fix: give a Wi-Fi the installer set up to NetworkManager, by hand

The Bible study laptop had working internet and a panel that said there was no connection. Both were true, and one thing caused both. Measured on the machine: nmcli device status wlp2s0 wifi unmanaged nmcli networking connectivity none while curl fetched fine nmcli device wifi list nothing, with the radio enabled /run/network/ifstate wlp2s0=wlp2s0 a second wpa_supplicant, -i wlp2s0, with no -c config file dhcpcd holding the lease /etc/network/interfaces 0600 root:root Debian's installer had been given the Wi-Fi, so it wrote it into /etc/network/interfaces and ifupdown brings it up. NetworkManager ships with plugins=ifupdown and [ifupdown] managed=false, so an interface named in that file is UNMANAGED — which is why the applet had nothing to report and why scanning found nothing. An unmanaged device is not a radio NetworkManager will scan with. rfkill was ruled out separately: the radio is enabled. managed=false stays; it is what keeps a tower's static Ethernet where an administrator put it. Only a wireless interface is moved. classroom-wifi grows --check, --adopt (with --dry-run) and --rollback. --adopt builds a NetworkManager SYSTEM connection from the SSID and key already in that root-only file, so the password never leaves the machine and never reaches a human or a log; it lands in a 0600 root file with psk-flags=0, the same shape 0.2.4 established, and the polkit rules protecting it are untouched. Deliberately NOT run by the upgrade. It moves a machine's only link between managers and the machine it could strand is a laptop in a locked room, so classroom-migrate only looks and prints what it found. An administrator runs it over SSH while watching. Two things this learned from testing the rollback rather than from reading the code, and both are why the rollback is worth testing: * ifdown was missing in the lab, subprocess raised FileNotFoundError, and the exception escaped AFTER the stanza was commented out. No rollback ran. Every hand-over command now goes through a runner that tolerates a missing binary, and the whole hand-over is inside a guard that restores the file on any failure at all. * it now refuses to start when ifdown or ifup are absent, because without them the hand-over would be a one-way door. Success also requires the interface itself to be carrying the connection, not merely that the machine is online — a machine with a second link would otherwise report a failed migration as a success. Verified in the lab against real NetworkManager with a real ifupdown file: --check and --dry-run leave it byte-identical, a failed --adopt rolls back byte-identically, and --rollback restores a half-migrated machine byte-identically and exits 0. The one thing no lab can do is the hand-over succeeding, which needs the laptop's radio. Co-Authored-By: Claude Opus 5 <[email protected]>
2026-09-21 21:11:19 -05:00
parent a31fa75d55
commit 35e3bdcbbd
6 changed files with 358 additions and 52 deletions
@@ -136,17 +136,46 @@ check("a wpa-ssid alone is enough",
 print("7. the command itself")
 wifi = (root / "scripts/classroom-wifi").read_text()
 check("--adopt exists and has a dry run", "--adopt" in wifi and "--dry-run" in wifi)
+check("--check reads without changing anything", "--check" in wifi)
+check("--rollback is a command a person can run, not only an automatic path",
+      "--rollback" in wifi)
 check("it keeps the original file before changing it",
      "before-ekklesia-classroom" in wifi)
 check("it verifies the room is really online, not just that NM says so",
      "curl" in wifi and "connectivity" in wifi)
-check("it rolls back to ifupdown if the network does not come back",
-      "rolling back" in wifi and "ifup" in wifi)
+# A machine with a second link would answer "online" while the interface
+# being migrated sat dead, and a migration that failed would be called a
+# success.
+check("and that the interface itself is carrying the connection",
+      "def carrying(" in wifi)
 check("it never prints the password",
      "psk}" not in wifi and "{psk" not in wifi)
 check("the connection it creates is still a system one",
      '"connection.permissions"' not in wifi)

+print("8. it cannot leave a machine half migrated")
+# Found by testing the rollback rather than by reading the code: ifdown
+# was missing in the lab, subprocess raised, and the exception escaped
+# AFTER the stanza had been commented out — no rollback, no network. Both
+# of these are the fix.
+check("every hand-over command tolerates not being installed",
+      "def run(" in wifi and "OSError" in wifi)
+check("and the whole hand-over is guarded, so any failure restores it",
+      "except BaseException" in wifi and "restore(device, ssid)" in wifi)
+check("it refuses to start when it could not undo itself",
+      "shutil.which" in wifi
+      and "leaving the network exactly as it is" in wifi)
+
+print("9. the upgrade does not do any of this on its own")
+# Moving a machine's only link during an unattended upgrade is fine until
+# the once it is not, and the machine it would strand is a laptop in a
+# locked room.
+migrate = (root / "scripts/classroom-migrate").read_text()
+code = "\n".join(line for line in migrate.splitlines()
+                 if not line.lstrip().startswith("#"))
+check("the migration never runs --adopt", "--adopt" not in code)
+check("it only looks, and says what it found", "classroom-wifi --check" in code)
+
 print()
 print(f"{passed} passed, {failed} failed")
 raise SystemExit(1 if failed else 0)