refactor!: rename the project from Monitor to MoShiro

Namespaces, assemblies, projects and directories, the solution, binaries,
images, systemd units, config paths, environment variables, protocol method
names, the media type and the raw chunk magic all move to MoShiro/moshiro.
Existing data and deployments are not compatible and must be recreated.
Also fix the architecture tests after the solution layout change and make
the update tests independent of their order.

packaging/update/install-updater.sh

@@ -30,8 +30,8 @@ case "$POLICY" in auto|manual) ;; *) echo "--policy must be auto or manual" >&2;
 case "$ENGINE" in podman|docker) ;; *) echo "--engine must be podman or docker" >&2; exit 2 ;; esac
 if [ -n "$DATA_VOLUME" ]; then
   [ -z "$DATA_DIR" ] || { echo "use --volume or --data-dir, not both" >&2; exit 2; }
-  [ -n "$HELPER_IMAGE" ] || { echo "--volume needs --helper-image (an already pulled Monitor image)" >&2; exit 2; }
-  STATUS_VOLUME="${STATUS_VOLUME:-monitor-$COMPONENT-status}"
+  [ -n "$HELPER_IMAGE" ] || { echo "--volume needs --helper-image (an already pulled MoShiro image)" >&2; exit 2; }
+  STATUS_VOLUME="${STATUS_VOLUME:-moshiro-$COMPONENT-status}"
   "$ENGINE" image inspect "$HELPER_IMAGE" >/dev/null
   "$ENGINE" volume inspect "$DATA_VOLUME" >/dev/null 2>&1 || "$ENGINE" volume create "$DATA_VOLUME" >/dev/null
   "$ENGINE" volume inspect "$STATUS_VOLUME" >/dev/null 2>&1 || "$ENGINE" volume create "$STATUS_VOLUME" >/dev/null
@@ -42,15 +42,15 @@ fi
 if [ "$SERVICE_SCOPE" = user ]; then
   [ "$(id -u)" -ne 0 ] || { echo "--user must run as the rootless Podman user, without sudo" >&2; exit 1; }
   [ "$ENGINE" = podman ] || { echo "--user currently supports rootless Podman; Docker uses system services" >&2; exit 2; }
-  CONF_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/monitor"
-  STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/monitor-update"
+  CONF_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/moshiro"
+  STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/moshiro-update"
   UNIT_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
   BIN_DIR="$HOME/.local/bin"
   TARGET=default.target
 else
   [ "$(id -u)" -eq 0 ] || { echo "system installation needs root; use --user for rootless Podman" >&2; exit 1; }
-  CONF_DIR=/etc/monitor-update
-  STATE_DIR=/var/lib/monitor-update
+  CONF_DIR=/etc/moshiro-update
+  STATE_DIR=/var/lib/moshiro-update
   UNIT_DIR=/etc/systemd/system
   BIN_DIR=/usr/local/sbin
   TARGET=multi-user.target
@@ -64,8 +64,8 @@ unit_escape() { printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'; }
 
 HERE="$(cd "$(dirname "$0")" && pwd)"
 install -d -m 755 "$CONF_DIR" "$STATE_DIR" "$UNIT_DIR" "$BIN_DIR"
-BIN="$BIN_DIR/monitor-update"
-install -m 755 "$HERE/monitor-update.sh" "$BIN"
+BIN="$BIN_DIR/moshiro-update"
+install -m 755 "$HERE/moshiro-update.sh" "$BIN"
 install -m 644 "$HERE/release-key.pub.pem" "$CONF_DIR/release-key.pub.pem"
 if [ -n "$DATA_VOLUME" ]; then
   : # Named volumes are initialized by the image; no host directory or chown needed.
@@ -92,49 +92,49 @@ PUBKEY="$CONF_DIR/release-key.pub.pem"
 chmod 600 "$CONF_DIR/$COMPONENT.conf"
 
 if [ -n "$DATA_VOLUME" ]; then
-  cat > "$UNIT_DIR/monitor-update-$COMPONENT.service" <<UNITFILE
+  cat > "$UNIT_DIR/moshiro-update-$COMPONENT.service" <<UNITFILE
 [Unit]
-Description=Check/apply signed volume update for monitor-$COMPONENT
+Description=Check/apply signed volume update for moshiro-$COMPONENT
 
 [Service]
 Type=oneshot
 TimeoutStartSec=300
-Environment="MONITOR_UPDATE_CONF_DIR=$(unit_escape "$CONF_DIR")"
+Environment="MOSHIRO_UPDATE_CONF_DIR=$(unit_escape "$CONF_DIR")"
 ExecStart="$(unit_escape "$BIN")" check $COMPONENT
 UNITFILE
-  cat > "$UNIT_DIR/monitor-update-$COMPONENT.timer" <<UNITFILE
+  cat > "$UNIT_DIR/moshiro-update-$COMPONENT.timer" <<UNITFILE
 [Unit]
-Description=Poll the update volume for monitor-$COMPONENT
+Description=Poll the update volume for moshiro-$COMPONENT
 
