enricobuehlerandClaude Fable 5
06a249e49f
The U2 leg of planning:host-update-from-web-console.md. A new dep-free root helper (crates/pf-update) runs the distro package manager against the INSTALLED punktfunk packages — apt (index refresh scoped to our list when present), dnf, rpm-ostree (single-transaction re-resolve, reported staged), sysext (the proven signed-feed updater), pacman only behind the explicit PACMAN_FULL_SYSUPGRADE opt-in — then the run-the-binary gate, then a root-written result record. Zero attacker-influenceable parameters end to end: fixed ExecStart oneshot (punktfunk-update.service), polkit rule scoped to that one unit's start verb for the shipped-EMPTY punktfunk-update group (joining it is the auditable opt-in; every postinst creates it, none populate it). The host starts the unit, interprets the record (staged / nothing-newer-yet / changed), and crosses its own restart on the same intent/reconcile machinery as the Windows leg. Status now reports staged results and the opt-in hint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
18 lines
959 B
Desktop File
18 lines
959 B
Desktop File
# The web-console-triggered host update, as a root oneshot (planning:
|
|
# host-update-from-web-console.md §7). Started — never enabled — by the unprivileged host via
|
|
# `systemctl start punktfunk-update.service`, authorized by the polkit rule
|
|
# (49-punktfunk-update.rules) for members of the `punktfunk-update` group. systemd gives us
|
|
# single-flight (a second start while active fails) and journal capture for free; the helper
|
|
# writes its machine-readable outcome to /var/lib/punktfunk/update-result.json.
|
|
[Unit]
|
|
Description=punktfunk host update (root helper)
|
|
# Network is a hard prerequisite for every leg (package manager / sysext feed).
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/libexec/punktfunk/pf-update apply
|
|
# The helper drives the distro package manager, which needs the real system — no sandboxing
|
|
# directives here on purpose; the constraint is the FIXED ExecStart (no parameters exist).
|