Skip to content

Conversation

@knuton
Copy link
Member

@knuton knuton commented Jan 20, 2026

Triggered by wanting to make deploy-update respect buildLive and buildInstaller (avoiding to build and publish ISOs), along the way

  • general cleanup of script,
  • clearer deployment summary,
  • make deployment preparation more time and space efficient,
  • automate post-deployment sanity checks from manual release steps.

Testing

Handy diff to inspect what script would do:

diff --git i/deployment/deploy-update/default.nix w/deployment/deploy-update/default.nix
index 16fdf956..2c0439f0 100644
--- i/deployment/deploy-update/default.nix
+++ w/deployment/deploy-update/default.nix
@@ -1,12 +1,12 @@
 { substituteAll
 , application, updateCert, unsignedRaucBundle, docs, installer, live
 , deployUrl, updateUrl, kioskUrl
-, rauc, awscli, python3
+, rauc, awscli, python3, coreutils
 }:
 substituteAll {
   src = ./deploy-update.py;
   dummyBuildCert = ../../pki/dummy/cert.pem;
   inherit updateCert unsignedRaucBundle docs installer live deployUrl updateUrl kioskUrl;
-  inherit rauc awscli python3;
+  inherit rauc coreutils python3;
   inherit (application) fullProductName safeProductName version;
 }
diff --git i/deployment/deploy-update/deploy-update.py w/deployment/deploy-update/deploy-update.py
index 77e9ef47..6e1bf056 100755
--- i/deployment/deploy-update/deploy-update.py
+++ w/deployment/deploy-update/deploy-update.py
@@ -29,8 +29,8 @@ DEPLOY_URL = "@deployUrl@"
 UPDATE_URL = "@updateUrl@"
 KIOSK_URL = "@kioskUrl@"
 
-RAUC = "@rauc@/bin/rauc"
-AWS_CLI = "@awscli@/bin/aws"
+RAUC = "@coreutils@/bin/echo"
+AWS_CLI = "@coreutils@/bin/echo"
 
 
 TMPDIR = "/tmp"

Checklist

  • Test against dist-test and share results
  • Changelog updated
  • Code documented
  • User manual updated

With a list of items to include for the distributed version, we no
longer have a good reason to collect all items into a tmp folder and
upload it recursively.

Doing so uses

- more lines of code (cp to folder, then cp to S3),
- more time (copy large files on disk),
- more disk space (duplicated files).

While the awscli S3 client parallelizes uploads, this already happens
when invoked for a single file of substantial size (concurrent upload of
multipart chunks)[^1] and this should max out the connection. So we seem
to have only downsides and no benefits from collecting into a local
directory first.

[^1]: https://docs.aws.amazon.com/cli/latest/topic/s3-config.html#multipart-chunksize
This automates two simple checks that act as sanity checks that the
deployed version truly went "live". They were previously part of a
manual release checklist, but can be easily checked by a computer.

Because they run after the deployment there seems to be no sense in
failing the script, but the verification outcome is color coded to stand
out.
@yfyf
Copy link
Collaborator

yfyf commented Jan 20, 2026

Handy diff to inspect what script would do:

Drive-by-comment: normalize this with a --dry-run | -n option? Seems useful in general both for debugging and educational purposes.

@knuton
Copy link
Member Author

knuton commented Jan 20, 2026

Drive-by-comment: normalize this with a --dry-run | -n option? Seems useful in general both for debugging and educational purposes.

Could consider, yes. Also thought of a verbose mode, in which it includes all items in the summary.

@knuton
Copy link
Member Author

knuton commented Jan 23, 2026

Drive-by-comment: normalize this with a --dry-run | -n option? Seems useful in general both for debugging and educational purposes.

Added this, it only skips uploads during dry-run and actually performs any local operations like signing, so one can check that it works.

Also added a verbose option.

@knuton
Copy link
Member Author

knuton commented Jan 23, 2026

Building with options akin to ./build develop, but with dummy cert.

