# A function so callers can RE-snapshot after in-pass ledger writers (the # cutover conversion appends its converted entry mid-script; replay must # fold that entry in the same pass, not next boot). snapshot_os_intent_ledger() { rm -f "$ledger_snapshot" "$ledger_snapshot.sha256" "$ledger_snapshot.skipped-bytes" # Existence pre-check is NOISE control only (quiet fresh-VM boots); the # python open owns enforcement, so a race here changes nothing. -e follows # symlinks, so a DANGLING guest-planted symlink must also pass the gate via # -L and reach the python open — that is what turns the plant into the loud # tamper message instead of a silent healthy-looking skip. if [ -e "$ledger_source" ] || [ -L "$ledger_source" ]; then snap_rc=0 python3 - "$ledger_source" "$ledger_snapshot" <<'PYSNAP' 2>/dev/null || snap_rc=$? import hashlib, os, stat, sys src, dst = sys.argv[1], sys.argv[2] try: fd = os.open(src, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK) except OSError: sys.exit(3) try: if not stat.S_ISREG(os.fstat(fd).st_mode): sys.exit(4) hasher = hashlib.sha256() retain = 16 * 1024 * 1024 ceiling = 64 * 1024 * 1024 hashed = 0 skipped = 0 out = os.open(dst, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600) try: while True: chunk = os.read(fd, 1 << 20) if not chunk: break hashed += len(chunk) if hashed > ceiling: sys.exit(5) hasher.update(chunk) take = chunk[:retain] if retain > 0 else b"" if take: os.write(out, take) retain -= len(take) skipped += len(chunk) - len(take) finally: os.close(out) if skipped: with open(dst + ".skipped-bytes", "w") as sidecar: sidecar.write("%d\n" % skipped) with open(dst + ".sha256", "w") as sidecar: sidecar.write(hasher.hexdigest() + "\n") finally: os.close(fd) PYSNAP

# Reconcile guest packages via hatch-manifest, run INSIDE the live cell. # # hatch-manifest maybe-apply compares the manifest fingerprint against a state # file: identical -> exits ~1ms; changed -> applies the package delta via apt # (through the cell's Sentinel egress). # # hatch-manifest and runtime-cell.kdl are image-vendored under # /opt/hatch-image/bin (the cell binds it read-only; see htch-runtime.nspawn). # Older bundle-era layouts shipped them under /opt/hatch/bin, kept here as a # fallback. Resolve each from the new home first. # # Prefer the /opt/hatch-image/manifests dir layout when present (bind it into the # cell once that diff lands); otherwise fall back to the single-file # runtime-cell.kdl resolved from /opt/hatch-image/bin (or legacy /opt/hatch/bin). # The manifests branch is kept so the cutover to the dir layout is a no-op here. in_cell_reconcile=' set -eu # Memory containment (see the maintenance-leaf note above: cgroup bounds # cannot reach this subtree). RLIMIT_AS, inherited by every child this # shell spawns — hatch-manifest, apt, dpkg, their methods. 3GiB of address # space never troubles a legitimate reconcile (normal apt peaks a few # hundred MB) but kills the degenerate multi-GB runs (observed 6.5G RSS, # SEV S698078) with a clean allocation failure — a nonzero exit and a # retry, never a guest-wide OOM hunt. Fail-open where unsupported. ulimit -v 3145728 2>/dev/null || true # Heal an interrupted dpkg BEFORE the reconcile, not only before the replay: # the reconcile runs first in every pass, so without this arm a pass that # died mid-dpkg would fail its NEXT manifest apply too (one wasted pass and # one wasted strike) before the replay-side heal repaired the db. Fast no-op # on a clean db; a failure here just lets the apply fail loudly as before. nice -n 10 ionice -c3 env DEBIAN_FRONTEND=noninteractive dpkg --configure -a >/dev/null 2>&1 || true manifest_bin= for cand in /opt/hatch-image/bin/hatch-manifest /opt/hatch/bin/hatch-manifest; do if [ -x "$cand" ]; then manifest_bin="$cand" break fi done if [ -z "$manifest_bin" ]; then echo "preflight-opportunistic: hatch-manifest missing in cell" >&2 exit 1 fi # Deliberately NO lock-file removal here: apt/dpkg fcntl locks die with # their process, so a stale lock cannot persist — while unlinking a LIVE # lock detaches it from its path and lets a second dpkg start against the # same database (status-db corruption). A lock-blocked run below just # fails this opportunistic pass and retries on the next cell restart. manifest_kdl= for cand in /opt/hatch-image/bin/runtime-cell.kdl /opt/hatch/bin/runtime-cell.kdl; do if [ -f "$cand" ]; then manifest_kdl="$cand" break fi done