13 KiB
Offline Linux inputs on Codex-ytr83r — 2026-09-11
PAUSED BY USER — authoritative final status
The user suspended Linux builds/checking until they resolve networking and explicitly instruct resumption. All Linux preparation/download work is paused as well. This is PAUSED BY USER, not blocked, failed or ready for installation. Do not resume downloads, installation, builds or checks automatically. Windows work is separate.
Worker stopped only its owned Python download PID8064; stop command exited0 and download session91581 terminated with exit1 from the intentional stop. A final read-only process audit found zero matching owned download processes. Root separately owns guest Rust-installer cleanup; worker performed no guest action, and root reports no APT installation began.
Frozen deb subset: 11 of76 complete,14,602,928bytes, each independently rehashed against its signed-index SHA256; 65 archives remain incomplete or not started. Two partials are preserved and not admitted: g++-15-x86-64-linux-gnu6,553,600B, SHA256 a5d2b67ca634ad1b1715a5e95eef54e84327595ee5d30865b79b2195ef4b1c39; gcc-15-x86-64-linux-gnu5,505,024B, SHA256 0147c2d57ae11ed22bfd0d1cc625c93557482e1d80f55da0b9c5018ecd4b6975. No retry, queued transfer or new download was started after cleanup. paused-by-user.json records complete filenames/hashes, remaining names, partial sizes/hashes, process/session cleanup and the resumption condition. Earlier completed Rust/Cargo/Ubuntu metadata inputs remain preserved, not installed or accepted by this worker.
The sections below preserve preparation history. Their earlier pending/active transfer wording is superseded by this user pause.
Owner: Codex-ytr83r /root/linux_build_plan; root owns persistent Ubuntu shell93868, Windows Cargo83906 and all guest installation/build/native work. Source freeze 29084050a7c020e0fb488be37c6e1ab235769cc0. Coordination read314/324/328 onward; ownership334. The worker owns only this report and .local/linux-offline-preparation-ytr83r/. No WSL, apt/dpkg, compiler, guest/root configuration, host networking or VPN inspection/modification, Git mutation, upload or release was performed by the worker.
Current preparation checkpoint
Native Rust components and Cargo offline inputs are complete. Three Ubuntu signed releases and six main/universe amd64 indices are complete. Exact dependency closure/download waits for root's isolated APT update and URI selection against this guest's installed state; no guessed77-package list from another host is reused.
Initial local inventory found no peer offline deb/Rust payloads. This host had29,176,729,600B free C: and2,628,736KiB free RAM; later free C:28,837,474,304B. Downloads used ordinary Windows HTTPS with two metadata transfers at most, then one Rust component transfer at a time alongside the root compiler. Source archives are reused only after independent Cargo.lock checksum verification; no Windows compiled objects, linker, user Cargo configuration or credentials are copied.
Trust and exact inputs
Fresh official archive.ubuntu.com base/updates and security.ubuntu.com security InRelease files are preserved without rewriting. Worker initially recorded hashes only and explicitly deferred signature validation. Root then ran guest gpgv with the distro-installed /usr/share/keyrings/ubuntu-archive-keyring.gpg; guest-state/signatures.log ends ARCADIA_SIGNATURES_DONE and records three exit0 good signatures from Ubuntu Archive Automatic Signing Key2018, fingerprint F6ECB3762474EDA9D21B7022871920D1991BC93C. The worker read that terminal log and matched all three hashes:
| Suite | InRelease SHA256 |
|---|---|
| resolute | 45f95ce276cdba3e41870516a130e03c58b8b7a79e9546b0efe9e526d255740c |
| resolute-updates | e9fa3064b816cb6d933ad1955a0a98a85adb64a0cec7f0790c81fa07e671db90 |
| resolute-security | 61451f547f1b68392fc1c17c2d26dcf970abb94745de873584b46711537daa96 |
Six amd64 main/universe Packages.xz files were fetched using immutable publisher by-hash/SHA256 URLs bound to those releases. Both compressed and decompressed lengths and SHA256 values match their InRelease records. Exact URLs/hash/size/release associations live in ubuntu-indices.json; normal paths and unchanged signed releases are staged under mirror/dists/. Restricted/multiverse/backports are not needed for the requested build/runtime package set unless APT reports otherwise; none were guessed or fetched. Ubuntu apt-secure describes this signed-release → index-hash → package-hash chain; package archive hashing alone is not signature validation.
