homebrew: publish trusted tap bottles and build Brewfile VFS images#962
Open
brandonpayton wants to merge 5 commits into
Open
homebrew: publish trusted tap bottles and build Brewfile VFS images#962brandonpayton wants to merge 5 commits into
brandonpayton wants to merge 5 commits into
Conversation
Allow conventional owner/homebrew-name repositories to use the reusable publisher while keeping checkout, GHCR, and token authority bound to the caller repository. Carry the distinct canonical owner/name Homebrew identity through build evidence, OCI receipts, Formula paths, and sidecars, with the existing first-party naming exception explicit.
Formula builds run as a separate system identity that cannot traverse the runner checkout parent. Bind the reviewed Kandelo and tap trees into each transient service through root-owned read-only aliases, hide their original paths, and fail explicitly when source auditing cannot traverse a protected tree.
Homebrew-built application images need an existing platform root filesystem, but the VFS builder previously could only pour bottles into an empty image. Accept an explicit ABI-matched platform base while preserving truthful bottle and filesystem provenance. Restore the base with its recorded growth ceiling, rebase only for an explicitly different capacity, and reject unlabeled, ABI-mismatched, or previously Homebrew-composed inputs. Bind only the base hash, byte count, and ABI into output metadata while retaining full source metadata in the external report, so large attestations cannot overflow output metadata or claim the mutated bytes. Record canonical tap identity, preserve unchanged base inodes during default composition, and cover first-party and third-party taps, near-limit metadata, composition rejection, retained files, and both capacity paths.
The publisher rejects repository and tap-name pairs that do not describe the same Homebrew tap, but the VFS planner previously validated those fields only in isolation. Mixed metadata could therefore present a third-party repository as the protected first-party tap during image composition. Apply the same canonical repository-to-tap mapping before any link manifest is loaded. Cover a valid conventional third-party tap plus protected-name aliases, mismatched names, and repositories without the required homebrew- prefix.
Phase B-1 matrix build status —
|
| Package | Arch | Status | Sha |
|---|---|---|---|
| kandelo-sdk | wasm32 | built | fe578cab |
| rootfs | wasm32 | built | 32a805a9 |
| shell | wasm32 | built | 56ad15cd |
| lamp | wasm32 | built | db62d79c |
| node-vfs | wasm32 | built | 0273ed82 |
| wordpress | wasm32 | built | 79dd26ef |
Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Kandelo needs one trustworthy path from a reviewed Homebrew tap to a complete virtual filesystem image.
The bottle publisher previously treated the GitHub repository name and Homebrew tap name as the same identity. That breaks conventional third-party taps such as repository
Example/homebrew-tools, whose Homebrew name isexample/tools. Formula builds also run as a restricted Linux user that cannot safely traverse the original GitHub checkout path.Separately, the VFS builder could pour bottles only into an empty filesystem and accepted package roots only as command-line flags. It could not compose an ABI-matched platform base with a checked-in, reproducible Brewfile selection.
This PR combines the reviewed publisher and VFS work so the trust boundary is tested as one system before merge.
What changed
This ordinary integration PR preserves five purpose commits:
automattic/kandelo-homebrew.The first two commits preserve #957. The next two preserve #959. The fifth fixes the cross-commit identity gap found during integration review.
This changes no Kandelo ABI and publishes no package, bottle, release artifact, or VFS image by itself. It adds no batch manifests, receipts, or batch-management framework.
Validation
Run through
scripts/dev-shell.shon exact head97c1ca6eebd07bcac696db12095dd78590870c34/ tree5e6d6a6495fd4a77ca19474c585c853ce8417515:git diff --checkpassed.Independent adversarial review rejected the first integration head for a protected tap-identity gap. The focused fifth commit fixes that issue, and re-review approved this exact head with no findings.
Remaining evidence
The local host is macOS, so the exact combined Linux systemd isolation fixture remains a hosted-CI gate. An earlier version of the source-alias implementation passed its privileged Ubuntu fixture, but that is not exact-head evidence.
A real Node and Chromium boot of a public dependency-bearing Brewfile image remains the next acceptance rung. The tap currently publishes only dependency-free
hello, so this PR does not claim that runtime proof. The checked-in builder and planner are Node-side tooling; the VFS bytes they produce are host-neutral.Merge and cleanup
Validate this PR now, but merge it after #934, #939, and #945. Rebase-merge it without squashing the five purpose commits. After it lands, close #957 and #959 as absorbed and delete their exact source branches manually.