[architect] k3s sysext is versioned on the OS release axis while its identity and payload are on the k3s axis — and it is x86_64-only despite an aarch64 build option

[kubestellar-hive]

Cluster

Files: elements/oci/k3s-sysext.bst, elements/k3s/k3s-bin.bst, files/k3s/sysext/extension-release.k3s, files/os/sysupdate.d/70-k3s.transfer, project.conf (options.arch, variables.release-version).

Problem 1 — the sysext straddles two version axes

elements/oci/k3s-sysext.bst names the artifact on the OS axis:

FNAME="k3s-%{release-version}.raw"     # release-version = the FSDK point release

while the extension declares its own identity on the k3s axis:

# files/k3s/sysext/extension-release.k3s
VERSION_ID=v1.36.2+k3s1

and the payload is pinned on the k3s axis too (elements/k3s/k3s-bin.bst → v1.36.2+k3s1).

Three consequences fall out of the mismatched axis:

1. A k3s security bump cannot ship on its own. Bumping k3s-bin.bst changes the binary but not %{release-version}, so the asset filename is unchanged. files/os/sysupdate.d/70-k3s.transfer matches k3s-@v.raw.zst, extracts the same version, and declines to update. Patching k3s requires an unrelated OS point-release bump to move the filename.
2. Every OS point release forces a no-op k3s update. Conversely, an FSDK bump renames the sysext even when the k3s binary is byte-identical, so every host in the fleet downloads and re-merges an unchanged extension.
3. systemd-sysext status can never agree with the artifact. It reports VERSION_ID=v1.36.2+k3s1; the file on disk is k3s-25.08.13.raw. Nothing in the repo maps one to the other, so an operator cannot answer "which k3s am I running" from the filename or "which asset do I have" from sysext status.

The element's own comment states the intent — "versioned on the OS release axis like the other release assets" — but k3s is not an OS asset; it is an independently-pinned third-party payload, and the sysupdate transfer treats the filename as its version oracle.

Problem 2 — undeclared x86_64-only constraint

project.conf declares aarch64 as a supported value of options.arch, and elements/freedesktop-sdk.bst carries a full per-arch bootstrap_build_arch conditional. The k3s subsystem has no such conditional:

• elements/k3s/k3s-bin.bst fetches github:k3s-io/k3s/releases/download/v1.36.2%2Bk3s1/k3s with one fixed SHA256. That URL is the amd64 binary; upstream publishes arm64 as a separately-named asset. The doc comment says "Pinned to the latest stable release for x86_64", but no (?) arch guard enforces it.
• files/k3s/sysext/extension-release.k3s hardcodes ARCHITECTURE=x86-64.

An arch=aarch64 build therefore succeeds and produces a publishable sysext containing an x86_64 ELF binary labelled ARCHITECTURE=x86-64. It fails only later, on the host, when systemd-sysext refuses to merge it. The architectural gap is that a declared build option has an unsatisfiable subsystem behind it with no fail-closed guard at build time.

Proposed direction

1. Version the k3s sysext on the k3s axis (derive FNAME and extension-release VERSION_ID from one pinned k3s version variable) so 70-k3s.transfer tracks the thing it actually delivers, and decouple k3s patching from OS point releases.
2. Either add per-arch source/SHA/ARCHITECTURE conditionals to the k3s elements, or make elements/oci/k3s-sysext.bst fail closed under arch != x86_64 so the unsupported combination cannot produce a release asset.

Related: #31 (the release-version axis itself has two competing sources of truth).

---

Filed by architect agent (ACMM L5 — hold-gated mode).

🐝 Hive Agent: architect | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: 5e263a0

— hive: agent=architect backend=copilot model=claude-opus-5

[castrojo]

Status update: Problem 2 (undeclared x86_64 constraint) was resolved by PR #40 (commit f4f7630), which added include/arch.yml and an explicit fail-closed guard in elements/k3s/k3s-bin.bst when %{arch} != x86_64.

[castrojo]

Resolved by commit 041ebb7 landed on main:

• Decoupled k3s sysext from OS release axis onto include/k3s.yml (Problem 1)
• Dynamic VERSION_ID and ARCHITECTURE injection
• Fail-closed arch==x86_64 constraint guard in oci/k3s-sysext.bst (Problem 2)
• Added check-k3s-version.py and unit test suite