@forgezero/agent 0.1.65 → 0.1.67

package/dist/index.d.ts

@@ -55,7 +55,7 @@ export type { SnpAttestationOptions } from './snp-attestation';
 export { attestNodeOnce, startNodeAttestation } from './attestation-client';
 export type { NodeAttestationOptions } from './attestation-client';
 export { applyMetalIsolation, metalGuestSliceUnit, metalHousekeepingDropIn } from './metal-isolation';
-export { assertSupportedGuestImage, SUPPORTED_GUEST_IMAGE } from './ubuntu';
+export { assertSupportedGuestImage, supportedGuestImage, SUPPORTED_GUEST_IMAGE, SUPPORTED_GUEST_IMAGES } from './ubuntu';
 export { calibrateHttpConcurrency, localCalibrationEndpoint } from './capacity-calibration';
 export type { CapacityCalibration, CapacityCalibrationOptions, CapacityStage } from './capacity-calibration';
 /**

package/dist/metal-bootstrap.js

@@ -27,15 +27,70 @@ import { join as join2 } from "path";
 import { dirname, isAbsolute, join } from "path";
 import { isIP } from "net";
 
+// src/software.ts
+var PINNED_BUN_VERSION = "1.3.14";
+var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f";
+var OS_CATALOG = [
+  {
+    id: "ubuntu",
+    version: "26.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-resolute-20260731",
+    imageLabel: "Ubuntu 26.04 LTS Resolute",
+    imageVersion: "2026-07-31",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
+    imageSha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05",
+    confidentialModes: ["sev-snp"]
+  },
+  {
+    id: "ubuntu",
+    version: "24.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-noble-20260705",
+    imageLabel: "Ubuntu 24.04 LTS Noble",
+    imageVersion: "2026-07-05",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/noble/release-20260705/ubuntu-24.04-server-cloudimg-amd64.img",
+    imageSha256: "ffe6203da54deeb6db5d2a98a83f9ec8e55f149d3f7ba622e1abe5fa966ee3d6",
+    confidentialModes: []
+  }
+];
+var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
+  "data-root": "/var/lib/docker",
+  "storage-driver": "overlay2",
+  "live-restore": true,
+  "log-driver": "local",
+  "log-opts": { "max-size": "10m", "max-file": "3" }
+}, null, 2)}
+`;
+
 // src/ubuntu.ts
+var current = OS_CATALOG[0];
 var SUPPORTED_GUEST_IMAGE = Object.freeze({
-  key: "ubuntu-resolute-20260731",
-  family: "ubuntu-26.04",
-  version: "2026-07-31",
-  label: "Ubuntu 26.04 LTS Resolute",
-  url: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
-  sha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05"
+  key: current.imageKey,
+  family: `${current.id}-${current.version}`,
+  version: current.imageVersion,
+  label: current.imageLabel,
+  url: current.imageUrl,
+  sha256: current.imageSha256
 });
+var SUPPORTED_GUEST_IMAGES = Object.freeze(OS_CATALOG.filter(({ status }) => status === "active").map(({ id, imageKey, imageLabel, imageVersion, version, confidentialModes }) => ({
+  key: imageKey,
+  label: imageLabel,
+  family: `${id}-${version}`,
+  version: imageVersion,
+  confidential: confidentialModes.some((mode) => mode === "sev-snp")
+})));
+function assertSupportedGuestImage(imageKey, confidential = false) {
+  const selected = OS_CATALOG.find((entry) => entry.status === "active" && entry.imageKey === imageKey);
+  if (!selected) {
+    throw new Error(`unsupported guest image ${imageKey}; supported images: ${SUPPORTED_GUEST_IMAGES.map(({ key }) => key).join(", ")}`);
+  }
+  if (confidential && !selected.confidentialModes.some((mode) => mode === "sev-snp")) {
+    throw new Error(`guest image ${imageKey} is not approved for SEV-SNP`);
+  }
+}
 
