Introduction
The book conservation team now uses a dedicated receiving account. Deliver the Garden Atlas to its prepared desk, then update its catalog and treatment, add a folio and retire the old generated listing. The receiver must be able to read the delivered texts and run the reader.
This lab starts independently with prepared credentials and folders. Basic terminal familiarity and the local rsync methods from the first lab are sufficient; SSH identity, host checking and remote paths are introduced here. Commands and synthetic book text remain English.
Identify the Prepared Receiving Account
In this step, you will confirm the prepared SSH identity and deliver the collection to its actual receiving account. Use the Terminal. This independent lab resets the source and receiver to edition 1; it does not reuse the previous lab's files.
The two accounts share this training environment and kernel. They represent two sides of a move, not two physical machines. labex owns /home/labex/project/folder-move/old; bindery owns /home/bindery/incoming. The receiving root contains its own note and an old catalog.
SSH runs a command as another account through an encrypted connection. Its client identity key authenticates you; the server host key identifies the endpoint. They solve different problems. Setup prepared a dedicated key and a trusted host-key pin from this environment's provisioning data. It did not change the platform's login access.
cd /home/labex/project/folder-move
cat ssh/config
Host bindery-desk is a client alias. It selects user bindery at 127.0.0.1, the loopback address of this same environment. IdentityFile names your dedicated private key; do not display or copy its contents. IdentitiesOnly yes selects that identity. UserKnownHostsFile names the prepared pin; StrictHostKeyChecking yes refuses an unknown or changed host. BatchMode yes makes authentication errors fail rather than wait for a password.
ssh-keygen -lf prints a public key's fingerprint. Compare the SHA256: value with the provisioning fingerprint:
ssh-keygen -lf ssh/known_hosts
cat ssh/host-fingerprint.txt
The hash values must match. Labels and comments can differ. Here the trusted provisioning file establishes the expected identity; a real move needs an independently trusted administrator fingerprint. A key collected from an untrusted network alone does not establish trust. Stop on a mismatch; do not delete the pin or disable host checking.
-F ssh/config selects this separate client configuration without replacing your normal SSH settings. A single-quoted command is passed to the receiver for execution; its paths are remote paths. Semicolons separate commands that run in order in that remote shell. Confirm the account, home, rsync and actual destination before transferring:
ssh -F ssh/config bindery-desk 'whoami; pwd; rsync --version; ls -la /home/bindery/incoming; cat /home/bindery/incoming/receiver-note.txt'
rsync --version
The account is bindery, the home is /home/bindery, and both ends report rsync. The note is the same west-shelf receiving instruction. A successful connection to the wrong account is not a valid migration. Permission denied means the selected identity or receiver permissions need investigation; a changed-host warning means the trusted endpoint needs investigation. Neither is repaired by adding insecure options.
For rsync, -e 'ssh -F ssh/config' chooses the SSH transport. A destination bindery-desk:/home/bindery/incoming/collection/ uses the configured account and a path on that receiver. The colon is what makes this a remote destination; a local folder named remote would not use SSH. Keep the source trailing slash and the filter already practiced:
rsync -ani -e 'ssh -F ssh/config' --exclude='*.tmp' old/collection/ bindery-desk:/home/bindery/incoming/collection/
rsync -ai -e 'ssh -F ssh/config' --exclude='*.tmp' old/collection/ bindery-desk:/home/bindery/incoming/collection/
ssh -F ssh/config bindery-desk '/home/bindery/incoming/collection/read-book'
Read the Garden Atlas catalog and paper-hinge treatment from the receiving account. This is actual remote use of the delivered reader, with its hidden configuration and execution permission. You are still at the local prompt afterward; a one-shot SSH command does not move your local terminal into the remote home.
Complete the First Remote Delivery
In this step, you will deliver the separate generated listing and read both receiver-owned and source-managed data through SSH. Continue in Terminal, in /home/labex/project/folder-move.
