feat(build): add /etc/clawdie-image-manifest (version/channel/rev/toggles), bridges to build-manifest.json #283
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat/image-build-manifest"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Closes the 19.jul.26 "which stick is this?" gap: booted on live media there was no discoverable way to ask the running system which build it carries and with which toggles (the SSH keys-only surprise — image built without
--ssh-password-auth, no way to confirm from the stick without the build log on the installed disk).Two coordinated stamps from the same variables in the same build run (no drift):
/etc/clawdie-image-manifest(new) — lean KEY=VALUE for a console operator: product, iso_version, build_channel, build_date (UTC), iso_repo_rev + dirty flag,ssh_password_auth=yes/no,live_default_password=yes/no. Header bridges to the full JSON.build-manifest.json(extended) — gainsssh_password_auth/live_default_passwordas JSON booleans so tooling that already parses it stays self-complete.Toggle values are read from
${SSH_PASSWORD_AUTH:-0}/${LIVE_DEFAULT_PASSWORD:-0}— the exact variables the drop-in writer, sshd self-check, and release gate consume; no re-parse of CLI args, so the manifest cannot disagree with what was baked. NON-SECRETS ONLY: no keys, passwords, or provider names (those travel via the CLAWDIESEED seed).Second commit fixes the comment block: build-manifest.json ships in-image at
/usr/local/share/clawdie-iso/(USB_SHARE is under MOUNT_POINT); the /etc file's justification is discoverability + format + toggles, not reachability.Gates:
sh -nclean, format gate green, JSON validity tested in both toggle states.🤖 Generated with Claude Code
Tonight's gap: booted on a stick with no way to ask "which build is this, built with which flags?" — the build log lives on the build host, unreachable from the live session. build-manifest.json is already staged in-image at /usr/local/share/clawdie-iso/build-manifest.json, but it lacked the effective toggles (ssh-password-auth / live-default-password) and lives at a JSON path less friendly to a console human. Two additions, stamped in the same build run from the same variables (no drift): 1. /etc/clawdie-image-manifest — lean, cat-able, shell-sourceable KEY=VALUE summary: product, iso_version, build_channel, build_date (UTC), iso_repo_rev (+ iso_repo_dirty), and the two effective toggles. Its header bridges to the full JSON so a console reader learns the detailed provenance file exists. NON-SECRETS ONLY: no keys/passwords/provider names (those travel via the CLAWDIESEED seed). Mode 0644. 2. build-manifest.json gains ssh_password_auth + live_default_password as JSON-native booleans, so the machine-readable manifest stays self-complete — publish lanes / fleet inventory / test harnesses that already parse it get the toggles without learning a second, shell-format file. Effective values, not re-parsed args: both stamp \${SSH_PASSWORD_AUTH:-0} and \${LIVE_DEFAULT_PASSWORD:-0} — the exact variables the drop-in writer (L2187), the sshd self-check (L2219), and the release gate (L624) use — so the manifest can never disagree with what was actually baked. sh -n clean; check-format green; JSON validity + both toggle states tested.The new comment block claimed build-manifest.json "lives on the build host's USB share — unreachable from a booted stick". Wrong, and it contradicted the heredoc header five lines below: USB_SHARE is ${MOUNT_POINT}/usr/local/share/clawdie-iso, inside the image and readable on any booted stick. The /etc file's real justification is discoverability + lean KEY=VALUE format + the effective toggles, not reachability — the comment now says that. Comment-only change; sh -n and format gate green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>