"Build it yourself" copies binaries from the builder's home directory

Breadway commented

2026-09-26 07:28:36 +08:00

Owner

Problem

build-local.sh sets BAKERY_BIN="$LAPTOP_HOME/.local/bin" (line 126) and installs those binaries into the image. Outside CI, it doesn't fetch the versions pinned in iso/bread-lockfile.toml or check them against the signed index. It bakes whatever versions the builder happens to have, and fails for anyone without the bread ecosystem already installed. The site says: "On a native Arch machine, the image builds without a container."

Fix

By default, run scripts/ci-stage-bakery.py (minisign-verified, pinned) into a temporary LAPTOP_HOME before baking, the same way CI does.
Keep the current behaviour behind BAKE_FROM_HOME=1, for local development.
Update the README and site text.

Acceptance

On a clean Arch container with no bread tools installed, sudo ./build-local.sh produces an ISO whose /usr/local/bin binaries match the lockfile pins (sha256 against the index).

Source: BOS v0.6.2 source review (tag dated 2026-09-19); line numbers refer to that tree. Read AGENTS.md first. One issue per branch/PR, match existing style. Add a CHANGELOG [Unreleased] entry.

## Problem `build-local.sh` sets `BAKERY_BIN="$LAPTOP_HOME/.local/bin"` (line 126) and installs those binaries into the image. Outside CI, it doesn't fetch the versions pinned in `iso/bread-lockfile.toml` or check them against the signed index. It bakes whatever versions the builder happens to have, and fails for anyone without the bread ecosystem already installed. The site says: "On a native Arch machine, the image builds without a container." ## Fix - By default, run `scripts/ci-stage-bakery.py` (minisign-verified, pinned) into a temporary `LAPTOP_HOME` before baking, the same way CI does. - Keep the current behaviour behind `BAKE_FROM_HOME=1`, for local development. - Update the README and site text. ## Acceptance On a clean Arch container with no bread tools installed, `sudo ./build-local.sh` produces an ISO whose `/usr/local/bin` binaries match the lockfile pins (`sha256` against the index). --- Source: BOS v0.6.2 source review (tag dated 2026-09-19); line numbers refer to that tree. Read AGENTS.md first. One issue per branch/PR, match existing style. Add a CHANGELOG `[Unreleased]` entry.

Breadway added the

labels

2026-09-26 07:28:37 +08:00

Breadway referenced this issue from a pull request that will close it,

2026-09-30 02:24:15 +08:00

"Build it yourself" copies binaries from the builder's home directory #59

Breadway commented

2026-09-30 02:25:26 +08:00

Author

Owner

PR: #59

The local ISO build now stages signed, lockfile-pinned bakery artifacts into a temporary home by default. BAKE_FROM_HOME=1 keeps the installed-home development path, and CI continues using its pre-staged home. README and CHANGELOG are updated. The PR is mergeable against current main.

Verified shell syntax, Python compilation/help, and git diff --check. I could not run the full ISO acceptance build in a clean Arch container. The requested landing page copy is also pending: its local checkout has no remote, and no bos-site Forgejo repo was found. Leaving the issue in DOING until those two external checks/updates are resolved.

PR: https://git.breadway.dev/Breadway/bos/pulls/59 The local ISO build now stages signed, lockfile-pinned bakery artifacts into a temporary home by default. `BAKE_FROM_HOME=1` keeps the installed-home development path, and CI continues using its pre-staged home. README and CHANGELOG are updated. The PR is mergeable against current main. Verified shell syntax, Python compilation/help, and `git diff --check`. I could not run the full ISO acceptance build in a clean Arch container. The requested landing page copy is also pending: its local checkout has no remote, and no bos-site Forgejo repo was found. Leaving the issue in DOING until those two external checks/updates are resolved.

