branding asset mapping.
Document distro-native update readiness in README and expand packaging/README to cover eight distro-tagged CGO builds, per-distro native package-manager dependencies, single-asset branding, PAM mapping and TAKO_DISTRO override. Clarify that GoReleaser emits two debs, five rpms and one pkg.tar.zst without requiring native builder tools.
…taged uploads Pin all file operations beneath an openat2 file root with NO_SYMLINKS, blocking proc/sys/dev escapes even when privileged. Strengthen stat fingerprints with dev/ino/uid/gid/ctime. Add paginated directory listing (parent/nextOffset/hasMore), resumable chunked uploads with per-chunk SHA-256 and cancel-upload, and trash/restore backed by sidecar metadata. Tighten archive extraction and write validation.
Introduce a FirewallStrategy seam and move read/apply into an adapter. Track runtime versus persistent rules with synchronized state, order-insensitive fingerprints, stricter per-action validation, and apply that verifies mutations without rolling back pre-existing rules.
Bound security command output, add AppArmor profile modes and denial findings, and strictly validate inspect/boolean/restorecon/enforce/load actions. Pin restorecon through the file root with matchpathcon checks and load AppArmor profiles only from trusted directories.
… tokens Add NetworkManager checkpoint create/destroy/rollback over D-Bus, require checkpoint tokens for commit/rollback, and apply connection changes persistently under a checkpoint with reconnect-required tracking. Coordinate checkpoint lifetime in sessiond with automatic rollback on expiry or close.
…read-only Kill and wait on journal child processes on read errors, derive stable log entry IDs from cursor hashes, and parse per-mount read-only flags into filesystems instead of first-measurement only.
Add per-UID slot limits for log queries and follows, time-box follow streams, close connections on exit, and re-check authorization on a ticker so revoked grants stop streaming.
Add home/system file scope with elevation enforcement and absolute path rewriting for administrative scope. Support paginated listing, fingerprint-pinned full-download streaming, and strict resumable-upload range checks. Stop logging query strings and cap the login limiter with periodic sweeps.
Guard sampler configuration and subscriptions with the mutex, clamp capacity and intervals to sane minima, make unsubscribe idempotent, and dedupe samples within retention buckets.
Replace space-y-2 with flex flex-col gap-2 without functional or markup changes.
Gate row virtualization on row count so small tables render without absolute positioning, and plumb a scroll-position callback through ScrollArea for scroll-aware consumers. Stub getAnimations in test setup for Radix components under jsdom.
…le uploads Rebuild the file browser on DataTable with home/system scope, server-side pagination, subfolder search, and full CRUD dialogs including trash/restore and system-only chmod. Add resumable 4 MiB chunked uploads with per-chunk SHA-256, pause/retry/discard, and scope-aware media preview and text editor with dirty tracking. Extend the FileResult API contract with upload and pagination fields.
Dedupe log entries by stable ID, batch SSE events to avoid render churn, pause live prepend while reading history with a jump-to-latest action, and add human-readable priorities plus collapsed advanced filters with time shortcuts.
Harden the update inventory stream with event parsing, sequence dedup, terminal-phase settling, and job reconciliation across reloads and visibility changes. Open the preview dialog immediately with pending/error/stale handling and fingerprint-bound apply, fold job progress into a cancellable live panel, and tidy the history card layout.
Rebuild the package table on shadcn Table for desktop with collapsible cards on mobile, effective severity badges, deduped advisory links, version summaries, and live-patch markers.
Exercise stale/blocked previews, SSE dedup, terminal settle with storage cleanup, pre-commit cancel, missing-job recovery, and package table grouping with expanded advisory links.
Expand GoReleaser to fifteen version-pinned distro/release/arch builds with arm64 coverage, driven by a targets.json manifest. Build one native package per host via target filtering, add Arch install/remove hooks with lifecycle coverage, and split out an openSUSE PAM policy.
Document per-target native builds, the manifest contract, VM validation evidence, and the beta signing and provenance flow.
Replace div with fieldset for .workflow-choices in apps/web/src/components/agent-workflows.astro:38 and add type="button" to choice buttons for correct semantics and keyboard handling. Update apps/web/src/styles/global.css:689 to reset fieldset defaults (min-inline-size, margin, border, padding) so the inline-size flex layout is preserved. Includes Biome formatting for both files.
Add type="button" to theme toggle, menu toggle and menu close buttons in apps/web/src/components/site-header.astro and fix markup so buttons contain their icons/semantics correctly. Includes Biome formatting (double quotes, semicolon handling) for the component.
Change back-to-top anchor from href="#" to href="#main" in apps/web/src/components/site-footer.astro:47 to point to the actual main landmark and avoid history pollution. Includes Biome formatting and HTML void-element fixes for the footer.