 [Timer]
 OnBootSec=10s
 OnUnitInactiveSec=30s
-Unit=monitor-update-$COMPONENT.service
+Unit=moshiro-update-$COMPONENT.service
 
 [Install]
 WantedBy=$TARGET
 UNITFILE
 else
 for action in check apply; do
-  cat > "$UNIT_DIR/monitor-update-$action-$COMPONENT.service" <<UNITFILE
+  cat > "$UNIT_DIR/moshiro-update-$action-$COMPONENT.service" <<UNITFILE
 [Unit]
-Description=$action the signed update for monitor-$COMPONENT
+Description=$action the signed update for moshiro-$COMPONENT
 
 [Service]
 Type=oneshot
 TimeoutStartSec=300
-Environment="MONITOR_UPDATE_CONF_DIR=$(unit_escape "$CONF_DIR")"
+Environment="MOSHIRO_UPDATE_CONF_DIR=$(unit_escape "$CONF_DIR")"
 ExecStart="$(unit_escape "$BIN")" $action $COMPONENT
 UNITFILE
   watched=offer.sig
   [ "$action" != apply ] || watched=apply.request
-  cat > "$UNIT_DIR/monitor-update-$action-$COMPONENT.path" <<UNITFILE
+  cat > "$UNIT_DIR/moshiro-update-$action-$COMPONENT.path" <<UNITFILE
 [Unit]
-Description=Watch $action events for monitor-$COMPONENT
+Description=Watch $action events for moshiro-$COMPONENT
 
 [Path]
 PathChanged=$DATA_DIR/update/$watched
-Unit=monitor-update-$action-$COMPONENT.service
+Unit=moshiro-update-$action-$COMPONENT.service
 
 [Install]
 WantedBy=$TARGET
@@ -144,11 +144,11 @@ fi
 if [ "$ENABLE" = true ]; then
   service_ctl daemon-reload
   if [ -n "$DATA_VOLUME" ]; then
-    service_ctl disable --now "monitor-update-check-$COMPONENT.path" "monitor-update-apply-$COMPONENT.path" >/dev/null 2>&1 || true
-    service_ctl enable --now "monitor-update-$COMPONENT.timer"
+    service_ctl disable --now "moshiro-update-check-$COMPONENT.path" "moshiro-update-apply-$COMPONENT.path" >/dev/null 2>&1 || true
+    service_ctl enable --now "moshiro-update-$COMPONENT.timer"
   else
-    service_ctl disable --now "monitor-update-$COMPONENT.timer" >/dev/null 2>&1 || true
-    service_ctl enable --now "monitor-update-check-$COMPONENT.path" "monitor-update-apply-$COMPONENT.path"
+    service_ctl disable --now "moshiro-update-$COMPONENT.timer" >/dev/null 2>&1 || true
+    service_ctl enable --now "moshiro-update-check-$COMPONENT.path" "moshiro-update-apply-$COMPONENT.path"
   fi
 fi
 echo "updater installed for $COMPONENT (engine: $ENGINE, scope: $SERVICE_SCOPE, policy: $POLICY)"

packaging/update/moshiro-update.sh

@@ -1,10 +1,10 @@
 #!/bin/sh
-# Monitor 容器节点（Agent、Probe）的宿主机更新器。用法：monitor-update <check|apply> <组件>   组件 = agent 或 probe
+# MoShiro 容器节点（Agent、Probe）的宿主机更新器。用法：moshiro-update <check|apply> <组件>   组件 = agent 或 probe
 #
 # 信任模型（防篡改、防中间人）：
 #   - 只接受用发布私钥签名的清单（ECDSA P-256 / SHA-256，对清单文件的原始字节签名）；公钥放在本机，面板和 Registry 都改不了它。
 #   - 清单里写的是镜像的 digest：拉取时用 repo@sha256:…，内容寻址，Registry 或链路上的人换不出另一个镜像。
-#   - 镜像仓库、组件、服务名都来自本机的配置（/etc/monitor-update/<组件>.conf），清单里写什么都不会改变拉哪个仓库。
+#   - 镜像仓库、组件、服务名都来自本机的配置（/etc/moshiro-update/<组件>.conf），清单里写什么都不会改变拉哪个仓库。
 #   - 清单的 seq 必须比已安装的大（防止旧清单被重放回滚）。
 #   - 业务进程（Agent、Probe）只能往数据目录里写「清单」和「请求」文件，更新由这个宿主机脚本完成，业务进程不执行任何命令。
 # Shell snippets below execute inside helper containers.
@@ -13,27 +13,27 @@ set -eu
 