Breadway commented

2026-09-30 02:40:48 +08:00

Author

Owner

The default clean Arch container acceptance run now passes: FAST_BUILD produced a 2.1 GB ISO, and all 19 staged binaries matched the signed-index SHA-256 values and lockfile versions. PR #59 contains the implementation and README/changelog updates. The only outstanding scope item is the BOS site copy; its local checkout has no Forgejo remote or mapped project, so that piece is blocked. Moving the code change to REVIEW for independent inspection.

Breadway commented

2026-09-30 02:40:49 +08:00

Author

Owner

Acceptance update for PR #59: refreshed the three stale package pins (bakery 0.8.0, bread-theme 0.8.0, breadpaper 0.2.0) to versions in the minisign-verified stable index, following the lockfile policy to bump after stable releases. The clean Arch container run completed a FAST_BUILD=1 ISO build with no bakery tools preinstalled. I extracted the built ISO's squashfs and verified all 19 required /usr/local/bin binaries against the signed index SHA-256 values; all lockfile versions match the verified index.

The only remaining scope item is the public landing page copy. The existing local site checkout has no remote configured, and no bos-site Forgejo repository exists, so I did not alter its non-main shared checkout. Issue remains in DOING pending a reviewable route for that site change.

Acceptance update for PR #59: refreshed the three stale package pins (bakery 0.8.0, bread-theme 0.8.0, breadpaper 0.2.0) to versions in the minisign-verified stable index, following the lockfile policy to bump after stable releases. The clean Arch container run completed a `FAST_BUILD=1` ISO build with no bakery tools preinstalled. I extracted the built ISO's squashfs and verified all 19 required `/usr/local/bin` binaries against the signed index SHA-256 values; all lockfile versions match the verified index. The only remaining scope item is the public landing page copy. The existing local site checkout has no remote configured, and no bos-site Forgejo repository exists, so I did not alter its non-main shared checkout. Issue remains in DOING pending a reviewable route for that site change.

Breadway commented

2026-09-30 02:42:45 +08:00

Author

Owner

Review handoff: the BOS implementation and clean-container acceptance check are complete and PR #59 is mergeable. I moved BOS-37 to REVIEW for the reviewer to inspect that PR. The standalone bos.breadway.dev copy remains a follow-up blocker because its local checkout has no remote or Forgejo repo; do not mark the issue DONE until that copy is addressed or explicitly deferred.

Breadway commented

2026-09-30 02:43:57 +08:00

Author

Owner

Review verdict: rework required

Acceptance interpretation and mapping:

A clean local build stages signed-index, lockfile-pinned binaries in a temporary home by default: implemented by build-local.sh:125-138; the clean Arch run reported in issue comment #749 verifies all 19 required binaries against signed-index SHA-256 values and lockfile versions.
BAKE_FROM_HOME=1 keeps the installed-home development path: build-local.sh:126-128, documented in README.md:134-141,149-152.
CI keeps using its already staged home: build-local.sh:129-131.
README and public BOS site copy both describe the new default: README is updated, but there is no site-copy change in PR #59. This acceptance criterion is incomplete.
The changed bakery, bread-theme, and breadpaper pins match the signed stable index: iso/bread-lockfile.toml; the issue comment #749 records the index and hash verification evidence.

Please address these items on the existing branch fix/bos-37-pinned-bakery-binaries; keep PR #59 open and do not open a second PR for BOS-37:

The issue explicitly requires updating the landing page copy. Add a reviewable change for the live BOS site that explains the new default and BAKE_FROM_HOME=1 override, or record an agreed scope change on BOS-37. The current PR only updates the BOS README.
build-local.sh:52,58-63 adds and locally signs the [breadway] key in the build host's persistent pacman keyring. Keep repository trust isolated to the build, as the previous temporary GPGDir path did, so running the ISO build does not leave a new system-wide trust entry.
Update the stale behavior comments at build-local.sh:82-83 and the lockfile header, which still say local builds snapshot whatever is installed even though the default now stages pinned binaries.

The Forgejo status endpoint reports no CI statuses for this BOS PR, so there is no failed check to report. The PR is currently mergeable. BOS is release-sensitive, so I have not merged it.

