diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index c302145..c20cd11 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -28,14 +28,21 @@ `dc-dc-stage3-phase2-dc-substrate`; runbook `runbooks/dc-dc-phase2-tofu-dc-substrate.md`). Stages 0-2 precede it; stages 4-7 are authored, not executed (workflow doc:873). -- Position inside Stage 3: deploy step A (the DC0 outer apply) EXECUTED - 2026-07-19 in the logged dc0-deploy window: 6 added / 0 changed / 6 - destroyed, exactly the saved plan; `vvr1-dc0` RUNNING (108 vCPU, 416 - GiB, autostart disable per D-127), `vr1-dc0-uplink` active, the six - vcloud planes destroyed (Model B relocation), both prior guests - untouched (ids 1/2). Convergence re-plan: no differences - (`docs/audit/outer-plan-20260719-postA-converged.txt`). ACTIVE gate: - G10 (steps B-E). +- Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6 + exact; convergence zero -- + `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B + (bootstrap) COMPLETE 2026-07-20** in the same logged dc0-deploy window: + transit reach established (voffice1 holds 172.31.0.1/30; reach = ssh + `-J voffice1` w/ dc0 key -- no vcloud host leg, item-20 disposition), + rack ENROLLED to the Office1 region, node-host ready (libvirt + nested + KVM + inner pool), SEC-010 applied+verified BOTH transit ends (row + CLOSED), OPNsense **26.7** nano base staged (operator ruling; step-C + boot REVALIDATES the D-112/D-113 path on 26.7). Named gate check EXIT 0: + `docs/audit/stepB-check-20260720-final.txt`. ACTIVE gate: G10 remaining + items (steps C-E: inner apply + depth-4 boot, D-125 egress isolation + test, MAAS vm-host + `TF_VAR_maas_api_key`, netem). Next mutation: + step C inner apply FROM voffice1 (qemu+ssh, R-5); region-side + metal-admin DHCP (primary_rack) is step-D territory. - The grounding audit is COMPLETE and EXITED (2026-07-19): Phases 1-6 all closed (charter `148dcef`; rulings `docs/audit/ga-rulings.md`; the Phase-5 sweep ran as six operator-gated batches in one session; exit @@ -222,11 +229,11 @@ | G7 | New captured plan == the expected triple recorded in section 5 | [V] re-plan to a capture file after G5+G6 | session | CLOSED 2026-07-19: capture `docs/audit/outer-plan-20260719-postG6.txt` = 6/0/6, equals section 5 exactly | | G8 | Same-session pre-apply re-verify: 6 planes still empty | [V] run in the SAME session as the apply | session | CLOSED 2026-07-19: verified in the apply session itself (all six 0 leases; only office1 nets attached) immediately before step A | | G9 | DC0 outer apply (deploy step A) | [V] operator-gated, logged (`run-logged.sh`), after G1-G8; audit exit criteria met (charter Phase 6). SEC pre-apply dependency (S2): SEC-010's transit FORWARD-drop is applied+verified at deploy step B via `site-headend-install.sh --host-nodes --check` on vvr1-dc0 (gate G10) -- the ONLY SEC row gated on this apply (register of record: security-ledger). CANONICAL ENTRY DOC (probe hole H1): `runbooks/dc-dc-phase2-tofu-dc-substrate.md`, with `docs/dc0-deploy-readiness.md` section E as the step table | operator | CLOSED 2026-07-19: G8 same-session planes check passed (6x 0 leases, 0 attachments); saved plan == 6/0/6 applied in the logged dc0-deploy window; convergence re-plan = no differences; vvr1-dc0 running, prior guests untouched | -| G10 | Deploy steps B-E in-sequence gates: SEC-010 `--host-nodes --check` on vvr1-dc0; depth-4 nested boot; D-125 foreign-MAC egress test; MAAS reachability + `TF_VAR_maas_api_key` before step D; netem placeholder step E | [V] exercised during the gated deploy | session (each mutation operator-approved) | Not reached (`docs/dc0-deploy-readiness.md:67-84,170-179`) | +| G10 | Deploy steps B-E in-sequence gates: SEC-010 `--host-nodes --check` on vvr1-dc0; depth-4 nested boot; D-125 foreign-MAC egress test; MAAS reachability + `TF_VAR_maas_api_key` before step D; netem placeholder step E | [V] exercised during the gated deploy | session (each mutation operator-approved) | Step B item DONE 2026-07-20: `--check` EXIT 0 incl. SEC-010 (`docs/audit/stepB-check-20260720-final.txt`; interfaces enp1s0/enp2s0). REMAINING: depth-4 boot + D-125 egress test (step C), MAAS reach + key (step D), netem (step E) | | G11 | Operator signs THIS document | [R] read top-to-bottom; discrepancies resolved in the document | operator | CLOSED: RE-SIGNED 2026-07-19 at audit exit, section 11 (replaces the 2026-07-18 signature) | | G12 | `vr1-dc1` build | [R] operator rules dc1 transit/rack addressing; then vars + substrate authored | operator | HELD (`docs/dc0-deploy-readiness.md:100-103`) | | G13 | D-129 residuals | [R] operator-gated live plugin install on the edge; qga channel retrofit at next scheduled edge restart; 4 sub-decisions (section 8) | operator | OPEN / PARTIALLY RULED (`docs/design-decisions.md:4017`) | -| G14 | 8 OPEN SEC rows (SEC-001, -003..-008, -010; prior cell said 9, enumeration + scan both measure 8 -- corrected per GA-R1/C2) | [R] per-row: rotations/flips at v1 close (external to VR1 track) except SEC-010 = apply+verify at G10 | operator / external | `docs/security-ledger.md` (register of record, GA-R4/F3); count cross-checked vs `bash scripts/ledger-scan.sh` 2026-07-19 | +| G14 | 7 OPEN SEC rows (SEC-001, -003..-008; SEC-010 CLOSED 2026-07-20, operator-ruled, applied+verified both transit ends) | [R] per-row: rotations/flips at v1 close (external to VR1 track) | operator / external | `docs/security-ledger.md` (register of record, GA-R4/F3); count re-verified vs `bash scripts/ledger-scan.sh` 2026-07-20 | | G15 | D-068 / D-071 rulings | [R] operator rules (section 8); neither blocks the VR1 substrate | operator | PROPOSED/OPEN (status lines, section 8) | ## 7. Version pins (measured; the authority for every pin) diff --git a/docs/audit/stepB-bootstrap-20260720-run2.txt b/docs/audit/stepB-bootstrap-20260720-run2.txt new file mode 100644 index 0000000..df36e64 --- /dev/null +++ b/docs/audit/stepB-bootstrap-20260720-run2.txt Binary files differ diff --git a/docs/audit/stepB-bootstrap-20260720.txt b/docs/audit/stepB-bootstrap-20260720.txt new file mode 100644 index 0000000..ff52749 --- /dev/null +++ b/docs/audit/stepB-bootstrap-20260720.txt @@ -0,0 +1,323 @@ +== 1. time: MAAS manages time via chrony; systemd-timesyncd conflicts == +== 2. MAAS 3.7/stable (rack: NO PostgreSQL -- the rack runs no DB) == + -> install maas +2026-07-20T05:39:44Z INFO Waiting for automatic snapd restart... +2026-07-20T05:39:45Z INFO Waiting for automatic snapd restart... +2026-07-20T05:39:46Z INFO Waiting for automatic snapd restart... +2026-07-20T05:39:47Z INFO Waiting for automatic snapd restart... +maas (3.7/stable) 3.7.2-17972-g.35e297c4d from Canonical** installed +== 3. maas init rack -- enroll to the region at http://10.10.0.20:5240/MAAS == + -> rack registered to region http://10.10.0.20:5240/MAAS +== node-host (D-123 Model B): make this rack a nested libvirt/KVM host for the inner tofu == + -> install qemu-kvm + libvirt + qemu-utils +Reading package