@forgezero/agent 0.1.40 → 0.1.42

package/dist/git-ssh.d.ts

@@ -0,0 +1,5 @@
+#!/usr/bin/env bun
+export declare class GitSshError extends Error {
+}
+export declare function gitSshArgv(args: readonly string[]): string[];
+export declare function runGitSsh(args?: string[]): Promise<number>;

package/dist/guest-enrolment.d.ts

@@ -29,6 +29,8 @@ export interface GuestEnrolmentOptions {
     keys: NodeKeyPair;
     label?: string;
     gitDeployPublicKey?: string;
+    /** Public half of the runner-only SSH identity; safe to show for authorized_keys. */
+    bootstrapSshPublicKey?: string;
     privateNetworkAttachment?: GuestPrivateNetworkAttachment;
     /** Stable API ingress identity; signed with the rest of the enrolment body. */
     edgeHostname?: string;

package/dist/guest-enrolment.js

@@ -147,6 +147,7 @@ async function enrolGuestIdentity(options) {
     token,
     label: options.label,
     gitDeployPublicKey: options.gitDeployPublicKey,
+    bootstrapSshPublicKey: options.bootstrapSshPublicKey,
     privateNetworkAttachment: options.privateNetworkAttachment,
     edgeHostname: options.edgeHostname?.trim() || undefined,
     publicKeys: {

package/dist/host-maintenance.d.ts

@@ -0,0 +1,39 @@
+export type HostMaintenanceOperation = 'transactions' | 'schema-plan' | 'schema-apply';
+export interface HostMaintenanceRequest {
+    operation: HostMaintenanceOperation;
+    prepareBlankFzTest?: boolean;
+    confirmation?: string;
+    fenceEvidencePath?: string;
+}
+export interface HostMaintenancePlan {
+    operation: HostMaintenanceOperation;
+    mutation: boolean;
+    activeSlot: 'blue' | 'green';
+    workingDirectory: string;
+    unit: string;
+    credentialNames: readonly string[];
+    argv: readonly string[];
+}
+export interface HostMaintenanceResult {
+    plan: HostMaintenancePlan;
+    exitCode: number;
+    output: string;
+}
+export interface HostMaintenanceRuntime {
+    uid(): number;
+    read(path: string): string;
+    inspect(path: string): {
+        regular: boolean;
+        symbolic: boolean;
+        uid: number;
+        links: number;
+        mode: number;
+        size: number;
+    };
+    exec(argv: readonly string[]): Promise<{
+        exitCode: number;
+        output: string;
+    }>;
+}
+export declare function planHostMaintenance(request: HostMaintenanceRequest, runtime?: HostMaintenanceRuntime): HostMaintenancePlan;
+export declare function applyHostMaintenance(request: HostMaintenanceRequest, runtime?: HostMaintenanceRuntime): Promise<HostMaintenanceResult>;