 // src/metal-provision.ts
 var SAFE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/;
@@ -86,9 +141,16 @@ function validateMetalProfile(profile) {
   if (telemetryEndpoint.protocol !== "https:" || telemetryEndpoint.username || telemetryEndpoint.password || telemetryEndpoint.search || telemetryEndpoint.hash || isIP(telemetryEndpoint.hostname) !== 0 || !telemetryEndpoint.hostname.includes(".") || telemetryEndpoint.hostname === "localhost" || telemetryEndpoint.hostname.endsWith(".local"))
     throw new MetalProvisionError("Agent telemetry endpoint must be a public HTTPS DNS coordinate without credentials, query or fragment");
   const imageKeys = Object.keys(profile.images);
-  if (imageKeys.length !== 1 || imageKeys[0] !== SUPPORTED_GUEST_IMAGE.key || profile.images[SUPPORTED_GUEST_IMAGE.key]?.sha256 !== SUPPORTED_GUEST_IMAGE.sha256) {
-    throw new MetalProvisionError(`metal profile must contain only the pinned ${SUPPORTED_GUEST_IMAGE.key} image contract`);
+  if (imageKeys.length === 0)
+    throw new MetalProvisionError("metal profile requires at least one pinned guest image");
+  for (const imageKey of imageKeys) {
+    const catalog = OS_CATALOG.find((entry) => entry.status === "active" && entry.imageKey === imageKey);
+    if (!catalog || profile.images[imageKey]?.sha256 !== catalog.imageSha256) {
+      throw new MetalProvisionError(`metal profile image ${imageKey} does not match the pinned OS catalog`);
+    }
   }
+  if (profile.confidential && !imageKeys.some((key) => OS_CATALOG.find((entry) => entry.imageKey === key)?.confidentialModes.some((mode) => mode === "sev-snp")))
+    throw new MetalProvisionError("confidential metal profile requires a pinned SEV-SNP guest image");
   if (!Array.isArray(profile.cpuPools) || profile.cpuPools.length === 0) {
     throw new MetalProvisionError("at least one exclusive CPU pool is required");
   }
@@ -292,7 +354,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.65";
+var VERSION = "0.1.67";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
@@ -558,10 +620,9 @@ function validateMetalBootstrapConfig(config) {
   if (config.profile.stateDir !== "/etc/forgezero/metal-guests" || config.profile.seedDir !== "/var/lib/forgezero/seed" || config.profile.unitDir !== UNIT_DIRECTORY || config.profile.legacyStateDir !== undefined) {
     throw new MetalBootstrapError("metal bootstrap uses fixed state, seed, and systemd unit directories");
   }
-  const image = config.profile.images[Object.keys(config.profile.images)[0]];
-  if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve(image.path) !== image.path || /[\0\r\n]/.test(image.path)) {
-    throw new MetalBootstrapError("the pinned guest image must use the fixed image directory");
-  }
+  for (const image of Object.values(config.profile.images))
+    if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve(image.path) !== image.path || /[\0\r\n]/.test(image.path))
+      throw new MetalBootstrapError("every pinned guest image must use the fixed image directory");
   if (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunReleaseSha256 !== SUPPORTED_BUN_RELEASE_SHA256 || config.profile.agentVersion !== VERSION) {
     throw new MetalBootstrapError("metal guest runtime must use the package-owned Bun and Agent release coordinates");
   }
@@ -863,9 +924,11 @@ var preflight = async (config, exec) => {
       throw new MetalBootstrapError("/dev/sev is required by the confidential profile");
     await runChecked(exec, ["/usr/bin/qemu-system-x86_64", "-object", "sev-snp-guest,help"]);
   }
-  const digest = (await runChecked(exec, ["/usr/bin/sha256sum", config.profile.images[Object.keys(config.profile.images)[0]].path])).stdout.split(/\s+/)[0];
