EverestLinux/libglacier-ng
2
0 Fork 0
Code Issues 1 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

10/4

Browse Source
This commit is contained in:
lw-everestlinux committed 2026-10-05 14:47:58 -04:00
1 parent c432274936
commit ee4bcc3b77
27 files changed
+2719 -589
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ROADMAP.txt
+208
View File
@@ -0,0 +1,208 @@
+--------------------------------------------+
| Glacier roadmap |
+--------------------------------------------+
What's left to build, in priority order. Status as of 2026-10-04.
Design detail lives in the companion docs; this file says WHAT and in
what order, and links to WHERE:
SECURITY_DESIGN.txt integrity, scope separation, refusal matrix
PACKAGE_SCOPES.txt layout, link routing, /etc config handling
IMAGE_DESIGN.txt system images as bootstrap output, sysroot
GLACIER_BOOTSTRAP.txt glacier-bootstrap plan, prerequisites, decisions
Mark an item [DONE yyyy-mm-dd] rather than deleting it, so the history
stays readable. CLAUDE.md "Known open items" tracks small bugs; this
file tracks work.
+--------------------------------------------+
| 1. Install Everest with glacier alone |
+--------------------------------------------+
The critical path: from "QEMU boots an initramfs assembled by a script"
(~/Projects/everest) to "glacier installs a system".
1.1 sysroot in the library (IMAGE_DESIGN section 3). Every path is
hardcoded to /glacier and /usr. Needs separate install-root
(where bytes are written) and runtime-root (what symlink targets
say). The trap: prune_stale_links follows absolute links, so a
naive prefix would judge the image's links against the HOST's
filesystem. Required test: an image build leaves the host's /usr
and /glacier byte-identical.
1.2 syspkg --root DIR (refuses unless DIR and its ancestors are
root-owned and not group/world-writable) and --strict (any link
refusal fails the transaction; an image's /usr starts empty).
gl_create_fs_tree already takes a root prefix.
1.3 glacier-bootstrap, local mode (GLACIER_BOOTSTRAP.txt sections 1-6).
Template index -> resolve -> verify -> syspkg --root, one
transaction. Never writes into TARGET itself.
1.4 Packages for glacier itself, so an installed system can manage
itself: luajit, libarchive (+ zlib), libconfig, libglacier-ng,
glacier-ng (syspkg, gpkg, gstore), doas.
1.5 The installer. Undesigned; needs its own design session
(SECURITY_DESIGN section 10). Partitioning, a bootloader or an
EFI-stub kernel on the ESP, copying the kernel there (a symlink
won't do on FAT), a disk image.
Already done on this path: hash verification, package symlinks, the
merged-/usr tree on syspkg -n, /etc config handling, a QEMU-bootable
musl + busybox + linux + everest-bootscripts set.
+--------------------------------------------+
| 2. Package-manager features |
+--------------------------------------------+
2.1 UPGRADES. Spec (2026-10-04):
- Replacing an installed version is `-lO` (local file) — plain
-l refuses ("extra::foo 1.0.0 is already installed.", nothing
more). [DONE 2026-10-04]
- The replaced version is BACKED UP: its files compressed into
<scope>/backup/<repo>/<name>/<name>-<ver>.gpkg + .sha256, a
complete installable package (saved manifest included).
KEEP_OLD in glacier.conf = how many backups to keep per
package (0 = none). No default: glacier.conf ships with
KEEP_OLD = 1, and an operation that would replace a version
refuses if it's missing or invalid. [DONE 2026-10-04]
- A restore interface for backups: later. (A backup can already
be reinstalled with -lO.)
- `gpkg -u` / `syspkg -u` = upgrade from a REMOTE repository;
waits for 3.1, like -f.
- /etc follows the existing config rules regardless.
2.2 gpkg -f / syspkg -f: MERGE. Spec (2026-10-04): exactly like -l,
except the package comes from a remote repository by name
instead of from a local file. Same summary, verification, scope
rules and transaction. Depends on 3.1 (remote repositories +
signing): until then there is nothing safe to fetch from.
2.3 Dependencies. PKG_DEPS / PKG_CONFS are parsed and ignored.
- install: refuse if a dependency isn't installed (or in the
same transaction);
- REMOVE: refuse to remove a package others depend on. Today
nothing stops `syspkg -x musl` from breaking every binary on
the system. Highest-value item in this section;
- conflicts: refuse to install a package that conflicts with
an installed one.
Check-only vs automatic resolution: GLACIER_BOOTSTRAP decision 9e.
2.4 Queries: list installed packages, show a package's details, find
which package owns a file. The index has the data; no CLI shows it.
2.5 Rollback. Every commit moves the previous state to old/ and then
deletes it. Keep it (or the last N), plus a command to return to
it. Interacts with 2.1's KEEP_OLD.
