Whonix

Recent Commits

• Patrick Schleizer (09 Jul 26)

  bumped changelog version

• Patrick Schleizer (09 Jul 26)

  .

• Patrick Schleizer (09 Jul 26)

  .

• Patrick Schleizer (09 Jul 26)

  .

• Patrick Schleizer (09 Jul 26)

  .

• Patrick Schleizer (09 Jul 26)

  comment

• Patrick Schleizer (09 Jul 26)

  .

• Patrick Schleizer (09 Jul 26)

  Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie'

• Aaron Rainbolt (09 Jul 26)

  Minor fixes, TODO, FIXME

• Patrick Schleizer (08 Jul 26)

  bumped changelog version

• Patrick Schleizer (08 Jul 26)

  CI

• Patrick Schleizer (08 Jul 26)

  cleanup

• Patrick Schleizer (08 Jul 26)

  bumped changelog version

• Patrick Schleizer (08 Jul 26)

  Merge remote-tracking branch 'org-ai-assisted/master'

• Patrick Schleizer (08 Jul 26)

  delete automated_builder (replaced by new CI scripts)

• assisted-by-ai (Bot Account) (Machine Account) (08 Jul 26)

  Merge pull request #52: native GitHub CI build (signed amd64+arm64) + apt-cache + retry_run Native amd64+arm64 signed build via ci/github-build; approx + docker-image apt caching; generic retry_run behind all apt calls (incl. pbuilder chroot). Original commits by @Mycobee preserved.

• claude (dev56 7c768585-e4f3-4e54-907f-be83affd0cb1) (08 Jul 26)

  3500: restore (apt_get_exit_code: ...) in the "failed again" message The second diagnostic message lost its "(apt_get_exit_code: $apt_get_exit_code)" detail during the retry_run rewrite. Restore it so the exit code is shown in both the first and the "as expected, failed again" error lines, as before. Full diff vs master now contains only the intended changes (strict-mode/SC2086 waiver, retry_run wraps, two comments). ## AI-Assisted

• claude (dev56 7c768585-e4f3-4e54-907f-be83affd0cb1) (08 Jul 26)

  3500: keep the original debug re-run exit-code capture + "did not fail?!?" When restoring the debug-output gathering I had simplified the capture to '|| true' and dropped the invariant check. Restore both verbatim: the debug re-run captures its own exit code via '|| { apt_get_exit_code="$?" ; true; }', and if that re-run unexpectedly SUCCEEDS (retry_run had given up), flag it loudly with "Second attempt installing ... did not fail?!?" and error, rather than silently proceeding. Only a genuine repeated failure falls through to apt_get_parse_unmet_dependency. ## AI-Assisted

• claude (dev56 7c768585-e4f3-4e54-907f-be83affd0cb1) (08 Jul 26)

  retry-run: validate --tries/--delay (AI review) Codex + a local fresh-eyes pass flagged that retry_run did not validate its counters: a missing value tripped an unbound $2 under nounset, a non-integer broke the arithmetic, and '--tries 0' returned success WITHOUT running the command. Reject a missing value and require a positive-integer --tries / non-negative-integer --delay. This also guarantees nothing in the loop can trigger errexit, so the pipefail restore at the end is always reached. Unit-tested: normal success, real-failure-propagation, and each misuse (tries 0 / non-numeric / missing value / no command) now rejected. ## AI-Assisted

• claude (dev56 7c768585-e4f3-4e54-907f-be83affd0cb1) (08 Jul 26)

  dm-docker-image-cache: graceful fallback on docker load failure A corrupted cache tar (partial write, disk/cache issue) made 'docker load' fail under errexit, aborting the CI step with no recovery -- blocking PRs until the cache expired. Treat a load failure as a cache miss: warn, drop the bad tar, and continue so build_docker_image rebuilds the image. Addresses CodeRabbit review on ci/dm-docker-image-cache. ## AI-Assisted

• claude (dev56 7c768585-e4f3-4e54-907f-be83affd0cb1) (08 Jul 26)

  2100: SC2086 waiver on the retry_run-wrapped apt update line $SUDO_TO_ROOT is intentionally word-split (it may be 'sudo --...'); add a per-line shellcheck disable=SC2086 matching this file's per-line-waiver idiom, so the wrapped call is gate-clean. ## AI-Assisted

• claude (dev56 7c768585-e4f3-4e54-907f-be83affd0cb1) (08 Jul 26)

  3500: restore the debug-output gathering the retry_run rewrite dropped The pkg-install rewrite replaced the two-attempt logic with retry_run but also removed the step that populated $apt_get_output -- which apt_get_parse_unmet_dependency parses to surface unmet dependencies. That left the diagnosis empty (and would hit an unbound $apt_get_output under nounset on a real failure). Restore it as a step AFTER retry_run gives up: on a non-transient / retry- exhausted failure, re-run the install once capturing its combined output into $apt_get_output, then diagnose. retry_run still owns the transient retry; this only runs on genuine failure. ## AI-Assisted

