PyPI - cs-image-system-bash-mod-plugin - Versions diffs - 0.1.6__tar.gz → 0.1.8__tar.gz - Mend

cs-image-system-bash-mod-plugin 0.1.6tar.gz → 0.1.8tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

{cs_image_system_bash_mod_plugin-0.1.6 → cs_image_system_bash_mod_plugin-0.1.8}/.gitignore RENAMED Viewed

@@ -13,16 +13,21 @@ build/
 .venv/
 .DS_Store
 packages/**/*.code-workspace
-# the IDE rewrites the root workspace file whenever folders are opened: it is the editor's, not the repository's (hygiene XXI)
+# the IDE rewrites the root workspace file whenever folders are opened: it is the editor's, not the repository's
 /*.code-workspace
 trial
 tfmodules/tftest
 YAML_DUMP.yaml
+# a configuration tree's run-local plaintexts and debug output, wherever a tree
+# sits in this repository (a copy of the frozen fixture included)
+_private/
 .obsidian
 .tofu-plugin-cache/
 _uncommitted/
 target/
-# never publishable, whatever the root (stage 35 refuses them; stage 40's publish-tree checks the policy)
+# never publishable, whatever the root (the public-safe hook refuses them; `just publish-tree` checks the policy)
 tfplan
 *.tfstate
 *.tfstate.backup
+REEXAMINE*
+TODO2.md

