10/14

GLACIER_BOOTSTRAP.txt

@@ -2,9 +2,10 @@
 | glacier-bootstrap                          |
 +--------------------------------------------+
 
-STATUS: PLAN. Nothing here is implemented. Section 9 lists the
-decisions still open; everything else is a recommendation to argue
-with, not a settled design.
+STATUS: LOCAL MODE IMPLEMENTED 2026-10-06 (glacier-ng/glacier-bootstrap,
+tests/bootstrap_alpine.sh; see section 10 for how it differs from the
+plan below). Remote mode (-r) and the pinning helper are still a plan.
+Section 9 lists the decisions still open.
 
 glacier-bootstrap takes a template index and builds a chrootable
 Everest system in a target directory, from either a local directory of
@@ -37,7 +38,8 @@ Sequence:
     3. fetch into a private cache; verify every hash        (section 5)
     4. doas syspkg --root TARGET -n                         create the tree
     5. doas syspkg --root TARGET --strict -l PKG...         ONE transaction
-    6. optional smoke test (-t)
+    6. doas syspkg --root TARGET -y                        TARGET's indexes
+    7. optional smoke test (-t)
 
 Step 5 is one transaction on purpose: TARGET ends up either the whole
 system or an empty tree, never half a system.
@@ -100,7 +102,6 @@ per package, so packages can carry pins:
 
     # templates/minimal.template
     NAME=minimal
-    SYS_PROFILE=x86_64-musl
     PKG=filesystem 1.0.0
     PKG=musl 1.2.5 sha256:3a5f...
     PKG=busybox 1.37.0 sha256:91c0...
@@ -110,7 +111,9 @@ per package, so packages can carry pins:
   - A pin is optional for -d (if present, it must ALSO match the
     sidecar) and required for -r until signed repos exist.
   - Strict parsing: unknown keys, a duplicate PKG name, a malformed pin
-    and an empty package list are all hard errors. Remember gworld bug
+    and an empty package list are all hard errors. SYS_PROFILE is an
+    unknown key (9b): nothing could check it until manifests record a
+    profile (ROADMAP 3.3). Remember gworld bug
     10: a field silently never parsing, with a default that looks right.
   - A `glacier-bootstrap --pin PKGDIR TEMPLATE` helper that fills pins in
     from local sidecars is the obvious way to produce a pinned template
@@ -131,8 +134,10 @@ doesn't.)
 Recommendation: CHECK, don't auto-resolve.
 
   - Every PKG_DEPS entry of every listed package must itself be listed,
-    with a matching version. Otherwise error: "busybox needs musl 1.2.5,
-    which the template does not list."
+    at that version or later (decided 2026-10-06: the ROADMAP 2.3 rule, so
+    the template check and syspkg's commit check agree). Otherwise error:
+    "base::busybox requires musl >= 1.2.5, which the template does not
+    list." / "..., but the template lists 1.2.4."
   - No two listed packages may conflict (PKG_CONFS).
   - Each manifest's PKG_NAME/PKG_VER must match its template line. This
     catches a mis-named file in -d mode, where there may be no pin.
@@ -242,14 +247,18 @@ independent of glacier-bootstrap itself:
      section 4). Pins mean nothing until syspkg actually checks sidecars.
   2. [DONE] Symlink extraction + linking, with the write-through-symlink
      defense (6a). Needed for anything to run.
-  3. sysroot in the library (IMAGE_DESIGN section 3), plus the "host
+  3. [DONE 2026-10-05] sysroot in the library (IMAGE_DESIGN section 3), plus the "host
      /usr and /glacier untouched" test.
-  4. syspkg --root DIR (IMAGE_DESIGN section 4), --strict (any link
+  4. [DONE 2026-10-05, as -R/--root] syspkg --root DIR (IMAGE_DESIGN section 4), --strict (any link
      refusal fails the transaction), and the skeleton on -n (6b) [the
      skeleton is DONE; --root and --strict are not].
-  5. Packages: busybox recipe (base), sbase rebuilt as base, every
+  5. [DONE: ~/Projects/everest builds musl, busybox, linux and
+     everest-bootscripts, all base, with sidecars.] Packages: busybox
+     recipe (base), sbase rebuilt as base, every
      package rebuilt with sidecars (6d-f).
-  6. glacier-bootstrap, local mode.
+  6. [DONE 2026-10-06: Everest's `everest.sh initramfs` now builds its
+     tree this way, and the result boots in QEMU.] glacier-bootstrap,
+     local mode.
      MILESTONE: `glacier-bootstrap -t -d pkgs templates/minimal.template
      /mnt/everest` succeeds, `chroot /mnt/everest /bin/sh` gives a
      working shell, and the host is byte-identical before and after.
@@ -281,8 +290,8 @@ orchestration over things that have to exist anyway.
 
