Skip to content

Commit a8aa7c3

Browse files
vpzedvpzed
authored
adding evidence for Crucible AC-0 results (#4)
1 parent 445d72e commit a8aa7c3

1 file changed

Lines changed: 141 additions & 0 deletions

File tree

‎evidence/ac-0.md‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
# Crucible AC-0
2+
3+
## Positive
4+
5+
### Baseline
6+
7+
```sh
8+
❯ grep -Ev '^\s*#|^$' inventory/ubuntu-test.yaml
9+
vm_id: 500
10+
description: "Ubuntu 26.04 cloud image, managed by OpenTofu"
11+
cpu_cores: 2
12+
memory_mb: 4096
13+
disk_gb: 32
14+
ipv4:
15+
gateway:
16+
dns_servers:
17+
dns_domain:
18+
archive_snapshot: 20260721T000000Z
19+
packages:
20+
- unzip # needed by the bun ansible role
21+
- git # needed by the metafactory_arc ansible role (gh only Recommends it)
22+
- gh
23+
- tree
24+
ansible_roles: [nats_server, bun, claude, docker, metafactory_arc]
25+
tags: ["ubuntu"]
26+
27+
❯ grep -Ev '^\s+#|^$' ansible/roles/{nats_server,bun,claude,docker,metafactory_arc}/defaults/main.yaml
28+
ansible/roles/nats_server/defaults/main.yaml:# Pinned fleet-wide; verified against the upstream SHA256SUMS at download.
29+
ansible/roles/nats_server/defaults/main.yaml:nats_server_version: "2.14.4"
30+
ansible/roles/bun/defaults/main.yaml:# Pinned fleet-wide; verified against the upstream SHASUMS256.txt at download.
31+
ansible/roles/bun/defaults/main.yaml:bun_version: "1.3.14"
32+
ansible/roles/claude/defaults/main.yaml:# Pinned fleet-wide; the binary is verified against the checksum in the
33+
ansible/roles/claude/defaults/main.yaml:# release's own manifest.json before the vendor installer runs.
34+
ansible/roles/claude/defaults/main.yaml:claude_version: "2.1.221"
35+
ansible/roles/docker/defaults/main.yaml:# download.docker.com has no snapshot service, so a VM's archive_snapshot
36+
ansible/roles/docker/defaults/main.yaml:# cannot pin these; the explicit versions below (epoch included) are the pin.
37+
ansible/roles/docker/defaults/main.yaml:# Current versions: apt-cache madison docker-ce on a guest, or the Version:
38+
ansible/roles/docker/defaults/main.yaml:# fields in
39+
ansible/roles/docker/defaults/main.yaml:# https://download.docker.com/linux/ubuntu/dists/resolute/stable/binary-amd64/Packages
40+
ansible/roles/docker/defaults/main.yaml:docker_packages:
41+
ansible/roles/docker/defaults/main.yaml: - docker-ce=5:29.7.1-1~ubuntu.26.04~resolute
42+
ansible/roles/docker/defaults/main.yaml: - docker-ce-cli=5:29.7.1-1~ubuntu.26.04~resolute
43+
ansible/roles/docker/defaults/main.yaml: - containerd.io=2.2.6-1~ubuntu.26.04~resolute
44+
ansible/roles/docker/defaults/main.yaml: - docker-compose-plugin=5.3.1-1~ubuntu.26.04~resolute
45+
ansible/roles/docker/defaults/main.yaml: - docker-buildx-plugin=0.36.1-1~ubuntu.26.04~resolute
46+
ansible/roles/docker/defaults/main.yaml: - docker-ce-rootless-extras=5:29.7.2-1~ubuntu.26.04~resolute
47+
ansible/roles/docker/defaults/main.yaml:# Docker's signing key, pinned by full fingerprint: a bare signed-by URL
48+
ansible/roles/docker/defaults/main.yaml:# would trust whatever download.docker.com serves.
49+
ansible/roles/docker/defaults/main.yaml:docker_gpg_fingerprint: "9DC858229FC7DD38854AE2D88D81803C0EBFCD88"
50+
ansible/roles/metafactory_arc/defaults/main.yaml:# Pinned fleet-wide; installed from the tagged release of the git repo, so
51+
ansible/roles/metafactory_arc/defaults/main.yaml:# the tag is the verification for arc's own source. From 0.45.0 arc tracks
52+
ansible/roles/metafactory_arc/defaults/main.yaml:# its bun.lock, so its dependency tree is pinned too and the role installs
53+
ansible/roles/metafactory_arc/defaults/main.yaml:# with --frozen-lockfile.