## Review verdict: rework required Acceptance interpretation and mapping: 1. A clean local build stages signed-index, lockfile-pinned binaries in a temporary home by default: implemented by `build-local.sh:125-138`; the clean Arch run reported in issue comment #749 verifies all 19 required binaries against signed-index SHA-256 values and lockfile versions. 2. `BAKE_FROM_HOME=1` keeps the installed-home development path: `build-local.sh:126-128`, documented in `README.md:134-141,149-152`. 3. CI keeps using its already staged home: `build-local.sh:129-131`. 4. README and public BOS site copy both describe the new default: README is updated, but there is no site-copy change in PR #59. This acceptance criterion is incomplete. 5. The changed bakery, bread-theme, and breadpaper pins match the signed stable index: `iso/bread-lockfile.toml`; the issue comment #749 records the index and hash verification evidence. Please address these items on the existing branch `fix/bos-37-pinned-bakery-binaries`; keep PR #59 open and do not open a second PR for BOS-37: - [ ] The issue explicitly requires updating the landing page copy. Add a reviewable change for the live BOS site that explains the new default and `BAKE_FROM_HOME=1` override, or record an agreed scope change on BOS-37. The current PR only updates the BOS README. - [ ] `build-local.sh:52,58-63` adds and locally signs the [breadway] key in the build host's persistent pacman keyring. Keep repository trust isolated to the build, as the previous temporary GPGDir path did, so running the ISO build does not leave a new system-wide trust entry. - [ ] Update the stale behavior comments at `build-local.sh:82-83` and the lockfile header, which still say local builds snapshot whatever is installed even though the default now stages pinned binaries. The Forgejo status endpoint reports no CI statuses for this BOS PR, so there is no failed check to report. The PR is currently mergeable. BOS is release-sensitive, so I have not merged it.

Breadway commented

2026-09-30 03:49:30 +08:00

Author

Owner

Rework pushed to existing PR #59 (0af7f8a). It now uses the merged BOS-38 temporary GPGDir isolation, and unified EXIT cleanup removes both the temporary keyring and staged bakery home. Updated the stale builder-home comments in build-local.sh and iso/bread-lockfile.toml.

Verification: a clean Arch container completed FAST_BUILD=1; the verified lockfile versions staged, and all 19 ISO binaries matched the signed-index SHA-256 hashes. The container's host pacman keyring did not gain the [breadway] key, and the temporary GPGDir was removed. bash -n, Python compilation, and git diff --check also pass.

The public BOS site copy remains blocked. The only local site checkout has no git remote, and no bos-site Forgejo project is mapped, so there is no reviewable repository for that change. Keep BOS-37 from DONE until the site copy is completed or its scope is explicitly changed. Sending the updated code for independent review now.

Rework pushed to existing PR #59 (`0af7f8a`). It now uses the merged BOS-38 temporary `GPGDir` isolation, and unified EXIT cleanup removes both the temporary keyring and staged bakery home. Updated the stale builder-home comments in `build-local.sh` and `iso/bread-lockfile.toml`. Verification: a clean Arch container completed `FAST_BUILD=1`; the verified lockfile versions staged, and all 19 ISO binaries matched the signed-index SHA-256 hashes. The container's host pacman keyring did not gain the [breadway] key, and the temporary GPGDir was removed. `bash -n`, Python compilation, and `git diff --check` also pass. The public BOS site copy remains blocked. The only local site checkout has no git remote, and no bos-site Forgejo project is mapped, so there is no reviewable repository for that change. Keep BOS-37 from DONE until the site copy is completed or its scope is explicitly changed. Sending the updated code for independent review now.

