v0.0.4 - Remove incomplete n_signer glue, update services/smoketest, add ISO version stamping, and include custom console fonts

.tmp_version_test/etc/n-os-tr/version

@@ -0,0 +1 @@
+n-os-tr v0.0.3 (0f74671)

.tmp_version_test/issue

@@ -0,0 +1,2 @@
+n-OS-tr · n-os-tr v0.0.3 (0f74671) · SHELL · \l
+

build.sh

@@ -8,6 +8,7 @@ WORKSPACE_ISO="$WORKSPACE_ISO_DIR/live-image-amd64.hybrid.iso"
 BUILD_LOG="$WORKSPACE_ISO_DIR/build.log"
 ARTIFACTS_DIR="$WORKSPACE_ISO_DIR/config/includes.chroot_before_packages/live-artifacts"
 BUILD_BINARIES_SCRIPT="$REPO_ROOT/scripts/build-binaries.sh"
+ISSUE_TEMPLATE_PATH="$REPO_ROOT/iso/config/templates/issue.template"
 
 CLEAN_REQUESTED=0
 # Fast iteration defaults:
@@ -104,6 +105,43 @@ stage_slice_bc_artifacts() {
     "$BUILD_BINARIES_SCRIPT"
 }
 
+determine_build_version() {
+    local latest_tag
+    latest_tag="$(git -C "$REPO_ROOT" tag -l 'v*.*.*' | sort -V | tail -n 1 || true)"
+
+    if [[ -z "$latest_tag" ]]; then
+        latest_tag="v0.0.0"
+        echo "[build.sh] warning: no semantic git tags found; defaulting to $latest_tag"
+    fi
+
+    local short_hash
+    short_hash="$(git -C "$REPO_ROOT" rev-parse --short HEAD)"
+
+    BUILD_VERSION_STRING="n-os-tr ${latest_tag} (${short_hash})"
+}
+
+stage_version_metadata() {
+    determine_build_version
+
+    local version_dir="$BUILD_DIR/config/includes.chroot/etc/n-os-tr"
+    local version_file="$version_dir/version"
+    local issue_file="$BUILD_DIR/config/includes.chroot/etc/issue"
+
+    mkdir -p "$version_dir"
+    printf '%s\n' "$BUILD_VERSION_STRING" > "$version_file"
+
+    if [[ ! -f "$ISSUE_TEMPLATE_PATH" ]]; then
+        echo "[build.sh] missing issue template: $ISSUE_TEMPLATE_PATH" >&2
+        exit 1
+    fi
+
+    sed "s|__N_OS_TR_VERSION__|$BUILD_VERSION_STRING|g" "$ISSUE_TEMPLATE_PATH" > "$issue_file"
+
+    echo "[build.sh] stamped version: $BUILD_VERSION_STRING"
+    echo "[build.sh] wrote: $version_file"
+    echo "[build.sh] rendered: $issue_file"
+}
+
 if [[ "$CLEAN_REQUESTED" -eq 1 ]]; then
     cleanup_artifacts
 fi
@@ -146,6 +184,8 @@ if [[ ! -d "$BUILD_DIR" ]]; then
     exit 1
 fi
 
+stage_version_metadata
+
 if [[ "$ISO_ONLY" -eq 1 ]]; then
     echo "[build.sh] fast mode: skipping includes/ binary rebuild"
 else

increment_and_push.sh

@@ -163,13 +163,12 @@ print_info "Staging changes..."
 git add -A
 
 if git diff --staged --quiet; then
-    print_warning "No staged changes to commit"
-    exit 0
-fi
-
+    print_warning "No staged changes to commit; continuing with version tag bump"
+else
     FULL_COMMIT_MESSAGE="$NEW_VERSION - $COMMIT_MESSAGE"
     print_info "Committing: $FULL_COMMIT_MESSAGE"
     git commit -m "$FULL_COMMIT_MESSAGE"
+fi
 
 if git rev-parse "$NEW_VERSION" >/dev/null 2>&1; then
     print_warning "Tag $NEW_VERSION already exists locally. Re-pointing to current commit."

