Online Universal Server Acquisition Contract

Status: Approval draft; no implementation authority.

Purpose and Boundary

The Online Universal Server ISO boots and installs the supported Ubuntu base, performs local hardware and license preflight, permits Server S/M/L/Max selection, then acquires the exact signed platform payload for the approved release. Network access is required, but network availability never replaces artifact authenticity, compatibility, or rollback checks.

The current implementation clones the default branch from https://cgit.cezentech.com/jinojose/aipackage.git during Ubuntu late commands and subsequently allows APT, Python, container, runtime, and model tooling to fetch mutable dependencies. This is observed legacy behavior, not the accepted release contract.

Approved Endpoint Classes

Every release candidate MUST provide an explicit allowlist containing scheme, hostname, port, certificate policy, purpose, authentication method, and whether access occurs before or after target disk mutation. No wildcard hostname is allowed.

Endpoint class	Required purpose	Contract
Release index	Discover one approved release manifest by channel/version	HTTPS; small signed index; no executable content
Content store	Download content-addressed payload objects	HTTPS; object path bound to SHA-256; range/resume supported
Ubuntu/package sources	Acquire pinned OS/package objects not embedded in media	Approved mirrors only; repository metadata and package signatures verified
Container registry	Acquire pinned images	Digest references only; registry authentication scoped read-only
License service	Optional online license acquisition/refresh where policy permits	Separate authenticated endpoint; signed license remains independently verifiable
Time source	Optional clock confidence	Never establishes artifact authenticity; absence has declared license/policy behavior

Git default branches, container tags, latest runtime URLs, unauthenticated scripts piped to shells, and model names without immutable revision/digest MUST NOT be release inputs.

Acquisition Sequence

Verify local boot-media identity and embedded trust roots.
Establish network and record interface, DNS, route, proxy, and local clock confidence without recording credentials.
Fetch the signed release index; verify trust policy, digest, signature, channel, expiry policy, and rollback/security floor before selecting a release.
Select Server tier only after license and hardware preflight. Tier selection does not change trust.
Resolve one immutable artifact manifest and evaluate architecture/category/tier/OS/capacity compatibility locally.
Download objects into a staging area by digest with bounded retries, timeouts, rate limits, and resumable range requests. Partial objects use a non-final name and are never executable.
Verify every completed object size/digest, then verify the complete signed manifest again.
Create and verify the declared pre-change checkpoint before platform mutation.
Activate through the shared durable operation/rollback contract.
Record release ID, manifest/signature identity, object inventory, endpoint classes used, retry counts, and final state without tokens, passwords, customer content, or full signed licenses.

Authentication and TLS

TLS certificate and hostname validation is mandatory; insecure/skip-verify modes are prohibited.
The embedded OS CA set is the minimum web PKI trust. A Cezen release-signing signature remains mandatory even when TLS succeeds.
Private content credentials MUST be short-lived, least-privilege, read-only, redacted from command lines/logs, and stored only for the operation lifetime unless an approved refresh policy requires otherwise.
Proxy support MUST preserve TLS validation and provide a customer-visible explanation when TLS interception uses a customer-approved CA. Silent trust-root installation is prohibited.
Redirects across hostnames are rejected unless the destination is independently allowlisted.

Retry, Resume, Cache, and Idempotency

DNS, connect, TLS, first-byte, idle, and total-operation timeouts are explicit release-policy values.
Retries are bounded exponential backoff with jitter and honor server retry guidance within limits.
A resumed object is retained only when its expected digest and length still match the signed manifest. ETag alone is insufficient identity.
Verified content-addressed objects MAY be reused across attempts and tiers; unverified or partial content is quarantined or deleted.
Re-running acquisition for the same operation ID resumes the same staging inventory. A different manifest creates a new operation and cannot silently replace active staging.

Failure and Recovery Contract

Failure point	Required outcome
No DHCP/static route/DNS	Target remains at local setup; show network evidence and safe retry
TLS/certificate/hostname failure	Stop before payload trust; never offer insecure bypass
Index/manifest unsigned, revoked, stale, or below security floor	Stop before payload download/mutation; preserve redacted evidence
Authentication denied/expired	Stop or renew through approved flow; do not log credential
Interrupted object download	Retain only bounded partial staging; safely resume by digest
Digest/size mismatch	Quarantine/delete object, invalidate cache entry, bounded retry from approved endpoint
Insufficient disk discovered	Stop before activation; report staging and rollback space separately
Network loss after full verification, before activation	Activation MAY continue only when every required object is locally verified
Network loss during activation	Activation outcome depends only on local staged objects; shared rollback contract applies
Reboot interruption	Resume the same durable operation and never reacquire already verified objects unnecessarily

Evidence Gates

Before implementation-ready status:

Platform/security owners approve the exact endpoint allowlist and ownership.
Release-index schema and test vectors extend the shared manifest/signature fixtures.
Credential source, lifetime, rotation, revocation, proxy, and customer-CA policies are approved.
Timeout/retry/cache quotas and staging retention are measurable and approved.
Tests cover DNS, TLS, redirect, proxy, auth, partial content, resume, corrupted cache, manifest replacement, insufficient disk, network loss before/after verification, activation, and reboot.
A clean install proves the deployed source revision and every acquired object match the accepted manifest; cloning a mutable default branch is a release blocker.

Decisions Still Requiring Owners

Production release-index and content-store hostnames and responsible operator.
Public versus authenticated payload access and credential issuer.
Approved Ubuntu/package mirrors and any customer-hosted mirror mode.
Proxy/customer CA enrollment workflow.
Supported release channels, index expiry, cache quota/retention, retry/timeouts, and support SLA.

7.1 KiB Raw Permalink Blame History