Breadway commented

2026-09-30 03:52:27 +08:00

Author

Owner

Re-review verdict: code PR is ready to merge; BOS-37 remains open in REVIEW

Acceptance mapping for PR #59 at 0af7f8a:

Default local builds stage signed-index, lockfile-pinned binaries in a temporary home: build-local.sh:143-154. The clean Arch evidence in issue comment #801 reports all 19 required binaries extracted from the ISO matching signed-index SHA-256 values and lockfile versions.
BAKE_FROM_HOME=1 retains the builder-installed development path: build-local.sh:143-145, also described in README.md.
CI keeps using its separately staged home: build-local.sh:146-148.
README and public site copy are updated: README is in the diff, but the site is not. The PR changes only CHANGELOG.md, README.md, build-local.sh, and iso/bread-lockfile.toml. The site-copy criterion remains unresolved.
Updated package pins and changelog are present in iso/bread-lockfile.toml and CHANGELOG.md.

The keyring rework fixes the prior concern. build-local.sh:28-34 installs one EXIT cleanup for both temporary resources; build-local.sh:36-41 puts pacman trust in the staged config's temporary GPGDir; and build-local.sh:74-81 runs pacman-key against that config. Issue comment #801 reports the clean Arch build confirmed the host keyring stayed unchanged and the temporary GPGDir was removed. The old builder-snapshot comments are corrected in build-local.sh:90-103 and the lockfile header.

Forgejo reports no CI statuses for this BOS PR, so there is no failed CI check. The PR is mergeable. The code PR itself is ready to merge, but the full BOS-37 acceptance remains incomplete until the public landing-page copy is addressed or its scope is explicitly changed. I am leaving BOS-37 in REVIEW and not marking it DONE. BOS is release-sensitive, so the merge is left to the maintainer.

## Re-review verdict: code PR is ready to merge; BOS-37 remains open in REVIEW Acceptance mapping for PR #59 at `0af7f8a`: 1. Default local builds stage signed-index, lockfile-pinned binaries in a temporary home: `build-local.sh:143-154`. The clean Arch evidence in issue comment #801 reports all 19 required binaries extracted from the ISO matching signed-index SHA-256 values and lockfile versions. 2. `BAKE_FROM_HOME=1` retains the builder-installed development path: `build-local.sh:143-145`, also described in `README.md`. 3. CI keeps using its separately staged home: `build-local.sh:146-148`. 4. README and public site copy are updated: README is in the diff, but the site is not. The PR changes only CHANGELOG.md, README.md, build-local.sh, and iso/bread-lockfile.toml. The site-copy criterion remains unresolved. 5. Updated package pins and changelog are present in `iso/bread-lockfile.toml` and `CHANGELOG.md`. The keyring rework fixes the prior concern. `build-local.sh:28-34` installs one EXIT cleanup for both temporary resources; `build-local.sh:36-41` puts pacman trust in the staged config's temporary GPGDir; and `build-local.sh:74-81` runs pacman-key against that config. Issue comment #801 reports the clean Arch build confirmed the host keyring stayed unchanged and the temporary GPGDir was removed. The old builder-snapshot comments are corrected in `build-local.sh:90-103` and the lockfile header. Forgejo reports no CI statuses for this BOS PR, so there is no failed CI check. The PR is mergeable. The code PR itself is ready to merge, but the full BOS-37 acceptance remains incomplete until the public landing-page copy is addressed or its scope is explicitly changed. I am leaving BOS-37 in REVIEW and not marking it DONE. BOS is release-sensitive, so the merge is left to the maintainer.

Breadway commented

2026-09-30 04:00:01 +08:00

Author

Owner

Independent acceptance review: site-copy PR #1

Acceptance mapping:

The BOS project card explains that local ISO builds use signed bakery binaries pinned by the lockfile by default: data/projects.toml:8.
It explains the BAKE_FROM_HOME=1 development override: data/projects.toml:8.
Scope is limited to the BOS project description. PR #1 changes only data/projects.toml; the wording is accurate and fits the requested site-copy update.

The reported zola build failure is from the existing concat filter in templates/index.html:11. The template blob is identical on the PR branch and main, and the PR does not change that file. This is a baseline build issue, not a regression from the site-copy PR, and should remain separate from BOS-37's copy scope.

