111 lines
7.1 KiB
Markdown
111 lines
7.1 KiB
Markdown
# Online Universal Server Acquisition Contract
|
|
|
|
**Status**: Approval draft; no implementation authority.
|
|
|
|
## Purpose and Boundary
|
|
|
|
The Online Universal Server ISO boots and installs the supported Ubuntu base, performs local hardware
|
|
and license preflight, permits Server S/M/L/Max selection, then acquires the exact signed platform
|
|
payload for the approved release. Network access is required, but network availability never replaces
|
|
artifact authenticity, compatibility, or rollback checks.
|
|
|
|
The current implementation clones the default branch from
|
|
`https://cgit.cezentech.com/jinojose/aipackage.git` during Ubuntu late commands and subsequently allows
|
|
APT, Python, container, runtime, and model tooling to fetch mutable dependencies. This is observed
|
|
legacy behavior, not the accepted release contract.
|
|
|
|
## Approved Endpoint Classes
|
|
|
|
Every release candidate MUST provide an explicit allowlist containing scheme, hostname, port,
|
|
certificate policy, purpose, authentication method, and whether access occurs before or after target
|
|
disk mutation. No wildcard hostname is allowed.
|
|
|
|
| Endpoint class | Required purpose | Contract |
|
|
|---|---|---|
|
|
| Release index | Discover one approved release manifest by channel/version | HTTPS; small signed index; no executable content |
|
|
| Content store | Download content-addressed payload objects | HTTPS; object path bound to SHA-256; range/resume supported |
|
|
| Ubuntu/package sources | Acquire pinned OS/package objects not embedded in media | Approved mirrors only; repository metadata and package signatures verified |
|
|
| Container registry | Acquire pinned images | Digest references only; registry authentication scoped read-only |
|
|
| License service | Optional online license acquisition/refresh where policy permits | Separate authenticated endpoint; signed license remains independently verifiable |
|
|
| Time source | Optional clock confidence | Never establishes artifact authenticity; absence has declared license/policy behavior |
|
|
|
|
Git default branches, container tags, `latest` runtime URLs, unauthenticated scripts piped to shells,
|
|
and model names without immutable revision/digest MUST NOT be release inputs.
|
|
|
|
## Acquisition Sequence
|
|
|
|
1. Verify local boot-media identity and embedded trust roots.
|
|
2. Establish network and record interface, DNS, route, proxy, and local clock confidence without
|
|
recording credentials.
|
|
3. Fetch the signed release index; verify trust policy, digest, signature, channel, expiry policy, and
|
|
rollback/security floor before selecting a release.
|
|
4. Select Server tier only after license and hardware preflight. Tier selection does not change trust.
|
|
5. Resolve one immutable artifact manifest and evaluate architecture/category/tier/OS/capacity
|
|
compatibility locally.
|
|
6. Download objects into a staging area by digest with bounded retries, timeouts, rate limits, and
|
|
resumable range requests. Partial objects use a non-final name and are never executable.
|
|
7. Verify every completed object size/digest, then verify the complete signed manifest again.
|
|
8. Create and verify the declared pre-change checkpoint before platform mutation.
|
|
9. Activate through the shared durable operation/rollback contract.
|
|
10. Record release ID, manifest/signature identity, object inventory, endpoint classes used, retry
|
|
counts, and final state without tokens, passwords, customer content, or full signed licenses.
|
|
|
|
## Authentication and TLS
|
|
|
|
- TLS certificate and hostname validation is mandatory; insecure/skip-verify modes are prohibited.
|
|
- The embedded OS CA set is the minimum web PKI trust. A Cezen release-signing signature remains
|
|
mandatory even when TLS succeeds.
|
|
- Private content credentials MUST be short-lived, least-privilege, read-only, redacted from command
|
|
lines/logs, and stored only for the operation lifetime unless an approved refresh policy requires
|
|
otherwise.
|
|
- Proxy support MUST preserve TLS validation and provide a customer-visible explanation when TLS
|
|
interception uses a customer-approved CA. Silent trust-root installation is prohibited.
|
|
- Redirects across hostnames are rejected unless the destination is independently allowlisted.
|
|
|
|
## Retry, Resume, Cache, and Idempotency
|
|
|
|
- DNS, connect, TLS, first-byte, idle, and total-operation timeouts are explicit release-policy values.
|
|
- Retries are bounded exponential backoff with jitter and honor server retry guidance within limits.
|
|
- A resumed object is retained only when its expected digest and length still match the signed
|
|
manifest. ETag alone is insufficient identity.
|
|
- Verified content-addressed objects MAY be reused across attempts and tiers; unverified or partial
|
|
content is quarantined or deleted.
|
|
- Re-running acquisition for the same operation ID resumes the same staging inventory. A different
|
|
manifest creates a new operation and cannot silently replace active staging.
|
|
|
|
## Failure and Recovery Contract
|
|
|
|
| Failure point | Required outcome |
|
|
|---|---|
|
|
| No DHCP/static route/DNS | Target remains at local setup; show network evidence and safe retry |
|
|
| TLS/certificate/hostname failure | Stop before payload trust; never offer insecure bypass |
|
|
| Index/manifest unsigned, revoked, stale, or below security floor | Stop before payload download/mutation; preserve redacted evidence |
|
|
| Authentication denied/expired | Stop or renew through approved flow; do not log credential |
|
|
| Interrupted object download | Retain only bounded partial staging; safely resume by digest |
|
|
| Digest/size mismatch | Quarantine/delete object, invalidate cache entry, bounded retry from approved endpoint |
|
|
| Insufficient disk discovered | Stop before activation; report staging and rollback space separately |
|
|
| Network loss after full verification, before activation | Activation MAY continue only when every required object is locally verified |
|
|
| Network loss during activation | Activation outcome depends only on local staged objects; shared rollback contract applies |
|
|
| Reboot interruption | Resume the same durable operation and never reacquire already verified objects unnecessarily |
|
|
|
|
## Evidence Gates
|
|
|
|
Before implementation-ready status:
|
|
|
|
1. Platform/security owners approve the exact endpoint allowlist and ownership.
|
|
2. Release-index schema and test vectors extend the shared manifest/signature fixtures.
|
|
3. Credential source, lifetime, rotation, revocation, proxy, and customer-CA policies are approved.
|
|
4. Timeout/retry/cache quotas and staging retention are measurable and approved.
|
|
5. Tests cover DNS, TLS, redirect, proxy, auth, partial content, resume, corrupted cache, manifest
|
|
replacement, insufficient disk, network loss before/after verification, activation, and reboot.
|
|
6. A clean install proves the deployed source revision and every acquired object match the accepted
|
|
manifest; cloning a mutable default branch is a release blocker.
|
|
|
|
## Decisions Still Requiring Owners
|
|
|
|
- Production release-index and content-store hostnames and responsible operator.
|
|
- Public versus authenticated payload access and credential issuer.
|
|
- Approved Ubuntu/package mirrors and any customer-hosted mirror mode.
|
|
- Proxy/customer CA enrollment workflow.
|
|
- Supported release channels, index expiry, cache quota/retention, retry/timeouts, and support SLA.
|