mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-16 09:55:29 +02:00
* feat(cso): add verified audits and replayable repair bundles * fix(cso): harden qualification and setup boundaries * fix(cso): assemble security canaries at runtime * fix(cso): bound release proof and maintenance work Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): require complete evaluation reports Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): replay expired snapshots from supplied source Co-Authored-By: OpenAI Codex <noreply@openai.com> * test(cso): synchronize DNS cancellation assertion Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore(ship): exempt repository owner from liveness proof Co-Authored-By: OpenAI Codex <noreply@openai.com> * test(cso): make recheck retention overlap deterministic Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: bump version and changelog (v1.85.0.0) Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): pass native release gates Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: move release to v1.86.0.0 Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): resolve rechecks by finding Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: move release to v1.87.0.0 Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): pass macOS and Windows release gates Normalize BSD wc output, compare Windows paths by filesystem identity, preserve portable snapshot race coverage, and narrow POSIX-only Windows fixtures. Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): harden native verification gates * fix(cso): refine Windows native diagnostics * test(cso): isolate Windows Git startup failure * test(cso): stabilize Windows native diagnostics * fix(cso): support hardened Git on Windows * fix(cso): close final verification gaps * test(cso): bound cold Docker fixture setup * fix(cso): restore cross-platform free-suite gates --------- Co-authored-by: OpenAI Codex <noreply@openai.com>
61 lines
2.6 KiB
TypeScript
61 lines
2.6 KiB
TypeScript
import * as fs from 'node:fs';
|
|
import * as path from 'node:path';
|
|
import { dispatchCsoCommand, type CsoCliDependencies } from '../../lib/cso/cli';
|
|
import { canonical, sha256 } from '../../lib/cso/contracts';
|
|
import { validateRuntimeCatalog, type QualifiedRuntime, type RuntimeCatalog, type RuntimePlatform } from '../../lib/cso/runtime-catalog';
|
|
import { completeRuntimeCatalogFixture } from './cso-runtime-catalog';
|
|
|
|
export interface QualifiedCsoCli {
|
|
readonly catalog: RuntimeCatalog;
|
|
readonly runtime: QualifiedRuntime;
|
|
command<T = unknown>(args: string[]): Promise<T>;
|
|
}
|
|
|
|
/** Bind a staged Node image to the real command dispatcher without adding a production override. */
|
|
export function qualifiedNodeCli(options: {
|
|
image: string;
|
|
versions: Record<string, string>;
|
|
watchdogPath: string;
|
|
platform: RuntimePlatform;
|
|
}): QualifiedCsoCli {
|
|
if (!path.isAbsolute(options.watchdogPath) || !fs.statSync(options.watchdogPath).isFile()) {
|
|
throw new Error('Node lifecycle qualification requires an absolute compiled watchdog path');
|
|
}
|
|
for (const key of ['node', 'npm', 'cso-preparation']) {
|
|
if (!/^\d+\.\d+\.\d+$/.test(options.versions[key] ?? '')) {
|
|
throw new Error(`Node lifecycle qualification requires exact ${key} version metadata`);
|
|
}
|
|
}
|
|
if (options.versions['cso-preparation'] !== '1.0.0') {
|
|
throw new Error('Node lifecycle qualification requires cso-preparation 1.0.0');
|
|
}
|
|
|
|
const catalog = completeRuntimeCatalogFixture('node-lifecycle-fixture');
|
|
const runtimeIndex = catalog.runtimes.findIndex(item => item.stack === 'node' && item.platform === options.platform);
|
|
const profile = catalog.profiles.find(item => item.stack === 'node' && item.platform === options.platform);
|
|
if (runtimeIndex < 0 || !profile || !catalog.promotion) throw new Error('Node lifecycle catalog fixture is incomplete');
|
|
const runtime: QualifiedRuntime = {
|
|
...catalog.runtimes[runtimeIndex],
|
|
image: options.image,
|
|
versions: { ...options.versions },
|
|
};
|
|
catalog.runtimes[runtimeIndex] = runtime;
|
|
profile.versions = { ...runtime.versions };
|
|
catalog.promotion.evidenceDigest = `sha256:${sha256(canonical(catalog.runtimes))}`;
|
|
validateRuntimeCatalog(catalog);
|
|
|
|
const dependencies: CsoCliDependencies = Object.freeze({
|
|
runtimeCatalog: catalog,
|
|
watchdogPath: () => options.watchdogPath,
|
|
});
|
|
return Object.freeze({
|
|
catalog,
|
|
runtime,
|
|
async command<T = unknown>(args: string[]): Promise<T> {
|
|
const [command, ...commandArgs] = args;
|
|
if (!command) throw new Error('CSO qualification command is required');
|
|
return await dispatchCsoCommand(command, commandArgs, dependencies) as T;
|
|
},
|
|
});
|
|
}
|