2.6 File conflicts between packages: two packages shipping the same
path — whichever links last silently wins. Detect and refuse.
2.7 glacier.conf parsing. [DONE 2026-10-04 for integers:
gl_conf_get_int, no defaults, missing/unreadable/wrong-type are
distinct errors.] Still open: rejecting UNKNOWN keys (CLAUDE.md bug
10's lesson — a misspelled KEEP_OLD currently reads as "not set",
which at least fails loudly).
2.8 gstore: -s (sync) is a stub; there's no restore command although
gstore -b's output tells you to run -r (gl_restore_istore exists).
2.9 User-scope config files: user packages still link etc/ into a
links tree that's rebuilt on every commit.
2.10 Hardlink entries in package archives are skipped at extraction.
+--------------------------------------------+
| 3. Security |
+--------------------------------------------+
3.1 Remote repositories + signing (authenticity, keyring). The agreed
next major item; separate design pass. Unblocks 2.2 and remote
glacier-bootstrap. Until then, GLACIER_BOOTSTRAP's pinned
templates are the safe bridge for remote fetches.
3.2 Hash verification lives in the CLIs' shared module. A third-party
tool calling gl_install_pkg directly isn't verified. Consider
moving it into the library, like the base-in-user-scope refusal.
3.3 Manifests don't record the SYS_PROFILE they were built under, so a
package built for the wrong target can't be detected.
3.4 gstore -n accepts UIDs with no passwd entry (pre-provisions a
directory nobody owns yet; a typo creates a stray one).
+--------------------------------------------+
| 4. Build tooling |
+--------------------------------------------+
4.1 gbuild system profiles (-P ARCH-LIBC[-FEATURE...]) and gworld's
SYS_PROFILE recipe field. CLAUDE.md described both as done; neither
exists in the tree (only one gbuild, in glacier-ng). Today the
target libc is decided by where gbuild runs (~/Projects/everest
builds in Alpine for musl).
4.2 Move ~/Projects/everest's per-package gbuild commands into gworld
recipes once 4.1 lands.
+--------------------------------------------+
| 5. Performance (not urgent) |
+--------------------------------------------+
5.1 gl_relink_store / gl_rebuild_index rescan the whole store on every
commit. Fine at current scale; a dirty set is the fix.
+--------------------------------------------+
| 6. Decisions waiting |
+--------------------------------------------+
- Images are only ever bootstrap OUTPUT (IMAGE_DESIGN 9a /
GLACIER_BOOTSTRAP 9a).
- Template index format (GLACIER_BOOTSTRAP 9b).
- Dependencies: check-only or automatic (GLACIER_BOOTSTRAP 9e).
- Where the pinning helper lives (GLACIER_BOOTSTRAP 9f).
- 2.1's open questions a-d (upgrade backups).
- extra vs community: should they ever behave differently?
- The installer (1.5).
+--------------------------------------------+
| 7. Done |
+--------------------------------------------+
[DONE 2026-10-04] Version replacement + backups (2.1): -lO replaces,
KEEP_OLD backups, gl_backup_pkg / gl_prune_backups / gl_conf_get_int,
the manifest saved in the store (.glacier-manifest), add_to_archive
learns symlinks (gstore -b silently dropped them too), gpkg modifier
flags (-O -S -V) order-independent so `gpkg -lO` works.
tests/upgrade_alpine.sh (29 checks).
[DONE 2026-10-04] Correctness batch:
- gbuild: autotools detected before a bare Makefile (bug 8 had
regressed); --cross-prefix fixed (its option-table key was
misspelled); -v/--version print the version as documented, with
--verbose for verbose output.
- gpkg -x: summary resolved from the index (was "unknown::pkg
0.0.0"); a package that isn't installed fails before the prompt.
- gpkg: precise refusal for a missing / squatted / loosened user
directory (was "No index found"), via gl_usr_base_status.
- gpkg -h lists -l and -S; -f/-u described by the 2.1/2.2 specs.
- Up-to-date reinstall logs once.
- Link conflicts reported once, by the package that has them, not
again on every later system commit (.glacier-fresh marker).
- A failed extraction no longer leaves a half-extracted version dir
(in a live context, every retry then said "already installed").
- Dead old-layout code removed from pkg.c (gl_prepare_pkgdir and the
gl_usr_* / gl_sys_* dir_t constants).
- tests/glacier_ffi.lua is a wrapper over lib/glacier_cdef.lua; its
own copy had already drifted (missing GL_INSTALL_ERR_SCOPE).
- Dockerfile.arch / .debian moved to the per-uid layout (root-owned
/app, libglacier-ng built from source, the gstore -n doas rule).
[DONE 2026-10-04] Hash verification; package symlinks; per-uid user
layout + doas gstore -n; syspkg -n top-level tree; /etc config
handling (copy + .new); -O/--overwrite; everest-bootscripts.