archipelagoandClaude Opus 5
b7e57ca9cf
Demo images / Build & push demo images (push) Successful in 3m29s
Both default update mirrors resolve to the SAME host — the primary by name over HTTPS, the fallback by IP over plain HTTP — while SystemUpdate.vue told the operator "Servers this node checks for updates. The primary is tried first; if it's slow or unreachable, the next one in the list is tried automatically." That promises availability redundancy the pair cannot provide: if the origin is down, both entries are down. Reported by the operator, who read the list and correctly concluded the fallback made no sense. The mechanism is fine and deliberate — it recovers a node whose DNS is broken or whose clock is wrong, both of which fail TLS while plain HTTP still works, and it is safe because the manifest carries an Ed25519 signature verified against the pinned release-root anchor, so transport integrity is not what protects the update. (That last part only became true once Workstream B pinned the anchor; before then this fallback would have been a real hole.) So the bug was the labelling, not the design: - Backend label "Direct (fallback)" -> "Same server, no DNS/TLS", and the comment now states plainly that it is the same host, what it recovers, and that real redundancy needs a different one. - UI copy now scopes the redundancy sentence to genuine mirrors and adds a paragraph saying the two built-in entries are one server, what the second actually recovers, that it does not help if the server is down, why an unencrypted fetch is acceptable, and how to get real redundancy. The relabel reaches existing nodes: force_ovh_update_primary rewrites labels for the two default URLs on every load, while the merge matches on URL and never on label — without that rewrite path a renamed default would have sat in the code and never propagated to a single deployed node. Noted inline so it is not re-broken. Verified: 40/40 update tests pass (including the mirror load/merge/strip ones), vue-tsc clean, build green, and the new copy is present in the freshly built SystemUpdate chunk. Nothing in the tree pinned the old label string. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>