fix: accept the locked Zarf init source archive #132
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
3 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!132
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/gitch-init-source-size"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Platform run 5105 passed its source scan and all four signed-image checks, then stopped before custom init package creation. The locked Zarf 0.86.0 source archive is 104,503,102 bytes, but the new downloader rejected everything above 64 MiB. Replaying the old helper against the checksum-verified archive reproduces that failure.
Match the streaming download bound to the exact reviewed archive length and reject truncated downloads. Keep the source SHA-256 pin, verified HTTPS, redirect rejection and extraction limits intact. Add public progress messages for download and chart preparation so these stages can be distinguished without exposing private command output.
Validation: 21 focused init, signed-image and Core-workflow tests pass; the actual locked archive passes download and chart preparation with the fix; fatal/undefined-name lint, diff checks and the required native Gitleaks hook pass. No local container/package build or cluster deployment was run.
After merge, publish/promote the workflow fix to stable-v1, then retry Homelab/platform core-delivery.yml on main with operation verify-only. No Platform code, image release, OpenBao value or credential change is required.
Reviewed the exact-head downloader and tests. The streaming bound now permits the declared 104,503,102-byte locked archive, rejects both oversized and truncated streams, and retains the pinned SHA-256 check before extraction, HTTPS/no-redirect behavior, bounded extraction, and signed image verification ahead of package creation. Progress stages wrap download and chart preparation without changing the UDS init package/image selection or deployment/routing ownership. The large-stream regression uses mocked bytes rather than downloading the upstream archive in this review; the claimed live archive reproduction is not independently verified here. Source review approved; Workflow acceptance, Repository security, and Library checks were still pending at review time and remain mandatory merge gates. No merge or deployment is authorized by this approval.
CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
Independently reviewed the current exact-head diff and complete changed downloader/test source. The 104,503,102-byte locked-source bound accepts the formerly rejected archive size, rejects oversized and truncated streams, and retains the pinned SHA-256 check before bounded extraction, verified HTTPS/no redirects, and signed image validation before package creation. Added progress stages do not alter UDS 1.14.1 package selection, deployment policy or routing ownership. The large-stream test mocks archive bytes; live archive retrieval was not independently reproduced in this review. Source approved only; Workflow acceptance, Repository security, and Library checks are running/pending at this head and remain mandatory merge gates. Earlier Library run 1050 at
0c69ce4is cancelled, not evidence that current checks passed. No merge or deployment authorized.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.