iso/config/includes.chroot/etc/default/console-setup

@@ -2,5 +2,5 @@
 ACTIVE_CONSOLES="/dev/tty[1-6]"
 CHARMAP="UTF-8"
 CODESET="Lat15"
-FONTFACE="Terminus"
-FONTSIZE="20x10"
+FONTFACE="DejaVu"
+FONTSIZE="40x74"

iso/config/includes.chroot/etc/issue

@@ -1,2 +1,2 @@
-n-OS-tr · SHELL · \l
+n-OS-tr · __N_OS_TR_VERSION__ · SHELL · \l
 

iso/config/includes.chroot/etc/systemd/system/c-relay.service.d/n-os-tr-signer.conf

@@ -1,5 +0,0 @@
-[Service]
-ExecStartPre=/usr/local/bin/n-os-tr-await-signer
-ExecStartPre=/bin/sh -c '/usr/local/bin/n-os-tr-get-key 1 > /run/c-relay.env'
-EnvironmentFile=-/run/c-relay.env
-ExecStartPost=/bin/rm -f /run/c-relay.env

iso/config/includes.chroot/etc/systemd/system/didactyl.service

@@ -6,9 +6,8 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-ExecStartPre=/usr/local/bin/n-os-tr-await-signer
-ExecStartPre=/usr/local/bin/n-os-tr-render-didactyl-genesis 5
-ExecStart=/usr/local/bin/didactyl --genesis /run/didactyl/genesis.jsonc
+EnvironmentFile=-/etc/default/didactyl
+ExecStart=/bin/sh -c '/usr/local/bin/didactyl ${DIDACTYL_ARGS:-}'
 RuntimeDirectory=didactyl
 
 # Memory hygiene

iso/config/includes.chroot/etc/systemd/system/fips.service.d/n-os-tr-signer.conf

@@ -1,5 +0,0 @@
-[Service]
-ExecStartPre=/usr/local/bin/n-os-tr-await-signer
-ExecStartPre=/bin/sh -c '/usr/local/bin/n-os-tr-get-key 3 > /run/fips.env'
-EnvironmentFile=-/run/fips.env
-ExecStartPost=/bin/rm -f /run/fips.env

iso/config/includes.chroot/etc/systemd/system/ginxsom.service.d/n-os-tr-signer.conf

@@ -1,5 +0,0 @@
-[Service]
-ExecStartPre=/usr/local/bin/n-os-tr-await-signer
-ExecStartPre=/bin/sh -c '/usr/local/bin/n-os-tr-get-key 2 > /run/ginxsom.env'
-EnvironmentFile=-/run/ginxsom.env
-ExecStartPost=/bin/rm -f /run/ginxsom.env

iso/config/includes.chroot/etc/systemd/system/nginx.service.d/n-os-tr-signer.conf

@@ -1,2 +0,0 @@
-[Service]
-ExecStartPre=/usr/local/bin/n-os-tr-await-signer

iso/config/includes.chroot/usr/local/bin/n-os-tr-await-signer

@@ -1,21 +0,0 @@
-#!/bin/bash
-# n-os-tr-await-signer: block until nsigner's abstract socket @n_os_tr is reachable.
-# Used as ExecStartPre= by services that depend on the signer.
-set -euo pipefail
-
-SOCKET_NAME="n_os_tr"
-TIMEOUT="${NSIGNER_AWAIT_TIMEOUT:-120}"
-INTERVAL=1
-ELAPSED=0
-
-while [ "$ELAPSED" -lt "$TIMEOUT" ]; do
-    # Try to connect to the abstract socket. socat will exit 0 on success.
-    if socat -u OPEN:/dev/null ABSTRACT-CONNECT:"$SOCKET_NAME" 2>/dev/null; then
-        exit 0
-    fi
-    sleep "$INTERVAL"
-    ELAPSED=$((ELAPSED + INTERVAL))
-done
-
-echo "n-os-tr-await-signer: timed out after ${TIMEOUT}s waiting for @${SOCKET_NAME}" >&2
-exit 1

