mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-16 01:45:29 +02:00
v1.87.0.0 feat: add verified CSO audits and replayable repair bundles (#2852)
* feat(cso): add verified audits and replayable repair bundles * fix(cso): harden qualification and setup boundaries * fix(cso): assemble security canaries at runtime * fix(cso): bound release proof and maintenance work Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): require complete evaluation reports Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): replay expired snapshots from supplied source Co-Authored-By: OpenAI Codex <noreply@openai.com> * test(cso): synchronize DNS cancellation assertion Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore(ship): exempt repository owner from liveness proof Co-Authored-By: OpenAI Codex <noreply@openai.com> * test(cso): make recheck retention overlap deterministic Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: bump version and changelog (v1.85.0.0) Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): pass native release gates Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: move release to v1.86.0.0 Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): resolve rechecks by finding Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: move release to v1.87.0.0 Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): pass macOS and Windows release gates Normalize BSD wc output, compare Windows paths by filesystem identity, preserve portable snapshot race coverage, and narrow POSIX-only Windows fixtures. Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): harden native verification gates * fix(cso): refine Windows native diagnostics * test(cso): isolate Windows Git startup failure * test(cso): stabilize Windows native diagnostics * fix(cso): support hardened Git on Windows * fix(cso): close final verification gaps * test(cso): bound cold Docker fixture setup * fix(cso): restore cross-platform free-suite gates --------- Co-authored-by: OpenAI Codex <noreply@openai.com>
This commit is contained in:
Garry Tan
co-authored by
OpenAI Codex
OpenAI Codex
parent
9f81911136
commit
4a3c6a8a3c
@@ -868,6 +868,80 @@ cleanup_copied_bun() {
|
||||
prepare_bun_for_windows_compile
|
||||
trap cleanup_copied_bun EXIT
|
||||
|
||||
_cso_unavailable() {
|
||||
CSO_BUILD_AVAILABLE=0
|
||||
CSO_FAIL_REASON="$1"
|
||||
}
|
||||
|
||||
# CSO has a native startup boundary. Its extra toolchain is optional for setup:
|
||||
# when unavailable, install every other skill and leave /cso visibly fail-closed.
|
||||
# A successful probe is only a prerequisite check; any later source build failure
|
||||
# still aborts setup and therefore cannot be mistaken for a missing local tool.
|
||||
probe_cso_build_prerequisites() {
|
||||
local _help _flag _platform _compiler _tmp _ps_script _repo_root _git_path
|
||||
CSO_BUILD_AVAILABLE=1
|
||||
CSO_FAIL_REASON=""
|
||||
|
||||
_help="$(bun_cmd build --help 2>&1 || true)"
|
||||
for _flag in --no-compile-autoload-dotenv --no-compile-autoload-bunfig --no-compile-autoload-tsconfig --no-compile-autoload-package-json; do
|
||||
case "$_help" in
|
||||
*"$_flag"*) ;;
|
||||
*) _cso_unavailable "bun-compile-flags"; return 0 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
_platform="$(uname -s)"
|
||||
if [ "$IS_WINDOWS" -eq 1 ]; then
|
||||
if ! command -v powershell.exe >/dev/null 2>&1 || ! command -v cygpath >/dev/null 2>&1; then
|
||||
_cso_unavailable "windows-shell-toolchain"
|
||||
return 0
|
||||
fi
|
||||
_ps_script="$(cygpath -w "$SOURCE_GSTACK_DIR/scripts/build-cso-windows.ps1")"
|
||||
_repo_root="$(cygpath -w "$SOURCE_GSTACK_DIR")"
|
||||
_git_path="$(type -P git 2>/dev/null || true)"
|
||||
if [ -z "$_git_path" ] || [ ! -f "$_git_path" ]; then
|
||||
_cso_unavailable "windows-git"
|
||||
return 0
|
||||
fi
|
||||
if ! powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass \
|
||||
-File "$_ps_script" -RepoRoot "$_repo_root" -GitExePath "$(cygpath -aw "$_git_path")" -CheckOnly >/dev/null 2>&1; then
|
||||
_cso_unavailable "windows-msvc-toolchain"
|
||||
fi
|
||||
return 0
|
||||
fi
|
||||
|
||||
_compiler="${CSO_CC:-cc}"
|
||||
if ! command -v "$_compiler" >/dev/null 2>&1; then
|
||||
_cso_unavailable "c-compiler"
|
||||
return 0
|
||||
fi
|
||||
_tmp="$(mktemp -d "${TMPDIR:-/tmp}/gstack-cso-probe.XXXXXX" 2>/dev/null || true)"
|
||||
if [ -z "$_tmp" ]; then
|
||||
_cso_unavailable "native-toolchain-probe"
|
||||
return 0
|
||||
fi
|
||||
printf '%s\n' 'int main(void) { return 0; }' > "$_tmp/probe.c"
|
||||
case "$_platform" in
|
||||
Linux)
|
||||
if ! "$_compiler" -std=c11 -static "$_tmp/probe.c" -o "$_tmp/probe" >/dev/null 2>&1; then
|
||||
_cso_unavailable "static-c-toolchain"
|
||||
fi
|
||||
;;
|
||||
Darwin)
|
||||
if ! command -v codesign >/dev/null 2>&1; then
|
||||
_cso_unavailable "macos-codesign"
|
||||
elif ! "$_compiler" -std=c11 "$_tmp/probe.c" -o "$_tmp/probe" >/dev/null 2>&1 || \
|
||||
! codesign --force --sign - --options runtime "$_tmp/probe" >/dev/null 2>&1 || \
|
||||
! codesign --verify --strict "$_tmp/probe" >/dev/null 2>&1 || \
|
||||
! codesign -d --verbose=4 "$_tmp/probe" 2>&1 | grep -q 'runtime'; then
|
||||
_cso_unavailable "macos-native-toolchain"
|
||||
fi
|
||||
;;
|
||||
*) _cso_unavailable "unsupported-platform" ;;
|
||||
esac
|
||||
rm -rf "$_tmp"
|
||||
}
|
||||
|
||||
# Resolve the model overlay used for generated Codex skills. Setup auto-detects
|
||||
# only Codex because it has one canonical TOML config surface; direct generator
|
||||
# calls remain deterministic and use the host default unless --model is explicit.
|
||||
@@ -905,22 +979,46 @@ if GSTACK_RENAME_COPY="$IS_WINDOWS" bun_cmd "$SOURCE_GSTACK_DIR/bin/gstack-migra
|
||||
fi
|
||||
|
||||
# 1. Build browse binary if needed (smart rebuild: stale sources, package.json, lock).
|
||||
# One `bun run build` produces every binary (browse, design, make-pdf), so a
|
||||
# missing or stale one of any of them triggers the whole build.
|
||||
probe_cso_build_prerequisites
|
||||
_EXE=""
|
||||
if [ "$IS_WINDOWS" -eq 1 ]; then _EXE=".exe"; fi
|
||||
# Never leave a trusted helper from an earlier toolchain/version available when
|
||||
# this setup run cannot reproduce it. The /cso skill then reports not assessed.
|
||||
if [ "$CSO_BUILD_AVAILABLE" -eq 0 ]; then
|
||||
rm -f "$SOURCE_GSTACK_DIR/bin/gstack-cso-launcher" \
|
||||
"$SOURCE_GSTACK_DIR/bin/gstack-cso-launcher.exe" \
|
||||
"$SOURCE_GSTACK_DIR/bin/gstack-cso-core" \
|
||||
"$SOURCE_GSTACK_DIR/bin/gstack-cso-core.exe" \
|
||||
"$SOURCE_GSTACK_DIR/bin/gstack-cso-watchdog" \
|
||||
"$SOURCE_GSTACK_DIR/bin/.gstack-cso-generation" \
|
||||
"$SOURCE_GSTACK_DIR/bin/.gstack-cso-generation.lock"
|
||||
fi
|
||||
BUILD_STAMP="$SOURCE_GSTACK_DIR/browse/dist/.build-complete"
|
||||
NEEDS_BUILD=0
|
||||
if [ ! -x "$BROWSE_BIN" ] || [ ! -x "$SOURCE_GSTACK_DIR/design/dist/design$_EXE" ] || [ ! -x "$SOURCE_GSTACK_DIR/make-pdf/dist/pdf$_EXE" ]; then
|
||||
if [ ! -f "$BUILD_STAMP" ] || [ ! -x "$BROWSE_BIN" ] || [ ! -x "$SOURCE_GSTACK_DIR/design/dist/design$_EXE" ] || [ ! -x "$SOURCE_GSTACK_DIR/make-pdf/dist/pdf$_EXE" ]; then
|
||||
NEEDS_BUILD=1
|
||||
fi
|
||||
if [ "$CSO_BUILD_AVAILABLE" -eq 1 ]; then
|
||||
if [ ! -x "$SOURCE_GSTACK_DIR/bin/gstack-cso-launcher$_EXE" ] || [ ! -x "$SOURCE_GSTACK_DIR/bin/gstack-cso-core$_EXE" ] || [ ! -f "$SOURCE_GSTACK_DIR/bin/.gstack-cso-generation" ]; then
|
||||
NEEDS_BUILD=1
|
||||
elif [ "$IS_WINDOWS" -eq 0 ] && [ ! -x "$SOURCE_GSTACK_DIR/bin/gstack-cso-watchdog" ]; then
|
||||
NEEDS_BUILD=1
|
||||
elif [ "$IS_WINDOWS" -eq 1 ] && [ ! -f "$SOURCE_GSTACK_DIR/bin/.gstack-cso-generation.lock" ];then
