The platform's managed interpreter is /usr/local/bin/python3, so every
package sys-pip-install puts system-wide lands its commands in
/usr/local/bin. CentOS Stream's sudoers pins secure_path to
/sbin:/bin:/usr/sbin:/usr/bin, so any escalated shell the administrator runs
there cannot find them. The meshed swarm arm deploys over SSH as the
administrator with sudo, and run 38864400393 failed Penpot#0 on centos at
"command -v baudolo" right after backup-docker-to-local installed; Fedora,
Debian and Ubuntu already ship /usr/local/bin in secure_path, and the direct
arm connects as root without sudo.
The path is set for the administrator only; root's and every other user's
sudo path are unchanged. Checked with the shipped file on CentOS Stream 10,
Fedora 44, Debian 13, Ubuntu and Manjaro: visudo accepts it, the
administrator finds a command in /usr/local/bin through sudo, and on CentOS
the same probe reported it missing before the change.
It builds three hosts from the repository the deploy runs from, which only
the controller holds. A swarm node, and the lab's backup host deployed in
its own compose play, no longer run it.
CLI tests are discovered by group membership alone, so a test that builds
its own fixtures from the controller's checkout ran on every host carrying
its role. The meshed swarm arm puts svc-net-wireguard on every node, and run
38864400393 failed Pretix#2, Magento and Matrix#2 with
"cd: /home/runner/work/infinito.nexus/infinito.nexus: No such file or
directory" on each node.
A role now declares cli.controller_only in meta/tests.yml, read through the
role_tests lookup like cli.timeout and cli.container_service_key, and its
test runs only on a host reached over a local connection. Every other role
runs exactly as before. Checked against a local-connection host and a
docker-connection host: svc-net-wireguard ran on the first and was skipped
on the second, and svc-net-tor ran on both.
SuiteCRM 8.10.2 tightened User::hasSaveAccess() from return true to is_admin($current_user) for a record without an id, and restrictAdminOnlyFields() now forces status Inactive on such a record. CreateUser::create() runs while the browser is still anonymous, because it is the LDAP and SAML auto-create path, so every FIRST login of a directory account ends in RuntimeException: Not authorized and HTTP 500 on POST /login. The pre-existing administrator is unaffected, which is why one persona passes and one fails in both auth modes. 451f63cbdd carried the role from 8.9.1 to 8.10.2; 8.9.1 exempted a new record from both guards.
The patch raises the admin context around that one save and restores it in a finally, rather than relaxing the guards, which stay closed for every request-driven save. create() has a single caller in its own file, createExternalAuthUser, which sets is_admin 0 and external_auth_only 1 before calling, so the raised context cannot mint an administrator. patch runs with -F0 so a hunk upstream has moved fails the build instead of landing somewhere else.
The patch path is derived once in vars/main.yml and reaches the Dockerfile as a build arg, following the role's existing SUITECRM_ENTRYPOINT_SCRIPT_* shape, so the file name is written once.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 495d23dbde)
# Conflicts:
# roles/web-app-suitecrm/vars/main.yml
Since 778c18fb23 the carrier key holds the tokens file's mtime and size.
sys-token-store changed that stat on every inclusion (00_core.yml
touched the file) and on every persisted token, and nothing re-parked a
carrier afterwards. Every later task's fresh worker then rendered the
applications SPOT cold, 30 to 80 s each. On main fea6f31d9f (run
38812964308) seven heavy jobs logged 194 to 287 such tasks and ran out
of the 20400 s budget; the same jobs before 778c18fb23 logged 65 to 83,
all of them real waits.
- 00_core.yml touches the store with modification_time and access_time
preserved, so it only creates a missing file. In swarm the controller
sees the store over NFS with attribute caching, and the touch alone
made the second pass go cold without any write.
- write.yml re-parks the carrier when the persist or the controller
mirror changed the store. Both run once, so every host that ran the
include gets the same verdict.
- tasks/utils/setup/role.yml re-parks after every role on every host,
so hosts that did not run the writing role recover too. Where the
key still matches this serves the carried payload; measured 0.1 s per
role in a local compose deploy.
- The tokens file enters the key as the SHA-256 of its content,
memoised per inode, mtime and size, so a touch no longer changes the
key. A stat that still matches serves the memo (1.67 us against
1.41 us for the old stat signature), and a stale stat keeps key and
YAML cache on the same old content instead of pairing new content
with an old key.
- applications_carrier opens the tokens file before it computes the
key, so on the NFS-mounted controller the parked key reflects the
revalidated attributes rather than a cached stat that changes a
minute later.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The last two criteria closed on fork run 38836531620, a manual steer of
svc-db-redis#0 in compose with the vpn axis enforced. Its job log shows
INFINITO_COMPOSE_VPN=true reaching the step, svc-net-wireguard deployed beside
the app and skipped on the CI host, which holds no mesh, and the CLI test of
svc-net-wireguard writing two full meshes of two members each. The inner play
passed four handshake gates and four MTU probes, and the test printed all six
reachability assertions: I and II reach each other, II and III reach each
other, I and III do not.
With nothing left open, make requirements-archive moved its heading into the
README and deleted the file.
evangelostsak
Prageeth Panicker
kevinveenbirkenbach
infinito-nexus-updater[bot]
