owner
9adec87c4b
Make governed release source closure explicit so a pushed governed candidate
can enter the authoritative Git/release closure without manual runtime
overwrite or fixed-recipe bypass.
- Gitea machine transport: add _safe_branch() and exact OID/branch verification.
- release_source_admission.py (new): admit a governed source by verifying remote
branch -> exact OID, fetching only to refs/aios/release-sources/<OID>,
validating authoritative main ancestry + tree OID, and writing a policy-bound,
HMAC-authenticated immutable admission record (source_admission_hmac).
- trusted candidate builder: read-only admission verifier, remains
PrivateNetwork / read-only; missing admission surfaces SOURCE_ADMISSION_REQUIRED.
- Model API / release saga: consume admission records and return machine-actionable
SOURCE_ADMISSION_REQUIRED (not NOT_FOUND) when a non-fixed source is unadmitted.
- systemd: add aios-release-source-admission.service (oneshot, root/gitops,
AIOS_GITOPS_WRITES_ENABLED=false, independent source_admission_hmac credential);
wire source_admission_hmac into trusted builder; update staging unit.
- Fixed V2R2C2/V2R2C3 recipes are not overridden by admission.
- Tests: new release_source_admission + adjusted builder/model-api/live-executor/
readiness tests.
Verified: 13-file after_sha256 byte-exact; py_compile PASS;
Linux 326 targeted passed / 0 failed; acceptance 165; regression 1401;
systemd-analyze verify 3/3 PASS.
Base: a320ea3 (agent/baseline-1.1-principal-recovery-20260908).
42 lines
2.0 KiB
Desktop File
42 lines
2.0 KiB
Desktop File
[Unit]
|
|
Description=AIOS governed release source admission
|
|
After=network-online.target aios-gitea.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User=root
|
|
Group=gitops
|
|
UMask=0027
|
|
Environment=AIOS_GITOPS_WRITES_ENABLED=false
|
|
Environment=AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
|
|
Environment=AIOS_GITOPS_AUTHORITATIVE_GIT_DIR=/data/aios-gitops/repo.git
|
|
Environment=AIOS_GITEA_API_BASE=https://g.cnnetmkt.top/git/api/v1
|
|
Environment=AIOS_GITEA_REMOTE_URL=https://g.cnnetmkt.top/git/aios/aios.git
|
|
Environment=AIOS_GITEA_MACHINE_CREDENTIAL_NAME=gitea-machine-token
|
|
EnvironmentFile=/run/aios-release-source-admission/request.env
|
|
LoadCredentialEncrypted=gitea-machine-token:/etc/aios/credentials/gitea-machine.token.cred
|
|
LoadCredentialEncrypted=source_admission_hmac:/etc/credstore.encrypted/aios-release-source-admission/source_admission_hmac
|
|
ExecStart=/usr/bin/python3 -B /opt/aios/release-source-admission/current/app/release_source_admission.py admit --version ${AIOS_RELEASE_VERSION} --task-id ${AIOS_RELEASE_TASK_ID} --source-ref ${AIOS_RELEASE_SOURCE_REF} --source-commit ${AIOS_RELEASE_SOURCE_COMMIT} --policy /opt/aios/trusted-candidate-builder/current/config/gitops/trusted-candidate-builder-policy.json --store-root /var/lib/aios-release-source-admission
|
|
ExecStartPost=/usr/bin/rm -f /run/aios-release-source-admission/request.env
|
|
RuntimeDirectory=aios-release-source-admission
|
|
RuntimeDirectoryMode=0750
|
|
StateDirectory=aios-release-source-admission
|
|
StateDirectoryMode=0750
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
LockPersonality=true
|
|
RestrictSUIDSGID=true
|
|
RestrictRealtime=true
|
|
MemoryDenyWriteExecute=true
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
CapabilityBoundingSet=
|
|
ReadOnlyPaths=/opt/aios/release-source-admission /opt/aios/trusted-candidate-builder /etc/aios/credentials /etc/credstore.encrypted
|
|
ReadWritePaths=/data/aios-gitops/repo.git /var/lib/aios-release-source-admission /run/aios-release-source-admission
|