dev: vagrant: downgrade kernel, https, better messaging by marksvc · Pull Request #3751 · sillsdev/web-xforge

marksvc · 2026-03-19T21:21:17Z

This change is

marksvc · 2026-03-19T21:25:05Z

The original Ubuntu 24.04 GA kernel doesn't have a bug with mouse positioning that the HWE kernel is showing.

Using https for apt avoids a problem with what may be stale proxies.

This PR also adds some clearer messaging regarding whether the vagrant guest machine finished provisioning successfully or not, via notification popups in the machine.

devin-ai-integration

Devin Review found 3 potential issues.

View 2 additional findings in Devin Review.

deploy/vagrant/sfdev/Vagrantfile

devin-ai-integration · 2026-03-19T21:26:35Z

deploy/vagrant/sfdev/Vagrantfile

+    subject="Please wait"
+    body="Please wait for provisioning to finish. $(date -Is)"
+    systemd-run --quiet --machine vagrant@.host --user notify-send --expire-time=0 "${subject}" "${body}"


🚩 systemd-run notification failure would abort provisioning under set -e

The systemd-run --quiet --machine vagrant@.host --user notify-send call at line 45 runs before any provisioning work. If the host doesn't have the right systemd/machinectl configuration (e.g., non-systemd host, wrong permissions), this command will fail and set -e will abort the entire script before any useful provisioning happens. The notifications are a UX nicety but probably shouldn't be fatal. The same concern applies to the systemd-run call inside on_exit at line 38 — if the error-path notification itself fails under set -e, it could mask the original error message (though since it's the last command in the trap, the impact is limited). This is likely fine for the known Vagrant box environment, but fragile if the box configuration changes.

Was this helpful? React with 👍 or 👎 to provide feedback.

I will let it rely on systemd-run working. Also, BTW the systemd-run and the notification happens in the guest not on the containing host. (Even though it says .host).

codecov · 2026-03-19T21:29:15Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.31%. Comparing base (72e6cbc) to head (b5afe7c).
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3751   +/-   ##
=======================================
  Coverage   81.31%   81.31%           
=======================================
  Files         620      620           
  Lines       39080    39080           
  Branches     6376     6376           
=======================================
  Hits        31778    31778           
  Misses       6330     6330           
  Partials      972      972

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

marksvc

@marksvc made 3 comments and resolved 3 discussions.
Reviewable status: 0 of 1 files reviewed, all discussions resolved.

marksvc · 2026-03-19T21:33:46Z

deploy/vagrant/sfdev/Vagrantfile

+    subject="Please wait"
+    body="Please wait for provisioning to finish. $(date -Is)"
+    systemd-run --quiet --machine vagrant@.host --user notify-send --expire-time=0 "${subject}" "${body}"


I will let it rely on systemd-run working. Also, BTW the systemd-run and the notification happens in the guest not on the containing host. (Even though it says .host).

deploy/vagrant/sfdev/Vagrantfile

devin-ai-integration

Devin Review found 2 new potential issues.

View 2 additional findings in Devin Review.

devin-ai-integration · 2026-03-19T21:46:54Z

deploy/vagrant/sfdev/Vagrantfile

+
+    subject="Please wait"
+    body="Please wait for provisioning to finish. $(date -Is)"
+    systemd-run --quiet --machine vagrant@.host --user notify-send --expire-time=0 "${subject}" "${body}"


🔴 systemd-run notification failure aborts entire provisioning due to set -e

The systemd-run call on line 45 sends a purely informational "Please wait" notification to the host. Because set -e is active (line 25), if this command fails for any reason (e.g., the host doesn't have notify-send, or machinectl registration isn't configured for the VM), the entire provisioning script immediately exits before performing any useful work (npm install, dotnet install, kernel downgrade). The EXIT trap then fires, reporting "Provisioning failed (code N)" — all because a cosmetic notification couldn't be delivered.

The same systemd-run call inside on_exit (deploy/vagrant/sfdev/Vagrantfile:38) is less of a concern since it's the last command in the trap handler and the script is already exiting. But the one on line 45 gates the entire provisioning process.

Suggested change

systemd-run --quiet --machine vagrant@.host --user notify-send --expire-time=0 "${subject}" "${body}"

systemd-run --quiet --machine vagrant@.host --user notify-send --expire-time=0 "${subject}" "${body}" || true

Was this helpful? React with 👍 or 👎 to provide feedback.

I will let it rely on systemd-run working. Also, BTW the systemd-run and the notification happens in the guest not on the containing host. (Even though it says .host).

devin-ai-integration · 2026-03-19T21:46:55Z

deploy/vagrant/sfdev/Vagrantfile

+    echo "== Downgrading kernel to GA =="
+    retry sudo apt-get --assume-yes install --install-recommends linux-generic
+    # Must reboot after removing modules.
+    sudo DEBIAN_FRONTEND=noninteractive apt-get --assume-yes purge linux-generic-hwe-\* linux-hwe-\* linux-modules\*-6.17.\*


🚩 apt-get purge with HWE glob patterns may fail if packages are absent

At line 86, apt-get purge uses glob patterns like linux-generic-hwe-\* and linux-modules\*-6.17.\*. If the base box has already been updated (or was never on HWE), these patterns may match zero packages, causing apt-get to return a non-zero exit code (E: Unable to locate package). Under set -e, this would abort provisioning. Currently the base box is expected to have HWE packages, so this works today, but it's fragile against future base box changes. Wrapping with || true or checking whether HWE packages exist first would make it more resilient.

Was this helpful? React with 👍 or 👎 to provide feedback.