-  if (digest !== config.profile.images[Object.keys(config.profile.images)[0]].sha256)
-    throw new MetalBootstrapError("pinned guest image digest mismatch");
+  for (const image of Object.values(config.profile.images)) {
+    const digest = (await runChecked(exec, ["/usr/bin/sha256sum", image.path])).stdout.split(/\s+/)[0];
+    if (digest !== image.sha256)
+      throw new MetalBootstrapError("pinned guest image digest mismatch");
+  }
 };
 var assertSupportedMetalHost = () => {
   if (process.platform !== "linux" || process.arch !== "x64") {
@@ -877,34 +940,38 @@ var assertSupportedMetalHost = () => {
   }
 };
 var ensurePinnedGuestImage = async (config, exec) => {
-  const image = config.profile.images[SUPPORTED_GUEST_IMAGE.key];
-  if (existsSync(image.path))
-    return;
-  mkdirSync2(dirname2(image.path), { recursive: true, mode: 493 });
-  const temporary = `${image.path}.next-${process.pid}`;
-  try {
-    await runChecked(exec, [
-      "/usr/bin/curl",
-      "--fail",
-      "--location",
-      "--proto",
-      "=https",
-      "--tlsv1.2",
-      "--output",
-      temporary,
-      SUPPORTED_GUEST_IMAGE.url
-    ]);
-    const digest = (await runChecked(exec, ["/usr/bin/sha256sum", temporary])).stdout.split(/\s+/)[0];
-    if (digest !== image.sha256)
-      throw new MetalBootstrapError("downloaded guest image digest mismatch");
-    chmodSync(temporary, 292);
-    chownSync(temporary, 0, 0);
-    renameSync(temporary, image.path);
-  } catch (cause) {
+  for (const [imageKey, image] of Object.entries(config.profile.images)) {
+    if (existsSync(image.path))
+      continue;
+    const catalog = OS_CATALOG.find((entry) => entry.status === "active" && entry.imageKey === imageKey);
+    if (!catalog)
+      throw new MetalBootstrapError(`guest image ${imageKey} is not active`);
+    mkdirSync2(dirname2(image.path), { recursive: true, mode: 493 });
+    const temporary = `${image.path}.next-${process.pid}`;
     try {
-      unlinkSync(temporary);
-    } catch {}
-    throw cause;
+      await runChecked(exec, [
+        "/usr/bin/curl",
+        "--fail",
+        "--location",
+        "--proto",
+        "=https",
+        "--tlsv1.2",
+        "--output",
+        temporary,
+        catalog.imageUrl
+      ]);
+      const digest = (await runChecked(exec, ["/usr/bin/sha256sum", temporary])).stdout.split(/\s+/)[0];
+      if (digest !== image.sha256)
+        throw new MetalBootstrapError("downloaded guest image digest mismatch");
+      chmodSync(temporary, 292);
+      chownSync(temporary, 0, 0);
+      renameSync(temporary, image.path);
+    } catch (cause) {
+      try {
+        unlinkSync(temporary);
+      } catch {}
+      throw cause;
+    }
   }
 };
 async function applyMetalBootstrap(config, options) {
@@ -1064,10 +1131,17 @@ async function metalBootstrapStatus(exec = defaultExec2) {
       ])).exitCode !== 0) {
         problems.push("local OTLP metrics receiver did not accept a proof request");
       }
-      const image = profile.images[Object.keys(profile.images)[0]];
-      if (existsSync(image.path)) {
+      imageVerified = true;
+      for (const image of Object.values(profile.images)) {
+        if (!existsSync(image.path)) {
+          imageVerified = false;
+          break;
+        }
         const digest = (await exec(["/usr/bin/sha256sum", image.path])).stdout.split(/\s+/)[0];
-        imageVerified = digest === image.sha256;
+        if (digest !== image.sha256) {
+          imageVerified = false;
+          break;
+        }
       }
       if (!imageVerified)
         problems.push("pinned guest image is absent or has the wrong digest");