lists... +Building dependency tree... +Reading state information... +The following additional packages will be installed: + acl adwaita-icon-theme alsa-topology-conf alsa-ucm-conf at-spi2-common + at-spi2-core cpu-checker dconf-gsettings-backend dconf-service dns-root-data + dnsmasq-base fontconfig glib-networking glib-networking-common + glib-networking-services gsettings-desktop-schemas gstreamer1.0-plugins-base + gstreamer1.0-plugins-good gstreamer1.0-x gtk-update-icon-cache + hicolor-icon-theme humanity-icon-theme ipxe-qemu + ipxe-qemu-256k-compat-efi-roms libaa1 libasound2-data libasound2t64 + libasyncns0 libatk-bridge2.0-0t64 libatk1.0-0t64 libatspi2.0-0t64 + libavahi-client3 libavahi-common-data libavahi-common3 libavc1394-0 + libboost-iostreams1.83.0 libboost-thread1.83.0 libbrlapi0.8 libcaca0 + libcacard0 libcairo-gobject2 libcairo2 libcdparanoia0 libcolord2 libcups2t64 + libdatrie1 libdaxctl1 libdconf1 libdecor-0-0 libdecor-0-plugin-1-gtk + libdrm-intel1 libdv4t64 libepoxy0 libfdt1 libflac12t64 libgbm1 + libgdk-pixbuf-2.0-0 libgdk-pixbuf2.0-bin libgdk-pixbuf2.0-common libgl1 + libgl1-mesa-dri libglvnd0 libglx-mesa0 libglx0 libgraphite2-3 + libgstreamer-plugins-base1.0-0 libgstreamer-plugins-good1.0-0 libgtk-3-0t64 + libgtk-3-bin libgtk-3-common libharfbuzz0b libiec61883-0 libiscsi7 + libjack-jackd2-0 liblcms2-2 libllvm20 libmp3lame0 libmpg123-0t64 libndctl6 + libnfs14 libnss-mymachines libogg0 libopus0 liborc-0.4-0t64 libpango-1.0-0 + libpangocairo-1.0-0 libpangoft2-1.0-0 libpciaccess0 libpcsclite1 + libpipewire-0.3-0t64 libpipewire-0.3-common libpixman-1-0 libpmem1 + libpmemobj1 libproxy1v5 libpulse0 librados2 libraw1394-11 librbd1 + librdmacm1t64 librsvg2-2 librsvg2-common libsamplerate0 libsdl2-2.0-0 + libshout3 libslirp0 libsndfile1 libsoup-3.0-0 libsoup-3.0-common + libspa-0.2-modules libspeex1 libspice-server1 libtag1v5 libtag1v5-vanilla + libthai-data libthai0 libtheora0 libtpms0 libtwolame0 liburing2 + libusbredirparser1t64 libv4l-0t64 libv4lconvert0t64 libvirglrenderer1 + libvirt-clients libvirt-daemon libvirt-daemon-config-network + libvirt-daemon-config-nwfilter libvirt-daemon-driver-qemu + libvirt-daemon-system-systemd libvirt-l10n libvirt0 libvisual-0.4-0 + libvorbis0a libvorbisenc2 libvpx9 libvte-2.91-0 libvte-2.91-common + libvulkan1 libwavpack1 libwayland-client0 libwayland-cursor0 libwayland-egl1 + libwebrtc-audio-processing1 libx11-xcb1 libxcb-dri3-0 libxcb-glx0 + libxcb-present0 libxcb-randr0 libxcb-render0 libxcb-shm0 libxcb-sync1 + libxcb-xfixes0 libxcomposite1 libxcursor1 libxdamage1 libxfixes3 libxi6 + libxinerama1 libxml2-utils libxrandr2 libxrender1 libxshmfence1 libxss1 + libxtst6 libxv1 libxxf86vm1 libyajl2 mdevctl mesa-libgallium + mesa-vulkan-drivers msr-tools ovmf qemu-block-extra qemu-system-common + qemu-system-data qemu-system-gui qemu-system-modules-opengl + qemu-system-modules-spice seabios session-migration swtpm swtpm-tools + systemd-container ubuntu-mono x11-common +Suggested packages: + gvfs alsa-utils libasound2-plugins colord cups-common libdv-bin oss-compat + libvisual-0.4-plugins jackd2 liblcms2-utils opus-tools pcscd pipewire + pulseaudio libraw1394-doc librsvg2-bin xdg-utils speex gstreamer1.0-libav + gstreamer1.0-plugins-ugly libvirt-clients-qemu libvirt-login-shell + libvirt-daemon-driver-storage-gluster + libvirt-daemon-driver-storage-iscsi-direct libvirt-daemon-driver-storage-rbd + libvirt-daemon-driver-storage-zfs libvirt-daemon-driver-lxc + libvirt-daemon-driver-vbox libvirt-daemon-driver-xen numad passt auditd + nfs-common pm-utils systemtap zfsutils samba vde2 trousers +The following NEW packages will be installed: + acl adwaita-icon-theme alsa-topology-conf alsa-ucm-conf at-spi2-common + at-spi2-core cpu-checker dconf-gsettings-backend dconf-service dns-root-data + dnsmasq-base fontconfig glib-networking glib-networking-common + glib-networking-services gsettings-desktop-schemas gstreamer1.0-plugins-base + gstreamer1.0-plugins-good gstreamer1.0-x gtk-update-icon-cache + hicolor-icon-theme humanity-icon-theme ipxe-qemu + ipxe-qemu-256k-compat-efi-roms libaa1 libasound2-data libasound2t64 + libasyncns0 libatk-bridge2.0-0t64 libatk1.0-0t64 libatspi2.0-0t64 + libavahi-client3 libavahi-common-data libavahi-common3 libavc1394-0 + libboost-iostreams1.83.0 libboost-thread1.83.0 libbrlapi0.8 libcaca0 + libcacard0 libcairo-gobject2 libcairo2 libcdparanoia0 libcolord2 libcups2t64 + libdatrie1 libdaxctl1 libdconf1 libdecor-0-0 libdecor-0-plugin-1-gtk + libdrm-intel1 libdv4t64 libepoxy0 libfdt1 libflac12t64 libgbm1 + libgdk-pixbuf-2.0-0 libgdk-pixbuf2.0-bin libgdk-pixbuf2.0-common libgl1 + libgl1-mesa-dri libglvnd0 libglx-mesa0 libglx0 libgraphite2-3 + libgstreamer-plugins-base1.0-0 libgstreamer-plugins-good1.0-0 libgtk-3-0t64 + libgtk-3-bin libgtk-3-common libharfbuzz0b libiec61883-0 libiscsi7 + libjack-jackd2-0 liblcms2-2 libllvm20 libmp3lame0 libmpg123-0t64 libndctl6 + libnfs14 libnss-mymachines libogg0 libopus0 liborc-0.4-0t64 libpango-1.0-0 + libpangocairo-1.0-0 libpangoft2-1.0-0 libpciaccess0 libpcsclite1 + libpipewire-0.3-0t64 libpipewire-0.3-common libpixman-1-0 libpmem1 + libpmemobj1 libproxy1v5 libpulse0 librados2 libraw1394-11 librbd1 + librdmacm1t64 librsvg2-2 librsvg2-common libsamplerate0 libsdl2-2.0-0 + libshout3 libslirp0 libsndfile1 libsoup-3.0-0 libsoup-3.0-common + libspa-0.2-modules libspeex1 libspice-server1 libtag1v5 libtag1v5-vanilla + libthai-data libthai0 libtheora0 libtpms0 libtwolame0 liburing2 + libusbredirparser1t64 libv4l-0t64 libv4lconvert0t64 libvirglrenderer1 + libvirt-clients libvirt-daemon libvirt-daemon-config-network + libvirt-daemon-config-nwfilter libvirt-daemon-driver-qemu + libvirt-daemon-system libvirt-daemon-system-systemd libvirt-l10n libvirt0 + libvisual-0.4-0 libvorbis0a libvorbisenc2 libvpx9 libvte-2.91-0 + libvte-2.91-common libvulkan1 libwavpack1 libwayland-client0 + libwayland-cursor0 libwayland-egl1 libwebrtc-audio-processing1 libx11-xcb1 + libxcb-dri3-0 libxcb-glx0 libxcb-present0 libxcb-randr0 libxcb-render0 + libxcb-shm0 libxcb-sync1 libxcb-xfixes0 libxcomposite1 libxcursor1 + libxdamage1 libxfixes3 libxi6 libxinerama1 libxml2-utils libxrandr2 + libxrender1 libxshmfence1 libxss1 libxtst6 libxv1 libxxf86vm1 libyajl2 + mdevctl mesa-libgallium mesa-vulkan-drivers msr-tools ovmf qemu-block-extra + qemu-system-common qemu-system-data qemu-system-gui + qemu-system-modules-opengl qemu-system-modules-spice qemu-system-x86 + qemu-utils seabios session-migration swtpm swtpm-tools systemd-container + ubuntu-mono x11-common +0 upgraded, 189 newly installed, 0 to remove and 0 not upgraded. +Need to get 125 MB of archives. +After this operation, 579 MB of additional disk space will be used. +Get:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 acl amd64 2.3.2-1build1.1 [39.4 kB] +Get:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libgdk-pixbuf2.0-common all 2.42.10+dfsg-3ubuntu3.3 [8302 B] +Get:3 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libgdk-pixbuf-2.0-0 