test(images): record which machine ID read fails in the tally

[bketelsen]

Summary

Publication run 38062049493 failed acceptance on a single check: openSUSE Tumbleweed r6's tally, on machine_id. Everything else passed, including the three images from #58. Nothing was published.

The failure looks transient:

• The machine_id check also reads every other machine's live /etc/machine-id. The tallies just before and after it passed, and both read Tumbleweed's machine too.
• A local rebuild of Tumbleweed r6 from the same commit, with the same systemd 261.3, has uninitialized in its tree.

The evidence recorded only distinct_across_machines, so nobody could tell which machine's read failed, or how.

machine_id_tally() is now a pure function, and its result records:

• failed_reads: for each read that exited non-zero or didn't return 32 characters, the exit status, output length, stderr tail and duration. It keeps the output only when it isn't an ID, such as uninitialized or an empty string.
• shared: the machines whose IDs collide.
• machines: how many machines were read.

It never records a machine ID itself, since machine-id(5) calls them confidential. The pass condition is unchanged, except that a read must now also exit 0.

Publication results

The second commit records Phase 2 of the more-releases plan and updates the docs index and publication design:

• The failed attempt, run 17, published nothing, so sequence 17 stays unused.
• Run 38072703300 published from the same commit and passed all 140 machine checks and the memory gate (932 MiB for four idle machines, budget 1,200). It promoted catalogue sequence 18 with all eleven machine images.
• The clean-host check passed. The released v0.10.0 binary, checked against the release checksums and attestation, created machines from debian:testing, fedora:rawhide and ubuntu:24.04 on an empty cache.

Testing

• New scripts/test_probe_machines.py covers distinct IDs, an ID in the image tree, failed reads (with no ID leaking into evidence) and a shared ID.
• probe-machines.py --only tally on Debian 13 r6 and Ubuntu 24.04 r2 with VM image r10 passed, and the evidence carried the new fields.
• make ci passes.

🤖 Generated with Claude Code