the .deb ships no dign binary — documented dign capsule fetch is command-not-found on a package install #316

Activity

1. MichaelTaylor3d commented on Aug 25, 2026

   

   MichaelTaylor3d

   on Aug 25, 2026

   ContributorAuthor

   More actions

   Lane open. Branch loop/316-317-deb-dign-isolation, draft PR #359 (batched with the sibling ticket — one branch, one PR, closes both).

   Worktree: worktrees/dn-316-317. Next action: TDD red — a scripts/tests/deb-contents.test.sh that builds a .deb and asserts dpkg-deb -c lists /usr/bin/dign and that the postinst honours a configure-before-joining marker.
2. MichaelTaylor3d commented on Aug 25, 2026

   

   MichaelTaylor3d

   on Aug 25, 2026

   ContributorAuthor

   More actions

   Fixed and proven on a real Ubuntu 24.04 host. Branch loop/316-317-deb-dign-isolation, HEAD 8a93ef2, PR #359 (still draft — gate round pending).

   The .deb now installs /usr/bin/dign as a relative symlink to dig-node, not a second copy: both binaries are one-line shims over the same dig_node_service::run and clap derives the displayed program name from arg0, so a symlink is behaviourally identical, cannot drift from its target, and does not double the package.

   Measured by building the package from the real 0.149.0 release binary and installing it:

   $ dpkg -L dig-node | grep -E '^/usr/bin|^/etc/dig-node'
   /etc/dig-node
   /etc/dig-node/dig-node.env
   /usr/bin
   /usr/bin/dig-node
   /usr/bin/dign
   
   $ ls -l /usr/bin/dign
   lrwxrwxrwx 1 root root 8 ... /usr/bin/dign -> dig-node
   
   $ dign --version
   dign 0.149.0
   
   $ dign capsule fetch --help
   Usage: dign capsule fetch [OPTIONS] <STORE> <ROOT>
   

   And the documented command reaching a running node from the packaged binary:

   $ dign capsule fetch <store> <root> --json
   {"ok":true,"action":"capsule",...,"status":"started"}
   

   <STORE> <ROOT> space-separated matches the docs; no doc change was needed there.

   The BIND hazard is asserted, not assumed. /usr/bin/dig is dnsutils' DNS tool. The package ships nothing at that path, and scripts/tests/deb-contents.test.sh fails if it ever does — proven load-bearing by adding ln -s dig-node \/usr/bin/dig and watching the check fire.

   The gate is the packaging test asked for: it builds a .deb and asserts against dpkg-deb -c, so it measures the artifact rather than the script's source. Reverting the symlink line makes it fail with the exact ticket text; shipping dign as a copy instead also fails it.
3. MichaelTaylor3d commented on Aug 25, 2026

   

   MichaelTaylor3d

   on Aug 25, 2026

   ContributorAuthor

   More actions

   Resume-ready: branch loop/316-317-deb-dign-isolation, HEAD 8a93ef2, PR #359 (draft, awaiting its gate round).

   Done — packaging fix, scripts/tests/deb-contents.test.sh (green in CI, log confirms it RAN rather than skipped), SPEC.md + README.md, version 0.151.1 → 0.152.0 with Cargo.lock re-locked, real-host acceptance on Ubuntu 24.04, seven revert-proofs. Companion docs PR: DIG-Network/docs.dig.net#83.

   CI: both build .deb jobs (amd64 + arm64) pass, plus Clippy, Rustfmt, CodeQL, commitlint, version-increment and the service-smoke matrix. Zero failures.

   Next action: dispatch the gate round over the combined diff, then undraft and squash-merge. Gate tier: one correctness gate — the diff edits no Rust symbol (shell, systemd unit, a new conffile, a new shell test, docs, version), so the blast radius is the package layout, not the node's behaviour.
4. MichaelTaylor3d commented on Aug 25, 2026

   

   MichaelTaylor3d

   on Aug 25, 2026

   ContributorAuthor

   More actions

   Cross-link + a finding that changes the scope of "every doc that names it".

   There are two different .debs that both install a binary called dig-node, and this ticket's fix reaches only one of them:

   	dig-node's release .deb (fixed by #359)	the apt.dig.net package
   built by	packaging/linux/build-deb.sh (this repo)	apt.dig.net/packaging/build-deb.sh
   unit	net.dignetwork.dig-node.service	dig-node.service
   runs as	root	User=dig-node (unprivileged)
   ships dign	yes, now	no

   I found this the expensive way: I edited docs.dig.net/docs/run-a-node/apt.md to say the package installs dign, runs as root and uses the reverse-DNS unit id — and that repo's tests/unit/install-path-lint.test.mjs failed the build, correctly. The apt page documents the other package and was accurate as written. That docs PR is closed not-planned (DIG-Network/docs.dig.net#83).

   So the dign gap also exists in apt.dig.net's package, by a different mechanism: its packaging/config.sh sets PKG_dig_store_EXTRA_BINS="digs" but no PKG_dig_node_EXTRA_BINS. Filed as DIG-Network/apt.dig.net#11.

   This ticket is still correctly closed by #359, because the fleets and the raw-package route both use this repo's .deb: .claude/scripts/e2e-p2p/mvp6-run.sh:56 fetches dig-node_${VER}_arm64.deb from this repo's releases, and line 57 fetches dign separately — the out-of-band workaround that can now retire.
5. MichaelTaylor3d

   closed this as completedin #359on Aug 25, 2026