dandri/ukmesh
1
0
Fork 0
mirror of https://github.com/gadgethd/ukmesh.git synced 2026-09-01 17:08:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden HopReach release image

Browse Source
This commit is contained in:
gadgethd
2026-08-02 17:27:48 +01:00
parent 94799df048
commit 09366e7dec
9 changed files with 33 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+4 -2
View File
@@ -74,8 +74,8 @@ jobs:
image: meshcore-hopreach
context: third_party/hopreach
file: third_party/hopreach/Dockerfile
source_revision: f497b3fb72644aa1fb5f5fcce3fe2afca78bdaf6
build_args: VERSION=v0.1.32-ukmesh.2
source_revision: 0230702be70a2729c5acc5640401f56ab9d65fd4
build_args: VERSION=v0.1.32-ukmesh.3
- component: ml-path-learner
image: meshcore-ml-path-learner
context: ml-path-learner
@@ -107,6 +107,8 @@ jobs:
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
labels: |
org.opencontainers.image.revision=${{ env.SOURCE_REVISION }}
tags: |
type=sha,format=long
type=ref,event=tag
README.md
+1 -1
View File
@@ -399,7 +399,7 @@ This project is built on the following open source libraries and tools:
### RF and link workers
| Package | License |
|---|---|
| [HopReach v0.1.32-ukmesh.2](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.2) | AGPL-3.0 plus Commons Clause |
| [HopReach v0.1.32-ukmesh.3](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.3) | AGPL-3.0 plus Commons Clause |
| [NumPy](https://numpy.org) | BSD 3-Clause |
| [SciPy](https://scipy.org) | BSD 3-Clause |
| [Shapely](https://shapely.readthedocs.io) | BSD 3-Clause |
docker-compose.yml
+1 -1
View File
@@ -560,7 +560,7 @@ services:
context: ./third_party/hopreach
dockerfile: Dockerfile
args:
VERSION: v0.1.32+ukmesh
VERSION: v0.1.32-ukmesh.3
SOURCE_REVISION: ${SOURCE_REVISION:-local}
restart: always
logging: *json-log-limits
docs/architecture.md
+2 -2
View File
@@ -16,8 +16,8 @@
The complete HopReach v0.1.32 source is vendored at
`third_party/hopreach`, with the exact upstream revision recorded in
`UPSTREAM_COMMIT`. The identical derived source is public as
[`v0.1.32-ukmesh.2`](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.2)
at commit `f497b3fb72644aa1fb5f5fcce3fe2afca78bdaf6`. The unmodified upstream CPU
[`v0.1.32-ukmesh.3`](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.3)
at commit `0230702be70a2729c5acc5640401f56ab9d65fd4`. The unmodified upstream CPU
raster remains an executable accuracy oracle. The production CPU path retains
the same propagation equations, DEM samples, free-space path loss, 4/3-earth
curvature, knife-edge diffraction, link budget, and margin calculation while
docs/rf-coverage-rollout.md
+7 -7
View File
@@ -1,13 +1,12 @@
# HopReach RF coverage rollout and recovery
Status: implemented and verified locally; production rollout is not performed
by this change.
Status: implemented and release-gated for production rollout.
Evidence date: 2026-08-02
Canonical model: the public UK Mesh HopReach tag
[`v0.1.32-ukmesh.2`](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.2)
at commit `f497b3fb72644aa1fb5f5fcce3fe2afca78bdaf6`, based directly on upstream
[`v0.1.32-ukmesh.3`](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.3)
at commit `0230702be70a2729c5acc5640401f56ab9d65fd4`, based directly on upstream
v0.1.32 commit `61efac0b4678f55496fe08f53eda0c79eb18655b`. The tagged tree is vendored
at `third_party/hopreach`.
@@ -20,7 +19,7 @@ at `third_party/hopreach`.
- Use digest-pinned backend, HopReach, and app images built by the signed
release workflow. Confirm the backend/app revision label is the integration
release commit and the HopReach revision label is
`f497b3fb72644aa1fb5f5fcce3fe2afca78bdaf6`.
`0230702be70a2729c5acc5640401f56ab9d65fd4`.
- Do not enable calibrated variants. The production profile deliberately has
`calibration.enabled: false`; evidence validation is a separate rollout.
- Do not reduce range, node count, terrain zoom, supersampling, or RF fidelity
@@ -70,9 +69,10 @@ From a clean reviewed revision:
docker compose config --quiet
docker run --rm --user "$(id -u):$(id -g)" -e HOME=/tmp \
-v "$PWD:/work" -w /work/third_party/hopreach \
golang:1.23-bookworm go test ./...
golang:1.25.7-bookworm@sha256:564e366a28ad1d70f460a2b97d1d299a562f08707eb0ecb24b659e5bd6c108e1 go test ./...