{cs_image_system_bash_mod_plugin-0.1.6 → cs_image_system_bash_mod_plugin-0.1.8}/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cs-image-system-bash-mod-plugin
-Version: 0.1.6
+Version: 0.1.8
 Summary: The shell modification plugin: inline script, script files and an ensure form become Packer shell provisioners
 Project-URL: Repository, https://github.com/infrastructurebuilder/cs-image-system-3
 Project-URL: Documentation, https://github.com/infrastructurebuilder/cs-image-system-3/blob/develop/docs/OPERATIONS.md
@@ -9,8 +9,8 @@ Author-email: Mykel Alvis <mykelalvis@infrastructurebuilder.org>
 License-Expression: Apache-2.0
 License-File: LICENSE
 Requires-Python: >=3.13
-Requires-Dist: cs-image-system-base==0.1.6
-Requires-Dist: cs-image-system-contract==0.1.6
+Requires-Dist: cs-image-system-base==0.1.8
+Requires-Dist: cs-image-system-contract<0.5,>=0.4
 Requires-Dist: pydantic>=2.13
 Description-Content-Type: text/markdown
@@ -55,18 +55,15 @@ How a YAML entry selects these classes:
   looks the builder up by name or alias, reads the builder's own `type`
   (`bash-remote`) and loads the item into the class registered under that
   service key for `MOD_BUILDER_ITEM_MODEL`: `BashModItemModel`. The
-  registry alone decides; the builder model's
-  `get_target_deferred_type_by_VCT` method, which also named that class
-  and had no caller, is gone (stage 63, 2026-09-25), as is the plugin's
-  empty `helpers.py`.
-- **The item's `type` is rewritten to the builder's `name` at load**
-  (stage 63 item 15). The image builder later fetches the builder with
+  registry alone decides.
+- **The item's `type` is rewritten to the builder's `name` at load.**
+  The image builder later fetches the builder with
   `ctx.mod_builders.get(mod.get_type())`, a map keyed by builder NAME
-  only, so an alias must not survive the load. An item declared
-  `type: bash` (the fixture builder's alias) is loaded as
-  `type: bash-remote`. Before 2026-09-25 the alias was kept, and
-  generation stopped with
+  only, so an alias must not survive the load: a kept alias would stop
+  generation with
   `AssertionError: No mod builder bash found in context for <image>`.
+  An item declared `type: bash` (the fixture builder's alias) is loaded
+  as `type: bash-remote`.
 - An `executables:` entry named `bash` is version-checked by
   `BashVersionChecker` (regex `.*version\s+([\d\.]+)` over
   `bash --version`).
@@ -80,21 +77,31 @@ Defined in [bash_models.py](src/cs_image_system/bash_mod_plugin/bash_models.py).
 [`ModBuilderModel`](../base/src/cs_image_system/base/models/mod_builder.py),
 which adds nothing to
 [`BuilderModel`](../base/src/cs_image_system/base/models/builder_model.py)
-(`name`, `type`, `description`, `aliases`, `executable`, `is_default`,
-`config`, `gitignore`, `tags`). `BashModBuilderModel` is the registered
-subclass; it adds no fields.
-| Field | Type | Default | Meaning |
-|---|---|---|---|
-| `execute_command` | `str \| None` | `None` | Emitted as `execute_command = "..."` on every shell provisioner of every item (Packer's command template, for example `sudo -E bash '{{.Path}}'`). The way to change how the script is invoked. May not be declared together with `configuration_user`. |
-| `configuration_user` | `str \| None` | `None` | When set, every shell provisioner of this builder gets `execute_command = "chmod +x {{ .Path }}; sudo su - <user> -c '{{ .Vars }} {{ .Path }}'"`, so each item's lines run as that user; the bake user only launches them (stage 63; declared and not read until 2026-09-25). Declaring it together with `execute_command` is refused at load. |
-| `environment_vars` | `list[str]` | `[]` | Emitted as `environment_vars = [...]` on every shell provisioner. |
-| `expect_disconnect` | `bool` | `False` | Emits `expect_disconnect = true` on every shell provisioner. |
-`extra_arguments` is not a field (stage 63): it was declared and never
-read, so it is removed, and a builder that still declares it fails to load
-with the unknown-key refusal. Use `execute_command` to change the
-invocation.
+(the common builder fields: `name`, `type`, `description`, `aliases`,
+`executable`, `is_default`, `config`, `gitignore`, `tags`;
+[CONFIGURATION section 4.1](../../docs/CONFIGURATION.md#41-fields-common-to-every-builder)
+holds that table). `BashModBuilderModel` is the registered subclass; it
+adds no fields.
+The keys this plugin adds are `execute_command`, `configuration_user`,
+`environment_vars` and `expect_disconnect`: each is a Packer
+shell-provisioner argument, emitted on every shell provisioner of every
+item of the builder.
+[CONFIGURATION section 7.2](../../docs/CONFIGURATION.md#72-bash-remote)
+holds the field table; [Configuration reference](#configuration-reference)
+below gives this plugin's reading of each key. Rules only this plugin
+enforces:
+- `execute_command` (Packer's command template, for example
+  `sudo -E bash '{{.Path}}'`) is the way to change how the script is
+  invoked. `configuration_user` writes its own: every shell provisioner
+  of the builder gets `execute_command = "chmod +x {{ .Path }}; sudo su -
+  <user> -c '{{ .Vars }} {{ .Path }}'"`, so each item's lines run as that
+  user and the bake user only launches them. Because both say how the
+  script runs, declaring them together is refused at load.
+- `extra_arguments` is not a field: a builder that declares it fails to
+  load with the unknown-key refusal. Use `execute_command` to change the
+  invocation.
 Base fields this plugin constrains: `executable` should name the `bash`
 executable (the fixture does), though the emission does not invoke it;
@@ -105,13 +112,28 @@ base-model rule). `config:` on the builder is carried but never read.
 Same file. Extends
 [`ModItemModel`](../base/src/cs_image_system/base/models/moditem_type.py)
-(`SubRootItem` -> `RootItem` -> `NameTyped`).
-| Field | Type | Default | Meaning |
-|---|---|---|---|
-| `script` | `list[str]` | `[]` | Inline command lines, run in order in one `provisioner "shell"` (`inline = [...]`). Literal shell; no templating. Blank entries are dropped. |
-| `scripts` | `list[str]` | `[]` | Script files, relative to the configuration root (the process's working directory, which the configuration load sets to the root), copied beside the Packer root and run as `scripts = [...]`. Blank entries are dropped. |
-| `ensure` | `dict[str, Any]` | `{}` | The declarative form. Allowed keys: `packages` (list of names), `files` (list of `{path, content, mode}`; `mode` defaults to `0644`), `services` (list of unit names, enabled and started), `commands` (list of `{run, unless}`; `run` executes only when `unless` fails). Every entry is validated at load by `validate_ensure` (stage 63 item 16): a wrong shape, an unknown key, a bad mode or an all-empty mapping raises `ValueError` naming the item and the entry. |
+(`SubRootItem` -> `RootItem` -> `NameTyped`). The item's own keys are
+`script`, `scripts` and `ensure`; the inherited ones (`name`, `type`,
+`description`, `aliases`, `tags`, `config`) are the modification item's,
+tabled in
+[CONFIGURATION section 7.3](../../docs/CONFIGURATION.md#73-the-modification-item-inside-an-images-modifications),
+and [Configuration reference](#configuration-reference) below reads every
+key as this plugin does.
+- `script` is the list of inline command lines, run in order in one
+  `provisioner "shell"` (`inline = [...]`). Literal shell; no templating.
+  Blank entries are dropped.
+- `scripts` is the list of script files, relative to the configuration
+  root (the process's working directory, which the configuration load
+  sets to the root), copied beside the Packer root and run as
+  `scripts = [...]`. Blank entries are dropped.
+- `ensure` is the declarative form. Allowed keys: `packages` (list of
+  names), `files` (list of `{path, content, mode}`; `mode` defaults to
+  `0644`), `services` (list of unit names, enabled and started),
+  `commands` (list of `{run, unless}`; `run` executes only when `unless`
+  fails). Every entry is validated at load by `validate_ensure`: a wrong
+  shape, an unknown key, a bad mode or an all-empty mapping raises
+  `ValueError` naming the item and the entry.
 Validation at load: at least one of `script`, `scripts`, `ensure` must be
 non-empty, otherwise `ValueError` ("must supply 'script' (inline lines),
@@ -134,15 +156,13 @@ Derived behaviour:
 - `remap_self_with_copied_assets(copied)`: replaces each `scripts` entry
   with its copied path when present in the mapping.
-Inherited item fields:
-| Base field | From | Default | Use in this plugin |
-|---|---|---|---|
-| `name` | `NameTyped` | required | Names the provisioner comment and the local bundle directory (`NN-<name>`). |
-| `type` | `ModItemModel` | `default` | Foreign key to a `mod_builders:` entry (see above). |
-| `description`, `aliases`, `tags` | `NameTyped` / `RootItem` | | Carried; not emitted. |
-| `config` | `RootItem` | `{}` | Not read by this plugin. It takes part in the lineage content hash of the modification and nothing else. |
-| `_model_id` | `ModItemModel` | set at load | The owning image's global id; `identified_model` resolves to the image. |
+Of the inherited fields, `name` names the provisioner comment and the
+local bundle directory (`NN-<name>`); `type` is the foreign key to a
+`mod_builders:` entry (see above); `description`, `aliases` and `tags`
+are carried and not emitted; `config` is not read by this plugin and
+takes part in the lineage content hash of the modification and nothing
+else; `_model_id`, set at load, is the owning image's global id, and
+`identified_model` resolves to the image.
 ### A modification item with only `config:`
@@ -171,10 +191,11 @@ calls, in order:
    `scripts` to `<block_dir>/<script path>` and returns
    `{script: script path}`. The source is resolved against the process's
    current working directory; the configuration load has already changed
-   directory to the configuration root (`--root-dir`, else
-   `working_directory` in `cfg/_config.yml`, else `.`), so in practice the
-   path is root-relative. A missing file raises `FileNotFoundError`; an
-   absolute path is not copied and is left in place.
+   directory to the configuration root (`--root-dir`, else the directory
+   the command was started from; `working_directory` in `cfg/_config.yml`
+   is not read), so the path is root-relative. A missing file raises
+   `FileNotFoundError`; an absolute path is not copied and is left in
+   place.
 2. `mod.remap_self_with_copied_assets(mapping)` on the item. Because the
    mapping's value is the same relative path the copy was placed at, the
    item's `scripts` entries keep their text; the emitted `scripts = [...]`
@@ -183,8 +204,8 @@ calls, in order:
 4. `generate_items_during_modification(image, mod, image_builder, phase, build_path)`:
    - `inline` = `ensure_lines()` followed by the `script` lines; `scripts`
      = the script files. When both lists are empty it logs a warning and
-     emits nothing; since stage 63 item 16 an all-empty `ensure` is
-     refused at load, so an item can no longer reach this.
+     emits nothing; an all-empty `ensure` is refused at load, so an item
+     cannot reach this.
    - Appends `# Modifications for <item name> of type <item type> (shell)`.
    - Then, because Packer's shell provisioner takes either `scripts` or
      `inline` but never both, one or two `provisioner "shell"` blocks:
@@ -197,7 +218,7 @@ calls, in order:
      with a `configuration_user`, `chmod +x {{ .Path }}; sudo su - <user>
      -c '{{ .Vars }} {{ .Path }}'` (Packer's `{{ .Vars }}`, the
      environment variables, travel inside the command because `su -`
-     starts a fresh login environment), else none (stage 63).
+     starts a fresh login environment), else none.
    - Every string is rendered as an HCL literal: backslashes and double
      quotes are escaped, and `${` / `%{` become `$${` / `%%{` so shell text
      such as `dpkg-query -f='${Package}'` survives Packer's template parser.
@@ -212,9 +233,7 @@ modification bundle records the item: its directory
