Harden daemon service installation

This commit is contained in:
Eric Wendland 2026-07-18 16:31:59 +02:00
commit 678865bfdc
6 changed files with 784 additions and 46 deletions

View file

@ -88,14 +88,26 @@ For deployment-readiness work that cuts across feature areas, see
- `[x]` Documentation distinguishes automated coverage from real-machine,
hardware-key, relay, and privileged-interface dogfooding.
- `[ ]` Add unified service-log inspection.
- `[x]` Add unified service-log inspection.
Acceptance criteria:
- `[ ]` One CLI command gives the platform-appropriate user-service log view
- `[x]` One CLI command gives the platform-appropriate user-service log view
or an exact recovery command on Linux, macOS, and Windows.
- `[ ]` Log access remains user-scoped and does not require a system service.
- `[ ]` Human and JSON output distinguish unavailable logs, an uninstalled
- `[x]` Log access remains user-scoped and does not require a system service.
- `[x]` Human and JSON output distinguish unavailable logs, an uninstalled
service, and an installed service with no log entries.
- `[x]` Verify background-service installation readiness and durability.
Acceptance criteria:
- `[x]` Direct `geth daemon install` waits for local control readiness by
default and reports a log-inspection recovery command on timeout.
- `[x]` Service executable paths are canonical regular files; Cargo-target
and temporary binaries are copied atomically into the selected geth home by
default rather than leaving a fragile service reference.
- `[x]` An explicit override supports intentional transient development
services, and advanced install can still omit immediate startup.
- `[x]` Tests cover transient path detection/copying, file-log states, and
user-scoped generated definitions.
- `[ ]` Publish copy-paste installation entrypoints for release artifacts.
Acceptance criteria:
- `[ ]` Linux, macOS, and Windows installation instructions verify artifact
@ -360,6 +372,9 @@ control, local CAS, service installation, and written architecture decisions.
- Linux install targets a systemd user unit, not a system service.
- macOS install targets a launchd user agent.
- Windows install targets a per-user scheduled task.
- Direct install verifies local daemon readiness and exposes unified logs.
- Transient build artifacts are copied into the selected geth home before a
service definition references them unless explicitly overridden.
- Tests verify generated definitions do not target privileged system services.
- `[x]` GitHub CI, security, and release automation.