amd64 2.42.10+dfsg-3ubuntu3.3 [147 kB] +Get:4 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 gtk-update-icon-cache amd64 3.24.41-4ubuntu1.3 [51.9 kB] +Get:5 http://archive.ubuntu.com/ubuntu noble/main amd64 hicolor-icon-theme all 0.17-2 [9976 B] +Get:6 http://archive.ubuntu.com/ubuntu noble/main amd64 humanity-icon-theme all 0.6.16 [1282 kB] +Get:7 http://archive.ubuntu.com/ubuntu noble/main amd64 ubuntu-mono all 24.04-0ubuntu1 [151 kB] +Get:8 http://archive.ubuntu.com/ubuntu noble/main amd64 adwaita-icon-theme all 46.0-1 [723 kB] +Get:9 http://archive.ubuntu.com/ubuntu noble/main amd64 alsa-topology-conf all 1.2.5.1-2 [15.5 kB] +Ign:10 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libasound2-data all 1.2.11-1ubuntu0.2 +Ign:11 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libasound2t64 amd64 1.2.11-1ubuntu0.2 +Err:12 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 alsa-ucm-conf all 1.2.10-1ubuntu5.11 + 404 Not Found [IP: 10.10.0.20 8000] +Get:13 http://archive.ubuntu.com/ubuntu noble/main amd64 at-spi2-common all 2.52.0-1build1 [8674 B] +Err:10 http://security.ubuntu.com/ubuntu noble-updates/main amd64 libasound2-data all 1.2.11-1ubuntu0.2 + 404 Not Found [IP: 10.10.0.20 8000] +Err:11 http://security.ubuntu.com/ubuntu noble-updates/main amd64 libasound2t64 amd64 1.2.11-1ubuntu0.2 + 404 Not Found [IP: 10.10.0.20 8000] +Get:14 http://archive.ubuntu.com/ubuntu noble/main amd64 libxi6 amd64 2:1.8.1-1build1 [32.4 kB] +Get:15 http://archive.ubuntu.com/ubuntu noble/main amd64 libatspi2.0-0t64 amd64 2.52.0-1build1 [80.5 kB] +Get:16 http://archive.ubuntu.com/ubuntu noble/main amd64 x11-common all 1:7.7+23ubuntu3 [21.7 kB] +Get:17 http://archive.ubuntu.com/ubuntu noble/main amd64 libxtst6 amd64 2:1.2.3-1.1build1 [12.6 kB] +Get:18 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libdconf1 amd64 0.40.0-4ubuntu0.1 [39.6 kB] +Get:19 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 dconf-service amd64 0.40.0-4ubuntu0.1 [27.6 kB] +Get:20 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 dconf-gsettings-backend amd64 0.40.0-4ubuntu0.1 [22.1 kB] +Get:21 http://archive.ubuntu.com/ubuntu noble/main amd64 session-migration amd64 0.3.9build1 [9034 B] +Get:22 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 gsettings-desktop-schemas all 46.1-0ubuntu1 [35.6 kB] +Get:23 http://archive.ubuntu.com/ubuntu noble/main amd64 at-spi2-core amd64 2.52.0-1build1 [56.6 kB] +Get:24 http://archive.ubuntu.com/ubuntu noble/main amd64 msr-tools amd64 1.3-5build1 [9610 B] +Get:25 http://archive.ubuntu.com/ubuntu noble/main amd64 cpu-checker amd64 0.7-1.3build2 [6148 B] +Get:26 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 dns-root-data all 2024071801~ubuntu0.24.04.1 [5918 B] +Ign:27 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 dnsmasq-base amd64 2.90-2ubuntu0.3 +Err:27 http://security.ubuntu.com/ubuntu noble-updates/main amd64 dnsmasq-base amd64 2.90-2ubuntu0.3 + 404 Not Found [IP: 10.10.0.20 8000] +Get:28 http://archive.ubuntu.com/ubuntu noble/main amd64 fontconfig amd64 2.15.0-1.1ubuntu2 [180 kB] +Get:29 http://archive.ubuntu.com/ubuntu noble/main amd64 libproxy1v5 amd64 0.5.4-4build1 [26.5 kB] +Get:30 http://archive.ubuntu.com/ubuntu noble/main amd64 glib-networking-common all 2.80.0-1build1 [6702 B] +Get:31 http://archive.ubuntu.com/ubuntu noble/main amd64 glib-networking-services amd64 2.80.0-1build1 [12.8 kB] +Get:32 http://archive.ubuntu.com/ubuntu noble/main amd64 glib-networking amd64 2.80.0-1build1 [64.1 kB] +Get:33 http://archive.ubuntu.com/ubuntu noble/main amd64 libcdparanoia0 amd64 3.10.2+debian-14build3 [48.5 kB] +Get:34 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 liborc-0.4-0t64 amd64 1:0.4.38-1ubuntu0.1 [207 kB] +Get:35 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libgstreamer-plugins-base1.0-0 amd64 1.24.2-1ubuntu0.4 [862 kB] +Get:36 http://archive.ubuntu.com/ubuntu noble/main amd64 libogg0 amd64 1.3.5-3build1 [22.7 kB] +Get:37 http://archive.ubuntu.com/ubuntu noble/main amd64 libopus0 amd64 1.4-1build1 [208 kB] +Get:38 http://archive.ubuntu.com/ubuntu noble/main amd64 libpixman-1-0 amd64 0.42.2-1build1 [279 kB] +Get:39 http://archive.ubuntu.com/ubuntu noble/main amd64 libxcb-render0 amd64 1.15-1ubuntu2 [16.2 kB] +Get:40 http://archive.ubuntu.com/ubuntu noble/main amd64 libxcb-shm0 amd64 1.15-1ubuntu2 [5756 B] +Get:41 http://archive.ubuntu.com/ubuntu noble/main amd64 libxrender1 amd64 1:0.9.10-1.1build1 [19.0 kB] +Get:42 http://archive.ubuntu.com/ubuntu noble/main amd64 libcairo2 amd64 1.18.0-3build1 [566 kB] +Get:43 http://archive.ubuntu.com/ubuntu noble/main amd64 libtheora0 amd64 1.1.1+dfsg.1-16.1build3 [211 kB] +Get:44 http://archive.ubuntu.com/ubuntu noble/main amd64 libvisual-0.4-0 amd64 0.4.2-2build1 [115 kB] +Get:45 http://archive.ubuntu.com/ubuntu noble/main amd64 libvorbis0a amd64 1.3.7-1build3 [97.6 kB] +Get:46 http://archive.ubuntu.com/ubuntu noble/main amd64 libvorbisenc2 amd64 1.3.7-1build3 [80.8 kB] +Get:47 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 gstreamer1.0-plugins-base amd64 1.24.2-1ubuntu0.4 [721 kB] +Get:48 http://archive.ubuntu.com/ubuntu noble/main amd64 libaa1 amd64 1.4p5-51.1 [49.9 kB] +Get:49 http://archive.ubuntu.com/ubuntu noble/main amd64 libraw1394-11 amd64 2.1.2-2build3 [26.2 kB] +Get:50 http://archive.ubuntu.com/ubuntu noble/main amd64 libavc1394-0 amd64 0.5.4-5build3 [15.4 kB] +Get:51 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libcaca0 amd64 0.99.beta20-4ubuntu0.2 [209 kB] +Get:52 http://archive.ubuntu.com/ubuntu noble/main amd64 libcairo-gobject2 amd64 1.18.0-3build1 [127 kB] +Get:53 http://archive.ubuntu.com/ubuntu noble/main amd64 libdv4t64 amd64 1.0.0-17.1build1 [63.2 kB] +Get:54 http://archive.ubuntu.com/ubuntu noble/main amd64 libflac12t64 amd64 1.4.3+ds-2.1ubuntu2 [197 kB] +Get:55 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libgstreamer-plugins-good1.0-0 amd64 1.24.2-1ubuntu1.4 [33.2 kB] +Get:56 http://archive.ubuntu.com/ubuntu noble/main amd64 libiec61883-0 amd64 1.2.0-6build1 [24.5 kB] +Get:57 http://archive.ubuntu.com/ubuntu noble/main amd64 libmp3lame0 amd64 3.100-6build1 [142 kB] +Get:58 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libmpg123-0t64 amd64 1.32.5-1ubuntu1.1 [169 kB] +Get:59 http://archive.ubuntu.com/ubuntu noble/main amd64 libasyncns0 amd64 0.8-6build4 [11.3 kB] +Get:60 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libsndfile1 amd64 1.2.2-1ubuntu5.24.04.1 [209 kB] +Get:61 http://archive.ubuntu.com/ubuntu noble/main amd64 libx11-xcb1 amd64 2:1.8.7-1build1 [7800 B] +Get:62 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libpulse0 amd64 1:16.1+dfsg1-2ubuntu10.1 [292 kB] +Get:63 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libspeex1 amd64 1.2.1-2ubuntu2.24.04.1 [59.6 kB] +Get:64 http://archive.ubuntu.com/ubuntu noble/main amd64 libshout3 amd64 2.4.6-1build2 [50.3 kB] +Get:65 http://archive.ubuntu.com/ubuntu noble/main amd64 libtag1v5-vanilla amd64 1.13.1-1build1 [326 kB] +Get:66 