mca/parking_solution
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

docs(desktop): updates are admin-only — keep the polkit prompt; AppImage rejected on field evidence

Browse Source 
Decision (user, 2026-09-04) after the first successful self-update
(v0.1.6 → v0.1.7): a .deb update runs pkexec dpkg -i and asks for an admin
password the operator does not have — that prompt is the intended gate.
The AppImage was tried as the no-root path and aborts on the 26.04 booth
(bundled 24.04 glib/WebKitGTK vs host gvfs/Mesa: EGL_BAD_PARAMETER), and it
discards the distro-maintained WebKitGTK the platform decision rests on.
Passwordless polkit for dpkg is root for the operator — rejected.

- update.prompt (en + sq) now says the install needs the administrator
  password.
- desktop-shell-tauri.md: decision, evidence, rejected alternatives, and the
  deferred fleet-grade option (root systemd timer in the .deb, minisign-
  verified, notify-only in-app).
- standing-decisions.md: ship the .deb; runtime backend; updates admin-only.
- appliance-provisioning.md: drop the stale "hardcoded to localhost" note.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU
This commit is contained in:
Julian Çuni
2026-09-04 18:11:41 +02:00
parent 54e691a4c9
commit 9c05f86c86
6 changed files with 52 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wiki/decisions/standing-decisions.md
+4 -1
View File
@@ -24,7 +24,10 @@ The decisions treated as settled in the design notes. (See [[parking-system-arch
(chosen over Electron, 2026-06-21) — small footprint, no bundled Chromium to patch, and a
deny-by-default native surface that fits [[threat-model|the booth-operator threat model]]. The
shell stays **thin**: all privileged logic remains in [[fastify]]. One open dependency — the
appliance's WebKitGTK version (see [[open-questions]] #11).
appliance's WebKitGTK version (see [[open-questions]] #11). Ships as a **`.deb`** (the AppImage
bundles a runner's WebKitGTK and fails on the 26.04 booth — 2026-09-04); its backend address is
**operator-entered at runtime**, not baked in; and **in-app updates are an admin-only action**
behind the polkit password prompt (user, 2026-09-04) — never make that prompt passwordless.
- **Integrity:** append-only, hash-chained, **software-signed** event log
([[append-only-event-chain]]) — hardware-backed signing (a non-extractable key in the
**[[tpm|TPM]]** or a **USB HSM**; the [[atecc608]] is [[open-questions|upcoming, not present]]) is