fix(seed): correct 7.1 pin prose, stop bump-seed.sh de-aligning it #28

Merged

zach merged 1 commit from fix/seed-pin-prose-and-alignment into main 2026-07-25 19:14:34 +00:00

Conversation 0 Commits 1 Files changed 2 +94 -16

zach commented 2026-07-25 19:13:20 +00:00

Owner

Copy link

Problem

configs/seeds/7.1.toml claimed:

anthraxx's Arch packaging has not published a 7.1 config.x86_64 yet, so the 7.1 line is seeded from the current 7.0.12 config

…and told the reader to bump to a real 7.1 config "as soon as anthraxx ships one". He shipped one. The pin has been 7.1.4.hardened1-1 since the seed-bump merged in b958c42, so the NOTE described the opposite of reality to anyone reading the file to understand the current seed.

The three keys bump-seed.sh rewrites had also drifted one column left of the three it doesn't (commit/tag/sha256 at 11 chars vs url/config_path/signer_fpr at 12).

Prose

Rewritten to describe the same-line 7.1 seed, keeping the pinning-model and signature-verification explanation intact. Two claims needed rewording rather than deleting:

• "the seed intentionally LAGS the kernel line" was about lagging an entire series. It still lags, but only by a patch level now — anthraxx changes config.x86_64 in ~1 in 4–5 tags. That's the ordinary case 7.0.toml already documents ("The seed routinely LAGS the kernel version — that is expected, handled by olddefconfig + the drift guard, not by a version-match gate"), so the two files now agree.
• "the hardening-drift guard covers inherited symbols once a 7.1 baseline exists" was conditional on a baseline that now exists — releases/ carries v7.1.1 through v7.1.4, so the guard is live for this line.

The cross-series fallback rationale is kept as history, since it applies to any future line stood up before anthraxx packages a config for it.

Root cause — tools/bump-seed.sh

This is what would have done it again:

1. De-alignment. Its sed replaced whole lines with hardcoded padding (commit = ), one space short of the files' config_path = column — so every bump silently skewed the three keys it rewrites. Now value-anchored with a \1 backreference, preserving whatever alignment the file has rather than imposing a width.

2. Silent no-op risk introduced by (1). A value-anchored substitution does nothing if a value isn't double-quoted, which would leave the pin unchanged while the script reports success and seed-bump.yml opens an empty PR. The rewrite is now verified and hard-fails if it didn't land.

3. Prose is never rewritten — the actual cause of the stale NOTE. The script now warns when a bump crosses a series boundary, and says so specifically when a line gains its first same-line seed. seed-bump.yml already embeds the script's whole summary in the PR body, so this reaches a human at review time with no workflow change. Rendered against the historical 7.0.12 → 7.1.4 bump:

     WARNING -- SERIES BOUNDARY: seed moves 7.0 -> 7.1
       Line 7.1 now has a SAME-LINE seed; it was previously seeded
       cross-series from 7.0. The header comment almost certainly
       still describes the old fallback arrangement.
       Re-read the header comment in configs/seeds/7.1.toml and update it in the SAME
       commit/PR as this pin -- this script does not touch prose.
   

Verification

Pin values are byte-identical to main — confirmed key by key; only prose and whitespace changed.

The two changed blocks were tested by extracting them from the real script rather than re-typing them, so the tests can't drift from the implementation. 15/15 pass:

• rewrite updates all three values, preserves alignment (matches 7.0.toml columns exactly), leaves prose untouched
• regression check: the old hardcoded sed does de-align, confirming the diagnosis
• unquoted value → hard error, not a silent no-op
• warning matrix: cross-series bump warns; same-line patch bump silent; 7.0-line bump silent; still-cross-series bump emits the softer note; commit-only pin (no tag) silent; non-series pin filename emits no bogus mismatch

Consumers re-checked against the rewritten file: python3 tomllib parses all six keys, and build/fetch-seed.sh's own toml_get returns the correct value for every key it reads.

Repo validators: shellcheck build/*.sh tools/*.sh clean, bash -n clean, yamllint -d relaxed .forgejo/workflows/ exit 0, workflow-expressions greps clean, py_compile tools/*.py clean, intent-matches-policy → "intent.config and POLICY.md agree".

