fix(deploy): rpm -q reports "not installed" on stdout, defeating the sentinel #227

Merged

grenade merged 1 commits from fix/deploy-rpm-q-detection into main 2026-08-04 04:16:45 +00:00

Conversation 0 Commits 1 Files Changed 1 +24 -4

grenade commented 2026-08-03 22:16:16 +00:00

Owner

Copy Link

Every deploy job used

installed=$(rpm -q --qf '...' "$pkg" 2>/dev/null || echo "not-installed")

but rpm -q prints package X is not installed to stdout and exits
1, so the || branch never runs and $installed holds the message text
rather than the sentinel. Visible in the deploy log:

helexa-angels: installed=package helexa-angels is not installed

Harmless in the three long-standing jobs — a bogus version string is
still unequal to the published one, so they install anyway — but it made
the unpublished-package guard added in #226 dead code, since that guard
tests for exactly this sentinel. Fixed at all four sites so the pattern
is not copied into a fifth.

I made the same mistake in a throwaway watcher script within the same
hour, which is reasonable evidence it is an easy one to make: rpm -q
looks like it fails cleanly and does not.

Note the actual blocker for the first angels deploy was separate and
already resolved out of band: gitea_ci had no sudoers entries for
helexa-angels on gallumbits. Those entries shipped in #225 but
asset/sudoers.d/ is only applied by script/infra-setup.sh, so
committing them is not installing them — the #188 first-rollout gotcha,
hit again. They are installed now.

Every deploy job used ```sh installed=$(rpm -q --qf '...' "$pkg" 2>/dev/null || echo "not-installed") ``` but `rpm -q` prints `package X is not installed` to **stdout** and exits 1, so the `||` branch never runs and `$installed` holds the message text rather than the sentinel. Visible in the deploy log: ``` helexa-angels: installed=package helexa-angels is not installed ``` Harmless in the three long-standing jobs — a bogus version string is still unequal to the published one, so they install anyway — but it made the unpublished-package guard added in #226 dead code, since that guard tests for exactly this sentinel. Fixed at all four sites so the pattern is not copied into a fifth. I made the same mistake in a throwaway watcher script within the same hour, which is reasonable evidence it is an easy one to make: `rpm -q` looks like it fails cleanly and does not. Note the *actual* blocker for the first angels deploy was separate and already resolved out of band: `gitea_ci` had no sudoers entries for helexa-angels on gallumbits. Those entries shipped in #225 but `asset/sudoers.d/` is only applied by `script/infra-setup.sh`, so committing them is not installing them — the #188 first-rollout gotcha, hit again. They are installed now.

grenade added 1 commit 2026-08-03 22:16:16 +00:00

fix(deploy): rpm -q reports "not installed" on stdout, not via exit only ... 10bc5c0a20

Every deploy job used

    installed=$(rpm -q --qf '...' "$pkg" 2>/dev/null || echo "not-installed")

but `rpm -q` prints "package X is not installed" to STDOUT and exits 1,
so the `||` branch never runs and `$installed` holds the message text
rather than the sentinel. The logs show it plainly:

    helexa-angels: installed=package helexa-angels is not installed

Harmless in the three long-standing jobs — a bogus version string is
still unequal to the published one, so they install anyway — but it made
the unpublished-package guard added in the previous commit dead code,
since it tests for exactly that sentinel. Fixed at all four sites so the
pattern is not copied into a fifth.

Same mistake I made in a throwaway watcher script minutes earlier, which
is a decent argument for it being an easy one to make: `rpm -q` looks
like it fails cleanly and does not.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0165r11RzqkMqWWXfJE8tAVU

grenade merged commit f2cdb51bf8 into main 2026-08-04 04:16:45 +00:00

grenade deleted branch fix/deploy-rpm-q-detection 2026-08-04 04:16:45 +00:00

grenade referenced this issue from a commit 2026-08-04 04:16:46 +00:00

Merge pull request 'fix(deploy): rpm -q reports "not installed" on stdout, defeating the sentinel' (#227) from fix/deploy-rpm-q-detection into main

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

out-of-scope

Outside helexa's constraining principles: near-frontier models on consumer hardware, served transparently and predictably

p1-now

Active pain or unblocking work — pick up first

p2-next

Engine levers — start once P1 baselines exist

p3-later

Dependent on earlier work, or demand-driven

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

grenade

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: helexa/helexa#227