mirror of
https://github.com/garrytan/gstack.git
synced 2026-10-31 14:06:50 +01:00
Garry Tan
514fbfdc97
* cso: ignore the compiled helpers' leading #! line in preparationSha256, on both sides of the release contract S1 (#3312) rewrote only line 1 of lib/cso/verifier.ts and lib/cso/preparation-container.ts. That shebang is an unused string in the compiled helper binaries, but it moved preparationSha256, so qualify run 39535948607 refused the run-5 statements staged at133cb36with STALE_RUNTIME_QUALIFICATION. Garry chose this narrow rule (option 2). The release contract re-measures a recorded preparationSha256 that differs from the checkout's at the staged commit (git history), accepts a record that matches it under the current or the legacy rule, and compares and records the current-rule value. Both release workflows fetch full history. * test(cso): prove the release-contract fingerprint rule without git history Free-suite checkouts are depth 1, so the tests no longer read133cb36or6b2b5f3. They rebuild the staged commit in a scratch repository from this tree with both helpers' S1 shebang reverted. Its legacy fingerprint equals the real run-5 record (b069f7ef...), so it is 133cb36's image source byte for byte, and the contract accepts that record under the current rule. * v1.91.176.0 stamp