54+
ansible/roles/metafactory_arc/defaults/main.yaml:metafactory_arc_version: "0.45.0"
55+
```
56+
57+
Destroy/create
58+
59+
```sh
60+
❯ ./scripts/vm-fingerprint.sh ubuntu@<vm-ip> fingerprints/ubuntu-test.txt
61+
fingerprint written to fingerprints/ubuntu-test.txt
62+
##### DIGESTS #####
63+
core sha256:cecf2948f2adbd7e54c1667465393a4f2983e7801ca8f6ce786f04dc6913dbfb
64+
provider sha256:0b63ff004e7aa8bb397d8f3cfb4e09eb37ca9e5bc3de71637aa8cbfefaaf533c
65+
combined sha256:3c099f378d48c5d00e02b1c8f2d8af18ccefa59dc5b2d89f52443ea97e781bd0
66+
67+
❯ git diff fingerprints/ubuntu-test.txt
68+
69+
❯
70+
```
71+
72+
---
73+
74+
## Negative
75+
76+
Starting from same baseline
77+
78+
### Change
79+
80+
NATS server version changed from 2.14.4 to 2.14.5
81+
82+
```sh
83+
❯ vi ansible/roles/nats_server/defaults/main.yaml
84+
85+
❯ cat ansible/roles/nats_server/defaults/main.yaml
86+
# Pinned fleet-wide; verified against the upstream SHA256SUMS at download.
87+
nats_server_version: "2.14.5"
88+
```
89+
90+
### Fingerprint result
91+
92+
Destroy/create
93+
94+
```sh
95+
❮ ./scripts/vm-fingerprint.sh ubuntu@<vm-ip> fingerprints/ubuntu-test.txt
96+
fingerprint written to fingerprints/ubuntu-test.txt
97+
##### DIGESTS #####
98+
core sha256:b54df67b4df039cb6a63adc00fb8384f5dc604fc944780162a701d9f0e2eb576
99+
provider sha256:0b63ff004e7aa8bb397d8f3cfb4e09eb37ca9e5bc3de71637aa8cbfefaaf533c
100+
combined sha256:aa15a8f0781be64c44781cb6ce43276c3826be31994d2e32a5fecf3c734dd996
101+
102+
❯ git diff
103+
diff --git a/ansible/roles/nats_server/defaults/main.yaml b/ansible/roles/nats_server/defaults/main.yaml
104+
index 714cfa1..3ffc84a 100644
105+
--- a/ansible/roles/nats_server/defaults/main.yaml
106+
+++ b/ansible/roles/nats_server/defaults/main.yaml
107+
@@ -1,2 +1,2 @@
108+
# Pinned fleet-wide; verified against the upstream SHA256SUMS at download.
109+
-nats_server_version: "2.14.4"
110+
+nats_server_version: "2.14.5"
111+
diff --git a/fingerprints/ubuntu-test.txt b/fingerprints/ubuntu-test.txt
112+
index 6e1ebc1..f0e55ee 100644
113+
--- a/fingerprints/ubuntu-test.txt
114+
+++ b/fingerprints/ubuntu-test.txt
115+
@@ -1858,11 +1858,11 @@ e39090ffe9c45c59082c3746e2aa2546dc53e3c5eeb4ad83f8210be7e2e58022 .bun/install/c
116+
a757e3b924af184b25e2386d1678b1fe341805a516ebf9bccee219b47aebd5e7 .bun/install/cache/yaml@2.9.0@@@1/dist/visit.js
117+
20b8b197cbd10dad245d45e463dfe58e4c8c25a47e24bc4256ad9ab58bf35683 .bun/install/cache/yaml@2.9.0@@@1/package.json
118+
2f1db26f6cc426ef698210b592f40cec49be1b6c4b34e7f2d61904786242bd85 .bun/install/cache/yaml@2.9.0@@@1/util.js
119+
-4b0bb1385667f2189814e6ac37bbe82d67da8ee3e81af61c316032319a48d11d .local/bin/nats-server
120+
+e1a2f9ba25077f4cf753bee829483bd68fbf0a4eec9b6645a1e5785a6de0c0d1 .local/bin/nats-server
121+
60db8e88d42c24b5199c92cfd56ec88370c510c3789c6f364af748354f087ada .local/share/claude/versions/2.1.221
122+
123+
===== layer2 versions =====
124+
-nats-server: v2.14.4
125+
+nats-server: v2.14.5
126+
1.3.14
127+
/home/ubuntu/.local/share/claude/versions/2.1.221
128+
../install/global/node_modules/arc/src/cli.ts
129+
@@ -1897,6 +1897,6 @@ status: done
130+
nocloud
131+
132+
##### DIGESTS #####
133+
-core sha256:cecf2948f2adbd7e54c1667465393a4f2983e7801ca8f6ce786f04dc6913dbfb
134+
+core sha256:b54df67b4df039cb6a63adc00fb8384f5dc604fc944780162a701d9f0e2eb576
135+
provider sha256:0b63ff004e7aa8bb397d8f3cfb4e09eb37ca9e5bc3de71637aa8cbfefaaf533c
136+
-combined sha256:3c099f378d48c5d00e02b1c8f2d8af18ccefa59dc5b2d89f52443ea97e781bd0
137+
+combined sha256:aa15a8f0781be64c44781cb6ce43276c3826be31994d2e32a5fecf3c734dd996
138+
139+
❯
140+
```
141+

0 commit comments

Comments
 (0)