http://archive.ubuntu.com/ubuntu noble/main amd64 libtag1v5 amd64 1.13.1-1build1 [11.7 kB] +Get:67 http://archive.ubuntu.com/ubuntu noble/main amd64 libtwolame0 amd64 0.4.0-2build3 [52.3 kB] +Get:68 http://archive.ubuntu.com/ubuntu noble/main amd64 libv4lconvert0t64 amd64 1.26.1-4build3 [87.6 kB] +Get:69 http://archive.ubuntu.com/ubuntu noble/main amd64 libv4l-0t64 amd64 1.26.1-4build3 [46.9 kB] +Get:70 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libvpx9 amd64 1.14.0-1ubuntu2.3 [1143 kB] +Get:71 http://archive.ubuntu.com/ubuntu noble/main amd64 libwavpack1 amd64 5.6.0-1build1 [84.6 kB] +Get:72 http://archive.ubuntu.com/ubuntu noble/main amd64 libxdamage1 amd64 1:1.1.6-1build1 [6150 B] +Get:73 http://archive.ubuntu.com/ubuntu noble/main amd64 libxfixes3 amd64 1:6.0.0-2build1 [10.8 kB] +Get:74 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libsoup-3.0-common all 3.4.4-5ubuntu0.7 [11.6 kB] +Get:75 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libsoup-3.0-0 amd64 3.4.4-5ubuntu0.7 [292 kB] +Get:76 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 gstreamer1.0-plugins-good amd64 1.24.2-1ubuntu1.4 [2236 kB] +Get:77 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libgraphite2-3 amd64 1.3.14-2ubuntu0.24.04.1 [73.4 kB] +Get:78 http://archive.ubuntu.com/ubuntu noble/main amd64 libharfbuzz0b amd64 8.3.0-2build2 [469 kB] +Get:79 http://archive.ubuntu.com/ubuntu noble/main amd64 libthai-data all 0.1.29-2build1 [158 kB] +Get:80 http://archive.ubuntu.com/ubuntu noble/main amd64 libdatrie1 amd64 0.2.13-3build1 [19.0 kB] +Get:81 http://archive.ubuntu.com/ubuntu noble/main amd64 libthai0 amd64 0.1.29-2build1 [18.9 kB] +Get:82 http://archive.ubuntu.com/ubuntu noble/main amd64 libpango-1.0-0 amd64 1.52.1+ds-1build1 [231 kB] +Get:83 http://archive.ubuntu.com/ubuntu noble/main amd64 libpangoft2-1.0-0 amd64 1.52.1+ds-1build1 [42.5 kB] +Get:84 http://archive.ubuntu.com/ubuntu noble/main amd64 libpangocairo-1.0-0 amd64 1.52.1+ds-1build1 [28.8 kB] +Get:85 http://archive.ubuntu.com/ubuntu noble/main amd64 libxv1 amd64 2:1.0.11-1.1build1 [10.7 kB] +Get:86 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 gstreamer1.0-x amd64 1.24.2-1ubuntu0.4 [85.0 kB] +Get:87 http://archive.ubuntu.com/ubuntu noble/main amd64 ipxe-qemu all 1.21.1+git-20220113.fbbdc3926-0ubuntu2 [1565 kB] +Get:88 http://archive.ubuntu.com/ubuntu noble/main amd64 ipxe-qemu-256k-compat-efi-roms all 1.0.0+git-20150424.a25a16d-0ubuntu5 [548 kB] +Get:89 http://archive.ubuntu.com/ubuntu noble/main amd64 libatk1.0-0t64 amd64 2.52.0-1build1 [55.3 kB] +Get:90 http://archive.ubuntu.com/ubuntu noble/main amd64 libatk-bridge2.0-0t64 amd64 2.52.0-1build1 [66.0 kB] +Get:91 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libavahi-common-data amd64 0.8-13ubuntu6.2 [30.1 kB] +Get:92 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libavahi-common3 amd64 0.8-13ubuntu6.2 [23.4 kB] +Get:93 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libavahi-client3 amd64 0.8-13ubuntu6.2 [26.8 kB] +Get:94 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libboost-iostreams1.83.0 amd64 1.83.0-2.1ubuntu3.2 [260 kB] +Get:95 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libboost-thread1.83.0 amd64 1.83.0-2.1ubuntu3.2 [276 kB] +Get:96 http://archive.ubuntu.com/ubuntu noble/main amd64 libbrlapi0.8 amd64 6.6-4ubuntu5 [31.4 kB] +Get:97 http://archive.ubuntu.com/ubuntu noble/main amd64 libpcsclite1 amd64 2.0.3-1build1 [21.4 kB] +Get:98 http://archive.ubuntu.com/ubuntu noble/main amd64 libcacard0 amd64 1:2.8.0-3build4 [36.5 kB] +Get:99 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 liblcms2-2 amd64 2.14-2ubuntu0.1 [161 kB] +Get:100 http://archive.ubuntu.com/ubuntu noble/main amd64 libcolord2 amd64 1.4.7-1build2 [149 kB] +Get:101 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libcups2t64 amd64 2.4.7-1.2ubuntu7.14 [274 kB] +Get:102 http://archive.ubuntu.com/ubuntu noble/main amd64 libdaxctl1 amd64 77-2ubuntu2 [21.4 kB] +Get:103 http://archive.ubuntu.com/ubuntu noble/main amd64 libwayland-client0 amd64 1.22.0-2.1build1 [26.4 kB] +Get:104 http://archive.ubuntu.com/ubuntu noble/main amd64 libdecor-0-0 amd64 0.2.2-1build2 [16.5 kB] +Get:105 http://archive.ubuntu.com/ubuntu noble/main amd64 libepoxy0 amd64 1.5.10-1build1 [220 kB] +Get:106 http://archive.ubuntu.com/ubuntu noble/main amd64 libwayland-cursor0 amd64 1.22.0-2.1build1 [10.4 kB] +Get:107 http://archive.ubuntu.com/ubuntu noble/main amd64 libwayland-egl1 amd64 1.22.0-2.1build1 [5628 B] +Get:108 http://archive.ubuntu.com/ubuntu noble/main amd64 libxcomposite1 amd64 1:0.4.5-1build3 [6320 B] +Get:109 http://archive.ubuntu.com/ubuntu noble/main amd64 libxcursor1 amd64 1:1.2.1-1build1 [20.7 kB] +Get:110 http://archive.ubuntu.com/ubuntu noble/main amd64 libxinerama1 amd64 2:1.1.4-3build1 [6396 B] +Get:111 http://archive.ubuntu.com/ubuntu noble/main amd64 libxrandr2 amd64 2:1.5.2-2build1 [19.7 kB] +Get:112 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libgtk-3-common all 3.24.41-4ubuntu1.3 [1426 kB] +Get:113 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libgtk-3-0t64 amd64 3.24.41-4ubuntu1.3 [2913 kB] +Get:114 http://archive.ubuntu.com/ubuntu noble/main amd64 libdecor-0-plugin-1-gtk amd64 0.2.2-1build2 [22.2 kB] +Get:115 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libpciaccess0 amd64 0.17-3ubuntu0.24.04.2 [18.9 kB] +Get:116 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libdrm-intel1 amd64 2.4.125-1ubuntu0.1~24.04.2 [63.9 kB] +Get:117 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libllvm20 amd64 1:20.1.2-0ubuntu1~24.04.3 [30.6 MB] +Get:118 http://archive.ubuntu.com/ubuntu noble/main amd64 libxcb-dri3-0 amd64 1.15-1ubuntu2 [7142 B] +Get:119 http://archive.ubuntu.com/ubuntu noble/main amd64 libxcb-present0 amd64 1.15-1ubuntu2 [5676 B] +Get:120 http://archive.ubuntu.com/ubuntu noble/main amd64 libxcb-randr0 amd64 1.15-1ubuntu2 [17.9 kB] +Get:121 http://archive.ubuntu.com/ubuntu noble/main amd64 libxcb-sync1 amd64 1.15-1ubuntu2 [9312 B] +Get:122 http://archive.ubuntu.com/ubuntu noble/main amd64 libxcb-xfixes0 amd64 1.15-1ubuntu2 [10.2 kB] +Get:123 http://archive.ubuntu.com/ubuntu noble/main amd64 libxshmfence1 amd64 1.3-1build5 [4764 B] +Get:124 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 mesa-libgallium amd64 25.2.8-0ubuntu0.24.04.2 [10.8 MB] +Get:125 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libgbm1 amd64 25.2.8-0ubuntu0.24.04.2 [34.2 kB] +Get:126 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libgdk-pixbuf2.0-bin amd64 2.42.10+dfsg-3ubuntu3.3 [13.9 kB] +Get:127 http://archive.ubuntu.com/ubuntu noble/main amd64 libvulkan1 amd64 1.3.275.0-1build1 [142 kB] +Get:128 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libgl1-mesa-dri amd64 25.2.8-0ubuntu0.24.04.2 [37.9 kB] +Get:129 http://archive.ubuntu.com/ubuntu noble/main amd64 libxcb-glx0 amd64 1.15-1ubuntu2 [24.8 kB] +Get:130 http://archive.ubuntu.com/ubuntu noble/main amd64 libxxf86vm1 amd64 1:1.1.4-1build4 [9282 B] +Get:131 