Security never sleeps in
The 42-day cycle handles features. The weekly watch handles everything that can't wait — automatically.
The weekly loop
Every week a systemd timer fires secwatch-weekly.sh, which runs three things in order:
- WatchThe
fluorite-secwatchcontainer runs read-only against your tree and compares the pinned milestone inBASE_VERSIONwith upstream's current fixes. Findings are written topending/REPORT.md. - ReactIf the watcher exits with code 10, a milestone fix exists: the report is printed and
apply-security-update.shfast-forwards the pinned base immediately. - Release
fluorite-release.shruns last, self-gated to its 42-day window — so ordinary weeks end quietly, while post-update weeks rebuild right away.
Why a container?
- Read-only access: the tree mounts at
/work:ro; the watcher physically cannot modify what it inspects. - One output path: reports land in
pending/, mounted read-write — the only writable surface it gets. - No host dependencies: the check logic ships its own environment. If Docker isn't available, the same script falls back to running inline with identical semantics.
- Runs unprivileged: the container executes as your own uid/gid. No root, no surprise ownership of output files.
$ systemctl status fluorite-secwatch.timer $ journalctl -u fluorite-secwatch.service
Exit-code contract
| Code | Meaning | Consequence |
|---|---|---|
| 0 | No relevant updates this week | Log it, move on |
| 10 | Milestone fix detected | Print REPORT.md, apply update, rebuild |
| anything else | The watcher itself failed | Hard fail — silence is never assumed to mean safety |
Fail loud, not safe: an erroring watcher aborts the run rather than letting the pipeline continue blind. Missing a scheduled check is treated as a problem, not a pass.
Why this exists
This is the direct answer to how Bromite ended. A hardened fork whose security response depends on someone noticing upstream changes eventually stops responding — around Chromium 108, in Bromite's case. Fluorite moves that vigilance into infrastructure: a timer, a container and three exit codes don't get tired.