Synchronize only the managed generated/ directory. Keep private staffing notes outside the transfer:
rsync -ani -e 'ssh -F ssh/config' old/generated/ bindery-desk:/home/bindery/incoming/generated/
rsync -ai -e 'ssh -F ssh/config' old/generated/ bindery-desk:/home/bindery/incoming/generated/
ssh -F ssh/config bindery-desk 'cat /home/bindery/incoming/generated/current.txt /home/bindery/incoming/receiver-note.txt; /home/bindery/incoming/collection/read-book'
Expect Garden Atlas | desk edition 1, the unchanged receiving note and the usable reader. Archive mode retains the executable bit, but receiving files belong to the receiving account; it cannot preserve arbitrary source owners. The two managed directories are complete without mirroring the receiving root.
If an earlier unfiltered transfer included a preview, first inspect the exact unwanted file through SSH. Remove only that named temporary file using the rm method taught in the local lab. Do not delete incoming or the receiver's note. A filter prevents later transfer but does not clean a previously copied file.
Apply the Next Edition within the Managed Scope
In this step, you will deliver a second edition and retire only the old generated listing. Stay in Terminal in /home/labex/project/folder-move. The destination paths after the colon are on the receiving account.
cat accepts several filenames and prints them in that order. Read the supplied next edition before replacing the editable source:
cat revision/collection/texts/catalog.txt revision/collection/texts/treatment.txt revision/collection/texts/addendum.txt
The catalog now has 48 folios, the treatment uses linen hinges, and an addendum is new. cp -a copies recursively while preserving file attributes. revision/. means all contents, including hidden files. This overlays supplied changes onto old/; it does not remove an entry absent from the revision. The desk explicitly retires old/generated/obsolete.txt, so remove that one named source file. rm deletes a file permanently; do not widen the path.
cp -a revision/. old/
rm old/generated/obsolete.txt
Normally rsync decides whether file data changed from size and modification time. -c adds a checksum comparison of file content. These tiny files make the cost small, and this also detects equal-size changes with preserved timestamps. It does not make a version history or backup. Preview and apply the collection update:
rsync -anci -e 'ssh -F ssh/config' --exclude='*.tmp' old/collection/ bindery-desk:/home/bindery/incoming/collection/
rsync -aci -e 'ssh -F ssh/config' --exclude='*.tmp' old/collection/ bindery-desk:/home/bindery/incoming/collection/
The collection preview should show the two revised texts and the new addendum, without temporary previews. Attribute-only changes may also appear.
--delete removes destination entries absent from the source within the chosen synchronization directory. Here only generated/ is wholly managed; the receiving root is not. Preview its retirement, looking for *deleting obsolete.txt, then apply exactly the same scope:
rsync -anci -e 'ssh -F ssh/config' --delete old/generated/ bindery-desk:/home/bindery/incoming/generated/
rsync -aci -e 'ssh -F ssh/config' --delete old/generated/ bindery-desk:/home/bindery/incoming/generated/
ssh -F ssh/config bindery-desk 'cat /home/bindery/incoming/generated/current.txt /home/bindery/incoming/collection/texts/addendum.txt /home/bindery/incoming/receiver-note.txt'
ssh -F ssh/config bindery-desk '/home/bindery/incoming/collection/read-book'
You should read desk edition 2, the new folio, the original receiving note and the updated reader output. A root-wide mirror with --delete could erase the note. Never use it to retire this one managed listing.
Repeat the same previews:
rsync -anci -e 'ssh -F ssh/config' --exclude='*.tmp' old/collection/ bindery-desk:/home/bindery/incoming/collection/
rsync -anci -e 'ssh -F ssh/config' --delete old/generated/ bindery-desk:/home/bindery/incoming/generated/
There should be no remaining file changes. A repeat is safe for this declared scope, but a later source deletion would still require a deliberate decision about which destination directory is managed. The original edition is not recoverable from rsync alone; use a separate backup when history matters.
Summary
You delivered a usable collection, kept its hidden configuration and reader permissions, and preserved the receiving desk note. A second synchronization updated the managed files and removed a retired listing only within its declared scope. Synchronization is directional; it is not a versioned backup or conflict merger.