|
||||
NEEDS_BUILD=1
|
||||
fi
|
||||
fi
|
||||
# lib/ holds the canonical claude-bin, error-handling and aside-render sources
|
||||
# the binaries embed (browse/src re-exports them), so it is part of the set.
|
||||
if [ "$NEEDS_BUILD" -eq 0 ]; then
|
||||
if [ -n "$(find "$SOURCE_GSTACK_DIR/browse/src" "$SOURCE_GSTACK_DIR/make-pdf/src" "$SOURCE_GSTACK_DIR/design/src" "$SOURCE_GSTACK_DIR/lib" -type f -newer "$BROWSE_BIN" -print -quit 2>/dev/null)" ]; then
|
||||
if [ -n "$(find "$SOURCE_GSTACK_DIR/browse/src" "$SOURCE_GSTACK_DIR/make-pdf/src" "$SOURCE_GSTACK_DIR/design/src" "$SOURCE_GSTACK_DIR/lib" -type f -newer "$BUILD_STAMP" -print -quit 2>/dev/null)" ]; then
|
||||
NEEDS_BUILD=1
|
||||
elif [ "$SOURCE_GSTACK_DIR/package.json" -nt "$BROWSE_BIN" ]; then
|
||||
elif [ "$SOURCE_GSTACK_DIR/package.json" -nt "$BUILD_STAMP" ]; then
|
||||
NEEDS_BUILD=1
|
||||
elif [ -f "$SOURCE_GSTACK_DIR/bun.lock" ] && [ "$SOURCE_GSTACK_DIR/bun.lock" -nt "$BROWSE_BIN" ]; then
|
||||
elif [ -f "$SOURCE_GSTACK_DIR/bun.lock" ] && [ "$SOURCE_GSTACK_DIR/bun.lock" -nt "$BUILD_STAMP" ]; then
|
||||
NEEDS_BUILD=1
|
||||
elif [ "$SOURCE_GSTACK_DIR/scripts/build.sh" -nt "$BUILD_STAMP" ]; then
|
||||
NEEDS_BUILD=1
|
||||
elif [ "$CSO_BUILD_AVAILABLE" -eq 1 ] && { [ "$SOURCE_GSTACK_DIR/scripts/build-cso.sh" -nt "$BUILD_STAMP" ] || [ "$SOURCE_GSTACK_DIR/scripts/build-cso-windows.ps1" -nt "$BUILD_STAMP" ]; }; then
|
||||
NEEDS_BUILD=1
|
||||
fi
|
||||
fi
|
||||
@@ -930,6 +1028,9 @@ if [ "$NEEDS_BUILD" -eq 1 ]; then
|
||||
(
|
||||
cd "$SOURCE_GSTACK_DIR"
|
||||
bun_cmd install --frozen-lockfile 2>/dev/null || bun_cmd install
|
||||
if [ "$CSO_BUILD_AVAILABLE" -eq 0 ]; then
|
||||
export GSTACK_SETUP_SKIP_CSO_BUILD=1
|
||||
fi
|
||||
bun_cmd run build
|
||||
)