iso/config/includes.chroot/usr/local/bin/n-os-tr-get-key

@@ -1,50 +0,0 @@
-#!/bin/bash
-# n-os-tr-get-key: request a role's secret key from nsigner via @n_os_tr
-# Usage: n-os-tr-get-key <role_name>
-# Outputs: 64-char hex private key on stdout
-# Exit 1 on failure.
-set -euo pipefail
-
-ROLE="${1:?usage: n-os-tr-get-key <role_name>}"
-SOCKET="n_os_tr"
-TIMEOUT="${NSIGNER_KEY_TIMEOUT:-30}"
-
-# Wait for socket to be available
-ELAPSED=0
-while [ "$ELAPSED" -lt "$TIMEOUT" ]; do
-    if socat -u OPEN:/dev/null ABSTRACT-CONNECT:"$SOCKET" 2>/dev/null; then
-        break
-    fi
-    sleep 1
-    ELAPSED=$((ELAPSED + 1))
-done
-
-if [ "$ELAPSED" -ge "$TIMEOUT" ]; then
-    echo "n-os-tr-get-key: timed out waiting for @${SOCKET}" >&2
-    exit 1
-fi
-
-# Build the framed request (4-byte big-endian length prefix + JSON payload)
-PAYLOAD='{"id":"1","method":"get_secret_key","params":[{"role":"'"$ROLE"'"}]}'
-PAYLOAD_LEN=${#PAYLOAD}
-
-# Use printf to create the 4-byte length prefix and send via socat
-RESPONSE=$(printf '%08x' "$PAYLOAD_LEN" | xxd -r -p | cat - <(echo -n "$PAYLOAD") | \
-    socat -t5 - ABSTRACT-CONNECT:"$SOCKET" 2>/dev/null | tail -c +5)
-
-# Check for error
-if echo "$RESPONSE" | grep -q '"error"'; then
-    ERROR=$(echo "$RESPONSE" | grep -o '"message":"[^"]*"' | cut -d'"' -f4)
-    echo "n-os-tr-get-key: signer error: ${ERROR:-unknown}" >&2
-    exit 1
-fi
-
-# Extract the hex private key from the result field
-KEY=$(echo "$RESPONSE" | grep -oP '"result"\s*:\s*"[a-f0-9]{64}"' | grep -o '[a-f0-9]\{64\}')
-
-if [ -z "$KEY" ] || [ ${#KEY} -ne 64 ]; then
-    echo "n-os-tr-get-key: failed to extract valid key from response" >&2
-    exit 1
-fi
-
-echo "$KEY"

iso/config/includes.chroot/usr/local/bin/n-os-tr-render-didactyl-genesis

@@ -1,30 +0,0 @@
-#!/bin/sh
-# Render didactyl genesis.jsonc from n_signer-derived key
-# Usage: n-os-tr-render-didactyl-genesis <nostr_index>
-set -e
-
-NOSTR_INDEX="${1:?Usage: $0 <nostr_index>}"
-OUTDIR="/run/didactyl"
-OUTFILE="$OUTDIR/genesis.jsonc"
-
-# Get the hex secret key from n_signer
-HEX_KEY=$(/usr/local/bin/n-os-tr-get-key "$NOSTR_INDEX")
-
-if [ -z "$HEX_KEY" ] || [ ${#HEX_KEY} -ne 64 ]; then
-    echo "ERROR: failed to get valid key from n_signer (index=$NOSTR_INDEX)" >&2
-    exit 1
-fi
-
-mkdir -p "$OUTDIR"
-
-cat > "$OUTFILE" <<GENESIS_EOF
-{
-    // Auto-generated by n-os-tr-render-didactyl-genesis
-    // Key derived from n_signer at nostr_index=$NOSTR_INDEX
-    "nsec_hex": "$HEX_KEY",
-    "relays": ["ws://127.0.0.1:7777"]
-}
-GENESIS_EOF
-
-chmod 600 "$OUTFILE"
-echo "Rendered $OUTFILE (nostr_index=$NOSTR_INDEX)"

iso/config/includes.chroot/usr/local/bin/n-os-tr-smoketest

@@ -39,16 +39,6 @@ check() {
     fi
 }
 
-# framed JSON-RPC helper for n_signer abstract socket @n_os_tr
-rpc_call_nsigner() {
-    local payload="$1"
-    local payload_len
-    payload_len=${#payload}
-
-    printf '%08x' "$payload_len" | xxd -r -p | cat - <(printf '%s' "$payload") | \
-        socat -t3 - ABSTRACT-CONNECT:n_os_tr 2>/dev/null | tail -c +5
-}
-
 # -------------------- core section ----------------------
 section "core"
 