Official channel-rust-1.98.1.toml matches its separately fetched publisher HTTPS SHA256 a7c8774a5fd8441c997d94c029776cbc5eb111e9d72ab5d256fa69866644347e; date2026-09-03. All five x86_64-unknown-linux-gnu components match its exact xz hashes:
| Component | Bytes | SHA256 |
|---|---|---|
| rustc | 79727616 | e974f036b28565f37c0f3bd92ddefa809bee16c04f9dcf07b9ed96e05aaaf7c4 |
| cargo | 11662108 | ea1de9f9e23107d97ee2b41a72c552f34064a593da503789218387aee59f3ba4 |
| rust-std | 30715684 | fa3ff450172a16c026944030230c5069947af93c728d9179971d44e5e0cfb561 |
| rustfmt | 2486356 | b29a1addcbf2aa8f5785075605700e63cbe131b08c8334b50c09cfca8bbc51dc |
| clippy | 5400924 | e167f333be24e1d5eea56ea563c7def0aa0bd613f5ce3445976c93b0288799d1 |
rust-components.json and rust-transfer.json record official dated URLs, times and hashes. This establishes publisher HTTPS checksum verification, not independent Rust OpenPGP verification. Root must inspect/install these ordinary distribution components under a task prefix and verify actual compiler/notices; the worker ran no install script or Rust binary.
Cargo reuse without Windows build inputs
All460 registry archives in this freeze's Cargo.lock were present locally and independently matched their locked SHA256. Each corresponding sparse-index record was parsed and its exact name/version/checksum matched the lock. The only copied registry configuration is public config.json with standard crates.io download/API URLs; no config.toml or credentials file is read/copied. Selected427 sparse-index files plus that public config and460 archives form888 files in cargo-registry-offline.tar.
Archive size101,079,040B, SHA256 78b498b66b737a43439d396cb66be89185edc85645707896caf6815aec8cc7a5. Every tar member was read back and compared against its expected hash; no extra/duplicate member admitted. cargo-bundle.json records every member's hash and cargo-cache-audit.json every locked package/source path. Root can extract into an empty Linux task CARGO_HOME, retaining a separate Linux target directory. This is a conservative cross-platform locked-source superset; no worker Cargo metadata/target-graph execution occurred. Actual Linux offline resolution remains root's gate.
Guest facts and isolated APT selection
Root saved completed guest-state/inventory.log and packages.tsv through the sole persistent guest shell. Actual guest Ubuntu26.04/resolute, amd64, gpgv present; only old April20 main/restricted package indices existed, with Universe absent. Therefore the old guest lists could not resolve the full dependency request accurately.
Prepared task-only apt.sources.list uses file mirror suites base/updates/security, main/universe, amd64 and the existing archive key. apt.conf points source list/parts and cache/list files to task paths under /var/tmp/arcadia-offline-ytr83r, leaving system sources, installed dpkg state and trust intact. It requests only Packages indices, no translations/command-not-found/icons, and disables by-hash acquisition for the local filenames while preserving signed-release checksum enforcement. No trusted=yes, allow-unauthenticated, insecure repository, new key, expired-release bypass or network workaround is used.
Root must run apt-get -c <staged apt.conf> update and preserve exit/log, then use the same config with --print-uris --yes --download-only --no-install-recommends install for the README build dependencies plus Git/certificates/curl/Python/jsonschema/file/Mesa. The exact command was handed to root. apt-get documentation defines print-URIs selection instead of downloading. The worker will map each selected pool path/size to a SHA256 in the verified index before fetching it; final APT install is root-owned and must retain normal signature/hash validation.
