Supply chain: hash-locked Python deps, pinned build image and actions, draft-first release, working Renovate (7.3.3)

[ks98]

Stage A ("supply chain") of the package archive plan, for linuxmuster-radius, as one PR. Version 7.3.3 (changelog entry included). No behaviour change: the venv carries the library versions 7.3.2 shipped, except idna 3.19 (was 3.20) and watchfiles 1.2.0 (was 1.3.0), because the lock only takes releases at least a week old and those two were days old (see 1).

What

1. Python dependencies only from hash-pinned lockfiles.
   • controlplane/requirements.lock: the runtime closure of pyproject.toml (36 packages, 919 sha256 hashes), generated by uv pip compile --generate-hashes --python-version=3.12 --exclude-newer=P7D --output-file=requirements.lock pyproject.toml. --exclude-newer=P7D: only releases that have been on PyPI for a week.
   • controlplane/build-requirements.lock (from build-requirements.in): pip itself (26.2.1) and setuptools (the build backend).
   • packaging/build-deb.sh installs both with --require-hashes --only-binary :all: --no-deps (every pip install in the script uses --only-binary :all:), builds the control plane offline into a wheel (--no-index --no-build-isolation, so setuptools is no longer fetched unpinned from PyPI) and installs it by name, runs pip check, removes setuptools again and fails the build unless pip freeze --all equals the lockfiles.
   • New CI job lockfile (scripts/check-lockfiles.sh, uv 0.12.18): the header is the canonical command; the pins survive a re-resolution from pyproject.toml; a second, strict resolution for CPython 3.12 / x86_64-manylinux_2_39 (glibc of Ubuntu 24.04) / wheels only gives the same pins; every hash is one PyPI publishes for that exact version, checked from a fresh resolution without the lockfile in place (uv otherwise carries the hashes of kept pins over from the existing file unverified).
   • The fast job runs pytest/mypy against the locked versions.
   • Why uv: it is the tool Renovate's pip-compile manager re-runs for this format, and it is fast. Renovate rejects --python-platform, --only-binary and -o in the header (allowlist in lib/modules/manager/pip-compile/common.ts), hence the plain header and the separate target-platform check.
   • Versions vs 7.3.2: starlette stays at 1.6.0 (1.7.0 was uploaded hours before the lock). Under P7D, idna 3.20 (uploaded 2026-09-17) and watchfiles 1.3.0 (2026-09-21) fall out, so the lock has idna 3.19 and watchfiles 1.2.0. watchfiles only serves uvicorn's auto-reload, which the service does not use; idna only matters for non-ASCII host names. The changelog says so.
   • A pin younger than seven days fails check-lockfiles.sh (P7D is part of the canonical header and both re-resolutions).
2. Images by digest. Build image ghcr.io/linuxmuster/lmndev-runner:24.04@sha256:6b0c8ac9… / :latest@sha256:d735e6cc… in ci.yml, release.yml and the build command in the Makefile; the data-plane base in image/Dockerfile is ubuntu:24.04@sha256:008173c2… (built locally: Ubuntu 24.04.5, FreeRADIUS 3.2.5, winbind 4.19.5).
3. Actions by commit SHA with a trailing # vN comment in all four workflows (SHAs from the stage A pin list, re-checked against the tags).
4. Release without softprops/action-gh-release. The release job uses the runner's gh: create a DRAFT (--verify-tag, --generate-notes, --prerelease for -rc tags), upload the .deb, compare GitHub's sha256 of the asset with the built file, then gh release edit --draft=false, and warn if the release is not immutable. A re-run completes a leftover draft; a published release is never touched. Same step as linuxmusterDEV/templates/release.yml.
5. Renovate actually runs now, and manages every pin.
   • Finding: Renovate never worked in this repo. renovatebot/github-action@v41.0.8 without renovate-version runs Renovate 39 (39.264.0 in run 35583859566), which rejects managerFilePatterns, opened Action Required: Fix Renovate Configuration #1 "Action Required: Fix Renovate Configuration", updated nothing and still ended green. renovate-config-validator 39.264.0 reproduces the error on the old config.
   • renovate.yml: engine pinned once as job env RENOVATE_VERSION: 44.105.4@sha256:e155ebea…; a first step runs renovate-config-validator --strict from that image (an invalid config now fails the job); a missing RENOVATE_TOKEN fails every run except a manual dry run; cron Thursday 04:00 UTC (lmndev-runner is rebuilt Mondays 03:00, so image digest PRs are three days old; ghcr gives no timestamps).
   • renovate.json: helpers:pinGitHubActionDigests, automerge: false everywhere; pip-compile manager for both lockfiles with lock-file maintenance on every weekly run (the dependencies in pyproject carry no version, so a fresh re-lock is how they move; P7D in the header is their age brake); minimumReleaseAge: "7 days" for the pypi datasource only (pinned CI tools; not Docker, which has no timestamps); regex managers for the build image (digest only, never the tag, one grouped PR) and the engine; uv joins the pinned CI tools; runs-on and Ubuntu base-image majors disabled; the github-actions manager does not touch renovate-version.