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libglx-mesa0 amd64 25.2.8-0ubuntu0.24.04.2 [110 kB] +Get:132 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libgtk-3-bin amd64 3.24.41-4ubuntu1.3 [73.9 kB] +Get:133 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 librdmacm1t64 amd64 50.0-2ubuntu0.2 [70.7 kB] +Get:134 http://archive.ubuntu.com/ubuntu noble/main amd64 libiscsi7 amd64 1.19.0-3build4 [68.7 kB] +Get:135 http://archive.ubuntu.com/ubuntu noble/main amd64 libsamplerate0 amd64 0.2.2-4build1 [1344 kB] +Get:136 http://archive.ubuntu.com/ubuntu noble/main amd64 libjack-jackd2-0 amd64 1.9.21~dfsg-3ubuntu3 [289 kB] +Get:137 http://archive.ubuntu.com/ubuntu noble/main amd64 libndctl6 amd64 77-2ubuntu2 [62.8 kB] +Get:138 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libnfs14 amd64 5.0.2-1ubuntu0.24.04.1 [109 kB] +Get:139 http://archive.ubuntu.com/ubuntu noble/main amd64 libwebrtc-audio-processing1 amd64 0.3.1-0ubuntu6 [290 kB] +Err:140 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libspa-0.2-modules amd64 1.0.5-1ubuntu3.2 + 404 Not Found [IP: 10.10.0.20 8000] +Err:141 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libpipewire-0.3-0t64 amd64 1.0.5-1ubuntu3.2 + 404 Not Found [IP: 10.10.0.20 8000] +Err:142 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libpipewire-0.3-common all 1.0.5-1ubuntu3.2 + 404 Not Found [IP: 10.10.0.20 8000] +Get:143 http://archive.ubuntu.com/ubuntu noble/main amd64 libpmem1 amd64 1.13.1-1.1ubuntu2 [84.8 kB] +Get:144 http://archive.ubuntu.com/ubuntu noble/main amd64 libpmemobj1 amd64 1.13.1-1.1ubuntu2 [116 kB] +Get:145 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 librados2 amd64 19.2.3-0ubuntu0.24.04.3 [4041 kB] +Get:146 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 librbd1 amd64 19.2.3-0ubuntu0.24.04.3 [3413 kB] +Get:147 http://archive.ubuntu.com/ubuntu noble/main amd64 librsvg2-2 amd64 2.58.0+dfsg-1build1 [2135 kB] +Get:148 http://archive.ubuntu.com/ubuntu noble/main amd64 librsvg2-common amd64 2.58.0+dfsg-1build1 [11.8 kB] +Get:149 http://archive.ubuntu.com/ubuntu noble/main amd64 libxss1 amd64 1:1.2.3-1build3 [7204 B] +Get:150 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libsdl2-2.0-0 amd64 2.30.0+dfsg-1ubuntu3.1 [686 kB] +Get:151 http://archive.ubuntu.com/ubuntu noble/main amd64 libslirp0 amd64 4.7.0-1ubuntu3 [63.8 kB] +Get:152 http://archive.ubuntu.com/ubuntu noble/main amd64 libspice-server1 amd64 0.15.1-1build2 [349 kB] +Get:153 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libtpms0 amd64 0.9.3-0ubuntu4.24.04.1 [373 kB] +Get:154 http://archive.ubuntu.com/ubuntu noble/main amd64 liburing2 amd64 2.5-1build1 [21.1 kB] +Get:155 http://archive.ubuntu.com/ubuntu noble/main amd64 libusbredirparser1t64 amd64 0.13.0-2.1build1 [16.5 kB] +Get:156 http://archive.ubuntu.com/ubuntu noble/main amd64 libvirglrenderer1 amd64 1.0.0-1ubuntu2 [226 kB] +Get:157 http://archive.ubuntu.com/ubuntu noble/main amd64 libyajl2 amd64 2.1.0-5build1 [20.2 kB] +Get:158 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libvirt0 amd64 10.0.0-2ubuntu8.14 [1830 kB] +Get:159 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libvirt-clients amd64 10.0.0-2ubuntu8.14 [438 kB] +Get:160 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libvirt-daemon-driver-qemu amd64 10.0.0-2ubuntu8.14 [740 kB] +Get:161 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libvirt-daemon amd64 10.0.0-2ubuntu8.14 [431 kB] +Get:162 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libvirt-daemon-config-network all 10.0.0-2ubuntu8.14 [3112 B] +Get:163 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libvirt-daemon-config-nwfilter all 10.0.0-2ubuntu8.14 [6040 B] +Get:164 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 systemd-container amd64 255.4-1ubuntu8.16 [417 kB] +Get:165 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libvirt-daemon-system-systemd all 10.0.0-2ubuntu8.14 [1374 B] +Get:166 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libvirt-daemon-system amd64 10.0.0-2ubuntu8.14 [49.8 kB] +Get:167 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libvirt-l10n all 10.0.0-2ubuntu8.14 [1150 B] +Get:168 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libvte-2.91-common amd64 0.76.0-1ubuntu0.1 [13.5 kB] +Get:169 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libvte-2.91-0 amd64 0.76.0-1ubuntu0.1 [230 kB] +Get:170 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libxml2-utils amd64 2.9.14+dfsg-1.3ubuntu3.8 [39.4 kB] +Get:171 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 mdevctl amd64 1.3.0-1ubuntu2.1 [959 kB] +Get:172 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 mesa-vulkan-drivers amd64 25.2.8-0ubuntu0.24.04.2 [17.5 MB] +Get:173 http://archive.ubuntu.com/ubuntu noble/main amd64 libfdt1 amd64 1.7.0-2build1 [20.1 kB] +Get:174 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 qemu-system-common amd64 1:8.2.2+ds-0ubuntu1.17 [1255 kB] +Get:175 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 qemu-system-data all 1:8.2.2+ds-0ubuntu1.17 [1796 kB] +Get:176 http://archive.ubuntu.com/ubuntu noble/main amd64 seabios all 1.16.3-2 [175 kB] +Get:177 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 qemu-system-x86 amd64 1:8.2.2+ds-0ubuntu1.17 [11.2 MB] +Get:178 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 qemu-utils amd64 1:8.2.2+ds-0ubuntu1.17 [2222 kB] +Get:179 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 qemu-block-extra amd64 1:8.2.2+ds-0ubuntu1.17 [114 kB] +Get:180 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 qemu-system-modules-opengl amd64 1:8.2.2+ds-0ubuntu1.17 [186 kB] +Get:181 http://archive.ubuntu.com/ubuntu noble/main amd64 libglvnd0 amd64 1.7.0-1build1 [69.6 kB] +Get:182 http://archive.ubuntu.com/ubuntu noble/main amd64 libglx0 amd64 1.7.0-1build1 [38.6 kB] +Get:183 http://archive.ubuntu.com/ubuntu noble/main amd64 libgl1 amd64 1.7.0-1build1 [102 kB] +Get:184 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 qemu-system-gui amd64 1:8.2.2+ds-0ubuntu1.17 [314 kB] +Get:185 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 qemu-system-modules-spice amd64 1:8.2.2+ds-0ubuntu1.17 [70.2 kB] +Get:186 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 swtpm amd64 0.7.3-0ubuntu5.24.04.1 [53.1 kB] +Get:187 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 swtpm-tools amd64 0.7.3-0ubuntu5.24.04.1 [92.9 kB] +Get:188 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libnss-mymachines amd64 255.4-1ubuntu8.16 [153 kB] +Err:189 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 ovmf all 2024.02-2ubuntu0.8 + 404 Not Found [IP: 10.10.0.20 8000] +Fetched 118 MB in 43s (2776 kB/s) +E: Failed to fetch http://security.ubuntu.com/ubuntu/pool/main/a/alsa-lib/libasound2-data_1.2.11-1ubuntu0.2_all.deb 404 Not Found [IP: 10.10.0.20 8000] +E: Failed to fetch http://security.ubuntu.com/ubuntu/pool/main/a/alsa-lib/libasound2t64_1.2.11-1ubuntu0.2_amd64.deb 404 Not Found [IP: 10.10.0.20 8000] +E: Failed to fetch