Checks fail, because dist-test is not actually set up as sub-domain.

  1. Normal build with nix-build --arg updateCert ./pki/dummy/cert.pem --arg updateUrl https://dist-test.dividat.com/releases/playos/develop/ --arg deployUrl s3://dist-test.dividat.ch/releases/playos/develop/ --arg kioskUrl https://dev-play.dividat.com/ --arg watchdogUrls '["https://dev-play.dividat.com/" "https://dev-api.dividat.com"]' --arg buildDisk false
  • Dry run, verbose
DEPLOYMENT PLAN
===============
  - RAUC Bundle: playos-2026.1.0-VALIDATION.raucb
  - Manual: playos-manual-2026.1.0-VALIDATION.pdf
  - Installer: playos-installer-2026.1.0-VALIDATION.iso
  - Live System: playos-live-2026.1.0-VALIDATION.iso

[DRY-RUN] /nix/store/fwwb9nfqd1abaj5828vjcp880q8nxwqk-awscli-1.34.30/bin/aws s3 cp /tmp/playos-signed-releasechgsksc4/playos-2026.1.0-VALIDATION.raucb s3://dist-test.dividat.ch/releases/playos/develop/2026.1.0-VALIDATION/playos-2026.1.0-VALIDATION.raucb --acl public-read
[DRY-RUN] /nix/store/fwwb9nfqd1abaj5828vjcp880q8nxwqk-awscli-1.34.30/bin/aws s3 cp /nix/store/b8zg4vdz7k79xra20czf6hn1fiidy8jq-playos-docs-2026.1.0-VALIDATION/user-manual.pdf s3://dist-test.dividat.ch/releases/playos/develop/2026.1.0-VALIDATION/playos-manual-2026.1.0-VALIDATION.pdf --acl public-read
[DRY-RUN] /nix/store/fwwb9nfqd1abaj5828vjcp880q8nxwqk-awscli-1.34.30/bin/aws s3 cp /nix/store/hb9jzl6gvar4j29f2w4mf2xgggx8l87q-playos-installer-2026.1.0-VALIDATION.iso/iso/playos-installer-2026.1.0-VALIDATION.iso s3://dist-test.dividat.ch/releases/playos/develop/2026.1.0-VALIDATION/playos-installer-2026.1.0-VALIDATION.iso --acl public-read
[DRY-RUN] /nix/store/fwwb9nfqd1abaj5828vjcp880q8nxwqk-awscli-1.34.30/bin/aws s3 cp /nix/store/w4x1j0mibk4g3qz58x8fiqlg83dzn5ar-playos-live-2026.1.0-VALIDATION.iso/iso/playos-live-2026.1.0-VALIDATION.iso s3://dist-test.dividat.ch/releases/playos/develop/2026.1.0-VALIDATION/playos-live-2026.1.0-VALIDATION.iso --acl public-read
[DRY-RUN] /nix/store/fwwb9nfqd1abaj5828vjcp880q8nxwqk-awscli-1.34.30/bin/aws s3 cp /tmp/playos-signed-releasechgsksc4/latest s3://dist-test.dividat.ch/releases/playos/develop/latest --acl public-read --cache-control max-age=0
[DRY-RUN] /nix/store/fwwb9nfqd1abaj5828vjcp880q8nxwqk-awscli-1.34.30/bin/aws s3 cp /nix/store/b8zg4vdz7k79xra20czf6hn1fiidy8jq-playos-docs-2026.1.0-VALIDATION/user-manual.pdf s3://dist-test.dividat.ch/releases/playos/develop/manual-latest.pdf --acl public-read --cache-control max-age=0 --content-disposition 'attachment; filename="playos-manual-2026.1.0-VALIDATION.pdf"'

CHECKS
======

SKIP [Latest version has been updated]
SKIP [Bundle is accessible]

