From 159143d297cdd5ee03f9d80ae6fabda893726e00 Mon Sep 17 00:00:00 2001 From: mrwulf Date: Mon, 6 Jul 2026 17:42:09 +0200 Subject: [PATCH] pacta repo public (owner order); server app is a git clone, update = git pull The pacta repository is now public on GitHub. The server's app/ was re-cloned from it (previously shipped via tar+scp while private), so the production update path is now pure git pull for both app and published log - no code shipping. Verified live after the switch: internal healthz and the public docs site both 200, tree size 8. DEPLOY.md runbook simplified accordingly. Co-Authored-By: Claude Fable 5 --- DEPLOY.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/DEPLOY.md b/DEPLOY.md index 10e5160..e51e99d 100644 --- a/DEPLOY.md +++ b/DEPLOY.md @@ -10,7 +10,7 @@ software layouts - no provider inventory, no credentials. The target host runs a compose stack; the LTL joined it as a read-only container instead of the host-systemd variant below: -- app + published-log clones + reconstructed log dir under the compose +- app (git clone of the now-public pacta repo) + published-log clone + reconstructed log dir under the compose project directory (`ltl/app`, `ltl/published`, `ltl/log`); - compose service: `python:3.12-alpine`, `read_only: true`, both volumes mounted `:ro`, NO published ports (reachable only on the compose @@ -38,9 +38,9 @@ Update runbook (after each new proof-check run on the provider machine): pacta_provider log-append ... # sign new head (offline, dogfood) pacta_provider log-publish --log-dir ... --git-dir --public-key cd && git add -A && git commit -m "log update" && git push -tar czf /tmp/pacta-app.tgz --exclude=.git --exclude='provider/state' --exclude='provider/out' --exclude='dogfood/state' --exclude='dogfood/*/target' --exclude='.venv' --exclude='__pycache__' --exclude='artifacts*' --exclude='repos' . # only when app code changed -scp /tmp/pacta-app.tgz zkdefi-ltl:/ltl/ -ssh zkdefi-ltl 'cd /ltl && (cd published && git pull) && \ +# both app/ and published/ on the server are git clones of the now-public repos, +# so the server-side update is pure git pull (no code shipping): +ssh zkdefi-ltl 'cd /ltl && (cd app && git pull -q) && (cd published && git pull -q) && \ python3 reconstruct.py && cd .. && sudo docker compose restart ltl' ```