🤖 Generated with Claude Code

## Problem [`configs/seeds/7.1.toml`](configs/seeds/7.1.toml) claimed: > anthraxx's Arch packaging has not published a 7.1 config.x86_64 yet, so the 7.1 line is seeded from the current 7.0.12 config …and told the reader to bump to a real 7.1 config "as soon as anthraxx ships one". He shipped one. The pin has been `7.1.4.hardened1-1` since the seed-bump merged in `b958c42`, so the `NOTE` described the opposite of reality to anyone reading the file to understand the current seed. The three keys `bump-seed.sh` rewrites had also drifted one column left of the three it doesn't (`commit`/`tag`/`sha256` at 11 chars vs `url`/`config_path`/`signer_fpr` at 12). ## Prose Rewritten to describe the same-line 7.1 seed, keeping the pinning-model and signature-verification explanation intact. Two claims needed *rewording* rather than deleting: - **"the seed intentionally LAGS the kernel line"** was about lagging an entire *series*. It still lags, but only by a patch level now — anthraxx changes `config.x86_64` in ~1 in 4–5 tags. That's the ordinary case `7.0.toml` already documents ("The seed routinely LAGS the kernel version — that is expected, handled by olddefconfig + the drift guard, not by a version-match gate"), so the two files now agree. - **"the hardening-drift guard covers inherited symbols once a 7.1 baseline exists"** was conditional on a baseline that now exists — `releases/` carries v7.1.1 through v7.1.4, so the guard is live for this line. The cross-series fallback rationale is kept as history, since it applies to any future line stood up before anthraxx packages a config for it. ## Root cause — `tools/bump-seed.sh` This is what would have done it again: 1. **De-alignment.** Its `sed` replaced whole lines with hardcoded padding (`commit = `), one space short of the files' `config_path = ` column — so every bump silently skewed the three keys it rewrites. Now value-anchored with a `\1` backreference, preserving whatever alignment the file has rather than imposing a width. 2. **Silent no-op risk introduced by (1).** A value-anchored substitution does nothing if a value isn't double-quoted, which would leave the pin unchanged while the script reports success and `seed-bump.yml` opens an empty PR. The rewrite is now verified and hard-fails if it didn't land. 3. **Prose is never rewritten** — the actual cause of the stale `NOTE`. The script now warns when a bump crosses a series boundary, and says so specifically when a line gains its first same-line seed. `seed-bump.yml` already embeds the script's whole summary in the PR body, so this reaches a human at review time with **no workflow change**. Rendered against the historical `7.0.12 → 7.1.4` bump: ``` WARNING -- SERIES BOUNDARY: seed moves 7.0 -> 7.1 Line 7.1 now has a SAME-LINE seed; it was previously seeded cross-series from 7.0. The header comment almost certainly still describes the old fallback arrangement. Re-read the header comment in configs/seeds/7.1.toml and update it in the SAME commit/PR as this pin -- this script does not touch prose. ``` ## Verification Pin values are byte-identical to `main` — confirmed key by key; only prose and whitespace changed. The two changed blocks were tested by *extracting them from the real script* rather than re-typing them, so the tests can't drift from the implementation. 15/15 pass: - rewrite updates all three values, preserves alignment (matches `7.0.toml` columns exactly), leaves prose untouched - regression check: the *old* hardcoded `sed` does de-align, confirming the diagnosis - unquoted value → hard error, not a silent no-op - warning matrix: cross-series bump warns; same-line patch bump silent; `7.0`-line bump silent; still-cross-series bump emits the softer note; commit-only pin (no tag) silent; non-series pin filename emits no bogus mismatch Consumers re-checked against the rewritten file: `python3 tomllib` parses all six keys, and `build/fetch-seed.sh`'s own `toml_get` returns the correct value for every key it reads. Repo validators: `shellcheck build/*.sh tools/*.sh` clean, `bash -n` clean, `yamllint -d relaxed .forgejo/workflows/` exit 0, `workflow-expressions` greps clean, `py_compile tools/*.py` clean, `intent-matches-policy` → "intent.config and POLICY.md agree". 🤖 Generated with [Claude Code](https://claude.com/claude-code)

zach added 1 commit 2026-07-25 19:13:20 +00:00

fix(seed): correct 7.1 pin prose, stop bump-seed.sh de-aligning it ... 644a26679a

configs/seeds/7.1.toml claimed "anthraxx's Arch packaging has not published a
7.1 config.x86_64 yet, so the 7.1 line is seeded from the current 7.0.12
config" and told the reader to bump to a real 7.1 config "as soon as anthraxx
ships one". He shipped one: the pin has been 7.1.4.hardened1-1 since the
seed-bump merged in b958c42, so the NOTE described the opposite of reality to
anyone reading the file to understand the current seed.

Rewrite the header to describe the same-line 7.1 seed, keeping the pinning-
model and signature-verification explanation intact. Two claims needed
rewording rather than deleting:

  - "the seed intentionally LAGS the kernel line" was about lagging an entire
    SERIES. It still lags, but now only by a patch level (anthraxx changes
    config.x86_64 in ~1 in 4-5 tags), which is the ordinary case 7.0.toml
    already documents.
  - "the hardening-drift guard covers inherited symbols once a 7.1 baseline
    exists" was conditional on a baseline that now exists -- releases/ carries
    v7.1.1 through v7.1.4, so the guard is live for this line.

The cross-series fallback rationale is kept as history, since it applies to
any future line stood up before anthraxx packages a config for it.

Root cause in tools/bump-seed.sh, which is what will do this again:

  - Its sed replaced whole lines with hardcoded padding (`commit     = `), one
    space short of the files' `config_path = ` column, so every bump silently
    de-aligned the three keys it rewrites and left the three it doesn't. Now
    value-anchored with a \1 backreference, preserving whatever alignment the
    file has. Also re-align the three keys it already skewed.
  - Value-anchored substitution is a no-op if a value isn't double-quoted,
    which would leave the pin unchanged while the script reports success and
    seed-bump.yml opens an empty PR. Verify the rewrite landed; hard-fail if
    not.
  - It rewrites values but never prose, which is how the stale NOTE survived.
    Warn when a bump crosses a series boundary, and specifically when a line
    gains its first same-line seed. seed-bump.yml embeds this summary in the PR
    body, so the warning reaches a human at review time with no workflow change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

zach merged commit 03f1a37d48 into main 2026-07-25 19:14:34 +00:00

zach deleted branch fix/seed-pin-prose-and-alignment 2026-07-25 19:14:34 +00:00

zach referenced this pull request from a commit 2026-07-25 19:14:35 +00:00

Merge pull request 'fix(seed): correct 7.1 pin prose, stop bump-seed.sh de-aligning it' (#28) from fix/seed-pin-prose-and-alignment into main

zach referenced this pull request 2026-07-25 20:39:59 +00:00

fix(build): re-verify the seed across the step boundary; refuse a cross-series seed #31

zach referenced this pull request from a commit 2026-07-25 20:40:00 +00:00

fix(build): re-verify the seed across the step boundary; refuse a cross-series seed

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

unredacted/linux-hardened-unredacted!28

No description provided.