DEPLOYMENT SUMMARY
==================

RAUC Bundle URL: https://dist-test.dividat.com/releases/playos/develop/2026.1.0-VALIDATION/playos-2026.1.0-VALIDATION.raucb
RAUC Bundle checksum (SHA256): 1b35a844d9433671da9953c253af145f50b490d066aca0094629248c180ed0e0

Manual URL: https://dist-test.dividat.com/releases/playos/develop/2026.1.0-VALIDATION/playos-manual-2026.1.0-VALIDATION.pdf
Manual checksum (SHA256): b049222fa58c909f5f31aab17a3d3260b2a8658b8048c39efb9f11c3815749cc

Installer URL: https://dist-test.dividat.com/releases/playos/develop/2026.1.0-VALIDATION/playos-installer-2026.1.0-VALIDATION.iso
Installer checksum (SHA256): 7af774fa6eb0b3c93a67573cf90ad949db92bcecb1686541b2f515a984cf686e

Live System URL: https://dist-test.dividat.com/releases/playos/develop/2026.1.0-VALIDATION/playos-live-2026.1.0-VALIDATION.iso
Live System checksum (SHA256): 93a4dd03be0385521fb1c299021d990fd1bf6365c3d1877e453201be5ac5c7ec
  • Deploy to dist-test
DEPLOYMENT PLAN
===============
  - RAUC Bundle: playos-2026.1.0-VALIDATION.raucb
  - Manual: playos-manual-2026.1.0-VALIDATION.pdf
  - Installer: playos-installer-2026.1.0-VALIDATION.iso
  - Live System: playos-live-2026.1.0-VALIDATION.iso

upload: ../../../../tmp/playos-signed-release7rslpf8a/playos-2026.1.0-VALIDATION.raucb to s3://dist-test.dividat.ch/releases/playos/develop/2026.1.0-VALIDATION/playos-2026.1.0-VALIDATION.raucb
upload: ../../../../nix/store/b8zg4vdz7k79xra20czf6hn1fiidy8jq-playos-docs-2026.1.0-VALIDATION/user-manual.pdf to s3://dist-test.dividat.ch/releases/playos/develop/2026.1.0-VALIDATION/playos-manual-2026.1.0-VALIDATION.pdf
upload: ../../../../nix/store/hb9jzl6gvar4j29f2w4mf2xgggx8l87q-playos-installer-2026.1.0-VALIDATION.iso/iso/playos-installer-2026.1.0-VALIDATION.iso to s3://dist-test.dividat.ch/releases/playos/develop/2026.1.0-VALIDATION/playos-installer-2026.1.0-VALIDATION.iso
upload: ../../../../nix/store/w4x1j0mibk4g3qz58x8fiqlg83dzn5ar-playos-live-2026.1.0-VALIDATION.iso/iso/playos-live-2026.1.0-VALIDATION.iso to s3://dist-test.dividat.ch/releases/playos/develop/2026.1.0-VALIDATION/playos-live-2026.1.0-VALIDATION.iso
upload: ../../../../tmp/playos-signed-release7rslpf8a/latest to s3://dist-test.dividat.ch/releases/playos/develop/latest
upload: ../../../../nix/store/b8zg4vdz7k79xra20czf6hn1fiidy8jq-playos-docs-2026.1.0-VALIDATION/user-manual.pdf to s3://dist-test.dividat.ch/releases/playos/develop/manual-latest.pdf

CHECKS
======

FAIL [Latest version has been updated] Exception: <urlopen error [Errno -2] Name or service not known>
FAIL [Bundle is accessible] Exception: <urlopen error [Errno -2] Name or service not known>

DEPLOYMENT SUMMARY
==================

Manual URL: https://dist-test.dividat.com/releases/playos/develop/2026.1.0-VALIDATION/playos-manual-2026.1.0-VALIDATION.pdf
Manual checksum (SHA256): b049222fa58c909f5f31aab17a3d3260b2a8658b8048c39efb9f11c3815749cc