 `run.sh` that runs `sh '<script>'` per script file and then
 `sh ./inline.sh`, and a `MANIFEST.yaml` with `operation: bash` and the
 item's `idempotent` value. `csis-mods rerun` on the image therefore
-re-applies the declarative `ensure` form too (stage 63). Until 2026-09-25
-the `ensure` lines were not in the bundle and a rerun replayed only the
-script files and the `script` lines.
+re-applies the declarative `ensure` form too.
 ## Emission
@@ -316,8 +335,8 @@ entry in `cfg/executables.yml`
 ([the fixture's](../../tests/fixtures/config/cfg/executables.yml) is
 `name: bash`, `binary: /usr/local/bin/bash`, no `version`), because
 `validate` checks every builder's `executable` against that list and every
-run checks every declared entry (stage 48: the binary must exist as an
-absolute path or a name on `PATH`, `BashVersionChecker` must parse a version
+run checks every declared entry (the binary must exist as an absolute
+path or a name on `PATH`, `BashVersionChecker` must parse a version
 from `<binary> --version`, and when the entry declares `version:` the parsed
 version must satisfy it). That is the whole extent of the plugin's use of a
 local bash: it is looked at, never run. The fixture declares no floor;
@@ -354,8 +373,8 @@ in `ensure` lines works there too.
 **How the plugin finds things.** The builder by the item's `type:` (the
 builder's name); the item class by the builder's `type: bash-remote`; the
 `bash` entry by the builder's `executable:`; script files by path relative
-to the configuration root (the working directory the load selects from
-`--root-dir`, else `cfg/_config.yml`'s `working_directory`, else `.`); the
+to the configuration root (the working directory the load changes into:
+`--root-dir`, else the directory the command was started from); the
 build VM through the image builder that hosts the emission. No environment
 variable, profile or file of its own.
@@ -365,7 +384,7 @@ variable, profile or file of its own.
 Every key the model accepts. An unknown key is refused at load
 (`extra="forbid"` in the shared model config), and `parameters:` is refused
-by name (retired in stage 26).
+by name.
 | Field | Type | Default | Meaning |
 |---|---|---|---|
@@ -379,24 +398,24 @@ by name (retired in stage 26).
 | `gitignore` | list[str] | `[]` | Accepted by the base model; nothing in this plugin reads it. |
 | `tags` | mapping | `{}` | Accepted, not read. |
 | `execute_command` | str or null | `null` | Emitted verbatim (HCL-escaped) as `execute_command` on every shell block of every item of this builder. Refused together with `configuration_user`. |
-| `configuration_user` | str or null | `null` | Read since stage 63 (accepted and ignored until 2026-09-25): every shell block of this builder runs its lines as this user through `execute_command = "chmod +x {{ .Path }}; sudo su - <user> -c '{{ .Vars }} {{ .Path }}'"`. Refused together with `execute_command` (`... both say how the script runs; declare one`). |
+| `configuration_user` | str or null | `null` | Every shell block of this builder runs its lines as this user through `execute_command = "chmod +x {{ .Path }}; sudo su - <user> -c '{{ .Vars }} {{ .Path }}'"`. Refused together with `execute_command` (`... both say how the script runs; declare one`). |
 | `environment_vars` | list[str] | `[]` | Emitted as `environment_vars = [...]` on every shell block. |
 | `expect_disconnect` | bool | `false` | When true, `expect_disconnect = true` on every shell block. |
-| `extra_arguments` | | | Refused at load as an unknown key (removed in stage 63; it was accepted and never read). Use `execute_command`. |
+| `extra_arguments` | | | Not a field; refused at load as an unknown key. Use `execute_command`. |
 ### The item (an image's `modifications:` entry whose `type:` names this builder)
 | Field | Type | Default | Meaning |
 |---|---|---|---|
 | `name` | str | required | Unique within the image. Names the comment line, the bundle directory `NN-<name>` and the lineage record. |
-| `type` | str | `default` | The builder's name, an alias, or `default` (or omitted). Rewritten to the builder's name at load (stage 63 item 15). Omitted or `default` with no `is_default: true` mod builder: refused at load (stage 63). |
+| `type` | str | `default` | The builder's name, an alias, or `default` (or omitted). Rewritten to the builder's name at load. Omitted or `default` with no `is_default: true` mod builder: refused at load. |
 | `description` | str or null | `null` | Accepted, not read. |
 | `aliases` | list[str] | `[]` | Accepted, not read. |
 | `tags` | mapping | `{}` | Accepted, not read. |
 | `config` | mapping | `{}` | Not read by the plugin. Part of the modification's content hash, so a change re-bakes the image. Not passed to the shell. |
 | `script` | list[str] | `[]` | Inline lines, literal, in order, after the `ensure` lines. Blank and whitespace-only entries are dropped. |
 | `scripts` | list[str] | `[]` | Script files; each is copied beside the Packer root and run first, in order. Blank entries are dropped. An absolute path is not copied and is emitted as is. |
-| `ensure` | mapping | `{}` | Only the four keys below are allowed; any other key is refused at load. Every entry's values are validated at load since stage 63 item 16 (`validate_ensure`; see "What it tests and verifies"). |
+| `ensure` | mapping | `{}` | Only the four keys below are allowed; any other key is refused at load. Every entry's values are validated at load (`validate_ensure`; see "What it tests and verifies"). |
 The `ensure` keys:
@@ -417,11 +436,11 @@ The `ensure` keys:
   `idempotent: unknown`, the same as free-form alone. `ensure` lines always
   precede the `script` lines in the inline block.
 - **`ensure` whose lists are all empty** (`ensure: {packages: []}`) is
-  refused at load (stage 63 item 16). Before 2026-09-25 it passed load,
-  counted as `declared`, and emitted nothing: the builder logged
-  `Bash modification <name> has no script lines or files; nothing emitted`
-  and the bake proceeded without a provisioner for it. The bundle directory
-  still exists, with a `run.sh` that runs nothing.
+  refused at load, because such an item would count as `declared` and
+  emit nothing: the builder would log
+  `Bash modification <name> has no script lines or files; nothing emitted`,
+  the bake would proceed without a provisioner for it, and the bundle
+  directory would hold a `run.sh` that runs nothing.
 - **`commands` with `unless`** is guarded; **without `unless`** the command
   runs on every bake and on every `csis-mods rerun`, so the item is
   idempotent only if the command is.
@@ -431,7 +450,7 @@ The `ensure` keys:
 - **`execute_command` set** puts that template on every block of every
   item of the builder; **`configuration_user` set** instead puts
   `chmod +x {{ .Path }}; sudo su - <user> -c '{{ .Vars }} {{ .Path }}'`
-  there, so the lines run as that user (stage 63); **both set** is refused
+  there, so the lines run as that user; **both set** is refused
   at load; **neither**, Packer's default applies and the lines run as the
   bake user. The same for
   `environment_vars` (emitted only when non-empty) and `expect_disconnect`
@@ -440,11 +459,10 @@ The `ensure` keys:
   `type`** reaches whichever mod builder is `is_default: true`; in the
   fixture that is `ansible-default`, so the item is loaded as an ANSIBLE
   item and its `script`/`scripts`/`ensure` keys are refused as unknown.
-  With no `is_default: true` mod builder at all, the load is refused
-  (stage 63): `No default builder found in mod_builder list.` first, and
-  the orchestrator's `` modification '<name>' names no builder (`type`) ... ``
-  for an item that reaches it anyway. Until 2026-09-25 such an item
-  became an `AttributeError` at generation.
+  With no `is_default: true` mod builder at all, the load is refused:
+  `No default builder found in mod_builder list.` first, and the
+  orchestrator's `` modification '<name>' names no builder (`type`) ... ``
+  for an item that reaches it anyway.
   **`type: <alias>`** behaves exactly as the builder's name: the loader
   rewrites it.
 - **AWS versus GCE runtime**: the lines are identical; only the `only`
@@ -479,7 +497,7 @@ integer mode no higher than `0777`, and not every kind empty); an item
 with none of `script`, `scripts`, `ensure`; an item `type:` that names no
 builder; an item with no `type:` when no mod builder is the default; a
 builder declaring both `configuration_user` and `execute_command`, or
-the removed `extra_arguments` (stage 63). Each is a
+`extra_arguments`. Each is a
 `ValueError` (or `KeyError` for the type) that stops the load; the CLI
 prints it and exits 1. Nothing loads, so nothing is generated.
@@ -532,81 +550,41 @@ failure prints `FAIL <image>/<mod>: rc=...` on stderr and exits 1. A
 ## When it fails
-Failures that have happened, in date order:
-- **2026-08-27, three defects found in the pre-V2 builder**
-  ([LEDGER](../../docs/history/LEDGER.md), "Finding 2026-08-27"). Every
-  item resolved to the default mod builder (the lookup used the field name
-  `modifications`, not the item's `type`), so a bash item was recorded as
-  `ansible-default` with no content; the bash builder wrote raw lines and an
-  `exit 0` straight into the build file, so any real bash item failed
-  `packer validate`; and `scripts:` was not a field, so files were dropped.
-  Fixed at gate 8; guarded by
-  [test_v2_gate8_modifications.py](../../tests/test_v2_gate8_modifications.py)
-  and [tests/test_bash_provisioner.py](tests/test_bash_provisioner.py). If
-  a comment line ever appears outside a `provisioner "shell" {` block, or
-  `exit 0` appears in a build file, this regressed.
-- **2026-09-10, the first `full-test`'s mod-test leg could not start a
-  container** for an EL 10 image: Docker Hub's `rockylinux` library stops at
-  9. The stand-in for `rhel` 10 and above is `almalinux:<version>` since
-  (`test_image_for` in [mod_tests.py](../base/src/cs_image_system/base/mod_tests.py)).
-  Symptom then: `docker run` failed to pull and the bash item's test never
-  ran. If `test-mods` reports `unsupported` with
-  `no local test image for the root OS family`, the family/version has no
-  stand-in; set `local_test_image` on the OS builder.
-- **Found live, undated, in the sibling shell emitter for image tests**
-  ([v2_provisioners.py](../packer-plugin/src/cs_image_system/packer_plugin/v2_provisioners.py)):
-  an `rpm --qf '%{NAME}'` line broke `packer fmt`, because `%{` and `${`
-  open Packer template directives. This plugin's `_hcl_string` escapes both
-  the same way. If `packer fmt` or `validate` ever reports
-  `Invalid template directive` or `Invalid template interpolation` on a
-  line you wrote, the escape regressed; the line in `generated/` should
-  read `%%{` / `$${`.
-- **2026-09-20, an assertion that could not fail** (image `tests:`, not this
-  plugin, but the same shell and the same trap;
-  [OPERATIONS.md](../../docs/OPERATIONS.md), "What a green bake proves").
-  Under `sh -e`, a command inside an AND-OR list other than the last does
-  not abort the script, so a `script:` line written `check || { echo no; }`
-  never fails the build however false `check` is. Two bakes went green
-  asserting a package that did not exist. If a `script` line must be able
-  to stop the bake, end it in something that exits nonzero (`|| exit 1`),
-  not in a braced group that returns 0. The plugin's own `commands` form,
-  `( unless ) || { run; }`, is deliberate: the group is the LAST element,
-  so a failing `run` does abort.
-- **2026-09-23, an item declared with the builder's alias failed at
-  generation** (found while writing this README, on a copy of the fixture
-  with `type: bash` on `derivative-setup`). Load and `validate` passed; the
-  run log then showed
-  `AssertionError: No mod builder bash found in context for imgfile-basic-dask`
-  and the summary was `ok: false` with no validation errors. Fixed by
-  stage 63 item 15 (2026-09-25): the loader rewrites the alias to the