package/dist/host-maintenance.js

@@ -0,0 +1,135 @@
+// @bun
+// src/host-maintenance.ts
+import { lstatSync, readFileSync } from "fs";
+var ROOT = "/opt/forgezero";
+var SLOT_FILE = `${ROOT}/.forge-slot`;
+var SHARED_ENV = `${ROOT}/shared/.env`;
+var JWT = "/etc/forgezero/creds/arangodb-jwt.cred";
+var FZ = "/usr/local/bin/fz";
+var localRuntime = () => ({
+  uid: () => process.getuid?.() ?? -1,
+  read: (path) => readFileSync(path, "utf8"),
+  inspect(path) {
+    const value = lstatSync(path);
+    return {
+      regular: value.isFile(),
+      symbolic: value.isSymbolicLink(),
+      uid: value.uid,
+      links: value.nlink,
+      mode: value.mode,
+      size: value.size
+    };
+  },
+  async exec(argv) {
+    const child = Bun.spawn([...argv], { stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited
+    ]);
+    return { exitCode, output: `${stdout}${stderr}`.slice(0, 256 * 1024) };
+  }
+});
+var trustedFile = (runtime, path, label, modeMask, max) => {
+  const metadata = runtime.inspect(path);
+  if (!metadata.regular || metadata.symbolic || metadata.uid !== 0 || metadata.links !== 1 || (metadata.mode & modeMask) !== 0 || metadata.size < 1 || metadata.size > max) {
+    throw new Error(`${label} is not a trusted root-owned regular file`);
+  }
+};
+function activeSlot(runtime) {
+  trustedFile(runtime, SLOT_FILE, "active slot marker", 18, 64);
+  const slot = runtime.read(SLOT_FILE).trim();
+  if (slot !== "blue" && slot !== "green")
+    throw new Error("active slot marker must be blue or green");
+  return slot;
+}
+var confirmation = (value) => {
+  if (!value || !/^apply-schema-consolidation-fz-[a-f0-9]{64}$/.test(value)) {
+    throw new Error("schema apply requires the exact fz plan confirmation");
+  }
+  return value;
+};
+function planHostMaintenance(request, runtime = localRuntime()) {
+  if (!["transactions", "schema-plan", "schema-apply"].includes(request.operation)) {
+    throw new Error("unsupported host maintenance operation");
+  }
+  const slot = activeSlot(runtime);
+  const workingDirectory = `${ROOT}/slots/${slot}`;
+  const common = [
+    "/usr/bin/systemd-run",
+    "--quiet",
+    "--wait",
+    "--pipe",
+    "--collect",
+    `--unit=forgezero-${request.operation}`,
+    "--property=User=forgezero",
+    `--property=WorkingDirectory=${workingDirectory}`,
+    `--property=EnvironmentFile=${SHARED_ENV}`,
+    "--property=Environment=NODE_ENV=production",
+    `--property=LoadCredentialEncrypted=arangodb-jwt:${JWT}`
+  ];
+  let child;
+  const credentials = ["arangodb-jwt"];
+  if (request.operation === "transactions") {
+    if (request.confirmation || request.fenceEvidencePath)
+      throw new Error("transaction rehearsal does not accept schema coordinates");
+    child = [
+      "--property=Environment=FZ_DATABASE_MODE=test",
+      "--property=Environment=ARANGO_DB=fz_test",
+      FZ,
+      "rehearse",
+      "transactions",
+      "--root",
+      workingDirectory,
+      "--confirm-staging-fz-test",
+      ...request.prepareBlankFzTest ? ["--prepare-blank-fz-test"] : []
+    ];
+  } else if (request.operation === "schema-plan") {
+    if (request.prepareBlankFzTest || request.confirmation || request.fenceEvidencePath) {
+      throw new Error("schema plan accepts no mutation coordinates");
+    }
+    child = [FZ, "db", "consolidate", "--root", workingDirectory, "--json"];
+  } else {
+    if (request.prepareBlankFzTest)
+      throw new Error("schema apply does not accept staging preparation");
+    const evidence = request.fenceEvidencePath;
+    if (!evidence?.startsWith("/") || /[\r\n:]/.test(evidence))
+      throw new Error("schema apply requires an absolute fence-evidence path");
+    trustedFile(runtime, evidence, "schema fence evidence", 63, 2 * 1024 * 1024);
+    credentials.push("schema-fence-evidence");
+    child = [
+      "--property=Environment=FZ_RECOVERY_FLEET_FENCED=all-api-and-scheduler-replicas-are-stopped",
+      `--property=LoadCredential=schema-fence-evidence:${evidence}`,
+      FZ,
+      "db",
+      "consolidate",
+      "--root",
+      workingDirectory,
+      "--json",
+      "--apply",
+      `--confirm=${confirmation(request.confirmation)}`
+    ];
+  }
+  return {
+    operation: request.operation,
+    mutation: request.operation !== "schema-plan",
+    activeSlot: slot,
+    workingDirectory,
+    unit: `forgezero-${request.operation}`,
+    credentialNames: credentials,
+    argv: [...common, ...child]
+  };
+}
+async function applyHostMaintenance(request, runtime = localRuntime()) {
+  if (runtime.uid() !== 0)
+    throw new Error("fz host --apply must run as root");
+  const plan = planHostMaintenance(request, runtime);
+  const result = await runtime.exec(plan.argv);
+  if (result.exitCode !== 0)
+    throw new Error(`host maintenance failed (${result.exitCode}): ${result.output.trim()}`);
+  return { plan, ...result };
+}
+export {
+  planHostMaintenance,
+  applyHostMaintenance
+};