No package download, guest install/build, WSLg/native acceptance or network success is inferred at this checkpoint. Ubuntu26.04 evidence does not establish the older Ubuntu24.04 packaging baseline. The preparation script preserves existing/partial files and refuses silent overwrite; failed inputs require explicit diagnosis rather than unsafe fallback.
Root update and installer source review
Root's isolated APT update later completed APT_UPDATE_EXIT=0, after all six local Packages acquisitions. Its log also contains Error: Timeout was reached before Reading package lists...; preserve this mixed result without assigning a cause. Root is inspecting existing ancillary hooks/index trust and selecting URIs. No deb download begins before the completed selection is reconciled with the six fixed signed indices.
Read-only Windows tar inspection of all five Rust archives found exactly the expected top-level directory per archive, no symbolic/hard links and no absolute/traversal member paths. The rustc archive contains both rustc/share/doc/rust/COPYRIGHT.html and COPYRIGHT-library.html needed by strict packaging. rust-review.json preserves the inventory; normalized local install.sh source copies are in rust-review/ (copies are for reading, never the files to execute).
The official installers declare Bash. Source lines789–813 make prefix-controlled bin/lib/etc/share paths and support --disable-ldconfig; lines654–692 gate Linux linker configuration on that flag. They can replace existing components, so the prepared driver requires fresh toolchain, Cargo and unpacked paths rather than reusing an existing installation. Actual installation must run the original archive installer, not the normalized review copy.
Prepared install-rust-for-root.sh, SHA256 1EBA4BA6AEF9CC74C85778D0E6A6BCECE66EA572CB5826FE4BF958909F424772, is not executed by this worker. Root can syntax-review it and run it through the existing guest shell when appropriate. It verifies rust-cargo-SHA256SUMS, creates fresh /root/arcadia-linux-ytr83r-29084050/{unpacked,cargo,toolchain,evidence}, extracts each ordinary component archive, invokes bash <original install.sh> --prefix=<task toolchain> --disable-ldconfig, saves per-component logs, extracts the verified Cargo cache tar and checks copyright reports/version output. Its final build-shell guidance uses only task PATH/CARGO_HOME/CARGO_TARGET_DIR; HOME, CODEX_HOME, RUSTUP_HOME and profiles are untouched. This is an installer preparation/source review, not a Linux toolchain execution or offline Cargo pass.
Exact APT closure admitted for download
Root's completed apt-index-check.log reports all six indices Trusted: yes, and the worker read those entries. The unchanged system 20packagekit post-invoke hook invokes gdbus ... --timeout 4; this is a plausible explanation for the generic timeout preceding update exit0, not a reproduced causal result. Neither hooks nor network configuration were changed.
Completed apt-uris.log ends APT_URIS_EXIT=0, SHA256 58bb654dc064e2689ff25229678cdfebad041ccdb7b7dbb20af5249a070f939d. Its exact closure is 76 archives /120,887,638bytes:61 newly installed,15 upgraded,0 removed,139 not upgraded. APT estimates316MB additional installed disk space. Git, Python3, python3-jsonschema and file are already newest. Before downloads this host had28,535,529,472B free C:.
The15 upgrades are ca-certificates, curl, libbz2-1.0, libc-bin, libc-gconv-modules-extra, libc6, libcurl3t64-gnutls, libcurl4t64, libegl-mesa0, libgbm1, libgl1-mesa-dri, libglx-mesa0, locales, mesa-libgallium and mesa-vulkan-drivers. This includes glibc and Mesa updates from the newer signed repository state; it is not an install-only transaction. Root received the scope before any guest installation. No full upgrade/removal was requested.
Worker reconciled every exact APT-selected pool filename/size against the fixed verified indices, retaining package/version/architecture, source suite, index hash and InRelease hash in deb-plan.json. APT's printed MD5 identifiers are not the integrity boundary: each download is checked against the SHA256 carried by signed metadata. Exactly these76 official HTTPS archives are now transferring into mirror/pool, at most two concurrently. No archive installation or completed-dependency claim yet; failed/partial downloads remain preserved for diagnosis.