Port GitLab appliance to TurnKey 19 - #43
Open
lirazsiri wants to merge 12 commits into
Open
Conversation
Install GitLab CE 19.3.0 from its official Debian 13 repository with a pinned version, bound signing key, and recorded package digest. Correct firstboot password handling and failure propagation so normal initialization remains secure and truthful. Add a non-mutating required-stop update check plus focused acceptance for root login, project creation, SSH Git round trips, database readback, and core GitLab services. Exact runtime acceptance remains pending on the known shared runner blocker; syntax and retained signed-package metadata gates pass.
Keep appliance packages unchanged by replacing the test-only jq assumption with typed JSON extraction through Debian Python inherited from Core. Record the retained runtime-inspect retry and fail-closed fixture evidence.
Use the established login cookie for private web raw-file readback because GitLab does not accept PRIVATE-TOKEN on the blob web route. Add phase-aware failures to every focused assertion and record the official v19.3 source and live response A/B evidence.
Keep credentials and Git fixtures under the root-only directory while placing only the generated Sidekiq probe in an exclusive root-owned, git-group-readable temporary file. Remove that file during cleanup and record the retained run and direct gitlab-rails privilege-drop matrix.
Map README claims to the retained scoped run results and capture source, harness, stage, updater, Sidekiq, cleanup, and artifact hashes.
Persist the prompted root email through GitLab's confirmed primary-email path and assert it through the authenticated API. Replace apt-key recovery with fingerprint-verified signed-by rotation, tighten updater trust checks, and correct the product-loop ledger.
Assert the root API email against the harness's nonsecret firstboot constant instead of its post-firstboot scrubbed preseed file. Record the retained product-loop-5 evidence without advancing the product ledger.
Seal the exact scoped run identity, source and harness hashes, phase results, and retained evidence checksums. Update the README crosswalk with the verified root email and updater trust results.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
ea6d0ebgitlab-update --checkgit diff --check origin/master...ea6d0eb