Installer URL: https://dist-test.dividat.com/releases/playos/develop/2026.1.0-VALIDATION/playos-installer-2026.1.0-VALIDATION.iso
Installer checksum (SHA256): 7af774fa6eb0b3c93a67573cf90ad949db92bcecb1686541b2f515a984cf686e
  1. ISO-less build with nix-build --arg updateCert ./pki/dummy/cert.pem --arg updateUrl https://dist-test.dividat.com/releases/playos/develop/ --arg deployUrl s3://dist-test.dividat.ch/releases/playos/develop/ --arg kioskUrl https://dev-play.dividat.com/ --arg watchdogUrls '["https://dev-play.dividat.com/" "https://dev-api.dividat.com"]' --arg buildDisk false --arg buildInstaller false --arg buildLive false
  • Dry run, verbose
DEPLOYMENT PLAN
===============
  - RAUC Bundle: playos-2026.1.0-VALIDATION.raucb
  - Manual: playos-manual-2026.1.0-VALIDATION.pdf

[DRY-RUN] /nix/store/fwwb9nfqd1abaj5828vjcp880q8nxwqk-awscli-1.34.30/bin/aws s3 cp /tmp/playos-signed-releasedx7zfpv1/playos-2026.1.0-VALIDATION.raucb s3://dist-test.dividat.ch/releases/playos/develop/2026.1.0-VALIDATION/playos-2026.1.0-VALIDATION.raucb --acl public-read
[DRY-RUN] /nix/store/fwwb9nfqd1abaj5828vjcp880q8nxwqk-awscli-1.34.30/bin/aws s3 cp /nix/store/b8zg4vdz7k79xra20czf6hn1fiidy8jq-playos-docs-2026.1.0-VALIDATION/user-manual.pdf s3://dist-test.dividat.ch/releases/playos/develop/2026.1.0-VALIDATION/playos-manual-2026.1.0-VALIDATION.pdf --acl public-read
[DRY-RUN] /nix/store/fwwb9nfqd1abaj5828vjcp880q8nxwqk-awscli-1.34.30/bin/aws s3 cp /tmp/playos-signed-releasedx7zfpv1/latest s3://dist-test.dividat.ch/releases/playos/develop/latest --acl public-read --cache-control max-age=0
[DRY-RUN] /nix/store/fwwb9nfqd1abaj5828vjcp880q8nxwqk-awscli-1.34.30/bin/aws s3 cp /nix/store/b8zg4vdz7k79xra20czf6hn1fiidy8jq-playos-docs-2026.1.0-VALIDATION/user-manual.pdf s3://dist-test.dividat.ch/releases/playos/develop/manual-latest.pdf --acl public-read --cache-control max-age=0 --content-disposition 'attachment; filename="playos-manual-2026.1.0-VALIDATION.pdf"'

CHECKS
======

SKIP [Latest version has been updated]
SKIP [Bundle is accessible]

DEPLOYMENT SUMMARY
==================

RAUC Bundle URL: https://dist-test.dividat.com/releases/playos/develop/2026.1.0-VALIDATION/playos-2026.1.0-VALIDATION.raucb
RAUC Bundle checksum (SHA256): 539c3610d998193eef32e256f49773c58edc3ece83893f40a14f7acfedfd0325

Manual URL: https://dist-test.dividat.com/releases/playos/develop/2026.1.0-VALIDATION/playos-manual-2026.1.0-VALIDATION.pdf
Manual checksum (SHA256): b049222fa58c909f5f31aab17a3d3260b2a8658b8048c39efb9f11c3815749cc
  • Deploy to dist-test
DEPLOYMENT PLAN
===============
  - RAUC Bundle: playos-2026.1.0-VALIDATION.raucb
  - Manual: playos-manual-2026.1.0-VALIDATION.pdf