PR #1 is mergeable, but Forgejo reports no CI statuses for it, and the reported site build does not pass on the current baseline. I am leaving this review open rather than treating the status as green. The site-copy change is accepted by review, but BOS-37 must remain out of DONE until both PR #59 and PR #1 are merged and the public copy is live.

## Independent acceptance review: site-copy PR #1 Acceptance mapping: 1. The BOS project card explains that local ISO builds use signed bakery binaries pinned by the lockfile by default: `data/projects.toml:8`. 2. It explains the `BAKE_FROM_HOME=1` development override: `data/projects.toml:8`. 3. Scope is limited to the BOS project description. PR #1 changes only `data/projects.toml`; the wording is accurate and fits the requested site-copy update. The reported `zola build` failure is from the existing `concat` filter in `templates/index.html:11`. The template blob is identical on the PR branch and `main`, and the PR does not change that file. This is a baseline build issue, not a regression from the site-copy PR, and should remain separate from BOS-37's copy scope. PR #1 is mergeable, but Forgejo reports no CI statuses for it, and the reported site build does not pass on the current baseline. I am leaving this review open rather than treating the status as green. The site-copy change is accepted by review, but BOS-37 must remain out of DONE until both PR #59 and PR #1 are merged and the public copy is live.

Breadway commented

2026-09-30 04:08:14 +08:00

Author

Owner

Independent site-source review found PR #1 changes data/projects.toml in the obsolete Zola catalog, which has no CI or deployment path. It does not update the live BOS site, served from the separate BOS Website [bos.breadway.dev] checkout. The BOS issue's site-copy acceptance therefore remains unmet. Keep this issue open until the live source has a reviewable change and the published page is verified.

Independent site-source review found PR #1 changes `data/projects.toml` in the obsolete Zola catalog, which has no CI or deployment path. It does not update the live BOS site, served from the separate `BOS Website [bos.breadway.dev]` checkout. The BOS issue's site-copy acceptance therefore remains unmet. Keep this issue open until the live source has a reviewable change and the published page is verified.

Breadway commented

2026-10-01 10:28:44 +08:00

Author

Owner

Recheck of BOS-37 at PR #59 `0af7f8af4f53da3f9a5f1c9e5758981ca59b36c0`

The BOS source PR still meets the code criteria reviewed earlier: default local builds stage signed-index lockfile pins in build-local.sh:143-154, BAKE_FROM_HOME=1 keeps the development override, CI reuses its staged home, README and changelog match, and the temporary GPGDir avoids host trust changes. The reported clean Arch ISO run verifies all 19 binaries against the signed index. The PR is mergeable and Forgejo reports no CI status.

The earlier site blocker has changed: Breadway/bos-site now exists with reviewable source PRs for other BOS issues. None of its current PRs changes the local-build copy required here. Please add a focused bos-site PR explaining the signed pinned default and BAKE_FROM_HOME=1, then verify the published page before marking BOS-37 done. The BOS code PR is ready for the release maintainer; no merge attempted.

## Recheck of BOS-37 at PR #59 `0af7f8af4f53da3f9a5f1c9e5758981ca59b36c0` The BOS source PR still meets the code criteria reviewed earlier: default local builds stage signed-index lockfile pins in `build-local.sh:143-154`, `BAKE_FROM_HOME=1` keeps the development override, CI reuses its staged home, README and changelog match, and the temporary GPGDir avoids host trust changes. The reported clean Arch ISO run verifies all 19 binaries against the signed index. The PR is mergeable and Forgejo reports no CI status. The earlier site blocker has changed: Breadway/bos-site now exists with reviewable source PRs for other BOS issues. None of its current PRs changes the local-build copy required here. Please add a focused bos-site PR explaining the signed pinned default and `BAKE_FROM_HOME=1`, then verify the published page before marking BOS-37 done. The BOS code PR is ready for the release maintainer; no merge attempted.