-  builder's name, and `tests/test_v2_defects_loading.py` generates that
-  same fixture copy.
-Failures the code raises that have not been seen outside tests:
+Incidents that have happened, with their cause and fix, are recorded on
+[INCIDENTS.md](../../docs/INCIDENTS.md); what follows keeps each
+failure's symptom, its meaning and what to do.
+Symptoms of the emission and of the bake, with what each means and what
+to do:
 | What you see | Where | Meaning and what to do |
 |---|---|---|
+| A `# Modifications for ...` comment line outside a `provisioner "shell" {` block, or `exit 0` in a build file | `generated/`; `packer validate` fails | The builder wrote raw lines into the build file instead of provisioner blocks. [tests/test_bash_provisioner.py](tests/test_bash_provisioner.py) and [test_modifications.py](../../tests/test_modifications.py) pin the block form; this is a regression of the plugin, not of the item. |
+| A bash item recorded in lineage as `ansible-default` with no content, or its script files dropped | `meta-state/lineage.yaml` after a bake | The item was resolved to the default mod builder instead of the builder its `type:` names. The same two tests pin the lookup by the item's `type`; check the item's `type:` names this builder. |
+| `test-mods` reports `unsupported` with `no local test image for the root OS family` | `test-mods` | The OS family and version have no stand-in container image (`test_image_for` in [mod_tests.py](../base/src/cs_image_system/base/mod_tests.py)): Docker Hub's `rockylinux` library stops at 9, so `rhel` 10 and above stand in as `almalinux:<version>`, and a family outside that table has none. Set `local_test_image` on the OS builder. |
+| `Invalid template directive` or `Invalid template interpolation` from `packer fmt` or `validate` on a line you wrote | the Packer plugin's run-now commands | `%{` and `${` open Packer template directives; this plugin's `_hcl_string` escapes both as `%%{` / `$${` (the sibling shell emitter for image tests, [v2_provisioners.py](../packer-plugin/src/cs_image_system/packer_plugin/v2_provisioners.py), does the same). If the line in `generated/` does not read so, the escape regressed. |
+| A `script:` line written `check || { echo no; }` never fails the build however false `check` is | the bake, green | Under `sh -e` a command inside an AND-OR list other than the last does not abort the script, so a bake can go green asserting a package that does not exist (the same trap holds for an image's `tests:`; [OPERATIONS.md](../../docs/OPERATIONS.md), "What a green bake proves"). If a `script` line must be able to stop the bake, end it in something that exits nonzero (`\|\| exit 1`), not in a braced group that returns 0. The plugin's own `commands` form, `( unless ) \|\| { run; }`, is deliberate: the group is the LAST element, so a failing `run` does abort. |
+| `AssertionError: No mod builder bash found in context for <image>` in the run log, summary `ok: false` with no validation errors, after load and `validate` passed | generation | An item's `type:` reached generation as the builder's alias; the loader rewrites an alias to the builder's name at load (`tests/test_modifications.py` generates a fixture copy with `type: bash`), so a tree whose loader does not is on an older form ([the stage index](../../docs/CHANGES.md#s63)). Write the builder's name, or update. |
 | `Bash modification '<name>' must supply 'script' (inline lines), 'scripts' (script files) and/or 'ensure' (declarative, idempotent)` | load; CLI exit 1 | The item has none of the three (a `config:`-only item). Add one or remove the item. |
 | `Bash modification '<name>': unknown ensure keys ['users']` | load; CLI exit 1 | Only `packages`, `files`, `services`, `commands` exist. Move anything else to `commands`. |
 | A pydantic error naming a key (`Extra inputs are not permitted`) on the builder or the item | load; CLI exit 1 | A misspelt or foreign key (`playbooks:` on a bash item, `script:` on an ansible item). Check the item's `type:` reaches the builder you meant; `type: default` reaches the default builder, which in the fixture is ansible. |
-| ``<builder>: `parameters` was retired (stage 26) ...`` | load; CLI exit 1 | Delete `parameters:` from the builder. |
+| ``<builder>: `parameters` was retired ...`` | load; CLI exit 1 | Delete `parameters:` from the builder. |
 | `KeyError: Could not resolve builder '<type>' referenced in Image(...)` | load; CLI exit 1 | The item's `type:` names no `mod_builders:` entry. |
-| `` mod builder '<name>': `configuration_user` and `execute_command` both say how the script runs; declare one `` | load; CLI exit 1 | Stage 63. `configuration_user` writes its own `execute_command`; keep one. To run as another user with a custom command, put the `sudo su - <user>` in your `execute_command`. |
-| A pydantic unknown-key error naming `extra_arguments` on a `bash-remote` builder | load; CLI exit 1 | Stage 63 removed the field (it was never read). Delete it; change the invocation with `execute_command`. |
-| `No default builder found in mod_builder list.` | load; CLI exit 1 | No mod builder says `is_default: true`. Mark one, or give every item a `type:`. The orchestrator's own form, for an item that reaches it, is `` modification '<name>' names no builder (`type`) and no mod builder is `is_default: true`; name one with `type:` or mark a default `` (stage 63; it used to be an `AttributeError` at generation). |
+| `` mod builder '<name>': `configuration_user` and `execute_command` both say how the script runs; declare one `` | load; CLI exit 1 | `configuration_user` writes its own `execute_command`; keep one. To run as another user with a custom command, put the `sudo su - <user>` in your `execute_command`. |
+| A pydantic unknown-key error naming `extra_arguments` on a `bash-remote` builder | load; CLI exit 1 | The field does not exist. Delete it; change the invocation with `execute_command`. |
+| `No default builder found in mod_builder list.` | load; CLI exit 1 | No mod builder says `is_default: true`. Mark one, or give every item a `type:`. The orchestrator's own form, for an item that reaches it, is `` modification '<name>' names no builder (`type`) and no mod builder is `is_default: true`; name one with `type:` or mark a default ``. |
 | `Executable bash specified for provider bash-remote not found in executables list.` | `validate`; exit 1 | Add a `bash` entry to `cfg/executables.yml` or change the builder's `executable:`. |
 | `bash: binary '/usr/local/bin/bash' not found (declared in cfg/executables.yml; an absolute path, or a name on PATH)` | `validate` and every run; exit 1 | The pinned path is wrong on this machine. Symlink the binary there or fix `binary:`. |
 | ``bash: BashVersionChecker could not parse a version from `/usr/local/bin/bash --version` `` | `validate` and every run | The first line of `--version` has no `version N.N`. Something other than bash is at that path. |
 | `bash 5.3.15 does not meet its requirement <spec> (cfg/executables.yml)` | `validate` and every run | The floor moved or the machine is behind. |
 | `FileNotFoundError: Bash modification script mod_image.sh does not exist or is not a file` | generation; run `ok: false`, traceback in the log | The path is resolved from the configuration root, not from the image file's directory or the shell's. Fix the path or `--root-dir`. |
 | `Bash modification '<name>': ensure declares [...] but every one is empty, so it would emit nothing` | load; CLI exit 1 | Every `ensure` list is empty. Fill one or drop `ensure`. |
-| `Bash modification '<name>': ensure.files[N]: `path` is required` (or `ensure.commands[N]: `run` is required`) | load; CLI exit 1 | A `files` entry without `path`, or a `commands` entry without `run`. Before stage 63 this was a `KeyError` at generation. |
-| `Bash modification '<name>': ensure.packages must be a list of package names, not str 'git'` | load; CLI exit 1 | `packages:` (or `services:`) given as a string; the old code iterated its letters. Write a list (`packages: [git]`). |
+| `Bash modification '<name>': ensure.files[N]: `path` is required` (or `ensure.commands[N]: `run` is required`) | load; CLI exit 1 | A `files` entry without `path`, or a `commands` entry without `run`. |
+| `Bash modification '<name>': ensure.packages must be a list of package names, not str 'git'` | load; CLI exit 1 | `packages:` (or `services:`) given as a string, which shell would iterate letter by letter. Write a list (`packages: [git]`). |
 | `Bash modification '<name>': ensure.files[N].mode 644 is not a mode YAML could have read from octal` | load; CLI exit 1 | An unquoted `644`, which YAML reads as a decimal number. Write `mode: "0644"`. |
 | `Bash modification '<name>': ensure.files[N]: unknown keys [...]` | load; CLI exit 1 | Only `path`, `content`, `mode` on a file and `run`, `unless` on a command. |
 | `csis ensure: no dnf, yum or apt-get to install <pkg>` | apply / `test-mods` | The image has none of the three package managers. Use a `script` line with the one it has. |
-| `dnf` (or `yum`, `apt-get`) error on a package step | apply / `test-mods` | The first package manager found could not install the package, and its message is the real one (no match, no repository, no network from the build subnet). Before stage 63 the line fell through to `apt-get` and showed `apt-get: command not found` last on an EL host. |
+| `dnf` (or `yum`, `apt-get`) error on a package step | apply / `test-mods` | The first package manager found could not install the package, and its message is the real one (no match, no repository, no network from the build subnet); the others are never tried, so no misleading `apt-get: command not found` follows it on an EL host. |
 | `cmp: command not found` or `base64: command not found` | apply | The image lacks diffutils / coreutils. Add the package to an earlier item's `ensure.packages` or a `script` line. |
 | `sudo: a terminal is required to read the password` | apply | The bake ssh user has no passwordless `sudo`. This is an OS builder / runtime matter, not the item's. |
 | `Failed to enable unit: Unit <svc>.service does not exist` | apply | `services:` names a unit the image has not installed yet; install it earlier in the same item's `packages` (packages run before services). |
@@ -638,20 +616,20 @@ Failures the code raises that have not been seen outside tests:
   [abstract_version_checker.py](../base/src/cs_image_system/base/basic/abstract_version_checker.py).
 - The image builder that calls it and hosts its output:
   [packer-plugin](../packer-plugin)
-  ([packer_ebs_builder.py](../packer-plugin/src/cs_image_system/packer_plugin/packer_ebs_builder.py),
+  ([packer_image_builder.py](../packer-plugin/src/cs_image_system/packer_plugin/packer_image_builder.py),
   [v2_local_mods.py](../packer-plugin/src/cs_image_system/packer_plugin/v2_local_mods.py)).
 - Lineage records for modifications:
   [lineage.py](../base/src/cs_image_system/base/lineage.py) (`mod_records`);
   the release gate in [release.py](../base/src/cs_image_system/base/release.py).
 - Tests: [tests/test_bash_provisioner.py](tests/test_bash_provisioner.py)
   (two blocks for files plus inline, builder options, script copying);
-  [test_v2_gate8_modifications.py](../../tests/test_v2_gate8_modifications.py)
+  [test_modifications.py](../../tests/test_modifications.py)
   (both kinds emitted, unknown type refused, the load rule);
-  [test_v2_explore_local_mods.py](../../tests/test_v2_explore_local_mods.py)
+  [test_modifications.py](../../tests/test_modifications.py)
   (`ensure` guards, idempotence recorded, the bundle);
-  [test_v2_explore_mod_tests.py](../../tests/test_v2_explore_mod_tests.py)
+  [test_mod_tests.py](../../tests/test_mod_tests.py)
   (the container tests on the fixture's bash item);
-  [test_v2_hygiene_three.py](../../tests/test_v2_hygiene_three.py)
+  [test_version_checks.py](../../tests/test_version_checks.py)
   (`BashVersionChecker` found by name, versions judged).
 - No terraform modules and no hashicorp-utils usage: the plugin writes
   Packer provisioner lines directly.

