[ABI] Keep protected staging portable on hosted Linux - #1254
Merged
Conversation
Protected staging failed before evaluating candidate artifacts on cold hosted Linux runners. The exact runtime builder placed tsx IPC sockets below a long artifact path, and several protected workflows captured Nix and dev-shell progress together with the Rust host target. Use one bounded private temporary directory for transient runtime IPC and pass the validated host target through a protected file boundary. Keep durable artifacts and the candidate HOME under the sealed runtime root, and bind both changes into request-policy version 11. Validated by the runtime preparation suite, all 93 Pages workflow mutations, protected workflow contracts, actionlint, request-policy freshness and 7 Rust tests, the full product-evidence gate (38 Node, 167 host, 26 Rust), and strict TypeScript.
Retain protected main's filtered host-target parsing and its structural checker coverage while preserving the short private runtime temporary directory needed for tsx IPC on hosted Linux. Remove the superseded file-based target helper and regenerate request-policy version 11 for the combined tree.
Protected request derivation reads repository-owned product inputs from the exact candidate checkout. Hosted shallow checkouts leave the musl gitlink uninitialized, so valid ABI staging requests failed before classification. Fetch that exact gitlink from a fixed public mirror without consulting the candidate .gitmodules file or exposing credentials. Bind the helper and both protected workflows into request-policy version 11, with hostile workflow and helper regression coverage.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Protected ABI staging currently fails before it can evaluate candidate
artifacts on a cold hosted Linux runner for two independent reasons.
First, the Pages runtime builder lets Nix and
tsxcreate aninter-process communication socket below the long artifact output path.
The resulting Unix-domain socket path can exceed Linux's 108-byte limit,
preventing the inert Pages canary from reaching the candidate runtime.
Second, protected request derivation reads repository-owned product
inputs from the exact candidate checkout, but hosted shallow checkouts
leave the musl gitlink uninitialized. The developer SDK product
therefore cannot read
libc/musl/COPYRIGHT, and request derivationfails before classification.
The related Rust target parsing failure was fixed independently by #1255
and #1256.
What changed
/tmpdirectory whilekeeping the candidate home and all durable artifacts under the sealed
runtime output root.
runtime preparation.
from one fixed public mirror, without consulting candidate
.gitmodulesdata or exposing GitHub credentials.objects,
Linux socket-length limits, and cleanup boundaries.
11, and regenerate its implementation projection.
Validation
The exact current head is
ce46414d374782a8fed29fec7f8c29ded410c16e.Fresh local validation through
scripts/dev-shell.sh:a rejected artifact.
classification, and request requirements: passed for all 33 Formulae.
Fresh hosted staging for this exact head is the remaining pre-merge
gate.
Bootstrap boundary
The two protected
pull_request_targetworkflows execute theirdefinitions and helper code from protected
main. They therefore cannotconsume this workflow repair while it is still only in the pull request.
They are expected to remain red until the protected helper lands.
The rollout uses the uncredentialed exact-head staging workflow plus the
local protected mutation gates as bootstrap evidence, then reruns
request derivation, the PR check, and the Pages canary from protected
mainimmediately after the merge.Rollout boundary
This pull request does not publish packages, deploy Pages, promote
bottles, or change the Kandelo ABI. It repairs protected read-only
preparation paths so hosted staging and the Pages canary can produce
trustworthy evidence before #1250 is merged.