Breadway commented

2026-10-01 10:29:54 +08:00

Author

Owner

The remaining public-site source change is ready for review: Breadway/bos-site#4

It documents the signed, lockfile-pinned default local build and the sudo BAKE_FROM_HOME=1 ./build-local.sh development override. Site PR #4 is stacked on site PR #1, which imports the actual bos.breadway.dev source. The existing BOS implementation remains in #59; its clean Arch ISO acceptance record already verifies all 19 staged binaries and temporary keyring isolation.

Site HTML parses, git diff --check passes, and both PRs are mergeable. Forgejo reports no CI statuses for either branch. The live page still needs publication after review and merge, so do not mark BOS-37 DONE yet.

The remaining public-site source change is ready for review: https://git.breadway.dev/Breadway/bos-site/pulls/4 It documents the signed, lockfile-pinned default local build and the `sudo BAKE_FROM_HOME=1 ./build-local.sh` development override. Site PR #4 is stacked on site PR #1, which imports the actual bos.breadway.dev source. The existing BOS implementation remains in https://git.breadway.dev/Breadway/bos/pulls/59; its clean Arch ISO acceptance record already verifies all 19 staged binaries and temporary keyring isolation. Site HTML parses, `git diff --check` passes, and both PRs are mergeable. Forgejo reports no CI statuses for either branch. The live page still needs publication after review and merge, so do not mark BOS-37 DONE yet.

Breadway commented

2026-10-01 15:27:17 +08:00

Author

Owner

BOS site-copy review: PR #4 is accurate, pending its prerequisite and publication

Acceptance interpretation: update the BOS site to explain that local ISO builds stage signed, lockfile-pinned tools by default and that BAKE_FROM_HOME=1 opts into installed versions. The new copy does so at index.html:1447,1451; the unrelated neighboring build and install text remains unchanged. PR #4 changes only the site copy and changelog.

PR #4 is open and mergeable, but it is stacked on site PR #1's fix/bos-42-site-exit-binding branch. Neither head has CI statuses. BOS PR #59 remains separately open and mergeable with no CI status; its clean Arch ISO acceptance is recorded in this issue. The BOS source change and site wording now cover the source acceptance, but the public copy is not live until the site branch stack is landed and deployed. This comment does not claim a live deploy or completion. BOS is release-sensitive, so no merge attempted.

## BOS site-copy review: PR #4 is accurate, pending its prerequisite and publication Acceptance interpretation: update the BOS site to explain that local ISO builds stage signed, lockfile-pinned tools by default and that `BAKE_FROM_HOME=1` opts into installed versions. The new copy does so at `index.html:1447,1451`; the unrelated neighboring build and install text remains unchanged. PR #4 changes only the site copy and changelog. PR #4 is open and mergeable, but it is stacked on site PR #1's `fix/bos-42-site-exit-binding` branch. Neither head has CI statuses. BOS PR #59 remains separately open and mergeable with no CI status; its clean Arch ISO acceptance is recorded in this issue. The BOS source change and site wording now cover the source acceptance, but the public copy is not live until the site branch stack is landed and deployed. This comment does not claim a live deploy or completion. BOS is release-sensitive, so no merge attempted.

Breadway commented

2026-10-01 15:32:53 +08:00

Author

Owner

Independent review update

Acceptance interpretation:

Default local ISO builds stage signed-index, lockfile-pinned binaries in a temporary home: build-local.sh:143-153. The recorded clean Arch run verifies all 19 installed ISO binaries against the signed index and lockfile.
BAKE_FROM_HOME=1 keeps the builder-installed development path, and CI retains its separately staged home: build-local.sh:143-148, README.md:134-153.
The build keyring is scoped to the temporary staged pacman config and cleaned up with the staged bakery home: build-local.sh:30-41,74-80; the recorded acceptance run confirmed the host keyring stayed unchanged.
The BOS README and site copy are addressed. Site PR #4 at Breadway/bos-site accurately describes the default and override in index.html:1446-1451. It is correctly stacked on PR #1, which imports the actual bos.breadway.dev static source into that repository.
The current BOS PR #59 head 0af7f8af4f53da3f9a5f1c9e5758981ca59b36c0 is mergeable. Forgejo reports no CI statuses for this repository.