|
||||
# Safety net: write .version if build script didn't (e.g., git not available during build)
|
||||
@@ -955,6 +1056,8 @@ if [ "$NEEDS_BUILD" -eq 1 ]; then
|
||||
# binary is genuinely SIGKILL'd on exec (exit 137).
|
||||
# See: https://github.com/garrytan/gstack/issues/997
|
||||
if [ "$(uname -s)" = "Darwin" ] && [ "$(uname -m)" = "arm64" ]; then
|
||||
# CSO artifacts are signed and verified inside build-cso's staged generation;
|
||||
# mutating them here would break its launcher-last publication guarantee.
|
||||
for _bin in browse/dist/browse browse/dist/find-browse design/dist/design make-pdf/dist/pdf bin/gstack-global-discover; do
|
||||
_bin_path="$SOURCE_GSTACK_DIR/$_bin"
|
||||
[ -f "$_bin_path" ] && [ -x "$_bin_path" ] || continue
|
||||
@@ -1004,6 +1107,26 @@ if [ "$NEEDS_BUILD" -eq 1 ]; then
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$CSO_BUILD_AVAILABLE" -eq 1 ]; then
|
||||
if [ ! -x "$SOURCE_GSTACK_DIR/bin/gstack-cso-launcher$_EXE" ] || [ ! -x "$SOURCE_GSTACK_DIR/bin/gstack-cso-core$_EXE" ] || [ ! -f "$SOURCE_GSTACK_DIR/bin/.gstack-cso-generation" ] || { [ "$IS_WINDOWS" -eq 0 ] && [ ! -x "$SOURCE_GSTACK_DIR/bin/gstack-cso-watchdog" ]; } || { [ "$IS_WINDOWS" -eq 1 ] && [ ! -f "$SOURCE_GSTACK_DIR/bin/.gstack-cso-generation.lock" ]; }; then
|
||||
echo "gstack setup failed: CSO build completed without its required native artifact set" >&2
|
||||
exit 1
|
||||
fi
|
||||
# Runtime/scanner execution never pulls. Setup is the sole automatic
|
||||
# acquisition path: the trusted launcher validates committed catalogs,
|
||||
# rejects remote Docker contexts, and uses an empty Docker config for
|
||||
# anonymous exact-digest pulls. Each image gets a bounded pull window and the
|
||||
# whole catalog remains under a hard aggregate deadline; Docker or network
|
||||
# gaps stay nonfatal so a later setup can continue from local exact digests.
|
||||
_CSO_IMAGE_SUMMARY=""
|
||||
_CSO_IMAGE_PULL_TIMEOUT_SECONDS="${GSTACK_CSO_IMAGE_PULL_TIMEOUT_SECONDS:-30}"
|
||||
if _CSO_IMAGE_SUMMARY="$("$SOURCE_GSTACK_DIR/bin/gstack-cso-launcher$_EXE" provision-images --setup-summary --per-image-seconds "$_CSO_IMAGE_PULL_TIMEOUT_SECONDS" 2>/dev/null)"; then
|
||||
[ -n "$_CSO_IMAGE_SUMMARY" ] && log "$_CSO_IMAGE_SUMMARY"
|
||||
else
|
||||
log "warning: qualified CSO images could not be checked or preloaded; static audits remain available. Re-run setup after local Docker and public registry access are available."
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ ! -x "$BROWSE_BIN" ]; then
|
||||
echo "gstack setup failed: browse binary missing at $BROWSE_BIN" >&2
|
||||
exit 1
|
||||
@@ -3070,6 +3193,25 @@ if ! grep -q '^redact_prepush_hook:' "$_GSTACK_CFG_FILE" 2>/dev/null; then
|
||||
fi
|
||||
fi
|
||||
|
||||
# ─── CSO native-helper summary ────────────────────────────────────────────────
|
||||
if [ "$CSO_BUILD_AVAILABLE" -eq 0 ]; then
|
||||
case "$CSO_FAIL_REASON" in
|
||||
bun-compile-flags) _CSO_PREREQ="upgrade Bun to a release supporting all four --no-compile-autoload-* build flags" ;;
|
||||
c-compiler) _CSO_PREREQ="install a C compiler (cc, Clang, or GCC)" ;;
|
||||
static-c-toolchain) _CSO_PREREQ="install a C toolchain capable of static linking" ;;
|
||||
macos-codesign|macos-native-toolchain) _CSO_PREREQ="install the macOS compiler and codesign command-line tools" ;;
|
||||
windows-shell-toolchain) _CSO_PREREQ="run setup from Git Bash with Windows PowerShell available" ;;
|
||||
windows-msvc-toolchain) _CSO_PREREQ="install Visual Studio 2022 Build Tools with Desktop development with C++" ;;
|
||||
windows-git) _CSO_PREREQ="install Git for Windows and run setup from its Git Bash" ;;
|
||||
unsupported-platform) _CSO_PREREQ="use a supported macOS, Linux, or Windows host" ;;
|
||||
*) _CSO_PREREQ="install the native CSO build prerequisites" ;;
|
||||
esac
|
||||
log ""
|
||||
log "CSO unavailable: its native helper was not built ($CSO_FAIL_REASON)."
|
||||
log " /cso will report not assessed and the install prerequisite; it will not use repository tooling."
|
||||
log " Everything else is installed and works. To enable /cso, $_CSO_PREREQ, then re-run ./setup."
|
||||
fi
|
||||
|
||||
# ─── Chromium bootstrap summary (best-effort browser, see # 2) ───────────────
|
||||
# Printed LAST so it is the thing the user sees, after every skill registered.
|
||||
# The skills that drive Aside first and use the bundled browser only as fallback
|
||||
|
||||
Reference in New Issue
Block a user