From 30dbda3af22bf8292d1d8638bff230eaf74b1b19 Mon Sep 17 00:00:00 2001 From: charly Date: Fri, 16 Oct 2026 18:21:35 +0200 Subject: [PATCH 1/2] fix(nvidia): move the gpgcheck assertion into the command so the Arch arm can skip honestly MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The probe claimed in-command Fedora scope, but the assertion lived in a stdout: matcher while the Arch skip path only exited 0. On the Arch arm the command succeeded, printed nothing, and the matcher still demanded gpgcheck=1 -- a red check on an arm where that fact cannot hold by construction. Measured on cachyos in a consumer's gate: 'stdout: expected to contain gpgcheck=1 (got: )'. The assertion now lives where the distro decision is made, and the matcher is gone. Proven by four direct cases: no DNF repo -> exit 0 (honest skip); gpgcheck=1 -> exit 0; gpgcheck=0 -> exit 1 (the negative control still fails when the fact is false); section without the key -> exit 1. Assisted-by: DeepSeek Harness deepseek-v4.1-flash (analysed on a live system — the four cases were executed; the class gate's image build has not been run for this head) --- charly.yml | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/charly.yml b/charly.yml index e73785c..23d38f2 100644 --- a/charly.yml +++ b/charly.yml @@ -79,17 +79,23 @@ nvidia: # Revert `gpgcheck: true` above (or the template's `true` arm) and it fails. - check: the nvidia-container-toolkit repo enforces package signature verification, so its packages cannot install unverified id: nvidia-container-toolkit-gpgcheck-enforced - # Fedora-scoped: the asserted `repo:` block (gpgcheck=0 vendor file - # overridden by dnf5 setopt) lives under distro.fedora; dnf5 and /etc/dnf - # exist only there. Arch-family arms (arch/cachyos/omarchy) install - # nvidia-utils from pacman and have no DNF repo — the file is correctly - # absent, so the step exits 0 without asserting (the fd condition below). - # The exclusion is implemented in the command itself: runner-level - # exclude-distro fields are not honored by the check runner. - exit_status: 0 - stdout: - - contains: "gpgcheck=1" - command: awk '/^\[nvidia-container-toolkit\]/{f=1;next} /^\[/{f=0} f' /etc/dnf/repos.override.d/99-config_manager.repo 2>/dev/null || test ! -e /etc/dnf/repos.override.d/99-config_manager.repo + # Fedora-scoped, implemented IN THE COMMAND (runner-level exclude-distro is not honoured). + # + # The assertion used to live in a `stdout:` matcher while the Arch skip path merely exited + # 0. On the Arch arm the command therefore succeeded, printed nothing, and the matcher still + # demanded "gpgcheck=1" -- a red check on an arm where that fact cannot hold by construction. + # Measured on cachyos: `stdout: expected to contain "gpgcheck=1" (got: )`. + # + # The assertion now lives where the distro decision is made, and the matcher is gone: on + # Fedora the repo section must carry gpgcheck=1 or the step FAILS; on the Arch-family arms + # there is no DNF repo to check, so it exits 0 honestly instead of printing a string it did + # not verify (which would be a vacuous probe). + command: | + set -eu + f=/etc/dnf/repos.override.d/99-config_manager.repo + [ -e "$f" ] || exit 0 + awk '/^\[nvidia-container-toolkit\]/{s=1;next} /^\[/{s=0} s' "$f" | grep -q 'gpgcheck=1' \ + || { echo "the nvidia-container-toolkit repo does not enforce gpgcheck=1: $(awk '/^\[nvidia-container-toolkit\]/{s=1;next} /^\[/{s=0} s' "$f" | tr '\n' ' ')"; exit 1; } - check: the nvidia-container-toolkit package is installed for CDI device generation package: package: nvidia-container-toolkit From e1fa070ad9a524d0d597e88695e10964a681b97d Mon Sep 17 00:00:00 2001 From: charly Date: Fri, 16 Oct 2026 18:27:11 +0200 Subject: [PATCH 2/2] fix(nvidia): key the gpgcheck skip on the distro, not on file presence (round 2) The first fix traded a false-RED on the Arch arm for a false-GREEN on Fedora: [ -e $f ] || exit 0 is true on CachyOS and ALSO true on a Fedora where the override was never written -- and there the missing override leaves NVIDIA's vendor gpgcheck=0 repo in force, which is precisely what this check exists to catch. A file-presence proxy for 'Arch' cannot express that. The skip now keys on the DISTRO: no DNF at all -> exit 0 (nothing to assert, honestly); a DNF host whose override file is MISSING -> FAIL; a DNF host whose section lacks gpgcheck=1 -> FAIL. The section is extracted ONCE and reused for the assertion and the message (R2). Evidence -- five cases executed, including the row the first table omitted: Arch arm/no DNF -> 0; Fedora gpgcheck=1 -> 0; Fedora gpgcheck=0 -> 1; Fedora section without the key -> 1; Fedora override MISSING -> 1. The first run of this harness returned 0 for every case, which was impossible: the extraction still probed the real /etc/dnf, absent here, so each case short-circuited at the distro check. A rig that cannot fail on what it claims to test is not evidence; the harness emulates the distro probe now. Missed control: I enumerated the states I thought of, not the cross-product of distro x precondition. Assisted-by: DeepSeek Harness deepseek-v4.1-flash (analysed on a live system -- the five cases were executed; the class gate's image build has not been run for this head) --- charly.yml | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/charly.yml b/charly.yml index 23d38f2..72d2908 100644 --- a/charly.yml +++ b/charly.yml @@ -92,10 +92,26 @@ nvidia: # not verify (which would be a vacuous probe). command: | set -eu + # Skip by DISTRO, never by file presence. "the override file is absent" is true on the + # Arch arms but ALSO on a Fedora where the override was never written -- and there a + # missing override leaves NVIDIA's vendor gpgcheck=0 repo in force, which is exactly what + # this check exists to catch. A file-presence proxy for "Arch" made that Fedora a + # false-green. So: + # * no DNF at all (arch/cachyos/omarchy) -> exit 0: nothing to assert, honestly; + # * a DNF host whose override file is MISSING -> FAIL: the vendor gpgcheck=0 repo stands; + # * a DNF host whose section lacks gpgcheck=1 -> FAIL. + # The section is extracted ONCE and reused for the assertion and the message. + if [ ! -e /etc/dnf ] && [ ! -e /etc/yum.repos.d ]; then + exit 0 + fi f=/etc/dnf/repos.override.d/99-config_manager.repo - [ -e "$f" ] || exit 0 - awk '/^\[nvidia-container-toolkit\]/{s=1;next} /^\[/{s=0} s' "$f" | grep -q 'gpgcheck=1' \ - || { echo "the nvidia-container-toolkit repo does not enforce gpgcheck=1: $(awk '/^\[nvidia-container-toolkit\]/{s=1;next} /^\[/{s=0} s' "$f" | tr '\n' ' ')"; exit 1; } + section=$(awk '/^\[nvidia-container-toolkit\]/{x=1;next} /^\[/{x=0} x' "$f" 2>/dev/null || true) + printf '%s\n' "$section" | grep -q 'gpgcheck=1' || { + echo "the nvidia-container-toolkit repo does not enforce gpgcheck=1 on this DNF host" + echo " file: $f" + echo " section: ${section:-}" + exit 1 + } - check: the nvidia-container-toolkit package is installed for CDI device generation package: package: nvidia-container-toolkit