http://archive.ubuntu.com/ubuntu/pool/main/a/alsa-ucm-conf/alsa-ucm-conf_1.2.10-1ubuntu5.11_all.deb 404 Not Found [IP: 10.10.0.20 8000] +E: Failed to fetch http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.90-2ubuntu0.3_amd64.deb 404 Not Found [IP: 10.10.0.20 8000] +E: Failed to fetch http://archive.ubuntu.com/ubuntu/pool/main/p/pipewire/libspa-0.2-modules_1.0.5-1ubuntu3.2_amd64.deb 404 Not Found [IP: 10.10.0.20 8000] +E: Failed to fetch http://archive.ubuntu.com/ubuntu/pool/main/p/pipewire/libpipewire-0.3-0t64_1.0.5-1ubuntu3.2_amd64.deb 404 Not Found [IP: 10.10.0.20 8000] +E: Failed to fetch http://archive.ubuntu.com/ubuntu/pool/main/p/pipewire/libpipewire-0.3-common_1.0.5-1ubuntu3.2_all.deb 404 Not Found [IP: 10.10.0.20 8000] +E: Failed to fetch http://archive.ubuntu.com/ubuntu/pool/main/e/edk2/ovmf_2024.02-2ubuntu0.8_all.deb 404 Not Found [IP: 10.10.0.20 8000] +E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing? diff --git a/docs/audit/stepB-check-20260720-final.txt b/docs/audit/stepB-check-20260720-final.txt new file mode 100644 index 0000000..27b4b28 --- /dev/null +++ b/docs/audit/stepB-check-20260720-final.txt @@ -0,0 +1,15 @@ +OK: maas snap 3.7.2-17972-g.35e297c4d (3.7/stable) +OK: MAAS rackd running +OK: enrolled to region http://10.10.0.20:5240/MAAS +== node-host (Model B) readiness == + [ok] libvirt/qemu installed + [ok] nested KVM ON (kvm_amd) + [ok] jessea123 in libvirt group + [ok] inner pool dir /var/lib/libvirt/vr1-dc0-inner + [ok] opnsense base /var/lib/libvirt/vr1-dc0-inner/opnsense-26.7-nano.qcow2 + [ok] SEC-010 transit FORWARD-drop present + transit interface 'enp1s0' exists + [ok] D-125 WAN bridge 'br-vr1-dc0-wan' present + uplink 'enp2s0' enslaved + [gate] DEPLOY-TIME (unprovable here, like the depth-4 boot gate): before the OPNsense chain + rides it, prove egress in ISOLATION -- attach a throwaway guest to 'br-vr1-dc0-wan', + confirm it gets a vcloud-ISP address and pings out. FAIL => revert to the D-125 + double-NAT fallback, NOT a redesign. diff --git a/docs/audit/stepB-check-20260720.txt b/docs/audit/stepB-check-20260720.txt new file mode 100644 index 0000000..333ee4d --- /dev/null +++ b/docs/audit/stepB-check-20260720.txt @@ -0,0 +1,15 @@ +OK: maas snap 3.7.2-17972-g.35e297c4d (3.7/stable) +OK: MAAS rackd running +OK: enrolled to region http://10.10.0.20:5240/MAAS +== node-host (Model B) readiness == + [ok] libvirt/qemu installed + [ok] nested KVM ON (kvm_amd) + [ok] jessea123 in libvirt group + [ok] inner pool dir /var/lib/libvirt/vr1-dc0-inner + [--] opnsense base missing -- run: opnsense-prep-image.sh 26.1 /var/lib/libvirt/vr1-dc0-inner/opnsense-26.1-nano.qcow2 + [ok] SEC-010 transit FORWARD-drop present + transit interface 'enp1s0' exists + [ok] D-125 WAN bridge 'br-vr1-dc0-wan' present + uplink 'enp2s0' enslaved + [gate] DEPLOY-TIME (unprovable here, like the depth-4 boot gate): before the OPNsense chain + rides it, prove egress in ISOLATION -- attach a throwaway guest to 'br-vr1-dc0-wan', + confirm it gets a vcloud-ISP address and pings out. FAIL => revert to the D-125 + double-NAT fallback, NOT a redesign. diff --git a/docs/audit/stepB-opnsense-prep-20260720.txt b/docs/audit/stepB-opnsense-prep-20260720.txt new file mode 100644 index 0000000..894396a --- /dev/null +++ b/docs/audit/stepB-opnsense-prep-20260720.txt Binary files differ diff --git a/docs/changelog-20260719-dc0-deploy-stepB.md b/docs/changelog-20260719-dc0-deploy-stepB.md index 7027e7e..b95fb39 100644 --- a/docs/changelog-20260719-dc0-deploy-stepB.md +++ b/docs/changelog-20260719-dc0-deploy-stepB.md @@ -118,6 +118,83 @@ cloudinit-vm serial-console/qga observability vars; cloudinit-vm MAC pinning; DOCFIX for runbook "mgmt/uplink" naming. +## 4c. Step B bootstrap EXECUTED on vvr1-dc0 (2026-07-20, logged window) + +- Snap proxy set to the region maas-proxy (measured serving: HTTP 200 to + archive.ubuntu.com, CONNECT to api.snapcraft.io) -- the D-107-shaped + answer to the rack's no-egress bootstrap; apt used the same proxy via + per-invocation env. Enrollment secret piped region->rack + (`install -m600 /dev/stdin`), verified by byte-count only (32), never + in context. +- Run 1 (`docs/audit/stepB-bootstrap-20260720.txt`): maas snap 3.7/stable + installed, **rack ENROLLED to http://10.10.0.20:5240/MAAS**; FAILED at + qemu apt install on stale image package lists (404s via proxy). + Fix: `apt-get update` (proxied), re-run. +- Run 2 (`docs/audit/stepB-bootstrap-20260720-run2.txt`): EXIT 0 -- + libvirt/qemu + nested KVM on, inner pool + AppArmor, SEC-010 + FORWARD-drop loaded on enp1s0 + `sec010-fw.service` enabled + (boot-persistent), `br-vr1-dc0-wan` verified with enp2s0 enslaved. +- `--check` (`docs/audit/stepB-check-20260720.txt`): all items ok EXCEPT + opnsense base (the remaining step-B item); rackd running, enrolled. +- Region-side residue for the MAAS phase (per script exit text): enable + DHCP on metal-admin at the Office1 region naming this rack primary_rack + (step D territory, NOT done). +- **Revert:** rack enrollment: region-side `maas ... rack-controllers + delete`; SEC-010: disable sec010-fw.service + rm /etc/nftables-sec010.nft; + packages: apt/snap remove; snap proxy: `snap unset system proxy.http + proxy.https`. + +## 4d. RULING RECORD (GA-R5) -- DC edge base version (2026-07-20) + +- **Question as presented:** reuse verified 26.1 artifact vs fresh download + (first exchange); then, sharpened after the operator noted "Office1 is + running OPNsense 26.7": 26.1-base-then-upgrade vs fresh 26.7 nano base. +- **Operator answer, exact utterance (option selected):** "Fresh 26.7 nano + base". +- Consequences implemented: prep runs 26.7 -> `opnsense-26.7-nano.qcow2`; + `vr1-dc0-substrate` `opnsense_base_path` default updated (no inner state + exists; pre-apply edit); step-B `--check` passes `--opnsense-base` for + the 26.7 path. LOGGED follow-items: site-headend-install.sh's 26.1 + default + hint strings (script change + harness, stage close); the + D-112/D-113 serial/API boot path is REVALIDATED on 26.7 at the step-C + boot gate (office1 precedent: 26.1-proven, upgraded in place to 26.7). +- Mirror: `https://mirror.ams1.nl.leaseweb.net/opnsense` -- MEASURED from + the vendor's live download page this session (not memory), HEAD-verified + serving the 26.7 nano (~468 MiB). LOGGED FINDING: opnsense-prep-image.sh + performs no checksum verification of the downloaded image (same property + as the original 26.1 prep; candidate hardening). + +## 4e. Step B CLOSED: 26.7 base staged; final check EXIT 0; SEC-010 CLOSED both ends + +- OPNsense 26.7 nano prepped ON the rack (leaseweb mirror via region proxy, + 468M; python3 bz2 fallback -- bunzip2 never needed, DOCFIX-184; + `docs/audit/stepB-opnsense-prep-20260720.txt`). Inner-root + `opnsense_base_path` default -> 26.7 (validate PASS). +- Final `--check` EXIT 0, ALL items ok + (`docs/audit/stepB-check-20260720-final.txt`). +- SEC-010 voffice1-side pin (the row's "same pin follows" clause, due since + this session wired voffice1's transit leg; voffice1 runs LXD so + ip_forward=1): identical scoped nft artifact + sec010-fw.service on + enp2s0, verified loaded + persistent; rack proxy/region paths re-verified + working post-pin. **SEC-010 row CLOSED (operator ruling, utterance in the + row).