package/dist/index.d.ts

@@ -18,8 +18,8 @@ export type { DeploymentPullOptions, RemoteDeploymentClaim, PullResult } from '.
 export { pullProvisioningOnce, startProvisioningPull } from './provisioning-pull';
 export type { CreateRemoteProvisionClaim, ProvisioningPullOptions, RemoteProvisionClaim, GuestAccess, ProvisionPullResult, ProvisionRunner, ProvisionResult } from './provisioning-pull';
 export { pullMigrationOnce, startMigrationPull } from './migration-pull';
-export { executeSshBootstrap, pullSshBootstrapOnce, startSshBootstrapPull } from './ssh-bootstrap';
-export type { RemoteSshBootstrapClaim, SshBootstrapPullOptions, SshBootstrapResult } from './ssh-bootstrap';
+export { executeMetalAdmission, executeSshBootstrap, pullMetalAdmissionOnce, pullSshBootstrapOnce, startMetalAdmissionPull, startSshBootstrapPull } from './ssh-bootstrap';
+export type { MetalAdmissionProof, MetalAdmissionResult, RemoteMetalAdmissionClaim, RemoteSshBootstrapClaim, SshBootstrapPullOptions, SshBootstrapResult } from './ssh-bootstrap';
 export type { MigrationAction, MigrationEvidence, MigrationNetwork, MigrationPullOptions, MigrationPullResult, RemoteMigrationClaim } from './migration-pull';
 export { enrolGuestIdentity, loadGuestBinding } from './guest-enrolment';
 export type { GuestBinding, GuestEnrolmentOptions } from './guest-enrolment';
@@ -32,6 +32,8 @@ export { DEFAULT_METAL_HELPER_SOCKET, requestMetalProvision, startMetalHelper }
 export { DEFAULT_LIFECYCLE_HELPER_SOCKET, executeLifecycleAction, loadLifecycleProfile, requestLifecycleAction, startLifecycleHelper, validateLifecycleProfile } from './lifecycle-helper';
 export type { LifecycleCommandResult, LifecycleExec, LifecycleProfile } from './lifecycle-helper';
 export { materializeWarpMdm, renderWarpMdm } from './warp-config';
+export { configureMeshConnector, readMeshConnectorCredential } from './mesh-connector';
+export type { MeshConnectorCommandResult, MeshConnectorExec } from './mesh-connector';
 export { compareVersions, restoreAgentRelease, selectAgentRelease, stageAgentRelease, validateAgentRelease, DEFAULT_AGENT_RELEASE_ROOT, DEFAULT_AGENT_UPDATE_SOCKET, MAX_AGENT_TARBALL_BYTES } from './agent-update';
 export type { AgentRelease, StagedAgentRelease, UpdateCommand, UpdateCommandResult } from './agent-update';
 export { activateAgentRelease, probeAgentSocket, readAgentUpdateReceipt, recoverInterruptedAgentUpdate, requestAgentUpdate, startAgentUpdateHelper, AGENT_UPDATE_GROUP, AGENT_UPDATE_HELPER_UNIT_PATH, AGENT_UPDATE_JOURNAL, AGENT_UPDATE_RECEIPT } from './agent-update-helper';

package/dist/mesh-connector.d.ts

@@ -0,0 +1,16 @@
+export interface MeshConnectorCommandResult {
+    exitCode: number;
+    output: string;
+}
+export type MeshConnectorExec = (argv: readonly string[]) => Promise<MeshConnectorCommandResult>;
+/** Read one systemd credential without accepting an arbitrary filesystem path. */
+export declare function readMeshConnectorCredential(name?: string): string;
+/**
+ * Register and connect one Cloudflare Mesh node. The management API token is
+ * never present; this consumes only the connector-specific registration token
+ * returned by the attended bootstrap.
+ */
+export declare function configureMeshConnector(input: {
+    token: string;
+    exec: MeshConnectorExec;
+}): Promise<void>;

