From 11ec050ca82e63981b2bf6511f5c2246cd4f76e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?m=C3=BCde?= Date: Wed, 23 Sep 2026 22:18:32 +0200 Subject: [PATCH] hive-tls: give swarm-services-cert the `cmp` it tests the root with MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `cmp` lives in diffutils, not coreutils, so the root-changed test exited 127 with "command not found". Inside `if ! cmp -s`, a 127 reads as "differs" and errexit never sees it, so `rootchanged` was 1 on every run and the trust-bundle rebuild it guards bounced `hive-tls-ca` after each issuance — the exact "only a changed one, or every boot would bounce a unit with nothing to do" the comment there rules out. Found in the journal of a hive that had just issued a leaf successfully: the unit logged "the services root changed" on a run where the store had left the issuer alone. --- nix/host-modules/hive-tls.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/nix/host-modules/hive-tls.nix b/nix/host-modules/hive-tls.nix index e6061327..cc71e5fe 100644 --- a/nix/host-modules/hive-tls.nix +++ b/nix/host-modules/hive-tls.nix @@ -693,6 +693,11 @@ in pkgs.openssl pkgs.coreutils pkgs.systemd + # `cmp`, which is NOT in coreutils. Without it the root-changed test + # below is `command not found` — 127, invisible under `if !`, and + # therefore always "changed", so the bundle rebuild it guards fired + # on every issuance instead of on a new root. + pkgs.diffutils ]; # Sized like the store's own granting units, and for the same # reason: under `seal = "shamir"` an operator unseals BY HAND, and