{cs_image_system_bash_mod_plugin-0.1.6 → cs_image_system_bash_mod_plugin-0.1.8}/README.md RENAMED Viewed

@@ -39,18 +39,15 @@ How a YAML entry selects these classes:
   looks the builder up by name or alias, reads the builder's own `type`
   (`bash-remote`) and loads the item into the class registered under that
   service key for `MOD_BUILDER_ITEM_MODEL`: `BashModItemModel`. The
-  registry alone decides; the builder model's
-  `get_target_deferred_type_by_VCT` method, which also named that class
-  and had no caller, is gone (stage 63, 2026-09-25), as is the plugin's
-  empty `helpers.py`.
-- **The item's `type` is rewritten to the builder's `name` at load**
-  (stage 63 item 15). The image builder later fetches the builder with
+  registry alone decides.
+- **The item's `type` is rewritten to the builder's `name` at load.**
+  The image builder later fetches the builder with
   `ctx.mod_builders.get(mod.get_type())`, a map keyed by builder NAME
-  only, so an alias must not survive the load. An item declared
-  `type: bash` (the fixture builder's alias) is loaded as
-  `type: bash-remote`. Before 2026-09-25 the alias was kept, and
-  generation stopped with
+  only, so an alias must not survive the load: a kept alias would stop
+  generation with
   `AssertionError: No mod builder bash found in context for <image>`.
+  An item declared `type: bash` (the fixture builder's alias) is loaded
+  as `type: bash-remote`.
 - An `executables:` entry named `bash` is version-checked by
   `BashVersionChecker` (regex `.*version\s+([\d\.]+)` over
   `bash --version`).
@@ -64,21 +61,31 @@ Defined in [bash_models.py](src/cs_image_system/bash_mod_plugin/bash_models.py).
 [`ModBuilderModel`](../base/src/cs_image_system/base/models/mod_builder.py),
 which adds nothing to
 [`BuilderModel`](../base/src/cs_image_system/base/models/builder_model.py)
-(`name`, `type`, `description`, `aliases`, `executable`, `is_default`,
-`config`, `gitignore`, `tags`). `BashModBuilderModel` is the registered
-subclass; it adds no fields.
-| Field | Type | Default | Meaning |
-|---|---|---|---|
-| `execute_command` | `str \| None` | `None` | Emitted as `execute_command = "..."` on every shell provisioner of every item (Packer's command template, for example `sudo -E bash '{{.Path}}'`). The way to change how the script is invoked. May not be declared together with `configuration_user`. |
-| `configuration_user` | `str \| None` | `None` | When set, every shell provisioner of this builder gets `execute_command = "chmod +x {{ .Path }}; sudo su - <user> -c '{{ .Vars }} {{ .Path }}'"`, so each item's lines run as that user; the bake user only launches them (stage 63; declared and not read until 2026-09-25). Declaring it together with `execute_command` is refused at load. |
-| `environment_vars` | `list[str]` | `[]` | Emitted as `environment_vars = [...]` on every shell provisioner. |
-| `expect_disconnect` | `bool` | `False` | Emits `expect_disconnect = true` on every shell provisioner. |
-`extra_arguments` is not a field (stage 63): it was declared and never
-read, so it is removed, and a builder that still declares it fails to load
-with the unknown-key refusal. Use `execute_command` to change the
-invocation.
+(the common builder fields: `name`, `type`, `description`, `aliases`,
+`executable`, `is_default`, `config`, `gitignore`, `tags`;
+[CONFIGURATION section 4.1](../../docs/CONFIGURATION.md#41-fields-common-to-every-builder)
+holds that table). `BashModBuilderModel` is the registered subclass; it
+adds no fields.
+The keys this plugin adds are `execute_command`, `configuration_user`,
+`environment_vars` and `expect_disconnect`: each is a Packer
+shell-provisioner argument, emitted on every shell provisioner of every
+item of the builder.
+[CONFIGURATION section 7.2](../../docs/CONFIGURATION.md#72-bash-remote)
+holds the field table; [Configuration reference](#configuration-reference)
+below gives this plugin's reading of each key. Rules only this plugin
+enforces:
+- `execute_command` (Packer's command template, for example
+  `sudo -E bash '{{.Path}}'`) is the way to change how the script is
+  invoked. `configuration_user` writes its own: every shell provisioner
+  of the builder gets `execute_command = "chmod +x {{ .Path }}; sudo su -
+  <user> -c '{{ .Vars }} {{ .Path }}'"`, so each item's lines run as that
+  user and the bake user only launches them. Because both say how the
+  script runs, declaring them together is refused at load.
+- `extra_arguments` is not a field: a builder that declares it fails to
+  load with the unknown-key refusal. Use `execute_command` to change the
+  invocation.
 Base fields this plugin constrains: `executable` should name the `bash`
 executable (the fixture does), though the emission does not invoke it;
@@ -89,13 +96,28 @@ base-model rule). `config:` on the builder is carried but never read.
 Same file. Extends
 [`ModItemModel`](../base/src/cs_image_system/base/models/moditem_type.py)
-(`SubRootItem` -> `RootItem` -> `NameTyped`).
-| Field | Type | Default | Meaning |
-|---|---|---|---|
-| `script` | `list[str]` | `[]` | Inline command lines, run in order in one `provisioner "shell"` (`inline = [...]`). Literal shell; no templating. Blank entries are dropped. |
-| `scripts` | `list[str]` | `[]` | Script files, relative to the configuration root (the process's working directory, which the configuration load sets to the root), copied beside the Packer root and run as `scripts = [...]`. Blank entries are dropped. |
-| `ensure` | `dict[str, Any]` | `{}` | The declarative form. Allowed keys: `packages` (list of names), `files` (list of `{path, content, mode}`; `mode` defaults to `0644`), `services` (list of unit names, enabled and started), `commands` (list of `{run, unless}`; `run` executes only when `unless` fails). Every entry is validated at load by `validate_ensure` (stage 63 item 16): a wrong shape, an unknown key, a bad mode or an all-empty mapping raises `ValueError` naming the item and the entry. |
+(`SubRootItem` -> `RootItem` -> `NameTyped`). The item's own keys are
+`script`, `scripts` and `ensure`; the inherited ones (`name`, `type`,
+`description`, `aliases`, `tags`, `config`) are the modification item's,
+tabled in
+[CONFIGURATION section 7.3](../../docs/CONFIGURATION.md#73-the-modification-item-inside-an-images-modifications),
+and [Configuration reference](#configuration-reference) below reads every
+key as this plugin does.
+- `script` is the list of inline command lines, run in order in one
+  `provisioner "shell"` (`inline = [...]`). Literal shell; no templating.
+  Blank entries are dropped.
+- `scripts` is the list of script files, relative to the configuration
+  root (the process's working directory, which the configuration load
+  sets to the root), copied beside the Packer root and run as
+  `scripts = [...]`. Blank entries are dropped.
+- `ensure` is the declarative form. Allowed keys: `packages` (list of
+  names), `files` (list of `{path, content, mode}`; `mode` defaults to
+  `0644`), `services` (list of unit names, enabled and started),
+  `commands` (list of `{run, unless}`; `run` executes only when `unless`
+  fails). Every entry is validated at load by `validate_ensure`: a wrong
+  shape, an unknown key, a bad mode or an all-empty mapping raises
+  `ValueError` naming the item and the entry.
 Validation at load: at least one of `script`, `scripts`, `ensure` must be
 non-empty, otherwise `ValueError` ("must supply 'script' (inline lines),
@@ -118,15 +140,13 @@ Derived behaviour:
 - `remap_self_with_copied_assets(copied)`: replaces each `scripts` entry
   with its copied path when present in the mapping.
-Inherited item fields:
-| Base field | From | Default | Use in this plugin |
-|---|---|---|---|
-| `name` | `NameTyped` | required | Names the provisioner comment and the local bundle directory (`NN-<name>`). |
-| `type` | `ModItemModel` | `default` | Foreign key to a `mod_builders:` entry (see above). |
-| `description`, `aliases`, `tags` | `NameTyped` / `RootItem` | | Carried; not emitted. |
-| `config` | `RootItem` | `{}` | Not read by this plugin. It takes part in the lineage content hash of the modification and nothing else. |
-| `_model_id` | `ModItemModel` | set at load | The owning image's global id; `identified_model` resolves to the image. |
+Of the inherited fields, `name` names the provisioner comment and the
+local bundle directory (`NN-<name>`); `type` is the foreign key to a
+`mod_builders:` entry (see above); `description`, `aliases` and `tags`
+are carried and not emitted; `config` is not read by this plugin and
+takes part in the lineage content hash of the modification and nothing
+else; `_model_id`, set at load, is the owning image's global id, and
+`identified_model` resolves to the image.
 ### A modification item with only `config:`
@@ -155,10 +175,11 @@ calls, in order:
    `scripts` to `<block_dir>/<script path>` and returns
    `{script: script path}`. The source is resolved against the process's
    current working directory; the configuration load has already changed
-   directory to the configuration root (`--root-dir`, else
-   `working_directory` in `cfg/_config.yml`, else `.`), so in practice the
-   path is root-relative. A missing file raises `FileNotFoundError`; an
-   absolute path is not copied and is left in place.
+   directory to the configuration root (`--root-dir`, else the directory
+   the command was started from; `working_directory` in `cfg/_config.yml`
+   is not read), so the path is root-relative. A missing file raises
+   `FileNotFoundError`; an absolute path is not copied and is left in
+   place.
 2. `mod.remap_self_with_copied_assets(mapping)` on the item. Because the
    mapping's value is the same relative path the copy was placed at, the
    item's `scripts` entries keep their text; the emitted `scripts = [...]`
@@ -167,8 +188,8 @@ calls, in order:
 4. `generate_items_during_modification(image, mod, image_builder, phase, build_path)`:
    - `inline` = `ensure_lines()` followed by the `script` lines; `scripts`
      = the script files. When both lists are empty it logs a warning and
-     emits nothing; since stage 63 item 16 an all-empty `ensure` is
-     refused at load, so an item can no longer reach this.
+     emits nothing; an all-empty `ensure` is refused at load, so an item
+     cannot reach this.
    - Appends `# Modifications for <item name> of type <item type> (shell)`.
    - Then, because Packer's shell provisioner takes either `scripts` or
      `inline` but never both, one or two `provisioner "shell"` blocks:
@@ -181,7 +202,7 @@ calls, in order:
      with a `configuration_user`, `chmod +x {{ .Path }}; sudo su - <user>
      -c '{{ .Vars }} {{ .Path }}'` (Packer's `{{ .Vars }}`, the
      environment variables, travel inside the command because `su -`
-     starts a fresh login environment), else none (stage 63).
+     starts a fresh login environment), else none.
    - Every string is rendered as an HCL literal: backslashes and double
      quotes are escaped, and `${` / `%{` become `$${` / `%%{` so shell text
      such as `dpkg-query -f='${Package}'` survives Packer's template parser.
@@ -196,9 +217,7 @@ modification bundle records the item: its directory
 `run.sh` that runs `sh '<script>'` per script file and then
 `sh ./inline.sh`, and a `MANIFEST.yaml` with `operation: bash` and the
 item's `idempotent` value. `csis-mods rerun` on the image therefore
-re-applies the declarative `ensure` form too (stage 63). Until 2026-09-25
-the `ensure` lines were not in the bundle and a rerun replayed only the
-script files and the `script` lines.
+re-applies the declarative `ensure` form too.
 ## Emission
@@ -300,8 +319,8 @@ entry in `cfg/executables.yml`
 ([the fixture's](../../tests/fixtures/config/cfg/executables.yml) is