@@ -56,53 +46,9 @@ check "n-os-tr-firstboot active" systemctl is-active n-os-tr-firstboot.service
 check "n-os-tr-firstboot succeeded" \
     bash -c '[[ "$(systemctl show -p Result --value n-os-tr-firstboot.service)" == "success" ]]'
 check "firstboot marker exists" test -f /var/lib/n-os-tr/.provisioned
-check "ginxsom nsec exists" test -f /var/lib/n-os-tr/keys/ginxsom.nsec
 check "env file readable by www-data" \
     sudo -u www-data test -r /var/lib/n-os-tr/env
 
-# -------------------- n_signer integration ----------------------
-section "n_signer integration"
-
-SIGNER_RUNNING=0
-if pgrep -x n_signer >/dev/null 2>&1; then
-    pass "n_signer process running" "pgrep"
-    SIGNER_RUNNING=1
-else
-    skip "n_signer process running" "not running in this environment"
-    skip "@n_os_tr socket reachable" "signer absent"
-    skip "get_public_key(nostr_index=0, caller=uid:0) returns valid 64-hex" "signer absent"
-    skip "sign_event non-preapproved nostr_index denied/prompted" "signer absent"
-    printf "  (note: signer checks skipped because n_signer is not running)\n"
-fi
-
-if [[ "$SIGNER_RUNNING" -eq 1 ]]; then
-    if ss -xl 2>/dev/null | grep -q '@n_os_tr' || socat -u OPEN:/dev/null ABSTRACT-CONNECT:n_os_tr >/dev/null 2>&1; then
-        pass "@n_os_tr socket reachable" "ss/socat"
-    else
-        fail "@n_os_tr socket reachable" "abstract socket not visible/reachable"
-    fi
-
-    PUBKEY_RESP=$(rpc_call_nsigner '{"id":"smoke-pub","method":"get_public_key","params":[{"nostr_index":0}]}' || true)
-    PUBKEY=$(echo "$PUBKEY_RESP" | grep -oE '"result"\s*:\s*"[0-9a-f]{64}"' | grep -oE '[0-9a-f]{64}' | head -n1)
-    if [[ ${#PUBKEY} -eq 64 ]]; then
-        pass "get_public_key(nostr_index=0, caller=uid:0) returns valid 64-hex" "${PUBKEY:0:16}..."
-    else
-        fail "get_public_key(nostr_index=0, caller=uid:0) returns valid 64-hex" "response=${PUBKEY_RESP:-<empty>}"
-    fi
-
-    SIGN_REQ='{"id":"smoke-sign","method":"sign_event","params":[{"nostr_index":99,"event":{"kind":1,"created_at":1700000000,"tags":[],"content":"n-os-tr smoketest"}}]}'
-    SIGN_RESP=$(rpc_call_nsigner "$SIGN_REQ" || true)
-    if [[ -z "$SIGN_RESP" ]]; then
-        pass "sign_event non-preapproved nostr_index denied/prompted" "no immediate auto-allow response"
-    elif echo "$SIGN_RESP" | grep -qiE 'denied|prompt|"error"'; then
-        pass "sign_event non-preapproved nostr_index denied/prompted" "${SIGN_RESP:0:80}"
-    elif echo "$SIGN_RESP" | grep -q '"result"'; then
-        fail "sign_event non-preapproved nostr_index denied/prompted" "unexpected auto-allow result"
-    else
-        fail "sign_event non-preapproved nostr_index denied/prompted" "unexpected response=${SIGN_RESP:0:120}"
-    fi
-fi
-
 # -------------------- nginx + ginxsom --------------------
 section "blossom (nginx + ginxsom)"