package/dist/mesh-connector.js

@@ -0,0 +1,46 @@
+// src/mesh-connector.ts
+import { constants, closeSync, fstatSync, openSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+var TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
+function readMeshConnectorCredential(name = "CF_WARP_CONNECTOR_TOKEN") {
+  if (!/^[A-Z_][A-Z0-9_]{0,63}$/.test(name))
+    throw new Error("Mesh connector credential name is invalid");
+  const directory = process.env.CREDENTIALS_DIRECTORY;
+  if (!directory?.startsWith("/run/credentials/"))
+    throw new Error("Mesh connector requires a systemd credential directory");
+  const path = join(directory, name);
+  let descriptor;
+  try {
+    descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const metadata = fstatSync(descriptor);
+    if (!metadata.isFile() || metadata.nlink !== 1 || metadata.size < 40 || metadata.size > 16384) {
+      throw new Error("Mesh connector systemd credential is malformed");
+    }
+    const token = readFileSync(descriptor, "utf8").trim();
+    if (!TOKEN.test(token))
+      throw new Error("Mesh connector systemd credential is malformed");
+    return token;
+  } finally {
+    if (descriptor !== undefined)
+      closeSync(descriptor);
+  }
+}
+async function configureMeshConnector(input) {
+  if (!TOKEN.test(input.token))
+    throw new Error("Mesh connector token is malformed");
+  const registration = await input.exec(["/usr/bin/warp-cli", "--accept-tos", "connector", "new", input.token]);
+  if (registration.exitCode !== 0 && !/already|registered/i.test(registration.output)) {
+    throw new Error("Cloudflare Mesh connector registration failed");
+  }
+  const connected = await input.exec(["/usr/bin/warp-cli", "--accept-tos", "connect"]);
+  if (connected.exitCode !== 0)
+    throw new Error("Cloudflare Mesh connector connect failed");
+  const status = await input.exec(["/usr/bin/warp-cli", "--accept-tos", "status"]);
+  if (status.exitCode !== 0 || !/\bconnected\b/i.test(status.output) || /\bdisconnected\b/i.test(status.output)) {
+    throw new Error("Cloudflare Mesh connector did not become connected");
+  }
+}
+export {
+  readMeshConnectorCredential,
+  configureMeshConnector
+};

package/dist/metal-bootstrap.js

@@ -233,7 +233,6 @@ async function applyMetalIsolation(profile, exec = defaultExec) {
 }
 
