@forgezero/agent 0.1.13 → 0.1.14

package/dist/fz-agent.js

@@ -1732,12 +1732,13 @@ function guestBootstrapScript(profile, attested = Boolean(profile.confidential),
   const agentBun = "/usr/local/lib/forgezero/bun";
   const attestationSetup = attested ? `# The report device is not part of the encryption path, so a guest can appear
 # healthy and encrypted while attestation is silently impossible. Install and
-# load the exact running-kernel module before the agent is allowed to start.
-DEBIAN_FRONTEND=noninteractive apt-get install -y linux-image-generic "linux-modules-extra-$(uname -r)"
+# load the driver shipped by the one pinned image before the agent starts. Do
+# not ask an evolving apt repository for an exact old kernel package: the image
+# can keep booting after Canonical removes that package from the mirror.
+if [[ ! -c /dev/sev-guest ]]; then modprobe sev-guest; fi
+test -c /dev/sev-guest
 printf 'sev-guest
 ' >/etc/modules-load.d/sev-guest.conf
-modprobe sev-guest
-test -c /dev/sev-guest
 ` : "";
   return `#!/usr/bin/env bash
 set -Eeuo pipefail
@@ -1926,7 +1927,7 @@ ethernets:
   primary:
     match: { name: "en*" }
     addresses: [ ${manifest.address}/24 ]
-    gateway4: ${profile.gateway}
+    routes: [ { to: default, via: ${profile.gateway} } ]
     nameservers: { addresses: [${(profile.nameservers ?? ["1.1.1.1", "9.9.9.9"]).join(", ")}] }
 `
   };
@@ -2712,7 +2713,7 @@ async function applyMetalIsolation(profile, exec = defaultExec) {
 }
 
 // src/version.ts
-var VERSION = "0.1.13";
+var VERSION = "0.1.14";
 
 // src/index.ts
 function loadOrCreateSeed(path) {

package/dist/fz.js

@@ -781,7 +781,7 @@ async function resolveIdentity(selector, socketPath) {
 }
 
 // src/version.ts
-var VERSION = "0.1.13";
+var VERSION = "0.1.14";
 
 // src/cli/index.ts
 var DEFAULT_MODE = THRESHOLD_MODES[0].id;

package/dist/metal-helper-socket.js

@@ -728,12 +728,13 @@ function guestBootstrapScript(profile, attested = Boolean(profile.confidential),
   const agentBun = "/usr/local/lib/forgezero/bun";
   const attestationSetup = attested ? `# The report device is not part of the encryption path, so a guest can appear
 # healthy and encrypted while attestation is silently impossible. Install and
-# load the exact running-kernel module before the agent is allowed to start.
-DEBIAN_FRONTEND=noninteractive apt-get install -y linux-image-generic "linux-modules-extra-$(uname -r)"
+# load the driver shipped by the one pinned image before the agent starts. Do
+# not ask an evolving apt repository for an exact old kernel package: the image
+# can keep booting after Canonical removes that package from the mirror.
+if [[ ! -c /dev/sev-guest ]]; then modprobe sev-guest; fi
+test -c /dev/sev-guest
 printf 'sev-guest
 ' >/etc/modules-load.d/sev-guest.conf
-modprobe sev-guest
-test -c /dev/sev-guest
 ` : "";
   return `#!/usr/bin/env bash
 set -Eeuo pipefail
@@ -922,7 +923,7 @@ ethernets:
   primary:
     match: { name: "en*" }
     addresses: [ ${manifest.address}/24 ]
-    gateway4: ${profile.gateway}
+    routes: [ { to: default, via: ${profile.gateway} } ]
     nameservers: { addresses: [${(profile.nameservers ?? ["1.1.1.1", "9.9.9.9"]).join(", ")}] }
 `
   };

package/dist/metal-provision.js

@@ -728,12 +728,13 @@ function guestBootstrapScript(profile, attested = Boolean(profile.confidential),
   const agentBun = "/usr/local/lib/forgezero/bun";
   const attestationSetup = attested ? `# The report device is not part of the encryption path, so a guest can appear
 # healthy and encrypted while attestation is silently impossible. Install and
-# load the exact running-kernel module before the agent is allowed to start.
-DEBIAN_FRONTEND=noninteractive apt-get install -y linux-image-generic "linux-modules-extra-$(uname -r)"
+# load the driver shipped by the one pinned image before the agent starts. Do
+# not ask an evolving apt repository for an exact old kernel package: the image
+# can keep booting after Canonical removes that package from the mirror.
+if [[ ! -c /dev/sev-guest ]]; then modprobe sev-guest; fi
+test -c /dev/sev-guest
 printf 'sev-guest
 ' >/etc/modules-load.d/sev-guest.conf
-modprobe sev-guest
-test -c /dev/sev-guest
 ` : "";
   return `#!/usr/bin/env bash
 set -Eeuo pipefail
@@ -922,7 +923,7 @@ ethernets:
   primary:
     match: { name: "en*" }
     addresses: [ ${manifest.address}/24 ]
-    gateway4: ${profile.gateway}
+    routes: [ { to: default, via: ${profile.gateway} } ]
     nameservers: { addresses: [${(profile.nameservers ?? ["1.1.1.1", "9.9.9.9"]).join(", ")}] }
 `
   };

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.13";
+export declare const VERSION = "0.1.14";

package/package.json

@@ -1,7 +1,7 @@
 {
 	"//": "Publishing happens from an operator's machine, not CI \u2014 CLAUDE.md records that the absence of CI is deliberate. npm's `provenance` attests a tarball was built by a recognised CI provider from a named commit, so it cannot be produced here: it was set, and the first publish failed with `Automatic provenance generation not supported for provider: null`. A setting that can never be satisfied is worse than none, because it reads as a guarantee nobody is getting. Restore it the day this publishes from CI, and not before.",
 	"name": "@forgezero/agent",
-	"version": "0.1.13",
+	"version": "0.1.14",
 	"type": "module",
 	"scripts": {
 		"check": "tsc --noEmit",