Ship rsync and minisign in the base image
Both are absent today and both stop fw13 doing the job it keeps after the
migration, which nothing had costed until GoingsOn alloy c4eb6d5e measured it.
rsync is the transport under the fleet tools. ops-exec spawns the binary by
name and bentod, the bento driver and sandod all link that crate, so a machine
without it cannot collect a build from another host or hand a release over. It
fails before anything is compiled and it fails the same way headless, so it
belongs in the base rather than in either profile.
minisign signs every Linux artifact this tree publishes. sign-artifacts.sh
exits when it is not on PATH and the recipe step that calls it aborts the run,
so the failure is a release that does not happen rather than one that ships
unsigned.
Measured against the built client image: minisign 0.12 from fedora, rsync
3.4.4 from updates. Both are Fedora 43 main, no COPR, no Terra.
CONTINUITY.md rejects rsync-based sync and still does. That paragraph is about
the continuity model, not the binary, and it now says so: nothing in alloy sync
calls rsync.
Unverified until the next real image build. No Rust changed; the suite is green
at 1097 passed, 12 ignored.
- Co-Authored-By
- Claude Opus 5 (1M context) <noreply@anthropic.com>
2 files changed,
+19 insertions,
-0 deletions
| 1228 |
1228 |
|
tailscale \
|
| 1229 |
1229 |
|
syncthing \
|
| 1230 |
1230 |
|
restic \
|
|
1231 |
+ |
# rsync is the transport under the fleet tools rather than a
|
|
1232 |
+ |
# convenience. ops-exec spawns the binary by name
|
|
1233 |
+ |
# (MNW/shared/ops-exec/src/transport.rs), and bentod, the bento
|
|
1234 |
+ |
# driver and sandod all link that crate, so a machine without it
|
|
1235 |
+ |
# cannot collect a build from another host or hand a release over.
|
|
1236 |
+ |
# That is the control plane and not a build step: it fails before
|
|
1237 |
+ |
# anything is compiled, and it fails identically on a box with no
|
|
1238 |
+ |
# graphical session, which is why it sits in the base.
|
|
1239 |
+ |
rsync \
|
| 1231 |
1240 |
|
# Local discovery, both halves. Alloy could already ANNOUNCE a .local
|
| 1232 |
1241 |
|
# name and could not RESOLVE one, which is a mismatch rather than a
|
| 1233 |
1242 |
|
# missing feature, and it only shows up on the machine doing the
|
| 1267 |
1276 |
|
avahi \
|
| 1268 |
1277 |
|
avahi-tools \
|
| 1269 |
1278 |
|
nss-mdns \
|
|
1279 |
+ |
# Artifact signing. Every Linux release this tree publishes is
|
|
1280 |
+ |
# signed with minisign: dist/sign-artifacts.sh checks for it on PATH
|
|
1281 |
+ |
# and exits if it is absent, and the recipe step that calls it is
|
|
1282 |
+ |
# sh_ok, so the run aborts rather than shipping the artifact
|
|
1283 |
+ |
# unsigned. Base rather than client for the same reason as rsync:
|
|
1284 |
+ |
# signing is a build-host act and has nothing to do with a desktop
|
|
1285 |
+ |
# session.
|
|
1286 |
+ |
minisign \
|
| 1270 |
1287 |
|
# podman, the runtime behind two of `alloy pkg box`'s three isolation
|
| 1271 |
1288 |
|
# levels: `workspace` calls it directly and distrobox wraps it for
|
| 1272 |
1289 |
|
# `host`. flatpak is the third and is client-only, since `sandboxed`
|
| 33 |
33 |
|
|
| 34 |
34 |
|
**Not shipping alternatives.** rsync-based sync is more mechanical and less mesh-shaped than Alloy wants; Resilio is proprietary; NextCloud/Seafile are servers, not sync tools. Syncthing is the honest pick for peer-to-peer file continuity.
|
| 35 |
35 |
|
|
|
36 |
+ |
The image does carry the `rsync` binary, added 2026-08-20, and that is not a reversal of the paragraph above. What is rejected here is rsync as the continuity model: a scripted push between two paths is not a mesh and does not survive a machine being away. The binary is in the base because fleet tooling shells out to it as a transport, which is a different job on a different schedule. Nothing in `alloy sync` calls it.
|
|
37 |
+ |
|
| 36 |
38 |
|
## First-boot flow
|
| 37 |
39 |
|
|
| 38 |
40 |
|
**Shipped as `alloy setup`.** At first login, one screen with two rows:
|