 // src/egress-policy.ts
-var AGENT_EGRESS_TABLE = "forgezero_agent_egress";
 var SYSTEMD_RESOLVED_ADDRESS = "127.0.0.53";
 var BLOCKED_IPV4 = [
   "0.0.0.0/8",
@@ -293,7 +292,137 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.40";
+var VERSION = "0.1.42";
+
+// src/otel-collector.ts
+var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
+var FORGEZERO_OTEL_COLLECTOR_VERSION = "0.157.0";
+var FORGEZERO_OTEL_COLLECTOR_SHA256 = "2937cf24892af55b143c072fddece17862239cf78280620029276493eb81beae";
+var ARCHIVE = "/run/forgezero-otelcol.tar.gz";
+var EXTRACT = "/run/forgezero-otelcol-release";
+var BINARY = "/usr/local/lib/forgezero/otelcol/otelcol";
+var CONFIG = "/etc/forgezero/otelcol.yaml";
+var UNIT = `/etc/systemd/system/${FORGEZERO_OTEL_COLLECTOR_UNIT}`;
+var checked2 = async (host, argv) => {
+  const result = await host.exec(argv);
+  const output = `${result.output ?? result.stdout ?? ""}${result.stderr ?? ""}`;
+  if (result.exitCode !== 0)
+    throw new Error(`OTLP collector operation failed: ${argv.join(" ")}${output.trim() ? `: ${output.trim()}` : ""}`);
+  return output.trim();
+};
+var destination = (value) => {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("OTLP collector export endpoint must be an absolute HTTPS URL");
+  }
+  if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.port && url.port !== "443") {
+    throw new Error("OTLP collector export endpoint must be credential-free HTTPS");
+  }
+  return url.toString().replace(/\/$/, "");
+};
+function renderForgeZeroOtelCollector(exportEndpoint) {
+  const endpoint = destination(exportEndpoint);
+  return {
+    config: `receivers:
+  otlp:
+    protocols:
+      http:
+        endpoint: 127.0.0.1:4318
+exporters:
+  otlphttp:
+    endpoint: ${JSON.stringify(endpoint)}
+service:
+  telemetry:
+    metrics:
+      address: 127.0.0.1:8888
+  pipelines:
+    traces:
+      receivers: [otlp]
+      exporters: [otlphttp]
+    metrics:
+      receivers: [otlp]
+      exporters: [otlphttp]
+    logs:
+      receivers: [otlp]
+      exporters: [otlphttp]
+`,
+    unit: `[Unit]
+Description=ForgeZero independently supervised OpenTelemetry Collector
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=forgezero-otel
+Group=forgezero-otel
+ExecStart=${BINARY} --config=${CONFIG}
+Restart=always
+RestartSec=2
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+`
+  };
+}
+async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
+  const rendered = renderForgeZeroOtelCollector(exportEndpoint);
+  const observed = await host.exec([BINARY, "--version"]);
+  const versionOutput = `${observed.output ?? observed.stdout ?? ""}${observed.stderr ?? ""}`;
+  if (observed.exitCode !== 0 || !versionOutput.includes(`otelcol version ${FORGEZERO_OTEL_COLLECTOR_VERSION}`)) {
+    await checked2(host, [
+      "/usr/bin/curl",
+      "--fail",
+      "--silent",
+      "--show-error",
+      "--location",
+      "--proto",
+      "=https",
+      "--output",
+      ARCHIVE,
+      `https://github.com/open-telemetry/opentelemetry-collector-releases/releases/download/v${FORGEZERO_OTEL_COLLECTOR_VERSION}/otelcol_${FORGEZERO_OTEL_COLLECTOR_VERSION}_linux_amd64.tar.gz`
+    ]);
+    const digest = (await checked2(host, ["/usr/bin/sha256sum", ARCHIVE])).split(/\s+/)[0];
+    if (digest !== FORGEZERO_OTEL_COLLECTOR_SHA256)
+      throw new Error("OTLP collector archive checksum mismatch");
+    await checked2(host, ["/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/otelcol", EXTRACT]);
+    await checked2(host, ["/usr/bin/tar", "-xzf", ARCHIVE, "-C", EXTRACT, "otelcol"]);
+    await checked2(host, ["/usr/bin/install", "-m", "0755", `${EXTRACT}/otelcol`, BINARY]);
+    await checked2(host, ["/usr/bin/rm", "-f", ARCHIVE, `${EXTRACT}/otelcol`]);
+  }
+  if ((await host.exec(["/usr/bin/getent", "group", "forgezero-otel"])).exitCode !== 0) {
+    await checked2(host, ["/usr/sbin/groupadd", "--system", "forgezero-otel"]);
+  }
+  if ((await host.exec(["/usr/bin/id", "forgezero-otel"])).exitCode !== 0) {
+    await checked2(host, [
+      "/usr/sbin/useradd",
+      "--system",
+      "--no-create-home",
+      "--shell",
+      "/usr/sbin/nologin",
+      "--gid",
+      "forgezero-otel",
+      "forgezero-otel"
+    ]);
+  }
+  host.write(CONFIG, rendered.config, 420);
+  host.write(UNIT, rendered.unit, 420);
+  await checked2(host, ["/usr/bin/systemctl", "daemon-reload"]);
+  await checked2(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+}
 
 // src/metal-bootstrap.ts
 var PROFILE_PATH = "/etc/forgezero/metal.json";
@@ -306,7 +435,7 @@ var HELPER_SOCKET = "/run/forgezero-metal/helper.sock";
 var UPDATE_SOCKET = "/run/forgezero-update/helper.sock";
 var MAX_CONFIG_BYTES = 256 * 1024;
 var SUPPORTED_BUN_VERSION = "1.3.14";
-var SUPPORTED_BUN_INSTALLER_SHA256 = "bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd";
+var SUPPORTED_BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f";
 