 `name: bash`, `binary: /usr/local/bin/bash`, no `version`), because
 `validate` checks every builder's `executable` against that list and every
-run checks every declared entry (stage 48: the binary must exist as an
-absolute path or a name on `PATH`, `BashVersionChecker` must parse a version
+run checks every declared entry (the binary must exist as an absolute
+path or a name on `PATH`, `BashVersionChecker` must parse a version
 from `<binary> --version`, and when the entry declares `version:` the parsed
 version must satisfy it). That is the whole extent of the plugin's use of a
 local bash: it is looked at, never run. The fixture declares no floor;
@@ -338,8 +357,8 @@ in `ensure` lines works there too.
 **How the plugin finds things.** The builder by the item's `type:` (the
 builder's name); the item class by the builder's `type: bash-remote`; the
 `bash` entry by the builder's `executable:`; script files by path relative
-to the configuration root (the working directory the load selects from
-`--root-dir`, else `cfg/_config.yml`'s `working_directory`, else `.`); the
+to the configuration root (the working directory the load changes into:
+`--root-dir`, else the directory the command was started from); the
 build VM through the image builder that hosts the emission. No environment
 variable, profile or file of its own.
@@ -349,7 +368,7 @@ variable, profile or file of its own.
 Every key the model accepts. An unknown key is refused at load
 (`extra="forbid"` in the shared model config), and `parameters:` is refused
-by name (retired in stage 26).
+by name.
 | Field | Type | Default | Meaning |
 |---|---|---|---|
@@ -363,24 +382,24 @@ by name (retired in stage 26).
 | `gitignore` | list[str] | `[]` | Accepted by the base model; nothing in this plugin reads it. |
 | `tags` | mapping | `{}` | Accepted, not read. |
 | `execute_command` | str or null | `null` | Emitted verbatim (HCL-escaped) as `execute_command` on every shell block of every item of this builder. Refused together with `configuration_user`. |
-| `configuration_user` | str or null | `null` | Read since stage 63 (accepted and ignored until 2026-09-25): every shell block of this builder runs its lines as this user through `execute_command = "chmod +x {{ .Path }}; sudo su - <user> -c '{{ .Vars }} {{ .Path }}'"`. Refused together with `execute_command` (`... both say how the script runs; declare one`). |
+| `configuration_user` | str or null | `null` | Every shell block of this builder runs its lines as this user through `execute_command = "chmod +x {{ .Path }}; sudo su - <user> -c '{{ .Vars }} {{ .Path }}'"`. Refused together with `execute_command` (`... both say how the script runs; declare one`). |
 | `environment_vars` | list[str] | `[]` | Emitted as `environment_vars = [...]` on every shell block. |
 | `expect_disconnect` | bool | `false` | When true, `expect_disconnect = true` on every shell block. |
-| `extra_arguments` | | | Refused at load as an unknown key (removed in stage 63; it was accepted and never read). Use `execute_command`. |
+| `extra_arguments` | | | Not a field; refused at load as an unknown key. Use `execute_command`. |
 ### The item (an image's `modifications:` entry whose `type:` names this builder)
 | Field | Type | Default | Meaning |
 |---|---|---|---|
 | `name` | str | required | Unique within the image. Names the comment line, the bundle directory `NN-<name>` and the lineage record. |
-| `type` | str | `default` | The builder's name, an alias, or `default` (or omitted). Rewritten to the builder's name at load (stage 63 item 15). Omitted or `default` with no `is_default: true` mod builder: refused at load (stage 63). |
+| `type` | str | `default` | The builder's name, an alias, or `default` (or omitted). Rewritten to the builder's name at load. Omitted or `default` with no `is_default: true` mod builder: refused at load. |
 | `description` | str or null | `null` | Accepted, not read. |
 | `aliases` | list[str] | `[]` | Accepted, not read. |
 | `tags` | mapping | `{}` | Accepted, not read. |
 | `config` | mapping | `{}` | Not read by the plugin. Part of the modification's content hash, so a change re-bakes the image. Not passed to the shell. |
 | `script` | list[str] | `[]` | Inline lines, literal, in order, after the `ensure` lines. Blank and whitespace-only entries are dropped. |
 | `scripts` | list[str] | `[]` | Script files; each is copied beside the Packer root and run first, in order. Blank entries are dropped. An absolute path is not copied and is emitted as is. |
-| `ensure` | mapping | `{}` | Only the four keys below are allowed; any other key is refused at load. Every entry's values are validated at load since stage 63 item 16 (`validate_ensure`; see "What it tests and verifies"). |
+| `ensure` | mapping | `{}` | Only the four keys below are allowed; any other key is refused at load. Every entry's values are validated at load (`validate_ensure`; see "What it tests and verifies"). |
 The `ensure` keys:
@@ -401,11 +420,11 @@ The `ensure` keys:
   `idempotent: unknown`, the same as free-form alone. `ensure` lines always
   precede the `script` lines in the inline block.
 - **`ensure` whose lists are all empty** (`ensure: {packages: []}`) is
-  refused at load (stage 63 item 16). Before 2026-09-25 it passed load,
-  counted as `declared`, and emitted nothing: the builder logged
-  `Bash modification <name> has no script lines or files; nothing emitted`
-  and the bake proceeded without a provisioner for it. The bundle directory
-  still exists, with a `run.sh` that runs nothing.
+  refused at load, because such an item would count as `declared` and
+  emit nothing: the builder would log
+  `Bash modification <name> has no script lines or files; nothing emitted`,
+  the bake would proceed without a provisioner for it, and the bundle
+  directory would hold a `run.sh` that runs nothing.
 - **`commands` with `unless`** is guarded; **without `unless`** the command
   runs on every bake and on every `csis-mods rerun`, so the item is
   idempotent only if the command is.
@@ -415,7 +434,7 @@ The `ensure` keys:
 - **`execute_command` set** puts that template on every block of every
   item of the builder; **`configuration_user` set** instead puts
   `chmod +x {{ .Path }}; sudo su - <user> -c '{{ .Vars }} {{ .Path }}'`
-  there, so the lines run as that user (stage 63); **both set** is refused
+  there, so the lines run as that user; **both set** is refused
   at load; **neither**, Packer's default applies and the lines run as the
   bake user. The same for
   `environment_vars` (emitted only when non-empty) and `expect_disconnect`
@@ -424,11 +443,10 @@ The `ensure` keys:
   `type`** reaches whichever mod builder is `is_default: true`; in the
   fixture that is `ansible-default`, so the item is loaded as an ANSIBLE
   item and its `script`/`scripts`/`ensure` keys are refused as unknown.
-  With no `is_default: true` mod builder at all, the load is refused
-  (stage 63): `No default builder found in mod_builder list.` first, and
-  the orchestrator's `` modification '<name>' names no builder (`type`) ... ``
-  for an item that reaches it anyway. Until 2026-09-25 such an item
-  became an `AttributeError` at generation.
+  With no `is_default: true` mod builder at all, the load is refused:
+  `No default builder found in mod_builder list.` first, and the
+  orchestrator's `` modification '<name>' names no builder (`type`) ... ``
+  for an item that reaches it anyway.
   **`type: <alias>`** behaves exactly as the builder's name: the loader
   rewrites it.
 - **AWS versus GCE runtime**: the lines are identical; only the `only`
@@ -463,7 +481,7 @@ integer mode no higher than `0777`, and not every kind empty); an item
 with none of `script`, `scripts`, `ensure`; an item `type:` that names no
 builder; an item with no `type:` when no mod builder is the default; a
 builder declaring both `configuration_user` and `execute_command`, or
-the removed `extra_arguments` (stage 63). Each is a
+`extra_arguments`. Each is a
 `ValueError` (or `KeyError` for the type) that stops the load; the CLI
 prints it and exits 1. Nothing loads, so nothing is generated.
@@ -516,81 +534,41 @@ failure prints `FAIL <image>/<mod>: rc=...` on stderr and exits 1. A
 ## When it fails
-Failures that have happened, in date order:
-- **2026-08-27, three defects found in the pre-V2 builder**
-  ([LEDGER](../../docs/history/LEDGER.md), "Finding 2026-08-27"). Every
-  item resolved to the default mod builder (the lookup used the field name
-  `modifications`, not the item's `type`), so a bash item was recorded as
-  `ansible-default` with no content; the bash builder wrote raw lines and an
-  `exit 0` straight into the build file, so any real bash item failed
-  `packer validate`; and `scripts:` was not a field, so files were dropped.
-  Fixed at gate 8; guarded by
-  [test_v2_gate8_modifications.py](../../tests/test_v2_gate8_modifications.py)
-  and [tests/test_bash_provisioner.py](tests/test_bash_provisioner.py). If
-  a comment line ever appears outside a `provisioner "shell" {` block, or
-  `exit 0` appears in a build file, this regressed.
-- **2026-09-10, the first `full-test`'s mod-test leg could not start a
-  container** for an EL 10 image: Docker Hub's `rockylinux` library stops at
-  9. The stand-in for `rhel` 10 and above is `almalinux:<version>` since
-  (`test_image_for` in [mod_tests.py](../base/src/cs_image_system/base/mod_tests.py)).
-  Symptom then: `docker run` failed to pull and the bash item's test never
-  ran. If `test-mods` reports `unsupported` with
-  `no local test image for the root OS family`, the family/version has no
-  stand-in; set `local_test_image` on the OS builder.
-- **Found live, undated, in the sibling shell emitter for image tests**
-  ([v2_provisioners.py](../packer-plugin/src/cs_image_system/packer_plugin/v2_provisioners.py)):
-  an `rpm --qf '%{NAME}'` line broke `packer fmt`, because `%{` and `${`
-  open Packer template directives. This plugin's `_hcl_string` escapes both
-  the same way. If `packer fmt` or `validate` ever reports
-  `Invalid template directive` or `Invalid template interpolation` on a
-  line you wrote, the escape regressed; the line in `generated/` should
-  read `%%{` / `$${`.
-- **2026-09-20, an assertion that could not fail** (image `tests:`, not this
-  plugin, but the same shell and the same trap;
-  [OPERATIONS.md](../../docs/OPERATIONS.md), "What a green bake proves").
-  Under `sh -e`, a command inside an AND-OR list other than the last does
-  not abort the script, so a `script:` line written `check || { echo no; }`
-  never fails the build however false `check` is. Two bakes went green
-  asserting a package that did not exist. If a `script` line must be able
-  to stop the bake, end it in something that exits nonzero (`|| exit 1`),
-  not in a braced group that returns 0. The plugin's own `commands` form,
-  `( unless ) || { run; }`, is deliberate: the group is the LAST element,
-  so a failing `run` does abort.
-- **2026-09-23, an item declared with the builder's alias failed at
-  generation** (found while writing this README, on a copy of the fixture
-  with `type: bash` on `derivative-setup`). Load and `validate` passed; the
-  run log then showed
-  `AssertionError: No mod builder bash found in context for imgfile-basic-dask`
-  and the summary was `ok: false` with no validation errors. Fixed by
-  stage 63 item 15 (2026-09-25): the loader rewrites the alias to the
-  builder's name, and `tests/test_v2_defects_loading.py` generates that
-  same fixture copy.
-Failures the code raises that have not been seen outside tests:
+Incidents that have happened, with their cause and fix, are recorded on
+[INCIDENTS.md](../../docs/INCIDENTS.md); what follows keeps each