• claude (dev56 7c768585-e4f3-4e54-907f-be83affd0cb1) (08 Jul 26)

  retry_run: extract to help-steps/retry-run; wrap all apt calls incl. chroot Use retry_run behind every apt-get call for consistency, in and out of the pbuilder/cowbuilder chroot. - help-steps/retry-run: new standalone, dependency-minimal library (needs only a pre-defined error + coreutils). Kept out of help-steps/pre so the pbuilder-chroot-script-* can source just this, not pre's colors / exception handlers / helper-scripts deps. Self-contained: enables pipefail locally for its 'CMD | tee' capture and restores the caller's setting, so it is correct regardless of caller shell options; uses rm (not safe-rm, absent in the chroot) for its mktemp tmpfile. - help-steps/pre: source the helper instead of defining retry_run inline. - build-steps.d/{3500,2100,1200}: wrap every network apt-get (update, install, dist-upgrade, fix-broken/-missing). 3500 gains the two missing strict-mode shopt lines + an SC2086 waiver so the touched file is clean. - build-steps.d/1300_cowbuilder-setup: copy retry-run into the chroot home (beside pbuilder_config_file). - help-steps/pbuilder-chroot-script-main: define a minimal local error, source the copied retry-run, wrap its apt dist-upgrade; complete its strict-mode + SC2086 waiver. Verified: retry_run unit test (success / transient-recovers / non-transient / pipefail-restore) 6/6; bash -n + shellcheck + ASCII clean; static gate clean except one pre-existing item: pre's intentional 'set +o errexit' (retry/exception mode) trips R-011, which has no waiver and is unsafe to restructure. inherit_errexit added to 3500 (its $() are guarded) and pbuilder-chroot-script-main (its only $() is commented out) -- validated by the CI build. ## AI-Assisted

• Patrick Schleizer (08 Jul 26)

  .

• Patrick Schleizer (08 Jul 26)

  .

• Patrick Schleizer (08 Jul 26)

  Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master'

• claude (dev56 7c768585-e4f3-4e54-907f-be83affd0cb1) (08 Jul 26)

  help-steps/pre: add generic retry_run; use it in 3500_install-packages Phase 1 of a shared retry helper for the many apt-get / curl call sites. - help-steps/pre: retry_run [--tries N] [--delay S] -- CMD [ARG...] runs a command, streaming its output (tee) while capturing it to judge retryability. It retries only TRANSIENT failures -- a shared regex covering apt and curl fetch errors (mid-publish 404, dropped connection, 5xx, hash-sum mismatch, DNS/TLS blips) -- with linear backoff, and returns immediately on a non-transient failure (unmet deps, real 4xx). Returns CMD's exit code, so callers are unchanged. Defined in pre (not a separate sourced file) because pre is the shared preamble that already defines error() and is sourced everywhere; the help-steps dir var is not yet set that early to source a sibling. - build-steps.d/3500_install-packages: wrap the derivative package install (the currently-flaky site) in retry_run, replacing the hand-rolled two-attempt logic whose "second attempt" was diagnostic only and even errored on an unexpected recovery. Non-transient failures still fall through to apt_get_parse_unmet_dependency + error. Verified: unit-tested retry_run (success / transient-recovers / non-transient-immediate / exhausted), gate green, bash -n + shellcheck clean, ASCII. Phases 2-3 (remaining network apt calls; curl sites) to follow. ## AI-Assisted

• claude (dev56 7c768585-e4f3-4e54-907f-be83affd0cb1) (08 Jul 26)

  CI: also cache the docker image (image-build apt, the second level) Adds the missing caching level. ci/approx-cache-sidecar covers the big in-container apt workload (target-OS packages via approx); this covers the other one: the docker IMAGE build, whose Dockerfile RUNs docker-setup's apt-get install of ~30 build-host tools directly against the mirrors (approx is not up during 'docker build'), re-downloaded on every ephemeral runner. - ci/dm-docker-image-cache: docker save/load "${IMG}:latest" via a runner-owned tar, so build_docker_image's 'docker images' guard finds the loaded image and skips the rebuild. CI-guarded like the sidecar. - local-build.yml: actions/cache the image tar keyed on hashFiles('docker/**') (no restore-keys, G-A-007); load on hit before the build, save on miss after. Per-arch key (amd64/arm64 images differ). actions/cache is already in the provenance table. Net win is modest (~30 packages; the tar shuffle offsets some of it), but it completes both-levels apt caching. ## AI-Assisted

• claude (dev56 7c768585-e4f3-4e54-907f-be83affd0cb1) (08 Jul 26)

  github-actions-security.md: fix outdated workflow file names The container-digest note referenced `lint.yml` and `dry-run.yml`, which were renamed to `local-lint.yml` and `local-build-dry-run.yml` (G-A-005 'local-' prefix). Update the names so the "bump both call sites in lockstep" instruction points at the files that actually pin the digest. ## AI-Assisted

• claude (dev56 7c768585-e4f3-4e54-907f-be83affd0cb1) (08 Jul 26)

  CI: cache the build's apt downloads via a runner-owned approx sidecar Adapt developer-meta-files' apt-install-with-cache pattern to the build's approx package cache. approx's dir (docker-run CACHER_VOLUME, $HOME/approx_cache_mnt) is chowned to the in-container approx uid 101:102 mode 770 by volume_prepare, so the unprivileged runner cannot tar it directly - the exact root-owned-dir case actions/cache must avoid. - ci/approx-cache-sidecar: seed the approx dir from a runner-owned sidecar before the build (pre-creating it with the 101:102/770 perms volume_prepare expects, so its 'if [ ! -d ]' guard leaves the seeded contents in place) and snapshot new packages back after (sudo-reading the approx-owned dir, then handing the sidecar back to the runner so actions/cache can tar it). CI-guarded like the upstream helper. - local-build.yml: actions/cache the sidecar (no restore-keys, G-A-007; hashFiles key per arch), plus seed/snapshot steps around the build. - agents/github-actions-security.md: add the actions/[email protected] provenance row (same SHA the developer-meta-files action pins). First run is a cache miss (empty seed == today's behavior); later runs reuse the cached packages, cutting download time and live approx fetches. ## AI-Assisted