 class MetalBootstrapError extends Error {
 }
@@ -373,7 +502,7 @@ function validateMetalBootstrapConfig(config) {
     "housekeepingCpus",
     "housekeepingMemoryNodes",
     "bunVersion",
-    "bunInstallerSha256",
+    "bunReleaseSha256",
     "agentVersion",
     "confidential"
   ], "metal profile");
@@ -389,7 +518,7 @@ function validateMetalBootstrapConfig(config) {
   if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve(image.path) !== image.path || /[\0\r\n]/.test(image.path)) {
     throw new MetalBootstrapError("the pinned guest image must use the fixed image directory");
   }
-  if (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunInstallerSha256 !== SUPPORTED_BUN_INSTALLER_SHA256 || config.profile.agentVersion !== VERSION) {
+  if (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunReleaseSha256 !== SUPPORTED_BUN_RELEASE_SHA256 || config.profile.agentVersion !== VERSION) {
     throw new MetalBootstrapError("metal guest runtime must use the package-owned Bun and Agent release coordinates");
   }
   let api;
@@ -413,6 +542,9 @@ function validateMetalBootstrapConfig(config) {
     throw new MetalBootstrapError("metal host OTLP must use exact loopback http://127.0.0.1:4318");
   }
   validUnit(config.hostTelemetryUnit);
+  if (config.hostTelemetryUnit !== FORGEZERO_OTEL_COLLECTOR_UNIT) {
+    throw new MetalBootstrapError(`metal bootstrap requires ${FORGEZERO_OTEL_COLLECTOR_UNIT}`);
+  }
   if (config.agentSeedFile)
     validateOwnerOnlyPath(config.agentSeedFile, false);
   return config;
@@ -452,13 +584,14 @@ function planMetalBootstrap(config) {
     metalHostname: config.metalHostname,
     profilePath: PROFILE_PATH,
     units: [
+      FORGEZERO_OTEL_COLLECTOR_UNIT,
       "forgezero-metal-helper.service",
       "forgezero-agent-update-helper.service",
       "forgezero-metal-agent-egress.service",
       "forgezero-metal-agent.service"
     ],
     steps: [
-      "install fixed KVM/LVM/cloud-init/nftables prerequisites",
+      "install fixed KVM/LVM/cloud-init/nftables prerequisites and the checksum-verified OTLP collector",
       "verify bridge, volume group, pinned guest image, KVM and optional SEV device",
       "install the published Agent binary and root-owned immutable metal profile",
       "seal or generate the metal identity seed as a systemd credential",
@@ -755,8 +888,13 @@ async function applyMetalBootstrap(config, options) {
     "cloud-image-utils",
     "lvm2",
     "nftables",
-    "curl"
+    "curl",
+    "ca-certificates"
   ]);
+  await ensureForgeZeroOtelCollector({
+    write: atomicWrite,
+    exec
+  }, config.profile.agentTelemetryEndpoint);
   await ensurePinnedGuestImage(config, exec);
   await preflight(config, exec);
   await ensureAccount(exec);

