From 9c05f86c8684f6f97885fc91b1f10ff4455147b9 Mon Sep 17 00:00:00 2001 From: Julian Cuni Date: Fri, 4 Sep 2026 18:11:41 +0200 Subject: [PATCH] =?UTF-8?q?docs(desktop):=20updates=20are=20admin-only=20?= =?UTF-8?q?=E2=80=94=20keep=20the=20polkit=20prompt;=20AppImage=20rejected?= =?UTF-8?q?=20on=20field=20evidence?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Decision (user, 2026-09-04) after the first successful self-update (v0.1.6 → v0.1.7): a .deb update runs pkexec dpkg -i and asks for an admin password the operator does not have — that prompt is the intended gate. The AppImage was tried as the no-root path and aborts on the 26.04 booth (bundled 24.04 glib/WebKitGTK vs host gvfs/Mesa: EGL_BAD_PARAMETER), and it discards the distro-maintained WebKitGTK the platform decision rests on. Passwordless polkit for dpkg is root for the operator — rejected. - update.prompt (en + sq) now says the install needs the administrator password. - desktop-shell-tauri.md: decision, evidence, rejected alternatives, and the deferred fleet-grade option (root systemd timer in the .deb, minisign- verified, notify-only in-app). - standing-decisions.md: ship the .deb; runtime backend; updates admin-only. - appliance-provisioning.md: drop the stale "hardcoded to localhost" note. Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU --- apps/web/src/lib/i18n/en.ts | 2 +- apps/web/src/lib/i18n/sq.ts | 2 +- wiki/decisions/appliance-provisioning.md | 8 ++++--- wiki/decisions/desktop-shell-tauri.md | 29 ++++++++++++++++++++++++ wiki/decisions/standing-decisions.md | 5 +++- wiki/log.md | 12 ++++++++++ 6 files changed, 52 insertions(+), 6 deletions(-) diff --git a/apps/web/src/lib/i18n/en.ts b/apps/web/src/lib/i18n/en.ts index 5e47505..71ece3c 100644 --- a/apps/web/src/lib/i18n/en.ts +++ b/apps/web/src/lib/i18n/en.ts @@ -58,7 +58,7 @@ export const en: Catalog = { }, update: { available: "Update available", - prompt: "Version {{version}} is available. Install now and restart?", + prompt: "Version {{version}} is available. Install now and restart? (Installing requires the administrator password.)", }, nav: { booth: "Booth", diff --git a/apps/web/src/lib/i18n/sq.ts b/apps/web/src/lib/i18n/sq.ts index 654d013..05685b1 100644 --- a/apps/web/src/lib/i18n/sq.ts +++ b/apps/web/src/lib/i18n/sq.ts @@ -61,7 +61,7 @@ export const sq = { }, update: { available: "Përditësim i disponueshëm", - prompt: "Versioni {{version}} është i disponueshëm. Ta instaloj tani dhe ta rinis?", + prompt: "Versioni {{version}} është i disponueshëm. Ta instaloj tani dhe ta rinis? (Instalimi kërkon fjalëkalimin e administratorit.)", }, nav: { booth: "Kabina", diff --git a/wiki/decisions/appliance-provisioning.md b/wiki/decisions/appliance-provisioning.md index 46b5e7c..d213879 100644 --- a/wiki/decisions/appliance-provisioning.md +++ b/wiki/decisions/appliance-provisioning.md @@ -462,9 +462,11 @@ before vision finishes loading). Reach the UI at **`http:///`** (Cad **Web-access gotchas (all fixed in the images/compose — see [[container-deployment]] "Web access"):** the SPA uses a RELATIVE `/api` base (works from any host; do NOT bake a domain) + a Caddy proxy gives the clean port-80 URL; the domain (`parksystems.msai.al`) is pointed at the booth's LAN IP via -`hosts`/DNS ON-SITE, never an image rebuild. The **Tauri desktop app** is hardcoded to -`localhost:3000` (CSP + endpoints) and can't reach a remote booth without code changes — a browser -works; the desktop app is a separate workstream. +`hosts`/DNS ON-SITE, never an image rebuild. The **Tauri desktop app** (install the `.deb` from +`mca/public_releases`, NOT the AppImage — see [[desktop-shell-tauri]]) asks for the server address +on first launch (`127.0.0.1:3000` on the booth itself, or any `:3000` / `` via Caddy); +nothing is baked in since v0.1.5. In-app updates need the **admin** password (polkit) — by +decision, updates are an admin action, so plan to be at the box when bringing it online for one. ## Quick-reference: the gotchas, in order they bit us diff --git a/wiki/decisions/desktop-shell-tauri.md b/wiki/decisions/desktop-shell-tauri.md index bbdc816..4494873 100644 --- a/wiki/decisions/desktop-shell-tauri.md +++ b/wiki/decisions/desktop-shell-tauri.md @@ -455,3 +455,32 @@ Sources: `tauri-plugin-updater-2.10.1/src/updater.rs` (`get_urls`, `install_inne - **Judgment note for the retrospective:** three fixes were shipped against this symptom without reading the updater's install path once. The whole chain is ~60 lines of vendored Rust in `~/.cargo/registry`; it names the exact failure (`InvalidUpdaterFormat`). + +### Decision: desktop updates are an admin-only action — the polkit prompt stays (2026-09-04) + +Settled with the user after the first successful self-update (v0.1.6 → v0.1.7 on the park-2 +booth, `pkexec dpkg -i`, polkit dialog, relaunch, badge shows 0.1.7). The prompt asks for an +**admin** password the operator does not have — and that is now the intended gate, not a defect. + +- **AppImage was tried and rejected on evidence, not theory.