docker run --rm --user "$(id -u):$(id -g)" -e HOME=/tmp \
-v "$PWD:/work" -w /work golang:1.23-bookworm \
-v "$PWD:/work" -w /work \
golang:1.25.7-bookworm@sha256:564e366a28ad1d70f460a2b97d1d299a562f08707eb0ecb24b659e5bd6c108e1 \
/work/scripts/benchmark-hopreach.sh
```
rf-coverage/SOURCE-OFFER.md
+3 -3
View File
@@ -1,9 +1,9 @@
# HopReach corresponding source
The deployed RF calculator's complete corresponding source is public in the
[UK Mesh HopReach fork](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.2)
at commit `f497b3fb72644aa1fb5f5fcce3fe2afca78bdaf6`, immutably tagged
`v0.1.32-ukmesh.2`. That revision is based directly on upstream HopReach
[UK Mesh HopReach fork](https://github.com/gadgethd/hopreach/tree/v0.1.32-ukmesh.3)
at commit `0230702be70a2729c5acc5640401f56ab9d65fd4`, immutably tagged
`v0.1.32-ukmesh.3`. That revision is based directly on upstream HopReach
v0.1.32 commit `61efac0b4678f55496fe08f53eda0c79eb18655b` and contains the
identifiable UK Mesh modifications vendored in `third_party/hopreach`.
scripts/replace-container.sh
+3 -3
View File
@@ -321,9 +321,9 @@ smoke_service() {
docker compose --project-name "$project_name" exec -T backend \
wget -qO- http://127.0.0.1:3000/readyz \
| jq -e '.status == "ready"' >/dev/null
docker compose --project-name "$project_name" exec -T backend \
wget -qO- http://127.0.0.1:9091/metrics \
| grep -q '^meshcore_process_'
metrics="$(docker compose --project-name "$project_name" exec -T backend \
wget -qO- http://127.0.0.1:9091/metrics)"
grep -q '^meshcore_process_' <<<"$metrics"
case "$target_service" in
backend)
curl --fail --silent http://127.0.0.1:3000/readyz \
third_party/hopreach/Dockerfile
Vendored
+7 -6
View File
@@ -4,7 +4,7 @@
# COVERAGE_GPU_MODE) links against wgpu-native's prebuilt static libs, which
# target glibc. The runtime stage below has to follow suit for the same
# reason.
FROM golang:1.23-bookworm AS build
FROM golang:1.25.7-bookworm@sha256:564e366a28ad1d70f460a2b97d1d299a562f08707eb0ecb24b659e5bd6c108e1 AS build
# VERSION is passed by .github/workflows/release.yml as the git tag that
# triggered this build (e.g. v0.1.8) — "dev" (buildinfo's own default,
# unmistakable in the UI/analytics page) if built some other way, e.g.
@@ -26,7 +26,7 @@ RUN CGO_ENABLED=1 go build -ldflags "-X hopreach/internal/buildinfo.Version=${VE
# drifting JS copy. wasm_exec.js (Go's own runtime shim) is copied from
# this same build stage so it's always paired with the Go version that
# actually compiled the module.
FROM golang:1.23-bookworm AS wasmbuild
FROM golang:1.25.7-bookworm@sha256:564e366a28ad1d70f460a2b97d1d299a562f08707eb0ecb24b659e5bd6c108e1 AS wasmbuild
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
@@ -42,7 +42,7 @@ RUN GOOS=js GOARCH=wasm go build -o /out/hopreach.wasm ./wasm \
# `devices:` block) — otherwise gpu.mode=auto's probe simply finds nothing
# and falls back to CPU, same as always. They're a modest image size cost
# either way, not a functional requirement.
FROM nginx:bookworm
FROM ubuntu:26.04@sha256:3131b4cc82a783df6c9df078f86e01819a13594b865c2cad47bd1bca2b7063bb
ARG SOURCE_REVISION=unknown
ARG VERSION=v0.1.32+ukmesh
LABEL org.opencontainers.image.revision="${SOURCE_REVISION}" \
@@ -50,8 +50,9 @@ LABEL org.opencontainers.image.revision="${SOURCE_REVISION}" \
org.opencontainers.image.version="${VERSION}" \
org.opencontainers.image.licenses="AGPL-3.0-only WITH Commons-Clause"
RUN apt-get update \
&& apt-get install -y --no-install-recommends libvulkan1 mesa-vulkan-drivers cron curl \
&& rm -rf /var/lib/apt/lists/*
&& apt-get install -y --no-install-recommends \
nginx cron curl libvulkan1 mesa-vulkan-drivers ca-certificates \
&& rm -rf /var/lib/apt/lists/* /etc/nginx/sites-enabled/default
COPY --from=build /app/hopreach /app/hopreach
COPY --from=build /app/hopreach-shareapi /app/hopreach-shareapi
@@ -64,7 +65,7 @@ COPY docker/config.docker.yaml /config/config.yaml
COPY LICENSE UPSTREAM_COMMIT /usr/share/doc/hopreach/
RUN chmod +x /entrypoint.sh /app/hopreach /app/hopreach-shareapi \
&& mkdir -p /data/dem-cache /data/shared-plans /var/cache/nginx/dem-tiles \
&& chown -R nginx:nginx /var/cache/nginx/dem-tiles
&& chown -R www-data:www-data /var/cache/nginx/dem-tiles
# The only environment variable HopReach's own binaries read — everything
# else lives in config.yaml (see /config/config.yaml, baked in above from
third_party/hopreach/docker/entrypoint.sh
Vendored
+5 -1
View File
@@ -13,7 +13,11 @@ mkdir -p /data/dem-cache /data/shared-plans
/app/hopreach -prepare
touch /var/log/fetch.log /var/log/prune.log
cron -f &
if command -v cron >/dev/null 2>&1; then
cron -f &
else
crond -f &
fi
tail -F /var/log/fetch.log /var/log/prune.log &
# The terrain-aware coverage computation can take minutes on first run (DEM