How verified

• Fast tier green locally in python:3.12 with the exact CI install sequence: ruff, ruff format, mypy, pytest (184 passed), reuse (96/96), shellcheck.
• .deb built as root in ghcr.io/linuxmuster/lmndev-runner:24.04@sha256:6b0c8ac9… (glibc 2.39, Python 3.12.3): pip freeze in the venv equals requirements.lock exactly (36/36, PEP 503-normalised), plus pip==26.2.1 and lmnradius==7.3.3, no setuptools. Built twice: pip freeze --all, the wheel tags of every distribution and all RECORD contents (2221 files with their sha256) are identical. The .deb bytes differ (mtimes, bytecode), so this is a reproducible dependency set, not a bit-for-bit reproducible package.
• Installed wheels match the target: every compiled wheel is x86_64 manylinux ≤ 2.34 (cryptography cp311-abi3-manylinux_2_34_x86_64).
• Negative tests: a tampered hash stops the build (pip hash mismatch) and fails check-lockfiles.sh; a pin younger than seven days (idna 3.20 with genuine hashes and a correct header) fails check-lockfiles.sh; a lockfile missing idna stops the build at pip check; a dependency added to pyproject without re-locking, a non-canonical header and a non-existent pinned version fail check-lockfiles.sh.
• Release step: shellcheck plus a mocked gh for a fresh -rc tag, a leftover draft, an already published release and a digest mismatch (no publish). The real release path cannot be proven without pushing a tag.
• Renovate: the validator step's exact docker command exits 0 on this config and 1 on an invalid one; the token gate fails for schedule and manual real runs, warns for a manual dry run; a local dry run of the pinned engine (--platform=local --dry-run=lookup) finds no config errors and plans: Dockerfile digest pins, the pip-compile refresh, the data-plane image digest, the engine (found via RENOVATE_VERSION), ruff 0.16.7 (not the six-day-old 0.16.8) and mypy (actions need a token, so they only show in the real run).
• CI of this PR: see the checks below (fast, lockfile, resolve, package, install-smoke, upgrade-smoke 7.3.2 → 7.3.3).

After merge (coordinator / Kevin)

0. Before any token: a main ruleset (PR required, no force push, bypass Kevin), see the family review Q3: a token with Contents+Workflows write could otherwise push to main directly.
1. RENOVATE_TOKEN (Kevin): the repo has no secrets, and from the next Thursday run on the Renovate job fails until it exists (intended, it used to stay green). Fine-grained PAT for this repo only, Contents / Pull requests / Issues / Workflows: read and write. Without it Renovate cannot push anything under .github/workflows/ and its PRs start no CI.
   gh secret set RENOVATE_TOKEN --repo faircomp/linuxmuster-radius
2. gh workflow run renovate.yml --repo faircomp/linuxmuster-radius -f dryRun=true, then check the log for "Found renovate config errors" (the job stays green even with errors). Issue Action Required: Fix Renovate Configuration #1 should close itself on the first valid run.
3. Tag ruleset v* (only admins create, move or delete release tags). Note: both org members (ks98, liprox) are org admins and therefore bypass it.

   gh api --method POST repos/faircomp/linuxmuster-radius/rulesets --input - <<'EOF'
   {
     "name": "release tags v*",
     "target": "tag",
     "enforcement": "active",
     "conditions": {"ref_name": {"include": ["refs/tags/v*"], "exclude": []}},
     "rules": [
       {"type": "creation"},
       {"type": "update", "parameters": {"update_allows_fetch_and_merge": false}},
       {"type": "deletion"}
     ],
     "bypass_actors": [{"actor_id": 5, "actor_type": "RepositoryRole", "bypass_mode": "always"}]
   }
   EOF

   (https://docs.github.com/en/rest/repos/rules#create-a-repository-ruleset)
4. After the first release through the new release job succeeded: enable immutable releases.
   gh api --method PUT repos/faircomp/linuxmuster-radius/immutable-releases (204), check with gh api repos/faircomp/linuxmuster-radius/immutable-releases → {"enabled":true,…} (today false).
   (https://docs.github.com/en/rest/repos/repos#enable-immutable-releases)

Not in this PR (noted)

• The .deb is Architecture: all but ships nine x86_64-only compiled wheels (cryptography, pydantic-core, uvloop, …); pre-existing, belongs to the debian/ conversion.
• scripts/tests/crabbox_bootstrap.sh still installs the dev environment unpinned (crabbox changes are Kevin's call).