+failure's symptom, its meaning and what to do.
+Symptoms of the emission and of the bake, with what each means and what
+to do:
 | What you see | Where | Meaning and what to do |
 |---|---|---|
+| A `# Modifications for ...` comment line outside a `provisioner "shell" {` block, or `exit 0` in a build file | `generated/`; `packer validate` fails | The builder wrote raw lines into the build file instead of provisioner blocks. [tests/test_bash_provisioner.py](tests/test_bash_provisioner.py) and [test_modifications.py](../../tests/test_modifications.py) pin the block form; this is a regression of the plugin, not of the item. |
+| A bash item recorded in lineage as `ansible-default` with no content, or its script files dropped | `meta-state/lineage.yaml` after a bake | The item was resolved to the default mod builder instead of the builder its `type:` names. The same two tests pin the lookup by the item's `type`; check the item's `type:` names this builder. |
+| `test-mods` reports `unsupported` with `no local test image for the root OS family` | `test-mods` | The OS family and version have no stand-in container image (`test_image_for` in [mod_tests.py](../base/src/cs_image_system/base/mod_tests.py)): Docker Hub's `rockylinux` library stops at 9, so `rhel` 10 and above stand in as `almalinux:<version>`, and a family outside that table has none. Set `local_test_image` on the OS builder. |
+| `Invalid template directive` or `Invalid template interpolation` from `packer fmt` or `validate` on a line you wrote | the Packer plugin's run-now commands | `%{` and `${` open Packer template directives; this plugin's `_hcl_string` escapes both as `%%{` / `$${` (the sibling shell emitter for image tests, [v2_provisioners.py](../packer-plugin/src/cs_image_system/packer_plugin/v2_provisioners.py), does the same). If the line in `generated/` does not read so, the escape regressed. |
+| A `script:` line written `check || { echo no; }` never fails the build however false `check` is | the bake, green | Under `sh -e` a command inside an AND-OR list other than the last does not abort the script, so a bake can go green asserting a package that does not exist (the same trap holds for an image's `tests:`; [OPERATIONS.md](../../docs/OPERATIONS.md), "What a green bake proves"). If a `script` line must be able to stop the bake, end it in something that exits nonzero (`\|\| exit 1`), not in a braced group that returns 0. The plugin's own `commands` form, `( unless ) \|\| { run; }`, is deliberate: the group is the LAST element, so a failing `run` does abort. |
+| `AssertionError: No mod builder bash found in context for <image>` in the run log, summary `ok: false` with no validation errors, after load and `validate` passed | generation | An item's `type:` reached generation as the builder's alias; the loader rewrites an alias to the builder's name at load (`tests/test_modifications.py` generates a fixture copy with `type: bash`), so a tree whose loader does not is on an older form ([the stage index](../../docs/CHANGES.md#s63)). Write the builder's name, or update. |
 | `Bash modification '<name>' must supply 'script' (inline lines), 'scripts' (script files) and/or 'ensure' (declarative, idempotent)` | load; CLI exit 1 | The item has none of the three (a `config:`-only item). Add one or remove the item. |
 | `Bash modification '<name>': unknown ensure keys ['users']` | load; CLI exit 1 | Only `packages`, `files`, `services`, `commands` exist. Move anything else to `commands`. |
 | A pydantic error naming a key (`Extra inputs are not permitted`) on the builder or the item | load; CLI exit 1 | A misspelt or foreign key (`playbooks:` on a bash item, `script:` on an ansible item). Check the item's `type:` reaches the builder you meant; `type: default` reaches the default builder, which in the fixture is ansible. |
-| ``<builder>: `parameters` was retired (stage 26) ...`` | load; CLI exit 1 | Delete `parameters:` from the builder. |
+| ``<builder>: `parameters` was retired ...`` | load; CLI exit 1 | Delete `parameters:` from the builder. |
 | `KeyError: Could not resolve builder '<type>' referenced in Image(...)` | load; CLI exit 1 | The item's `type:` names no `mod_builders:` entry. |
-| `` mod builder '<name>': `configuration_user` and `execute_command` both say how the script runs; declare one `` | load; CLI exit 1 | Stage 63. `configuration_user` writes its own `execute_command`; keep one. To run as another user with a custom command, put the `sudo su - <user>` in your `execute_command`. |
-| A pydantic unknown-key error naming `extra_arguments` on a `bash-remote` builder | load; CLI exit 1 | Stage 63 removed the field (it was never read). Delete it; change the invocation with `execute_command`. |
-| `No default builder found in mod_builder list.` | load; CLI exit 1 | No mod builder says `is_default: true`. Mark one, or give every item a `type:`. The orchestrator's own form, for an item that reaches it, is `` modification '<name>' names no builder (`type`) and no mod builder is `is_default: true`; name one with `type:` or mark a default `` (stage 63; it used to be an `AttributeError` at generation). |
+| `` mod builder '<name>': `configuration_user` and `execute_command` both say how the script runs; declare one `` | load; CLI exit 1 | `configuration_user` writes its own `execute_command`; keep one. To run as another user with a custom command, put the `sudo su - <user>` in your `execute_command`. |
+| A pydantic unknown-key error naming `extra_arguments` on a `bash-remote` builder | load; CLI exit 1 | The field does not exist. Delete it; change the invocation with `execute_command`. |
+| `No default builder found in mod_builder list.` | load; CLI exit 1 | No mod builder says `is_default: true`. Mark one, or give every item a `type:`. The orchestrator's own form, for an item that reaches it, is `` modification '<name>' names no builder (`type`) and no mod builder is `is_default: true`; name one with `type:` or mark a default ``. |
 | `Executable bash specified for provider bash-remote not found in executables list.` | `validate`; exit 1 | Add a `bash` entry to `cfg/executables.yml` or change the builder's `executable:`. |
 | `bash: binary '/usr/local/bin/bash' not found (declared in cfg/executables.yml; an absolute path, or a name on PATH)` | `validate` and every run; exit 1 | The pinned path is wrong on this machine. Symlink the binary there or fix `binary:`. |
 | ``bash: BashVersionChecker could not parse a version from `/usr/local/bin/bash --version` `` | `validate` and every run | The first line of `--version` has no `version N.N`. Something other than bash is at that path. |
 | `bash 5.3.15 does not meet its requirement <spec> (cfg/executables.yml)` | `validate` and every run | The floor moved or the machine is behind. |
 | `FileNotFoundError: Bash modification script mod_image.sh does not exist or is not a file` | generation; run `ok: false`, traceback in the log | The path is resolved from the configuration root, not from the image file's directory or the shell's. Fix the path or `--root-dir`. |
 | `Bash modification '<name>': ensure declares [...] but every one is empty, so it would emit nothing` | load; CLI exit 1 | Every `ensure` list is empty. Fill one or drop `ensure`. |
-| `Bash modification '<name>': ensure.files[N]: `path` is required` (or `ensure.commands[N]: `run` is required`) | load; CLI exit 1 | A `files` entry without `path`, or a `commands` entry without `run`. Before stage 63 this was a `KeyError` at generation. |
-| `Bash modification '<name>': ensure.packages must be a list of package names, not str 'git'` | load; CLI exit 1 | `packages:` (or `services:`) given as a string; the old code iterated its letters. Write a list (`packages: [git]`). |
+| `Bash modification '<name>': ensure.files[N]: `path` is required` (or `ensure.commands[N]: `run` is required`) | load; CLI exit 1 | A `files` entry without `path`, or a `commands` entry without `run`. |
+| `Bash modification '<name>': ensure.packages must be a list of package names, not str 'git'` | load; CLI exit 1 | `packages:` (or `services:`) given as a string, which shell would iterate letter by letter. Write a list (`packages: [git]`). |
 | `Bash modification '<name>': ensure.files[N].mode 644 is not a mode YAML could have read from octal` | load; CLI exit 1 | An unquoted `644`, which YAML reads as a decimal number. Write `mode: "0644"`. |
 | `Bash modification '<name>': ensure.files[N]: unknown keys [...]` | load; CLI exit 1 | Only `path`, `content`, `mode` on a file and `run`, `unless` on a command. |
 | `csis ensure: no dnf, yum or apt-get to install <pkg>` | apply / `test-mods` | The image has none of the three package managers. Use a `script` line with the one it has. |
-| `dnf` (or `yum`, `apt-get`) error on a package step | apply / `test-mods` | The first package manager found could not install the package, and its message is the real one (no match, no repository, no network from the build subnet). Before stage 63 the line fell through to `apt-get` and showed `apt-get: command not found` last on an EL host. |
+| `dnf` (or `yum`, `apt-get`) error on a package step | apply / `test-mods` | The first package manager found could not install the package, and its message is the real one (no match, no repository, no network from the build subnet); the others are never tried, so no misleading `apt-get: command not found` follows it on an EL host. |
 | `cmp: command not found` or `base64: command not found` | apply | The image lacks diffutils / coreutils. Add the package to an earlier item's `ensure.packages` or a `script` line. |
 | `sudo: a terminal is required to read the password` | apply | The bake ssh user has no passwordless `sudo`. This is an OS builder / runtime matter, not the item's. |
 | `Failed to enable unit: Unit <svc>.service does not exist` | apply | `services:` names a unit the image has not installed yet; install it earlier in the same item's `packages` (packages run before services). |
@@ -622,20 +600,20 @@ Failures the code raises that have not been seen outside tests:
   [abstract_version_checker.py](../base/src/cs_image_system/base/basic/abstract_version_checker.py).
 - The image builder that calls it and hosts its output:
   [packer-plugin](../packer-plugin)
-  ([packer_ebs_builder.py](../packer-plugin/src/cs_image_system/packer_plugin/packer_ebs_builder.py),
+  ([packer_image_builder.py](../packer-plugin/src/cs_image_system/packer_plugin/packer_image_builder.py),
   [v2_local_mods.py](../packer-plugin/src/cs_image_system/packer_plugin/v2_local_mods.py)).
 - Lineage records for modifications:
   [lineage.py](../base/src/cs_image_system/base/lineage.py) (`mod_records`);
   the release gate in [release.py](../base/src/cs_image_system/base/release.py).
 - Tests: [tests/test_bash_provisioner.py](tests/test_bash_provisioner.py)
   (two blocks for files plus inline, builder options, script copying);
-  [test_v2_gate8_modifications.py](../../tests/test_v2_gate8_modifications.py)
+  [test_modifications.py](../../tests/test_modifications.py)
   (both kinds emitted, unknown type refused, the load rule);
-  [test_v2_explore_local_mods.py](../../tests/test_v2_explore_local_mods.py)
+  [test_modifications.py](../../tests/test_modifications.py)
   (`ensure` guards, idempotence recorded, the bundle);
-  [test_v2_explore_mod_tests.py](../../tests/test_v2_explore_mod_tests.py)
+  [test_mod_tests.py](../../tests/test_mod_tests.py)
   (the container tests on the fixture's bash item);
-  [test_v2_hygiene_three.py](../../tests/test_v2_hygiene_three.py)
+  [test_version_checks.py](../../tests/test_version_checks.py)
   (`BashVersionChecker` found by name, versions judged).
 - No terraform modules and no hashicorp-utils usage: the plugin writes
   Packer provisioner lines directly.

