SysAdmin 8a3cd0ba22 fix(linux/build): allow untagged / uncommitted submodule commits (M1.1) ...

Run #4256 finally cleared every preceding obstacle and reached
git_sanity_test's per-submodule verification phase. sq-git authenticated
every commit signature in the chain — that part is working perfectly —
but failed at:

    ERROR: Untagged commit in: qubes/qubes-template-kicksecure
    INFO: As a developer or advanced user you might want to use:
    WARNING: This can be insecure if you cannot audit the changes.
    --allow-untagged true --allow-uncommitted true

git_sanity_test runs two orthogonal checks:
  1. signatures (sq-git, verified ✅)
  2. tagged-commit-only mode (verified ❌ for one submodule)

The pinned upstream tag (18.1.7.4-developers-only — the name itself
flags the intent) deliberately ships with some submodule pointers at
intermediate / merge commits rather than release tags. parse-cmd
documents `--allow-untagged true` and `--allow-uncommitted true` for
exactly this case. Signatures remain verified; we're only relaxing the
release-tag check, which is appropriate when we've deliberately pinned
to a developer tag.

If/when we move to a redistributable upstream tag in M1.10+ (signing
ceremony milestone), these flags should come back out.

No image rebuild needed — script-only change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-07 11:35:27 +01:00

3.0 KiB

Executable File

Raw Blame History

View Raw