 CMD="${1:-}"
 COMPONENT="${2:-}"
-case "$CMD" in check|apply) ;; *) echo "usage: monitor-update <check|apply> <agent|probe>" >&2; exit 2 ;; esac
+case "$CMD" in check|apply) ;; *) echo "usage: moshiro-update <check|apply> <agent|probe>" >&2; exit 2 ;; esac
 case "$COMPONENT" in agent|probe) ;; *) echo "component must be agent or probe" >&2; exit 2 ;; esac
 
 if [ "$(id -u)" -eq 0 ]; then
-  DEFAULT_CONF_DIR=/etc/monitor-update
+  DEFAULT_CONF_DIR=/etc/moshiro-update
 else
-  DEFAULT_CONF_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/monitor"
+  DEFAULT_CONF_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/moshiro"
 fi
-CONF="${MONITOR_UPDATE_CONF_DIR:-$DEFAULT_CONF_DIR}/$COMPONENT.conf"
+CONF="${MOSHIRO_UPDATE_CONF_DIR:-$DEFAULT_CONF_DIR}/$COMPONENT.conf"
 [ -r "$CONF" ] || { echo "missing $CONF" >&2; exit 2; }
-# 配置：DATA_DIR（容器里 /etc/monitor 对应的宿主机目录）、IMAGE_REPO、UNIT、PUBKEY、POLICY（auto|manual）、AUTHFILE（可选）、
+# 配置：DATA_DIR（容器里 /etc/moshiro 对应的宿主机目录）、IMAGE_REPO、UNIT、PUBKEY、POLICY（auto|manual）、AUTHFILE（可选）、
 #       STATE_DIR（已安装版本的记录）、ENV_FILE（容器单元读取的 IMAGE=… 文件）
 # shellcheck disable=SC1090
 . "$CONF"
 : "${IMAGE_REPO:?}" "${UNIT:?}" "${PUBKEY:?}" "${ENV_FILE:?}"
 POLICY="${POLICY:-manual}"
-STATE_DIR="${STATE_DIR:-/var/lib/monitor-update}"
+STATE_DIR="${STATE_DIR:-/var/lib/moshiro-update}"
 ENGINE="${ENGINE:-podman}"
 SERVICE_SCOPE="${SERVICE_SCOPE:-system}"
 DATA_VOLUME="${DATA_VOLUME:-}"
-STATUS_VOLUME="${STATUS_VOLUME:-monitor-$COMPONENT-status}"
+STATUS_VOLUME="${STATUS_VOLUME:-moshiro-$COMPONENT-status}"
 case "$ENGINE" in podman|docker) ;; *) echo "unsupported engine: $ENGINE" >&2; exit 2 ;; esac
 case "$SERVICE_SCOPE" in system|user) ;; *) echo "unsupported service scope: $SERVICE_SCOPE" >&2; exit 2 ;; esac
 service_ctl() {
@@ -84,8 +84,8 @@ fetch_offer() {
   for name in offer.manifest offer.sig; do
     if [ -n "$DATA_VOLUME" ]; then
       "$ENGINE" run --pull=never --rm --network none --read-only --cap-drop ALL --security-opt no-new-privileges \
-        -v "$DATA_VOLUME:/etc/monitor:ro" --entrypoint /bin/sh "$HELPER_IMAGE" \
-        -c 'f="/etc/monitor/update/$1"; if [ -f "$f" ] && [ ! -L "$f" ]; then head -c 8192 "$f"; fi' sh "$name" > "$WORK/$name"
+        -v "$DATA_VOLUME:/etc/moshiro:ro" --entrypoint /bin/sh "$HELPER_IMAGE" \
+        -c 'f="/etc/moshiro/update/$1"; if [ -f "$f" ] && [ ! -L "$f" ]; then head -c 8192 "$f"; fi' sh "$name" > "$WORK/$name"
       continue
     fi
     f="$UPDATE_DIR/$name"
@@ -163,7 +163,7 @@ do_check() {
 do_apply() {
   if [ -n "$DATA_VOLUME" ]; then
     "$ENGINE" run --pull=never --rm --network none --read-only --cap-drop ALL --security-opt no-new-privileges \
-      -v "$DATA_VOLUME:/etc/monitor" --entrypoint /bin/sh "$HELPER_IMAGE" -c 'rm -f /etc/monitor/update/apply.request'
+      -v "$DATA_VOLUME:/etc/moshiro" --entrypoint /bin/sh "$HELPER_IMAGE" -c 'rm -f /etc/moshiro/update/apply.request'
   else
     rm -f "$UPDATE_DIR/apply.request"
   fi
@@ -200,8 +200,8 @@ case "$CMD" in
   check)
     if [ -n "$DATA_VOLUME" ] && [ "$POLICY" != auto ]; then
       requested="$($ENGINE run --pull=never --rm --network none --read-only --cap-drop ALL --security-opt no-new-privileges \
-        -v "$DATA_VOLUME:/etc/monitor:ro" --entrypoint /bin/sh "$HELPER_IMAGE" \
-        -c '[ ! -f /etc/monitor/update/apply.request ] || printf yes')"
+        -v "$DATA_VOLUME:/etc/moshiro:ro" --entrypoint /bin/sh "$HELPER_IMAGE" \
+        -c '[ ! -f /etc/moshiro/update/apply.request ] || printf yes')"
       if [ "$requested" = yes ]; then do_apply; else do_check; fi
     else
       do_check