Qualify Fleet Node release artifacts

[ankitgoswami]

Reviewable diff: +36/-24 across 3 files (excludes generated, test, and story files).

Summary

Fleet Node release artifacts are installed and exercised on native amd64 and arm64 systemd runners before upload. The customer archive contains only production plugins, and each executable must be a valid, statically linked ELF. The qualification stays intentionally narrow: it proves local startup, failed-upgrade rollback, and state-preserving uninstall without duplicating the full installer test suite.

Stack

1. #990 — startup readiness and safe upgrade boundary (merged)
2. #991 — installer lifecycle (merged)
3. #992 — this PR: native release-artifact qualification
4. #989 — one-command enrollment helper

With #990 and #991 merged, this PR's current diff is against main. It exercises their explicit readiness and rollback contracts using the packaged artifact. The enrollment helper remains isolated in #989; signing, release publication policy, and runbooks remain out of scope here.

How it works

1. The artifact matrix builds directly on native ubuntu-latest amd64 and ubuntu-24.04-arm runners.
2. CI verifies that Fleet Node and all production plugins are valid ELF executables without dynamic interpreters or shared-library dependencies.
3. Packaging omits the virtual test plugin while retaining Fleet Node, Proto, Antminer, and asicrs binaries plus required configuration and unit files.
4. Before upload, the runner invokes the real installer as a non-root user. Only installer mutations cross sudo, matching the customer privilege boundary.
5. Qualification verifies that a fresh installation stays stopped, starts the service using synthetic local state, injects a broken plugin into an upgrade, and requires the previous running payload to be restored byte-for-byte.
6. A final uninstall must remove the program and unit while preserving Fleet Node state and its service account.
7. The exact archive and checksum are uploaded only after qualification succeeds.

flowchart LR
  A["Native amd64 or arm64 runner"] --> B["Build Fleet Node and production plugins"]
  B --> C["Validate ELF and static linkage"]
  C --> D["Create exact-version archive and checksum"]
  D --> E["Install through the customer installer"]
  E --> F["Start with real systemd"]
  F --> G["Inject failed upgrade and verify rollback"]
  G --> H["Uninstall while preserving state"]
  H --> I["Upload qualified artifact"]

Loading

sequenceDiagram
  participant CI
  participant Installer
  participant Systemd
  CI->>Installer: fresh install exact archive
  Installer-->>CI: stopped and disabled
  CI->>Systemd: start with synthetic local state
  Systemd-->>CI: active after local readiness
  CI->>Installer: upgrade with broken plugin
  Installer->>Systemd: candidate start fails
  Installer->>Systemd: restore and start previous payload
  Systemd-->>CI: previous service active
  CI->>Installer: uninstall
  Installer-->>CI: program removed and state preserved

Loading

Areas of the code involved

Area / package / file	What changed	Why it matters for review
.github/workflows/proto-fleet-artifact-build.yml	Builds on native runners, validates static executables, packages production contents, and qualifies before upload	Defines the release gate and exact customer artifact
.github/workflows/deployment-config-checks.yml	Syntax-checks the qualification script during PR CI	Catches shell parse failures before nightly or tagged builds
deployment-files/fleetnode/install-fleet-node.sh	Adds a constrained local-file systemd qualification mode and removes the virtual plugin from the accepted manifest	Reuses the customer installer without exposing production override hooks
deployment-files/fleetnode/tests/qualify-package.sh	Adds the focused native systemd lifecycle scenario	Proves the packaged binaries, unit, installer, and rollback work together; review-light
Installer tests	Updates the package fixture and qualification-mode guards	Prevents test-only content or broader override behavior from returning; review-light

Key technical decisions & trade-offs

• Native execution replaces explicit ELF machine-string matching: wrong-architecture binaries fail by running, while CI avoids maintaining architecture-specific output text.
• Static-link validation remains explicit because a dynamically linked executable may work on the runner but fail on a customer host missing that library.
• The qualification seam accepts only a local file:// source and rejects root-path, architecture, and systemctl overrides.
• The native scenario covers the high-value systemd and rollback boundary; successful upgrade variants and reinstall permutations remain in the fast installer suite.
• Synthetic state proves local daemon and plugin readiness, not real Fleet enrollment or server connectivity.

Testing & validation

• bash -n deployment-files/fleetnode/install-fleet-node.sh deployment-files/fleetnode/tests/qualify-package.sh deployment-files/fleetnode/tests/test-install-fleetnode.sh
• ./deployment-files/fleetnode/tests/test-install-fleetnode.sh
• source ./bin/activate-hermit && just lint
• Restacked make Fleet Node enrollment one command #989: installer suite plus 13 focused enrollment-command client tests
• git diff --check for both stack layers
• Native amd64/arm64 systemd execution runs in nightly and tagged artifact workflows; it cannot be reproduced on this macOS workstation.

[github-actions]

🔐 Codex Security Review

Note: This is an automated security-focused code review generated by Codex.
It should be used as a supplementary check alongside human review.
False positives are possible - use your judgment.

Scope summary

• Reviewed pull request diff only (6a25ea25c9b285ede0a9f82f0f439ce8f636d63d...efca3081f21b4c22f362b624c2542904cb2a4598, exact PR three-dot diff)
• Model: gpt-5.6-sol

💡 Click "edited" above to see previous reviews for this PR.

---

Review Summary

Overall Risk: NONE

Findings

No concrete security, correctness, or reliability issues were found in the reviewed diff.

Notes

The authoritative diff matched the specified commit range. Shell syntax and ShellCheck validation passed for changed lines. The full installer test could not run because the review sandbox prohibits temporary-file creation.

---

_{Generated by Codex Security Review |
Triggered by: @ankitgoswami |
Review workflow run}

[Copilot]

🟡 Changes recommended

Add purge qualification and checks, or remove the unsupported purge claim.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Qualifies Fleet Node release artifacts on native amd64 and arm64 systemd runners before upload.

Changes:

• Validates executable architecture and static linkage.
• Excludes the virtual test plugin from customer archives.
• Tests installation, upgrade, rollback, reinstall, and uninstall behavior.

File summaries

File	Description
deployment-files/fleetnode/tests/test-install-fleetnode.sh	Updates installer fixtures and manifest assertions.
deployment-files/fleetnode/tests/qualify-package.sh	Exercises package lifecycle behavior, but does not test the claimed purge path.
deployment-files/fleetnode/install-fleet-node.sh	Adds constrained local qualification mode and updates the accepted manifest.
.github/workflows/proto-fleet-artifact-build.yml	Adds executable validation and native systemd qualification before upload.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 955ef23c48

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".