** The v0.1.6 AppImage fails to + start on the Ubuntu 26.04 booth: `libgvfscommon.so: undefined symbol: + g_variant_builder_init_static` (the host's newer gvfs modules loading into the *bundled* older + glib) followed by `Could not create default EGL display: EGL_BAD_PARAMETER. Aborting...` (the + bundled WebKitGTK vs. the host's Mesa). Tauri's AppImage freezes the CI runner's (24.04) + GTK/WebKitGTK/glib into the bundle, which throws away the one property this platform decision + rests on — the **distro-maintained, Canonical-patched WebKitGTK** — and replaces it with a + host-mismatch hazard at every OS update. `WEBKIT_DISABLE_DMABUF_RENDERER=1` / + `WEBKIT_DISABLE_COMPOSITING_MODE=1` may paper over the EGL abort; they don't fix the shape. + **The `.deb` is the right artifact; only its install step needs root.** +- **Passwordless polkit/sudoers for `dpkg -i` rejected:** any rule that lets the operator + account pass that prompt silently lets them run `pkexec dpkg -i ` — root — which the + [[threat-model]] forbids outright. +- **Deferred, not rejected — the fleet-grade answer:** a root systemd timer shipped inside the + `.deb` (via Tauri's deb `files` + postinstall) that fetches `latest.json` from + `public_releases`, verifies the `.deb` with `minisign` against the same embedded pubkey, and + `dpkg -i`s it when the box is online; the in-app updater then only *notifies*. No prompt, no + privileged code in the shell, standard appliance practice. Revisit when more than one booth + needs keeping current, or when someone other than the admin has to bring a box online. +- **Operator-facing consequence:** the in-app prompt now says the install needs the + administrator password (i18n `update.prompt`, en + sq). An operator who accepts and can't + authenticate simply stays on the current version; nothing breaks, and the failure is logged. diff --git a/wiki/decisions/standing-decisions.md b/wiki/decisions/standing-decisions.md index ac7b641..dc1a97c 100644 --- a/wiki/decisions/standing-decisions.md +++ b/wiki/decisions/standing-decisions.md @@ -24,7 +24,10 @@ The decisions treated as settled in the design notes. (See [[parking-system-arch (chosen over Electron, 2026-06-21) — small footprint, no bundled Chromium to patch, and a deny-by-default native surface that fits [[threat-model|the booth-operator threat model]]. The shell stays **thin**: all privileged logic remains in [[fastify]]. One open dependency — the - appliance's WebKitGTK version (see [[open-questions]] #11). + appliance's WebKitGTK version (see [[open-questions]] #11). Ships as a **`.deb`** (the AppImage + bundles a runner's WebKitGTK and fails on the 26.04 booth — 2026-09-04); its backend address is + **operator-entered at runtime**, not baked in; and **in-app updates are an admin-only action** + behind the polkit password prompt (user, 2026-09-04) — never make that prompt passwordless. - **Integrity:** append-only, hash-chained, **software-signed** event log ([[append-only-event-chain]]) — hardware-backed signing (a non-extractable key in the **[[tpm|TPM]]** or a **USB HSM**; the [[atecc608]] is [[open-questions|upcoming, not present]]) is diff --git a/wiki/log.md b/wiki/log.md index b5e3bde..3ae5fa3 100644 --- a/wiki/log.md +++ b/wiki/log.md @@ -2873,3 +2873,15 @@ latest.json now has one signed entry per installer (deb, rpm, AppImage); a .deb polkit password prompt (pkexec dpkg -i), which is the intended admin gate on a root-installed package. README + [[desktop-shell-tauri]] updated. First real test: tag v0.1.7 and accept the prompt on the v0.1.6 booth. + +## [2026-09-04] decision | Desktop updates are admin-only: keep the polkit prompt; AppImage rejected on field evidence + +First successful desktop self-update (v0.1.6 → v0.1.7, pkexec dpkg -i + polkit dialog) raised +the question of the admin password the operator lacks. Tried the AppImage as the no-root path: +it fails to start on the Ubuntu 26.04 booth (bundled 24.04 glib/WebKitGTK vs host gvfs/Mesa — +EGL_BAD_PARAMETER abort), and structurally it abandons the distro-maintained WebKitGTK the +platform decision depends on. Passwordless polkit for dpkg is root-for-the-operator, rejected. +Decision (user, 2026-09-04): the .deb stays, updates are an admin action behind the prompt; the +in-app prompt now says so (en + sq). A root systemd updater timer shipped in the .deb (minisign- +verified, notify-only in-app) is recorded as the deferred fleet-grade option on +[[desktop-shell-tauri]].