upload: ../../../../tmp/playos-signed-releaseeyit8gpp/playos-2026.1.0-VALIDATION.raucb to s3://dist-test.dividat.ch/releases/playos/develop/2026.1.0-VALIDATION/playos-2026.1.0-VALIDATION.raucb
upload: ../../../../nix/store/b8zg4vdz7k79xra20czf6hn1fiidy8jq-playos-docs-2026.1.0-VALIDATION/user-manual.pdf to s3://dist-test.dividat.ch/releases/playos/develop/2026.1.0-VALIDATION/playos-manual-2026.1.0-VALIDATION.pdf
upload: ../../../../tmp/playos-signed-releaseeyit8gpp/latest to s3://dist-test.dividat.ch/releases/playos/develop/latest
upload: ../../../../nix/store/b8zg4vdz7k79xra20czf6hn1fiidy8jq-playos-docs-2026.1.0-VALIDATION/user-manual.pdf to s3://dist-test.dividat.ch/releases/playos/develop/manual-latest.pdf

CHECKS
======

FAIL [Latest version has been updated] Exception: <urlopen error [Errno -2] Name or service not known>
FAIL [Bundle is accessible] Exception: <urlopen error [Errno -2] Name or service not known>

DEPLOYMENT SUMMARY
==================

Manual URL: https://dist-test.dividat.com/releases/playos/develop/2026.1.0-VALIDATION/playos-manual-2026.1.0-VALIDATION.pdf
Manual checksum (SHA256): b049222fa58c909f5f31aab17a3d3260b2a8658b8048c39efb9f11c3815749cc

@knuton knuton added the reviewable Ready for initial or iterative review label Jan 23, 2026
@knuton knuton marked this pull request as ready for review January 23, 2026 14:25
@knuton knuton requested a review from dividat-jgu January 23, 2026 15:07
Copy link
Contributor

@dividat-jgu dividat-jgu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good change! Testing it out now, having trouble building develop for the moment.

else:
print(f"\033[91mFAIL\033[0m [{description}] Expected {expected}, got {actual}")
except Exception as e:
print(f"\033[91mFAIL\033[0m [{description}] Exception: {e}")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nitpick: create small helpers for color codes? Like colorizeSuccess(txt: str) -> str and colorizeError(txt: str) -> str.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I decided not to, because there's not lots of duplication right now, but I also don't mind adding it.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It’s a bit hard to see at a glance the message, or if there is an error with the codes.

Copy link
Member Author

@knuton knuton Jan 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A bit on the edge, but maybe it's worth it:

4a5a9c8

@dividat-jgu dividat-jgu added changes suggested Asking for changes before next round of reviewing and removed reviewable Ready for initial or iterative review labels Jan 26, 2026
To avoid manually optimizing for existing or absent slashes in path
fragments, use a helper that strips and adds slashes appropriately.

Similar functions exist in Python stdlibs, but are not quite right:

- https://docs.python.org/3/library/urllib.parse.html#urllib.parse.urljoin
  performs relative path resolution instead of just joining
- https://docs.python.org/3/library/pathlib.html#pathlib.PurePath.joinpath
  is sensitive to leading slashes (absolute paths) in parts
@knuton knuton added reviewable Ready for initial or iterative review and removed changes suggested Asking for changes before next round of reviewing labels Jan 26, 2026
@knuton knuton requested a review from dividat-jgu January 26, 2026 21:45
@dividat-jgu
Copy link
Contributor

✔️ Skipping isos doesn’t create links in result and the script behave as expected.

It's not a status, and it doesn't follow the same format. Retreating to
a simple print before ending up with an
AbstractPrintStatusProxyBeanFactory.
Lay out development plan section closer to other sections.
@knuton knuton requested a review from dividat-jgu January 27, 2026 11:01
Copy link
Contributor

@dividat-jgu dividat-jgu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good, deploy to develop after the PR has been merged?

@dividat-jgu dividat-jgu merged commit dc4a4c9 into dividat:main Jan 27, 2026
55 of 56 checks passed
@dividat-jgu dividat-jgu removed the reviewable Ready for initial or iterative review label Jan 27, 2026
@knuton knuton deleted the skippable-isos-deployment branch January 27, 2026 14:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants