batch 3: tmux tree bc rlwrap bind-utils nmap socat whois traceroute openssh-clients git git-lfs vim make diffutils zip unzip zstd xz pigz

glen commented

2026-09-23 16:05:37 -04:00

Collaborator

Campaign batch 3 (DESIGN batches 6–7) — twenty hand-authored archetype-B packages + three virtual entrypoints, one commit each, all on the repo fedora:44 pin with the dnf both-halves rule. Highlights: openssh-clients ships clients only (sshd deliberately excluded) with ssh/scp/sftp virtual entrypoints (age-keygen pattern) and a gate-safe ssh-agent surface — bind_try of $XDG_RUNTIME_DIR → /run/user/1000 (ro) + SSH_AUTH_SOCK host-value pass-through, with the full behavior matrix in the entrypoint comment (no-agent hosts degrade to passphrase prompts; nothing breaks); git composes openssh-clients (compose-don't-vendor) and git-lfs composes git (composition documented as non-transitive); tmux redirects TMUX_TMPDIR to the /persist state-bind so server sockets survive across invocations; nmap/traceroute carry a documented connect-scan-only posture (no CAP_NET_RAW in the unprivileged sandbox, nothing setuid); scp/sftp smokes are deliberately empty check lists (OpenSSH 10.x has no -V — live-verified: unknown option, exit 1); zip/unzip smoke the -v diagnostic banner (no --version exists); zstd 1.5.7 changed its version banner upstream (source-verified; anchored on the drift-safe by Yann Collet). Licenses are the f44 spec tags — verbatim where the spec carries one global tag (bind MPL-2.0 AND ISC AND …, nmap LicenseRef-Nmap, tmux/openssh compound chains), simplified accurate SPDX where the chain is longer (git GPL-2.0-or-later, git-lfs MIT). Reviewer notes: tree has no f44 spec (retired after F35, re-introduced with revived 2.x — version pinned from the actual f44 Everything rpm tree-2.2.1-4.fc44, license from spec-history + upstream LICENSE); bc/socat rpms also ship dc/filan/procan — future virtual-entrypoint candidates. Versions are the f44 spec vintage at authoring time (standard archetype-B float); every smoke anchors on a version-free substring so f44 update drift can't trip the gate. Authored via the 3-agent fan-out (batch3/{a,b,c} merged here); this CI run is the first real build+smoke of the set.

Campaign batch 3 (DESIGN batches 6–7) — twenty hand-authored archetype-B packages + three virtual entrypoints, one commit each, all on the repo `fedora:44` pin with the dnf both-halves rule. Highlights: **openssh-clients ships clients only** (sshd deliberately excluded) with ssh/scp/sftp virtual entrypoints (age-keygen pattern) and a gate-safe ssh-agent surface — `bind_try` of `$XDG_RUNTIME_DIR → /run/user/1000` (ro) + `SSH_AUTH_SOCK` host-value pass-through, with the full behavior matrix in the entrypoint comment (no-agent hosts degrade to passphrase prompts; nothing breaks); **git composes openssh-clients** (compose-don't-vendor) and **git-lfs composes git** (composition documented as non-transitive); **tmux redirects `TMUX_TMPDIR`** to the /persist state-bind so server sockets survive across invocations; **nmap/traceroute** carry a documented connect-scan-only posture (no CAP_NET_RAW in the unprivileged sandbox, nothing setuid); **scp/sftp smokes are deliberately empty** check lists (OpenSSH 10.x has no `-V` — live-verified: unknown option, exit 1); **zip/unzip** smoke the `-v` diagnostic banner (no `--version` exists); **zstd 1.5.7 changed its version banner upstream** (source-verified; anchored on the drift-safe `by Yann Collet`). Licenses are the f44 spec tags — verbatim where the spec carries one global tag (bind `MPL-2.0 AND ISC AND …`, nmap `LicenseRef-Nmap`, tmux/openssh compound chains), simplified accurate SPDX where the chain is longer (git `GPL-2.0-or-later`, git-lfs `MIT`). Reviewer notes: **tree has no f44 spec** (retired after F35, re-introduced with revived 2.x — version pinned from the actual f44 Everything rpm `tree-2.2.1-4.fc44`, license from spec-history + upstream LICENSE); bc/socat rpms also ship dc/filan/procan — future virtual-entrypoint candidates. Versions are the f44 spec vintage at authoring time (standard archetype-B float); every smoke anchors on a version-free substring so f44 update drift can't trip the gate. Authored via the 3-agent fan-out (`batch3/{a,b,c}` merged here); this CI run is the first real build+smoke of the set.

glen added 22 commits

2026-09-23 16:05:37 -04:00

tmux: add 3.7c (archetype B) 69c26a47e0

Version/license from the f44 spec:
https://src.fedoraproject.org/rpms/tmux/raw/f44/f/tmux.spec
License: ISC AND BSD-2-Clause AND BSD-3-Clause AND SSH-short AND LicenseRef-Fedora-Public-Domain.

Entrypoint redirects TMUX_TMPDIR to /persist
($BUBBLEBOX_DATA_DIR/tmux, create = true) because the engine mounts /tmp
as a private per-invocation tmpfs — default socket location cannot persist
or be shared. Smoke: tmux -V (spec %check does the same).

tree: add 2.2.1 (archetype B) f3e040296d

F44 version: tree-2.2.1-4.fc44, confirmed present in the f44 Everything
release repo (rpmfind index of dl.fedoraproject.org/releases/44/Everything/
x86_64/os/Packages/t/). The historical dist-git repo (rpms/tree) is gone in
Fedora's forge migration and the old koji package record ends at 1.8.0-7
(fc35) — the package was retired post-F35 and re-introduced with the
revived 2.x upstream, so no f44 spec URL exists; pin is the repo rpm itself.
License: GPL-2.0-or-later (old Fedora spec tag GPLv2+ + upstream LICENSE
GPLv2 with 'or later version' notice).

DESIGN batch-6 note for the integrator: DESIGN-ecosystem.md 5.1 assumed the
f44 spec exists; it does not — see above.

bc: add 1.08.2 (archetype B) 21cdbd467e

Version/license from the f44 spec:
https://src.fedoraproject.org/rpms/bc/raw/f44/f/bc.spec
License: GPL-3.0-or-later.
Note: the rpm also ships /usr/bin/dc (sibling binary); a dc virtual
entrypoint could be added later if wanted (age-keygen pattern).

rlwrap: add 0.47.1 (archetype B) 945ab0fd9d

Version/license from the f44 spec:
https://src.fedoraproject.org/rpms/rlwrap/raw/f44/f/rlwrap.spec
License: GPL-2.0-or-later.
Smoke: rlwrap --version (prints 'rlwrap <version>', exit 0).

socat: add 1.8.1.1 (archetype B) 254a53afbc

Version/license from the f44 spec:
https://src.fedoraproject.org/rpms/socat/raw/f44/f/socat.spec
License: GPL-2.0-only.
Smoke: socat -V (no long-form --version; -V prints the credit line +
feature list, exit 0). rpm also ships filan/procan helpers.

whois: add 5.6.6 (archetype B) 404b8353bf

Version/license from the f44 spec:
https://src.fedoraproject.org/rpms/whois/raw/f44/f/whois.spec
License: GPL-2.0-or-later.
Smoke: whois --version (prints 'Version <x>.' and exits 0).
Note: /usr/bin/whois is an update-alternatives symlink to whois.md,
materialized by %post during image build — resolves on the rootfs.

vim: add 9.2.1119 (archetype B) 1d34351fbb

Fedora f44 version source: https://src.fedoraproject.org/rpms/vim/raw/f44/f/vim.spec (vim-enhanced 9.2.1119-1)
SPDX license: Vim

traceroute: add 2.1.6 (archetype B) 9918b658a7

Version/license from the f44 spec:
https://src.fedoraproject.org/rpms/traceroute/raw/f44/f/traceroute.spec
License: GPL-2.0-or-later (rpm epoch 3).
DESIGN batch-6 note implemented in the Containerfile header: no
CAP_NET_RAW inside the sandbox, nothing setuid, no file caps on the rpm
binary — raw UDP/ICMP probe modes degraded, connect-scan (-T) only.
Smoke: --version banner check only.

make: add 4.4.1 (archetype B) 25e7068b1a

Fedora f44 version source: https://src.fedoraproject.org/rpms/make/raw/f44/f/make.spec (4.4.1-12)
SPDX license: GPL-3.0-or-later

diffutils: add 3.12 (archetype B) cf0cde5a5c

Fedora f44 version source: https://src.fedoraproject.org/rpms/diffutils/raw/f44/f/diffutils.spec (3.12-5)
SPDX license: GPL-3.0-or-later

zip: add 3.0 (archetype B) 997cbe87de

Fedora f44 version source: https://src.fedoraproject.org/rpms/zip/raw/f44/f/zip.spec (3.0-45)
SPDX license: Info-ZIP