Reformat apps/web/src/components/compatibility.astro with Biome (double quotes, semicolon removal) and address lint rules: introduce sceneElement alias to avoid non-null assertion on scene, expand arrow functions to blocks and add braces. No behavioral change to orbit animation.
Add reusable composite action that installs gcc, libpam0g-dev, libsystemd-dev and systemd for Go backend jobs.
Split monolithic unit/race/lint into go-unit with atomic coverage and baseline enforcement, go-race, go-quality with go vet and staticcheck, dashboard tests/quality/coverage, web typecheck/lint/build, backend build and packaging checks. Add openapi-contract, workflow-quality with actionlint, shell-quality with shellcheck, reusable integration job and pr-gate fail-closed aggregation. Add concurrency cancellation, cache-dependency-path for go.work.sum, and coverage baseline env. Add Redocly and actionlint configs.
Add reusable integration workflow for ubuntu/fedora disposable VMs and packaging-lifecycle workflow for old vs new package validation. Wire lifecycle-validation into beta-release as required predecessor to vm-validation and evidence-gate, and download both package-* and vm-evidence-* artifacts.
Add tools/tako-integration root-only VM runner with distro gating and evidence capture, allow extra Go tags via TAKO_EXTRA_GO_TAGS in tako-go.sh, add backend integration Nx target, and fix package-check to sh -n deb/rpm/arch scripts and bash -n smoke/lifecycle scripts.
Move updates integration test from platform to distro (NewUpdateService) and add fuzz for ValidateFileOperation, safe archive names, decodeUpdateOperation, readFrame and decodeHostPayload. Add protected route surface test requiring session and fix vite dev proxy to bind explicit tcp4 loopback.
Configure Vitest v8 coverage with text/lcov/html reporters, add coverage Nx target and @vitest/coverage-v8 dependency, and ignore generated dashboard coverage directory.
Quote response descriptions so they pass minimal Redocly rules.
Extend Theme to include tako-light and tako-dark, resolve system
to tako-${system}, sync colorScheme and dual class on the root,
switch to useLayoutEffect and handle tako toggle. Add terminal
tokens and full Tako paper/ink/terracotta palettes for both
tako-light and tako-dark, keeping the shell dark for ANSI
readability.
Replace click items with a radio group bound to the current theme, exposing Tako Light/Dark alongside Standard Light/Dark and System with separators and icons.
Read terminal colors from CSS variables and observe root class mutations so the xterm instance follows Tako theme changes, and use terminal design tokens for container styling.
Add tests for default Tako theme, live system changes, restoring persisted themes, D key toggling with input-ignore, and cross-tab storage sync with invalid fallback.
Add Overview (01) as first nav item and renumber following items to 02-06 with explicit number fields so Docs can omit the prefix. Render menu-number conditionally and add id="overview" to the product section to support hash navigation.
Create a temporary root with a /usr/bin/tako stub and invoke systemd-analyze with --root so unit verification does not fail on missing ExecStart binary in clean/restricted build environments.
Replace manual go install with goreleaser/goreleaser-action@v7 install-only for the packaging job's static configuration checks, removing GOBIN and PATH plumbing while keeping version selection via vars.GORELEASER_VERSION.
Cover accepted VM evidence, substituted package digest, commit mismatch and missing evidence cases for tools/release-gate.
Replace bun run test:packaging with direct bun test for tools/release-gate.test.ts, add tools/package to shellcheck, and remove the disposable VM integration job from the PR gate. Privileged VM validation now runs only via beta release and its own schedule.
Add ::add-mask:: for TAKO_TEST_PASSWORD_OLD/NEW so random credentials do not leak in workflow logs.
Remove workflow_dispatch trigger so validation is only reachable via workflow_call from beta, and add 45 minute timeout to bound self-hosted runs.
Preserve release tag version in GoReleaser snapshot builds via GORELEASER_CURRENT_TAG, pass the current tag through the native matrix, fix goreleaser arch mapping and download URL, add missing libsystemd-dev/unzip deps, fix bun install invocation, stage systemd units under a fake root for systemd-analyze verify and add git safe.directory for containerized builds.
Add integration as required beta job and evidence-gate dependency, pass both evidence and package directories to release-gate, generate checksums with relative paths from within release/, and drop unnecessary id-token/attestations from finalize permissions.
Document that PR CI uses GitHub-hosted runners while VM integration is beta-gated, that vm-validation is reusable and consumes same-run native artifacts, and that tag builds preserve versions with relative checksums for verification.
Generate checksums to a temp file outside release/ and move into place only on success, with a trap to clean up on exit, so a failed run does not leave a partial checksums.txt.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.