installer-setup WS-B: platform-gate hardening (bootstrap-prereq parity, disk-on-store, early hal0 user)#1139
Merged
Merged
Conversation
…y, disk-on-store, early hal0 user) The direct `sudo bash install.sh` path skipped the same base-prereq checks (Linux host, curl/tar/sha256sum) that bootstrap.sh's one-liner enforces before ever fetching the release tarball, so a minimal host could sail past "Pre-flight checks" and die deep in the run with a bare "command not found". The hal0 system user was also created very late (after directories, the source copy, and hal0.toml were already mutated), and the disk-space preflight only ever measured VAR_DIR, never the models store an operator picks via --models-dir/HAL0_MODELS_DIR. Add preflight_bootstrap_prereqs (mirrors bootstrap.sh's preflight()) and call it hard in install.sh's own Pre-flight step; move the hal0 user/group + render/video group creation to right after pre-flight, before any filesystem mutation; add a warn-only disk probe on MODELS_DIR alongside the existing (fatal) VAR_DIR probe. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
thinmintdev
added a commit
that referenced
this pull request
Jul 6, 2026
…ity tests (#1143) full_bin_dir seeds PATH tools as symlinks to the real binaries; _fake_uname then overwrote `uname` via write_text(), which FOLLOWS the symlink and rewrites the host's /usr/bin/uname → PermissionError on the CI runner (TestNonLinuxHost::test_darwin_is_rejected / test_linux_is_accepted), or silent mutation of the real binary when the suite runs as root. _write_exe now unlinks first so it replaces the symlink with a regular file. Unblocks CI on main (regression from #1098/#1139 merged green off a box-local run where /usr/bin/uname was writable). Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #1098.
Three up-front gate gaps closed in
installer/install.sh/installer/lib/preflight.sh:installer/bootstrap.sh(thecurl|bashone-liner) hard-requires a Linux host pluscurl/tar/sha256sumin its ownpreflight()before it ever fetches the release tarball.install.shleans on all three later in its own run (the network probe's curl call, the rsync-fallback tar copy, the FLM.debsha256 check) but a directsudo bash install.sh— no bootstrap in front — never checked for them up front. Addedpreflight_bootstrap_prereqs()toinstaller/lib/preflight.sh(mirrors bootstrap.sh's checks/message style) and call it, hard (dieon failure), as the first thing install.sh does in its "Pre-flight checks" step. Also wired intopreflight_allsohal0 doctorreports the same floor.VAR_DIR. Model weights land atMODELS_DIR, which is frequently a different mount (--models-dir=/data/models, a NAS/NVMe). Added a secondpreflight_diskcall againstMODELS_DIR, warn-only (non-fatal) — no model is picked yet at install time, so an undersized store shouldn't hard-block the rest of the platform gate the way a genuinely full root disk should.hal0user creation — thehal0system user/group + render/video group membership used to be created very late (after directories, the source copy, and hal0.toml were already mutated). Moved to immediately after pre-flight, before the first mutating step ("Filesystem layout"'smkdir -p). The directory-dependent follow-up work that needsVAR_DIRto exist (FLM cache, HF cache,STATE.mdownership) stays where it was, in its own now-ui_step-free block.No regression to the one-liner path: bootstrap.sh is unchanged, and install.sh's new checks are strictly additive.
Test plan
bash -n installer/install.shuv run ruff format src tests/ruff check/ruff format --check— cleantests/installer/test_bootstrap_prereq_parity.py(function-level, via subprocess+stubs — asserts Linux/curl/tar/sha256sum checks, install.sh wiring + ordering) andtests/installer/test_platform_gate_hardening.py(static-text/ordering assertions: early user creation precedes mutation, no duplicate user/group creation, models-store disk check present and warn-only)uv run pytest tests/ -q --ignore=tests/e2e— same ~14 pre-existing failures asmain(confirmed viagit stash: hermes venv, comfyui phase4, proxmox host detection, container spec, config-url-proxy, models-preview, settings-store), no new failures introduced🤖 Generated with Claude Code