unzip: add 6.0 (archetype B) ee052b6c20

Fedora f44 version source: https://src.fedoraproject.org/rpms/unzip/raw/f44/f/unzip.spec (6.0-69)
SPDX license: Info-ZIP

zstd: add 1.5.7 (archetype B) 5c12f84a1f

Fedora f44 version source: https://src.fedoraproject.org/rpms/zstd/raw/f44/f/zstd.spec (1.5.7-5)
SPDX license: BSD-3-Clause OR GPL-2.0-only

xz: add 5.8.2 (archetype B) 7b817a3408

Fedora f44 version source: https://src.fedoraproject.org/rpms/xz/raw/f44/f/xz.spec (5.8.2-2)
SPDX license: 0BSD AND GPL-2.0-or-later (Fedora adds LicenseRef-Fedora-Public-Domain for upstream public-domain files)

pigz: add 2.8 (archetype B) 600de196d0

Fedora f44 version source: https://src.fedoraproject.org/rpms/pigz/raw/f44/f/pigz.spec (2.8, %autorelease)
SPDX license: zlib

bind-utils: add 9.18.50 (archetype B) 771eafeda0

Fedora f44 version source: https://src.fedoraproject.org/rpms/bind/raw/f44/f/bind.spec (9.18.50-2)
SPDX license: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause

nmap: add 7.92 (archetype B) 0b1d286b7f

Fedora f44 version source: https://src.fedoraproject.org/rpms/nmap/raw/f44/f/nmap.spec
SPDX license: LicenseRef-Nmap (Nmap Public Source License; redistribution ok)

openssh-clients: add 10.2p1 (archetype B) + ssh/scp/sftp virtual entrypoints 2ecc4a4a55

Clients only — openssh-server deliberately excluded (no daemon surface, no
host keys, nothing listens). Multi-binary surface is virtual entrypoints
(age-keygen pattern): ssh/, scp/, sftp/ each carry entrypoint.toml + smoke.toml
and the SAME sandbox spec as the main package: writable_home (~/.ssh) plus the
gate-safe ssh-agent surface — bind_try $XDG_RUNTIME_DIR -> /run/user/1000 ro,
SSH_AUTH_SOCK pass-through env (unset host agent => empty bind src is skipped
by bind_try, empty env value is 'no agent'; nothing breaks in CI).

scp/sftp smokes are deliberately empty check lists: OpenSSH 10.x scp/sftp have
no version flag (scp -V / sftp -V exit 1; verified on OpenSSH 10.5p1).

Fedora f44 version source: https://src.fedoraproject.org/rpms/openssh/raw/f44/f/openssh.spec (10.2p1-14)
SPDX license: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant

git: add 2.55.0 (archetype B) b5696dfc0d

Compose, don't vendor: the entrypoint composes the openssh-clients package
for git@ remotes (lands in this same PR; verify.sh builds all Containerfile
packages before any smoke). writable_home carries the user's ~/.gitconfig +
~/.ssh in (config-less image, gh precedent); the ssh-agent surface is
repeated from openssh-clients/entrypoint.toml because compose overlays images,
not entrypoint sandboxes.

Fedora f44 version source: https://src.fedoraproject.org/rpms/git/raw/f44/f/git.spec (2.55.0-1)
SPDX license: GPL-2.0-or-later (git proper; spec chain for the source package: BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT)

git-lfs: add 3.7.1 (archetype B) 8874c7aaf2

Composes the git package image (git-lfs shells out to git for every object
operation); composition is not transitive — git's own openssh-clients compose
does not travel, and git-lfs needs no ssh itself. writable_home for
~/.gitconfig (git lfs install writes it) — config-less image, gh precedent.

Fedora f44 version source: https://src.fedoraproject.org/rpms/git-lfs/raw/f44/f/git-lfs.spec
SPDX license: MIT (upstream declared; spec chain for the source package: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0)

merge batch3/b 3c972e0ee7

merge batch3/c

verify / verify (pull_request) Failing after 3m53s

Details

875c7d3ee7

glen referenced this pull request from a commit

2026-09-23 16:17:56 -04:00

bind-utils: expect DiG banner in smoke — f44 dig -v prints 'DiG 9.18.50', not the old 'dig Version' wording (PR #14 gate run)

glen referenced this pull request from a commit

2026-09-23 16:17:56 -04:00

whois: replace update-alternatives indirection with a direct symlink — host /etc/alternatives overlay hides the image's link, leaving /usr/bin/whois dangling (PR #14 gate run)

glen added 3 commits