{cs_image_system_bash_mod_plugin-0.1.6 → cs_image_system_bash_mod_plugin-0.1.8}/pyproject.toml RENAMED Viewed

@@ -4,7 +4,7 @@
 [project]
 name = "cs-image-system-bash-mod-plugin"
-version = "0.1.6"
+version = "0.1.8"
 description = "The shell modification plugin: inline script, script files and an ensure form become Packer shell provisioners"
 readme = "README.md"
 authors = [{ name = "Mykel Alvis", email = "mykelalvis@infrastructurebuilder.org" }]
@@ -12,8 +12,8 @@ license = "Apache-2.0"
 license-files = ["LICENSE"]
 requires-python = ">=3.13"
 dependencies = [
-    "cs-image-system-contract==0.1.6",
-    "cs-image-system-base==0.1.6",
+    "cs-image-system-contract>=0.4,<0.5",
+    "cs-image-system-base==0.1.8",
     "pydantic>=2.13",
 ]

{cs_image_system_bash_mod_plugin-0.1.6 → cs_image_system_bash_mod_plugin-0.1.8}/src/cs_image_system/bash_mod_plugin/bash_builder.py RENAMED Viewed

@@ -9,17 +9,15 @@ import shutil
 from pathlib import Path
 from typing import TypeVar, cast
-from cs_image_system.contract.assets import AssetSet
-from cs_image_system.base.bake_steps import execute_command_line
-from .bash_models import BASH_BUILDER, BASH_EXECUTABLE, BashBuilderModel, BashModItemModel, BashModBuilderModel
 from cs_image_system.base.basic.abstract_version_checker import AbstractVersionChecker
+from cs_image_system.base.basic.builder_base_image import ImageBuilderBase, build_target_label_of
 from cs_image_system.base.basic.builder_base_mod import ModBuilderBase
-from cs_image_system.contract.lifecycle import ExecutionLifecyclePhase
 from cs_image_system.base.models.image import Image
-from cs_image_system.base.basic.builder_base_image import ImageBuilderBase
 from cs_image_system.base.models.moditem_type import ModItemModel
-from cs_image_system.base.basic.builder_base_image import build_target_label_of
+from cs_image_system.contract.assets import AssetSet
+from cs_image_system.contract.lifecycle import ExecutionLifecyclePhase
+from .bash_models import BASH_BUILDER, BASH_EXECUTABLE, BashBuilderModel, BashModBuilderModel, BashModItemModel
 log = logging.getLogger(__name__)
@@ -81,14 +79,14 @@ class BashModBuilder(ModBuilderBase[Q]):
         for body in parts:
             lines += ['provisioner "shell" {', f'  only = ["{build_target_label_of(ibb, image)}"]']
             lines += body
-            command = self.model.effective_execute_command()     # stage 63: configuration_user
+            command = self.model.effective_execute_command()     # configuration_user
             if command:
                 lines.append(f"  execute_command = {_hcl_string(command)}")
             else:
-                # stage 86: through the bake's step runner, so `ensure: packages`
+                # through the bake's step runner, so `ensure: packages`
                 # and a script's own installs wait out a held package database;
                 # a builder that says how its script runs keeps its own command
-                lines.append(execute_command_line("  "))
+                lines.append(self._get_context().services.commands.execute_command_line("  "))
             if self.model.environment_vars:
                 lines.append("  environment_vars = [" + ", ".join(_hcl_string(v) for v in self.model.environment_vars) + "]")
             if self.model.expect_disconnect:

{cs_image_system_bash_mod_plugin-0.1.6 → cs_image_system_bash_mod_plugin-0.1.8}/src/cs_image_system/bash_mod_plugin/bash_models.py RENAMED Viewed

@@ -4,13 +4,15 @@
 import re
 from dataclasses import field
-from cs_image_system.contract.model_config import CSIS_MODEL_CONFIG
-from pydantic.dataclasses import dataclass  # stage 23: validation at construction
 from pathlib import Path
 from typing import Any
+from pydantic.dataclasses import dataclass  # validation at construction
 from cs_image_system.base.models.mod_builder import ModBuilderModel
 from cs_image_system.base.models.moditem_type import ModItemModel
+from cs_image_system.contract.model_config import CSIS_MODEL_CONFIG
 BASH_EXECUTABLE: str = "bash"
 BASH_BUILDER: str = "bash-remote"
@@ -31,8 +33,8 @@ def _mode_text(mode: Any) -> str:
     """A file mode as the four-digit octal text ``install -m`` takes.
     YAML reads an unquoted ``0644`` as the integer 420, so an integer is
-    rendered back in octal (stage 63 item 16, decided 2026-09-25); a
-    string must already be three or four octal digits."""
+    rendered back in octal; a string must already be three or four octal
+    digits."""
     if isinstance(mode, bool):
         raise ValueError(f"mode {mode!r} is not a file mode")
     if isinstance(mode, int):
@@ -74,8 +76,8 @@ def _entries(label: str, kind: str, value: Any, allowed: set[str], required: str
 def validate_ensure(label: str, ensure: Any) -> dict[str, Any]:
-    """Every ``ensure`` entry checked at load, one rule per kind (stage 63
-    item 16). A valid mapping comes back UNCHANGED except that an integer
+    """Every ``ensure`` entry checked at load, one rule per kind. A valid
+    mapping comes back UNCHANGED except that an integer
     file mode becomes its octal text: the lineage fingerprint hashes this
     mapping, so a tree that was already valid keeps every fingerprint.
@@ -171,7 +173,7 @@ class BashModItemModel(ModItemModel):
         pkgs = [str(p) for p in self.ensure.get("packages", []) or []]
         if pkgs:
             joined = " ".join(pkgs)
-            # stage 63 item 16: the FIRST package manager that exists installs,
+            # the FIRST package manager that exists installs,
             # and its failure is the failure (the old chain fell through dnf,
             # yum and apt-get, so an EL host showed `apt-get: command not found`)
             out.append(f"for p in {joined}; do rpm -q \"$p\" >/dev/null 2>&1 || dpkg -s \"$p\" >/dev/null 2>&1 || "
@@ -202,7 +204,7 @@ class BashBuilderModel(ModBuilderModel):
     """Dataclass representing a Bash script modification.
     """
     type = BASH_BUILDER
-    # stage 63: when set, every item's lines run as this user -- the shell
+    # when set, every item's lines run as this user -- the shell
     # provisioner's execute_command becomes `sudo su - <user> -c '...'`, so the
     # bake user only launches them. Declaring it with execute_command is
     # refused (one of the two decides how the script runs).

{cs_image_system_bash_mod_plugin-0.1.6 → cs_image_system_bash_mod_plugin-0.1.8}/src/cs_image_system/bash_mod_plugin/main.py RENAMED Viewed

@@ -3,10 +3,12 @@
 # SPDX-License-Identifier: Apache-2.0
 import logging
-from .bash_builder import  BashModBuilder, BashVersionChecker
-from .bash_models import BASH_BUILDER, BASH_EXECUTABLE, BashModItemModel, BashModBuilderModel
 from cs_image_system.base.basic.abstract_plugin_metadata import AbstractPluginMetadata
+from .bash_builder import BashModBuilder, BashVersionChecker
+from .bash_models import BASH_BUILDER, BASH_EXECUTABLE, BashModBuilderModel, BashModItemModel
 log = logging.getLogger(__name__)
 class BashModTypes(AbstractPluginMetadata):

{cs_image_system_bash_mod_plugin-0.1.6 → cs_image_system_bash_mod_plugin-0.1.8}/tests/test_bash_provisioner.py RENAMED Viewed

@@ -7,26 +7,34 @@ from pathlib import Path
 from types import SimpleNamespace
 from typing import Any, cast
+from cs_image_system.base.bake_steps import execute_command_line
 from cs_image_system.bash_mod_plugin.bash_builder import BashModBuilder
 from cs_image_system.bash_mod_plugin.bash_models import BashModItemModel
-from cs_image_system.base.lifecycle import ExecutionLifecyclePhase
+from cs_image_system.contract.lifecycle import ExecutionLifecyclePhase
 def _builder(**model_fields):
     fields = {"execute_command": None, "environment_vars": [], "expect_disconnect": False}
     fields.update(model_fields)
     model = SimpleNamespace(**fields)
-    # stage 63: the builder asks the model how the script runs
+    # the builder asks the model how the script runs
     model.effective_execute_command = lambda: model.execute_command
     b = BashModBuilder.__new__(BashModBuilder)
     b._model = model  # type: ignore[attr-defined]
+    # the builder asks its run's commands service for the execute_command
+    # line; a builder made here is bound to a stand-in that answers with the
+    # kit's own (the loader binds a real one)
+    b.bind(cast(Any, SimpleNamespace(services=SimpleNamespace(
+        commands=SimpleNamespace(execute_command_line=execute_command_line)))))
     return b
 def _emit(builder, mod):
     image = SimpleNamespace(name="img")
+    # the image builder labels the build target through its runtime; a stub answers here
+    ibb = SimpleNamespace(build_target_label=lambda img: f"amazon-ebs.{img.name}")
     items = builder.generate_items_during_modification(
-        image, mod, cast(Any, None), ExecutionLifecyclePhase.IMAGE_GENERATION, Path("build.pkr.hcl"))
+        image, mod, cast(Any, ibb), ExecutionLifecyclePhase.IMAGE_GENERATION, Path("build.pkr.hcl"))
     return "\n".join(a.value for a in items)

{cs_image_system_bash_mod_plugin-0.1.6 → cs_image_system_bash_mod_plugin-0.1.8}/LICENSE RENAMED Viewed

File without changes

{cs_image_system_bash_mod_plugin-0.1.6 → cs_image_system_bash_mod_plugin-0.1.8}/src/cs_image_system/bash_mod_plugin/__init__.py RENAMED Viewed

File without changes

{cs_image_system_bash_mod_plugin-0.1.6 → cs_image_system_bash_mod_plugin-0.1.8}/src/cs_image_system/py.typed RENAMED Viewed

File without changes

cs-image-system-bash-mod-plugin 0.1.6__tar.gz → 0.1.8__tar.gz

cs-image-system-bash-mod-plugin 0.1.6tar.gz → 0.1.8tar.gz