Port Odoo appliance to TurnKey 19 - #32
Open
lirazsiri wants to merge 26 commits into
Open
Conversation
Replace the expired Odoo 16 backports package with supported Odoo 19 Community from the official daily channel. Bind the repository key and exact package digest, use a least-privileged PostgreSQL role, and keep generated and firstboot credentials out of traces and process arguments. Add a non-mutating update check and focused acceptance for HTTPS admin login, business-record creation and readback, PostgreSQL persistence, database management credentials, and administration components. Exact runtime acceptance remains pending on the known shared runner blocker; syntax and retained signed-package gates pass.
Run Odoo with nonzero workers and proxy mode, route WebSocket traffic through Apache to the gevent port, and remove stale Odoo 16 backports controls. Load the build database credential from the protected application config instead of exposing it in the initializer argv. Exercise the supported Odoo database CLI with a throwaway initialized database, require valid authentication and API readback after restart, and replace the obsolete database-creation instructions. Focused shell, Python, diff, secret-path, proxy, and seven-field evidence checks pass; the shared runtime builder remains reserved by Observium.
Require every documented and acceptance-created Odoo database to receive a non-default administrator password, then authenticate the throwaway fixture with Odoo's own API before deletion. Route generated database and master-password config updates through a stdin-only helper so neither secret is exposed in process arguments. Preserve special characters exactly and narrow the changelog claim to this verified boundary. Verified with the focused live-argv and config replacement fixture, Bash syntax checks, Python AST parsing, and git diff validation.
Debian Trixie no longer provides wkhtmltopdf, so the legacy plan entry prevents the appliance root from building. Odoo 19 does not declare it as a package dependency; remove it and its X font companion while recording the resulting PDF-report limitation.
Replace the stale infrastructure caveat with the exact retained build failure. Record the official package dependency missing from Trixie, evidence hashes, successful cleanup checks, exhausted product fix budget, and the bounded decision required to resume.
Odoo's official 19 package collapses its source-declared python3-pypdf2 or python3-pypdf dependency to the package name absent from Trixie. Repack the exact hash-verified official artifact by changing only that control dependency while preserving the upstream data archive byte-for-byte. Use the same deterministic transformation for supervised updates, require an approved repacked hash before installation, and retain upstream, payload, and repack provenance. Positive and negative source, control, payload, signed-download, prepare, and apply fixtures pass alongside shell syntax, Python compile and AST, diff, evidence-schema, documentation, and signed-feed checks.
The supervised apply path sources prepare output as machine-readable metadata, while apt-get download can emit progress on stdout. Redirect downloader stdout to stderr at the prepare boundary so network chatter cannot contaminate or execute from the metadata file. Exercise representative progress and assignment-shaped chatter through the real prepare and approved-hash apply paths. The focused fixture verifies the six-key metadata schema, stream separation, non-execution, deterministic repack gates, signed-hash rejection, and apply hash rejection.
Odoo 19 ships admin_passwd in its configuration as a semicolon-commented default. The build-time secret writer treated that valid slot as absent and stopped after the official package installed. Recognize semicolon-commented allowed keys, activate each replacement exactly once, and reject duplicate settings before writing. Mirror the upstream configuration in the fixture and cover successful replacement plus transactional missing, duplicate, and unknown-key failures. Verified with tests/config-secrets.sh, tests/repack-fixture.sh, Bash syntax checks, Python AST parsing, documentation punctuation checks, and git diff --check.
The prior loop-6 correction treated any semicolon-commented allowed key as a replacement slot. That could unintentionally activate a commented db_password or a near-match configuration line. Recognize only Odoo 19's exact vendor admin_passwd default while retaining ordinary active-setting replacement. Add transactional fixtures for active settings, commented db_password, and near-miss admin comments so unsupported comment forms remain absent and unchanged. Verified with tests/config-secrets.sh, Bash syntax, Python AST parsing, documentation punctuation checks, scoped diff validation, and git diff --check.
The final acceptance reached a healthy Odoo runtime, then the fixture failed before its configuration assertions because importing the top-level Odoo package does not load the tools submodule in Odoo 19. Import odoo.tools explicitly in both configuration probes. This changes only test initialization and preserves every runtime assertion and acceptance criterion. Verified with the focused embedded-Python AST checks, tests/config-secrets.sh, Bash syntax, documentation punctuation checks, and git diff --check.
Combine the local Odoo 19 configuration and probe corrections with the newer tkldev epoch-two data-directory validation. Prefer the newer remote resolution where implementation files overlap while retaining non-conflicting local dependency, secret, and runtime work and both histories. Verification: git diff --check and Bash syntax checks passed.
The post-PASS merge introduced an untested package repacker and updater changes that left undefined variables and broke the updater metadata contract. Remove that optional machinery and restore all product, packaging, and test content byte-for-byte to the accepted epoch-two candidate at 9bfc97e. Retain the later epoch-two validation record because it truthfully documents the accepted exact run. Verified with Bash syntax checks, Python AST and compile checks, all source-local Odoo fixtures, documentation punctuation checks, and an exact non-document tree comparison against 9bfc97e.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
docs/v19.0-testing.mdSHIPgit diff --check origin/master...213ee412360abdb486b2489474d842052ca39b04