   a. IMAGE_DESIGN.txt section 9a still stands: images are bootstrap
      OUTPUT, never install INPUT. Everything here assumes yes.
-  b. Template format (section 3): one PKG= line per package with an
-     optional pin, or something else.
+  b. DECIDED 2026-10-06: NAME= plus one `PKG=name version [sha256:hex]`
+     per package; no SYS_PROFILE until manifests record one (section 3).
   c. DECIDED 2026-10-04: option 1, copy on install, .new on conflict.
      Implemented in istoreutils.c (install_config / prune_config): a
      system-scope package's top-level etc/ is copied into /etc, never
@@ -293,7 +302,58 @@ orchestration over things that have to exist anyway.
   d. DECIDED 2026-10-04: syspkg -n creates the top-level tree itself
      (6b). Implemented as gl_create_fs_tree(root, verbose), called by
      gl_init_sys before the index is written.
-  e. Dependency handling (section 4): check-only, as recommended, or
-     automatic closure.
+  e. DECIDED 2026-10-05: automatic closure, once there is a source to
+     resolve from (remote repos, ROADMAP 3.1). Until then a missing
+     dependency refuses; the resolver is written so 3.1 plugs in. The
+     index already records auto vs explicit installs (ROADMAP 2.3).
+     Section 4's template check still applies to bootstrap: a template
+     lists what it installs.
   f. Pinning helper: part of glacier-bootstrap (--pin) or of gworld
      (which already knows what it just built).
+
+
++--------------------------------------------+
+| 10. As implemented (local mode, 2026-10-06)|
++--------------------------------------------+
+
+    glacier-bootstrap [-hvntV] -d PKGDIR TEMPLATE TARGET
+
+Where it differs from, or adds to, sections 1-8:
+
+  - syspkg is the one on the caller's PATH (decided 2026-10-06),
+    resolved to an absolute path first and run through doas, or
+    directly when already root. -t runs `doas chroot`.
+  - Order: parse, then verify, then resolve. Manifests are read only
+    from VERIFIED copies: each PKGDIR/NAME-VER.gpkg is copied into a
+    private mktemp -d while being hashed, checked against its sidecar and
+    the pin, and given a sidecar written from that hash. syspkg is handed
+    the copies, so a pin binds syspkg too, and a file swapped in PKGDIR
+    later is never read. The copies are removed on every exit.
+  - TARGET must be absolute, not /, and pass gl_check_sysroot (checked
+    read-only up front). It must be fresh, or initialised by syspkg -n
+    with nothing installed: then -n is skipped, so a run declined at
+    syspkg's prompt can simply be repeated. TARGET with packages is
+    refused.
+  - syspkg's prompt is passed through (it's the review step). It exits 0
+    when declined, so afterwards TARGET's index is read (it's world-
+    readable) and every template package must be listed.
+  - Every problem in a phase is reported before failing. Exit status:
+    1 usage or target, 2 template, 3 verification, 4 resolution,
+    5 installation, 6 smoke test, 7 repositories.
+  - Repositories (2026-10-07; the user: bootstrap must leave a
+    semi-functional system, so it configures repositories, pacstrap
+    style). The configuration comes from a PACKAGE in the template
+    (Everest: everest-repos, shipping /etc/glacier/repos.conf and
+    keys/*.pub), so bootstrap still never writes into TARGET. After the
+    install check, if TARGET's repos.conf gives any repository a url,
+    it runs `syspkg -R TARGET -y`: syspkg reads TARGET's OWN keyring
+    under -R for repository operations (REPO_DESIGN section 6, "Keyrings
+    under -R"), fetches into TARGET/glacier/sys/repos, and so sets
+    TARGET's rollback floor at build time. A failed fetch: exit 7,
+    TARGET stays installed, no "Bootstrapped" line. No repos.conf, or
+    no url: `[!] No remote repositories are configured in TARGET.` and
+    exit 0. Copying the host's repos.conf (pacstrap's mirrorlist copy)
+    is left out for now (user, 2026-10-07).
+  - Its own lib/ is found from its realpath (package.path and ffi.load),
+    not the current directory; no root-ownership checks (unprivileged).
+  - Not implemented: -r (remote) and --pin (9f still open).