** Open SEC count 8 -> 7. +- LOGGED follow-item: site-headend-install.sh region-role support for the + transit-if pin (voffice1's was hand-applied to the script's exact + artifact shape; fold into the script + harness at stage close). +- **Revert:** rm the two files + `systemctl disable sec010-fw` on voffice1; + `nft delete table inet sec010`; ledger row reopens citing this item. + +## 6. ledger-scan hardening: FAIL-OPEN is terminology, not a status + +- SEC-010's close surfaced a scanner false positive: the OPEN-row detector + (`awk toupper(cell) ~ /OPEN|PENDING/`) matched the substring OPEN inside + "fail-open" in the closed row's disposition -- the row counted OPEN + forever (same class as the GA-F15 wrap trap). Fix: strip FAIL-OPEN from + the cell before matching (`scripts/ledger-scan.sh`); harness gains a + CLOSED-row-with-fail-open fixture + nochk (45/45 PASS). Count re-verified: + 7 open, SEC-010 absent. +- **Revert:** git revert of this commit's ledger-scan.sh + test hunks. + ## 5. Host tooling: libguestfs-tools installed on vcloud (operator-run) - `sudo apt-get install -y libguestfs-tools` (1:1.52.0-5ubuntu3) -- enables diff --git a/docs/security-ledger.md b/docs/security-ledger.md index 4e19767..e7b4f5c 100644 --- a/docs/security-ledger.md +++ b/docs/security-ledger.md @@ -18,7 +18,7 @@ | SEC-007 | 2026-07-12 | `~/vr1-office1-creds/` on the jumphost holds the Office1 edge root password + its bcrypt hash + the `office1_svc` SSH PRIVATE key + (added 2026-07-13) the OPNsense **API key/secret** (`opnsense-api.txt`, 0600), all in plaintext (dir 0700, files 0600) | 2026-07-12 edge build; custody detail deliberately not recorded here per D-069 | operator | OPEN -- required for edge management (D-112(c) makes SSH the only management path), so this is a ROTATION obligation, not a delete-me. Rotate at v1 close / if the jumphost is rebuilt or shared | | SEC-008 | 2026-07-13 | `~/vr1-office1-creds/tailscale-authkey.txt` (vcloud, 0600) -- the operator's 48-char Tailscale auth key for the SELF-HOSTED control plane `tailscale.baldurkeep.com`. Used to enrol `office1-tailscale`. Consumed BY PATH and never printed into a session; the copy shipped to the node was SHREDDED after `tailscale up` (tailscaled holds its own node key now). | 2026-07-13 Office1 Tailscale enrolment; docs/vr1-office1-as-built.md | operator | OPEN -- ROTATION obligation, not a delete-me: the key is still on vcloud for re-enrolment. Revoke/reissue on the control server at v1 close, or immediately if vcloud is rebuilt or shared. | | SEC-009 | 2026-07-15 | Credential/env SPRAWL + world-readable exposure on vcloud: three env files sat loose in `~` outside the consolidated `~/vr1-office1-creds/` -- `.vr1-netbox.env` (upstream NetBox token), `vr1-office1.env` (edge root-password hash + SSH key path), and `vr1-stage1.env` which held `TF_VAR_maas_api_key` (a MAAS API secret) at mode **0664 (group/world-readable)**; `tailscale-authkey.txt` in the creds dir was also 0664. | docs/archive/changelogs/changelog-20260715-creds-consolidation.md | operator | **REMEDIATED 2026-07-15** -- all three moved into `~/vr1-office1-creds/`, every sensitive file `chmod 600`. STANDING CONVENTION established (below). Note: this is a CLOSED in-house test; the rotation obligations of SEC-005/006/007 still apply at v1 close, this row only closes the SPRAWL + PERMS exposure. | -| SEC-010 | 2026-07-16 | **metal-admin DC-LOCAL invariant (D-052/D-100) is PRESERVED but NOT ENFORCED in the committed Stage-3 config.** The `vvr1_dc0` rack straddles metal-admin (10.12.8.0/22, DC-local) + the office1<->dc0 transit (crosses fiber). Its committed cloud-init pins static IPs only -- **no `net.ipv4.ip_forward=0` sysctl, no host firewall on the transit leg.** Cross-plane routing (metal-admin <-> the whole Office1 /22, bidirectional) is blocked ONLY by Ubuntu's distro default; the deferred MAAS-rack install could silently flip it. A MAAS rack proxies at the application layer and needs no kernel forwarding, so pinning is free. **MODEL B UPDATE (2026-07-16):** after the D-123 Model B reshape, the OUTER `vvr1-dc0` is single-leg (transit only); metal-admin + the other 5 planes are now INNER bridges on `vvr1-dc0`'s own libvirtd. The forwarding hardening is MORE critical (vvr1-dc0 now bridges ALL 6 inner planes + the transit) and belongs on the inner libvirt host, not just a 2-leg rack -- wire it in the C3 bootstrap (`site-headend-install.sh` node-host mode). | 2026-07-16 plane-segregation review + Model B reshape cross-check; `opentofu/main.tf` `module "vvr1_dc0"` | operator | **OPEN -- artifact COMMITTED (Phase D 2026-07-16), gated on apply+verify.** Enforced via a FORWARD-drop across the transit leg, NOT a global `ip_forward=0`. `scripts/site-headend-install.sh --host-nodes` writes `/etc/nftables-sec010.nft` (drop FORWARD in+out the transit interface, default `mgmt`) + a boot-persistent `sec010-fw.service`; `--host-nodes --check` is the MECHANICAL pre-apply gate (fails if the rule is absent, AND -- hardened 2026-07-16 -- if the keyed transit interface does not EXIST, since an nftables oifname on an absent iface loads clean but matches nothing = fail-open). **D-125 UPDATE (2026-07-16):** the earlier rationale (a global `ip_forward=0` being unusable because the inner `vr1-dc0-wan` NAT forced `ip_forward=1`) NO LONGER applies -- under bridge-in the inner `vr1-dc0-wan` is a BRIDGE (no inner NAT). The scoped FORWARD-drop is RETAINED as-is (correct either way). **br_netfilter CONSTRAINT:** it MUST stay interface-scoped and NEVER be globalized -- with `br_netfilter` loaded, bridged WAN frames traverse the L3 FORWARD chain, so a global forward-drop would silently kill the `br-vr1-dc0-wan` WAN path. `--check` now also verifies the WAN bridge exists with its uplink enslaved (same fail-open class). Nothing routes across the fiber THROUGH vvr1-dc0; the rack proxies MAAS at the app layer (originated/terminated, not forwarded). Same pin follows onto `voffice1` when its transit leg is wired. Region route must target only the rack transit /30, never 10.12.8.0/22. Stays OPEN until applied + verified on vvr1-dc0. | +| SEC-010 | 2026-07-16 | **metal-admin DC-LOCAL invariant (D-052/D-100) is PRESERVED but NOT ENFORCED in the committed Stage-3 config.** The `vvr1_dc0` rack straddles metal-admin (10.12.8.0/22, DC-local) + the office1<->dc0 transit (crosses fiber). Its committed cloud-init pins static IPs only -- **no `net.ipv4.ip_forward=0` sysctl, no host firewall on the transit leg.