package/dist/metal-helper-socket.js

@@ -339,45 +339,70 @@ var yamlFile = (path, content, permissions) => `  - path: ${JSON.stringify(path)
     encoding: b64
     content: ${base64(content)}
 `;
-function guestBootstrapScript(profile, attested = Boolean(profile.confidential), hasEnrolment = true, nodeLabel = "compute") {
+function guestBootstrapOperations(profile, attested = Boolean(profile.confidential), hasEnrolment = true, nodeLabel = "compute") {
   validateMetalProfile(profile);
   const agentBun = "/usr/local/lib/forgezero/bun";
-  const telemetryEndpoint = `'${profile.agentTelemetryEndpoint.replace(/'/g, `'\\''`)}'`;
-  const attestationSetup = attested ? `# The report device is not part of the encryption path, so a guest can appear
-# healthy and encrypted while attestation is silently impossible. Install and
-# load the driver shipped by the one pinned image before the agent starts. Do
-# not ask an evolving apt repository for an exact old kernel package: the image
-# can keep booting after Canonical removes that package from the mirror.
-if [[ ! -c /dev/sev-guest ]]; then modprobe sev-guest; fi
-test -c /dev/sev-guest
-printf 'sev-guest
-' >/etc/modules-load.d/sev-guest.conf
-` : "";
-  return `#!/usr/bin/env bash
-set -Eeuo pipefail
-${attestationSetup}if [[ ! -x /usr/local/bin/bun ]]; then
-  curl -fsSL https://bun.sh/install -o /run/fz-bun-install
-  printf '%s  %s
-' '${profile.bunInstallerSha256}' /run/fz-bun-install | sha256sum -c -
-  HOME=/root BUN_INSTALL=${agentBun} BUN_VERSION=${profile.bunVersion} bash /run/fz-bun-install
-  install -m 0755 ${agentBun}/bin/bun /usr/local/bin/bun
-  rm -f /run/fz-bun-install
-fi
-if [[ ! -x /usr/local/lib/forgezero/agent/fz-agent ]] || [[ "$(/usr/local/lib/forgezero/agent/fz-agent --version 2>/dev/null || true)" != "${profile.agentVersion}" ]]; then
-  env BUN_INSTALL=${agentBun} /usr/local/bin/bun add -g --no-cache --force @forgezero/agent@${profile.agentVersion}
-fi
-env   FZ_API=${profile.apiUrl}   OTEL_EXPORTER_OTLP_ENDPOINT=${telemetryEndpoint}   FZ_AGENT_BIN=/usr/local/lib/forgezero/agent/fz-agent   FZ_AGENT_USER=forgezero-agent   FZ_SOCKET_PATH=/run/forgezero/vault.sock   FZ_SEED_CREDENTIAL_PATH=/etc/forgezero/creds/agent-seed.cred   FZ_GIT_CREDENTIAL_PATH=/etc/forgezero/creds/git-deploy-key.cred   FZ_GIT_PUBLIC_KEY_PATH=/etc/forgezero/git/deploy.pub   FZ_DEPLOY_ROOT=/opt/forgezero   FZ_DEPLOY_PULL=${hasEnrolment ? "true" : "false"}   FZ_AGENT_EGRESS_ENFORCE=${hasEnrolment ? "true" : "false"}   FZ_NODE_LABEL=${nodeLabel}   ${agentBun}/bin/fz agent install --apply${hasEnrolment ? " --enrol" : ""}
-`;
+  return [
+    ...attested ? [
+      ["/usr/sbin/modprobe", "sev-guest"],
+      ["/usr/bin/test", "-c", "/dev/sev-guest"]
+    ] : [],
+    [
+      "/usr/bin/curl",
+      "--fail",
+      "--silent",
+      "--show-error",
+      "--location",
+      "https://github.com/oven-sh/bun/releases/download/bun-v1.3.14/bun-linux-x64.zip",
+      "--output",
+      "/run/forgezero-bun.zip"
+    ],
+    ["/usr/bin/sha256sum", "--check", "/etc/forgezero/bun.sha256"],
+    ["/usr/bin/unzip", "-q", "/run/forgezero-bun.zip", "-d", "/run/forgezero-bun"],
+    ["/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/runtime", agentBun],
+    ["/usr/bin/install", "-m", "0755", "/run/forgezero-bun/bun-linux-x64/bun", "/usr/local/lib/forgezero/runtime/bun"],
+    ["/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/runtime/bun", "/usr/local/bin/bun"],
+    [
+      "/usr/bin/env",
+      `BUN_INSTALL=${agentBun}`,
+      "/usr/local/bin/bun",
+      "add",
+      "-g",
+      "--no-cache",
+      "--force",
+      `@forgezero/agent@${profile.agentVersion}`
+    ],
+    [
+      "/usr/bin/env",
+      `FZ_API=${profile.apiUrl}`,
+      `OTEL_EXPORTER_OTLP_ENDPOINT=${profile.agentTelemetryEndpoint}`,
+      "FZ_AGENT_BIN=/usr/local/lib/forgezero/agent/fz-agent",
+      "FZ_AGENT_USER=forgezero-agent",
+      "FZ_SOCKET_PATH=/run/forgezero/vault.sock",
+      "FZ_SEED_CREDENTIAL_PATH=/etc/forgezero/creds/agent-seed.cred",
+      "FZ_GIT_CREDENTIAL_PATH=/etc/forgezero/creds/git-deploy-key.cred",
+      "FZ_GIT_PUBLIC_KEY_PATH=/etc/forgezero/git/deploy.pub",
+      "FZ_DEPLOY_ROOT=/opt/forgezero",
+      `FZ_DEPLOY_PULL=${hasEnrolment}`,
+      `FZ_AGENT_EGRESS_ENFORCE=${hasEnrolment}`,
+      `FZ_NODE_LABEL=${nodeLabel}`,
+      `${agentBun}/bin/fz`,
+      "agent",
+      "install",
+      "--apply",
+      ...hasEnrolment ? ["--enrol"] : []
+    ]
+  ];
 }
 function cloudInit(profile, claim, manifest) {
   const enrolled = Boolean(claim.enrolment);
-  const bootstrap = guestBootstrapScript(profile, claim.spec.confidential, enrolled, manifest.name);
+  const bootstrap = guestBootstrapOperations(profile, claim.spec.confidential, enrolled, manifest.name);
   const access = claim.access;
   const users = access ? `users:
   - default
   - name: ${access.sshUser}
     groups: [sudo]
-    shell: /bin/bash
+    shell: /bin/dash
     sudo: ALL=(ALL) NOPASSWD:ALL
     ssh_authorized_keys:
 ${access.sshPublicKeys.map((key) => `      - ${JSON.stringify(key)}`).join(`
@@ -385,6 +410,10 @@ ${access.sshPublicKeys.map((key) => `      - ${JSON.stringify(key)}`).join(`
 ` : "";
   const enrolmentFiles = enrolled ? yamlFile("/run/forgezero-enrol-token", `${claim.enrolment.token}
 `, "0600") : "";
+  const attestationFile = claim.spec.confidential ? yamlFile("/etc/modules-load.d/sev-guest.conf", `sev-guest
+`, "0644") : "";
+  const bunChecksum = yamlFile("/etc/forgezero/bun.sha256", `${profile.bunReleaseSha256}  /run/forgezero-bun.zip
+`, "0600");
   return {
     userData: `#cloud-config
 package_update: true
@@ -393,8 +422,9 @@ ${users}disable_root: true
 # every dynamically claimed repository must be cloneable on a clean image.
 packages: [curl, ca-certificates, openssl, openssh-client, git, unzip${claim.spec.confidential ? ", python3" : ""}]
 write_files:
-${enrolmentFiles}${yamlFile("/usr/local/sbin/forgezero-guest-bootstrap", bootstrap, "0700")}runcmd:
-  - [ bash, /usr/local/sbin/forgezero-guest-bootstrap ]
+${enrolmentFiles}${attestationFile}${bunChecksum}runcmd:
+${bootstrap.map((argv) => `  - ${JSON.stringify(argv)}`).join(`
+`)}
 `,
     metaData: `instance-id: ${manifest.name}-${claim.attempt}
 local-hostname: ${manifest.name}