I don't retry the purge because it's deleting packages that are installed. Testing in situations of the packages being present and not being present show the command to work as desired.

marksvc

@marksvc made 2 comments and resolved 2 discussions.
Reviewable status: 0 of 1 files reviewed, all discussions resolved.

marksvc · 2026-03-19T21:49:30Z

deploy/vagrant/sfdev/Vagrantfile

+
+    subject="Please wait"
+    body="Please wait for provisioning to finish. $(date -Is)"
+    systemd-run --quiet --machine vagrant@.host --user notify-send --expire-time=0 "${subject}" "${body}"


I will let it rely on systemd-run working. Also, BTW the systemd-run and the notification happens in the guest not on the containing host. (Even though it says .host).

marksvc · 2026-03-19T21:49:30Z

deploy/vagrant/sfdev/Vagrantfile

+    echo "== Downgrading kernel to GA =="
+    retry sudo apt-get --assume-yes install --install-recommends linux-generic
+    # Must reboot after removing modules.
+    sudo DEBIAN_FRONTEND=noninteractive apt-get --assume-yes purge linux-generic-hwe-\* linux-hwe-\* linux-modules\*-6.17.\*


I don't retry the purge because it's deleting packages that are installed. Testing in situations of the packages being present and not being present show the command to work as desired.

devin-ai-integration

Devin Review found 1 new potential issue.

View 3 additional findings in Devin Review.

devin-ai-integration · 2026-03-20T17:31:12Z

deploy/vagrant/sfdev/Vagrantfile

+        body="Destroy and recreate this vagrant machine. See WARNING-NOT-PROVISIONED.txt on the desktop for details. $(date -Is)"
+      fi
+      echo >&2 "${subject}: ${body}"
+      systemd-run --quiet --machine vagrant@.host --user notify-send --expire-time=0 "${subject}" "${body}"


🚩 EXIT trap's systemd-run could alter final exit status

The on_exit function at line 38 ends with a systemd-run call. If provisioning succeeds (exit 0) but this notification command fails, the last command in the EXIT trap has a non-zero exit status. In some bash versions, this can override the script's final exit status, causing Vagrant to interpret a successful provisioning as a failure. While the main-line systemd-run at line 45 was reported as a bug, this trap-side instance has its own subtle risk. Adding || true here as well would make the behavior robust across bash versions.

Was this helpful? React with 👍 or 👎 to provide feedback.

(I'm going to rely on systemd-run working.)

marksvc

@marksvc made 1 comment and resolved 1 discussion.
Reviewable status: 0 of 2 files reviewed, all discussions resolved.

marksvc · 2026-03-20T17:36:24Z

deploy/vagrant/sfdev/Vagrantfile

+        body="Destroy and recreate this vagrant machine. See WARNING-NOT-PROVISIONED.txt on the desktop for details. $(date -Is)"
+      fi
+      echo >&2 "${subject}: ${body}"
+      systemd-run --quiet --machine vagrant@.host --user notify-send --expire-time=0 "${subject}" "${body}"


(I'm going to rely on systemd-run working.)

pmachapman

I liked the notifications prompting me to restart, and that the provisioning was successful.

@pmachapman reviewed 2 files and all commit messages, and made 1 comment.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on marksvc).

marksvc marked this pull request as draft March 19, 2026 21:21

devin-ai-integration bot reviewed Mar 19, 2026

View reviewed changes

marksvc force-pushed the task/vag-kernel branch from 1d5e847 to a8d3c3a Compare March 19, 2026 21:33

marksvc commented Mar 19, 2026

View reviewed changes

marksvc added the testing not required label Mar 19, 2026

devin-ai-integration bot reviewed Mar 19, 2026

View reviewed changes

marksvc commented Mar 19, 2026

View reviewed changes

marksvc marked this pull request as ready for review March 19, 2026 21:50

dev: vagrant: downgrade kernel, https, better messaging

d5bb4b0

marksvc force-pushed the task/vag-kernel branch from a8d3c3a to d5bb4b0 Compare March 20, 2026 17:25

marksvc changed the title ~~dev: vagrant: downgrade kernel, better messaging~~ dev: vagrant: downgrade kernel, https, better messaging Mar 20, 2026

devin-ai-integration bot reviewed Mar 20, 2026

View reviewed changes

marksvc commented Mar 20, 2026

View reviewed changes

pmachapman self-assigned this Mar 22, 2026

pmachapman approved these changes Mar 22, 2026

View reviewed changes

Merge branch 'master' into task/vag-kernel

b5afe7c

marksvc enabled auto-merge (squash) March 23, 2026 18:03

marksvc merged commit d192a53 into master Mar 23, 2026
21 of 22 checks passed

marksvc deleted the task/vag-kernel branch March 23, 2026 18:10

	systemd-run --quiet --machine vagrant@.host --user notify-send --expire-time=0 "${subject}" "${body}"
	systemd-run --quiet --machine vagrant@.host --user notify-send --expire-time=0 "${subject}" "${body}" \|\| true

Uh oh!

Conversation

marksvc commented Mar 19, 2026 • edited by devin-ai-integration bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marksvc commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

devin-ai-integration bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

marksvc left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration bot Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

marksvc left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration bot Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

marksvc left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pmachapman left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

marksvc commented Mar 19, 2026 •

edited by devin-ai-integration bot

Loading

marksvc commented Mar 19, 2026 •

edited

Loading

codecov bot commented Mar 19, 2026 •

edited

Loading

devin-ai-integration bot Mar 19, 2026 •

edited

Loading