** Cross-plane routing (metal-admin <-> the whole Office1 /22, bidirectional) is blocked ONLY by Ubuntu's distro default; the deferred MAAS-rack install could silently flip it. A MAAS rack proxies at the application layer and needs no kernel forwarding, so pinning is free. **MODEL B UPDATE (2026-07-16):** after the D-123 Model B reshape, the OUTER `vvr1-dc0` is single-leg (transit only); metal-admin + the other 5 planes are now INNER bridges on `vvr1-dc0`'s own libvirtd. The forwarding hardening is MORE critical (vvr1-dc0 now bridges ALL 6 inner planes + the transit) and belongs on the inner libvirt host, not just a 2-leg rack -- wire it in the C3 bootstrap (`site-headend-install.sh` node-host mode). | 2026-07-16 plane-segregation review + Model B reshape cross-check; `opentofu/main.tf` `module "vvr1_dc0"` | operator | **CLOSED 2026-07-20** (was: artifact COMMITTED Phase D 2026-07-16, gated on apply+verify -- both now done, see close note at end of this cell). Enforced via a FORWARD-drop across the transit leg, NOT a global `ip_forward=0`. `scripts/site-headend-install.sh --host-nodes` writes `/etc/nftables-sec010.nft` (drop FORWARD in+out the transit interface, default `mgmt`) + a boot-persistent `sec010-fw.service`; `--host-nodes --check` is the MECHANICAL pre-apply gate (fails if the rule is absent, AND -- hardened 2026-07-16 -- if the keyed transit interface does not EXIST, since an nftables oifname on an absent iface loads clean but matches nothing = fail-open). **D-125 UPDATE (2026-07-16):** the earlier rationale (a global `ip_forward=0` being unusable because the inner `vr1-dc0-wan` NAT forced `ip_forward=1`) NO LONGER applies -- under bridge-in the inner `vr1-dc0-wan` is a BRIDGE (no inner NAT). The scoped FORWARD-drop is RETAINED as-is (correct either way). **br_netfilter CONSTRAINT:** it MUST stay interface-scoped and NEVER be globalized -- with `br_netfilter` loaded, bridged WAN frames traverse the L3 FORWARD chain, so a global forward-drop would silently kill the `br-vr1-dc0-wan` WAN path. `--check` now also verifies the WAN bridge exists with its uplink enslaved (same fail-open class). Nothing routes across the fiber THROUGH vvr1-dc0; the rack proxies MAAS at the app layer (originated/terminated, not forwarded). Same pin follows onto `voffice1` when its transit leg is wired. Region route must target only the rack transit /30, never 10.12.8.0/22. **CLOSED 2026-07-20 (operator ruling, exact utterance: "Close SEC-010 (Recommended)"): applied + verified BOTH ends in the logged dc0-deploy step-B window.** vvr1-dc0: written by `site-headend-install.sh --role rack --host-nodes`, verified by the named `--check` EXIT 0 (`docs/audit/stepB-check-20260720-final.txt` -- rule present + `enp1s0` exists + `br-vr1-dc0-wan`/`enp2s0` enslaved; note the transit interface is `enp1s0`, not the script-default `mgmt` -- netplan set-name dropped, session changelog). voffice1 (the "same pin follows" clause -- its transit leg `enp2s0` was wired 2026-07-20): identical scoped artifact + `sec010-fw.service` enabled, `nft list table inet sec010` verified, proxy/region paths re-verified working post-pin. | | SEC-011 | 2026-07-16 | **Node least-connectivity gap (not an L2 breach).** Under D-121 Option C role separation, all nodes get a uniform 6-plane NIC set, so a ceph-osd STORAGE node has a leg on provider-public (external/FIP) + data-tenant (tenant geneve) -- planes it never binds per D-052. Planes stay isolated L2 (no crosstalk). | 2026-07-16 plane-segregation review; `opentofu/main.tf` `local.vr1_dc0_node_nics` | operator | **CLOSED 2026-07-16 (operator ruling -- keep uniform 6-NIC).** Review R3-F10: A2's cross-examination refuted the attack-surface concern -- in the isolated-L2 sim the unbound vNICs have no reachability out, and pruning would INCREASE Roosevelt-delta (baremetal trunks all VLANs to every node on bonded NICs, so all planes are present regardless of L3 binding). Uniform 6-NIC is the more Roosevelt-faithful model. Accepted non-issue; no code change. | **STANDING CONVENTION (SEC-009, 2026-07-15): per-site credential/env consolidation.** ALL sensitive diff --git a/opentofu/vr1-dc0-substrate/variables.tf b/opentofu/vr1-dc0-substrate/variables.tf index 8796726..8c1d539 100644 --- a/opentofu/vr1-dc0-substrate/variables.tf +++ b/opentofu/vr1-dc0-substrate/variables.tf @@ -21,7 +21,10 @@ variable "opnsense_base_path" { description = "Path INSIDE vvr1-dc0 to the prepped OPNsense nano qcow2 (staged by the bootstrap step, opnsense-prep-image.sh run on vvr1-dc0)." type = string - default = "/var/lib/libvirt/vr1-dc0-inner/opnsense-26.1-nano.qcow2" + # 26.7 per operator ruling 2026-07-20 (fresh 26.7 nano base for the DC edge; the + # office1 edge's proven 26.1 boot path becomes a REVALIDATION item at the step-C + # boot gate -- session changelog dc0-deploy-stepB, ruling record). + default = "/var/lib/libvirt/vr1-dc0-inner/opnsense-26.7-nano.qcow2" } variable "domain_suffix" { diff --git a/scripts/ledger-scan.sh b/scripts/ledger-scan.sh index ca1b103..53024b2 100644 --- a/scripts/ledger-scan.sh +++ b/scripts/ledger-scan.sh @@ -90,8 +90,12 @@ # session ledger's machine-derived block carries pointer + count, never rows. echo "-- OPEN security-ledger rows (register of record: docs/security-ledger.md) --" if [ -r "$SL" ]; then + # FAIL-OPEN is firewall terminology, not a status: strip it before matching, or a + # CLOSED row whose disposition explains a fail-open guard counts as OPEN forever + # (hit for real on SEC-010's close, 2026-07-20 -- same false-positive class as the + # GA-F15 wrap trap). OPEN_SEC="$(grep -E '^\|[[:space:]]*SEC-[0-9]' "$SL" \ - | awk -F'|' 'toupper($(NF-1)) ~ /OPEN|PENDING/ {gsub(/^ *| *$/,"",$2); print $2}')" + | awk -F'|' '{cell=toupper($(NF-1)); gsub(/FAIL-OPEN/,"",cell)} cell ~ /OPEN|PENDING/ {gsub(/^ *| *$/,"",$2); print $2}')" if [ -n "$OPEN_SEC" ]; then printf ' %s open: %s\n' "$(printf '%s\n' "$OPEN_SEC" | wc -l | tr -d ' ')" \ "$(printf '%s\n' "$OPEN_SEC" | paste -sd' ' -)" diff --git a/tests/ledger-scan/run-tests.sh b/tests/ledger-scan/run-tests.sh index 59aeec9..3567194 100644 --- a/tests/ledger-scan/run-tests.sh +++ b/tests/ledger-scan/run-tests.sh @@ -30,6 +30,7 @@ | SEC-002 | 2026-06-17 | token rule | x | operator | STANDING RULE | | SEC-003 | 2026-07-03 | unseal custody | D-069 | operator | OPEN -- assign | | SEC-004 | 2026-05-27 | repo public | x | operator | CLOSED -- flipped private | +| SEC-005 | 2026-07-16 | forward drop | x | operator | CLOSED -- verified; the --check guards the fail-open case (rule keyed on absent iface) | SL # next-free fixtures: mention up to DOCFIX-085, BUNDLEFIX-009 in a doc printf 'refs: DOCFIX-084 DOCFIX-085 BUNDLEFIX-008 BUNDLEFIX-009 D-070\n' > "$W/runbooks/refs.md" @@ -53,6 +54,7 @@ chk 'SEC-001' "surfaces SEC-001 OPEN" chk 'SEC-003' "surfaces SEC-003 OPEN" nochk 'SEC-004' "omits SEC-004 CLOSED" +nochk 'SEC-005' "omits SEC-005 CLOSED whose disposition says fail-open (terminology, not status -- SEC-010 close 2026-07-20)" grep -q 'SEC-002' <<<"$OUT" && no "omits SEC-002 STANDING (not open)" || ok "omits SEC-002 STANDING" # GA-R4/F3: pointer + count, never row-level dispositions chk '2 open: SEC-001 SEC-003' "SEC count + ID list (GA-R4/F3)"