Rework is required in the site source dependency before the prior approval applies:

On existing Breadway/bos-site PR #1, remove the hardcoded private overlay IP default in deploy.sh:12 and the internal route detail in deploy.sh:4-6. The review comment is on PR #1. Keep PR #4 open and stacked on PR #1.

BOS-37 returns to TODO until PR #1 is reworked. Do not mark it DONE until the site PRs are reviewed, merged, and the published page is verified.

## Independent review update Acceptance interpretation: 1. Default local ISO builds stage signed-index, lockfile-pinned binaries in a temporary home: `build-local.sh:143-153`. The recorded clean Arch run verifies all 19 installed ISO binaries against the signed index and lockfile. 2. `BAKE_FROM_HOME=1` keeps the builder-installed development path, and CI retains its separately staged home: `build-local.sh:143-148`, `README.md:134-153`. 3. The build keyring is scoped to the temporary staged pacman config and cleaned up with the staged bakery home: `build-local.sh:30-41,74-80`; the recorded acceptance run confirmed the host keyring stayed unchanged. 4. The BOS README and site copy are addressed. Site PR #4 at `Breadway/bos-site` accurately describes the default and override in `index.html:1446-1451`. It is correctly stacked on PR #1, which imports the actual `bos.breadway.dev` static source into that repository. 5. The current BOS PR #59 head `0af7f8af4f53da3f9a5f1c9e5758981ca59b36c0` is mergeable. Forgejo reports no CI statuses for this repository. Rework is required in the site source dependency before the prior approval applies: - [ ] On existing `Breadway/bos-site` PR #1, remove the hardcoded private overlay IP default in `deploy.sh:12` and the internal route detail in `deploy.sh:4-6`. The review comment is on PR #1. Keep PR #4 open and stacked on PR #1. BOS-37 returns to TODO until PR #1 is reworked. Do not mark it DONE until the site PRs are reviewed, merged, and the published page is verified.

Breadway commented

2026-10-01 15:46:01 +08:00

Author

Owner

Addressed the site privacy rework on the existing dependency PR #1, branch fix/bos-42-site-exit-binding, exact head 9b977d0142a2e7aab836cf2180a7e36d7539ea59: removed private overlay IP default and route topology from deploy.sh, require caller-supplied HESTIA_HOST, and removed internal network details from README. PR #4 remains stacked on PR #1. Verified bash -n deploy.sh, missing-host guard behavior, a privacy scan of README/deploy.sh, and git diff --check. No deployment was run. The public page still requires the normal PR review/merge/deployment path before BOS-37 can be marked DONE.

Addressed the site privacy rework on the existing dependency PR #1, branch `fix/bos-42-site-exit-binding`, exact head `9b977d0142a2e7aab836cf2180a7e36d7539ea59`: removed private overlay IP default and route topology from `deploy.sh`, require caller-supplied `HESTIA_HOST`, and removed internal network details from README. PR #4 remains stacked on PR #1. Verified `bash -n deploy.sh`, missing-host guard behavior, a privacy scan of README/deploy.sh, and `git diff --check`. No deployment was run. The public page still requires the normal PR review/merge/deployment path before BOS-37 can be marked DONE.

Breadway closed this issue

2026-10-02 14:28:49 +08:00

Rows
Columns

"Build it yourself" copies binaries from the builder's home directory #37

Problem

Fix

Acceptance

Review verdict: rework required

Re-review verdict: code PR is ready to merge; BOS-37 remains open in REVIEW

Independent acceptance review: site-copy PR #1

Recheck of BOS-37 at PR #59 0af7f8af4f53da3f9a5f1c9e5758981ca59b36c0

BOS site-copy review: PR #4 is accurate, pending its prerequisite and publication

Independent review update

Recheck of BOS-37 at PR #59 `0af7f8af4f53da3f9a5f1c9e5758981ca59b36c0`