package/dist/metal-provision.d.ts

@@ -37,7 +37,7 @@ export interface MetalProvisionProfile {
     /** NUMA nodes reserved for host allocations when the topology permits it. */
     housekeepingMemoryNodes?: string;
     bunVersion: string;
-    bunInstallerSha256: string;
+    bunReleaseSha256: string;
     agentVersion: string;
     confidential?: {
         cbitpos: number;
@@ -72,7 +72,7 @@ export declare function validateMetalProfile(profile: MetalProvisionProfile): vo
 export declare function allocateAddress(profile: MetalProvisionProfile, computeKey: string, rows: GuestManifest[]): string;
 /** Stable tight-fit allocation of one exclusive CPU/NUMA pool. */
 export declare function allocateCpuPool(profile: MetalProvisionProfile, claim: Pick<RemoteProvisionClaim, 'computeKey' | 'spec'>, rows: GuestManifest[]): MetalCpuPool;
-export declare function guestBootstrapScript(profile: MetalProvisionProfile, attested?: boolean, hasEnrolment?: boolean, nodeLabel?: string): string;
+export declare function guestBootstrapOperations(profile: MetalProvisionProfile, attested?: boolean, hasEnrolment?: boolean, nodeLabel?: string): readonly (readonly string[])[];
 export declare function cloudInit(profile: MetalProvisionProfile, claim: CreateRemoteProvisionClaim, manifest: GuestManifest): {
     userData: string;
     metaData: string;