novox/mesh-catalog
18
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'Pack archive artifacts in mesh-build-go, a module's directory or a pinned file, and refuse any path that leads out of the module through a link (issue 1589, ADR 0478 §1)' (#408) from fix/1589-archive-artifacts into main

Browse Source
This commit was merged in pull request #408.
This commit is contained in:
mesh-tools
2026-10-21 10:34:00 +00:00
parent 710cfbd622 e023f69989
commit b5dbfbb784
13 changed files with 741 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/mesh-build-go/README.md
+7 -1
View File
@@ -96,4 +96,10 @@ module's directory, by the installed go (`GOTOOLCHAIN=local`) from the module ca
(`GOPROXY=off`). The binary is named as the build agent names it. The output directory is packed with mesh-sdk's `Pack`,
as the build agent packs; two build nodes on the same toolchain give the same digest for the same tree (ADR 0477 §6). The step ends with the artifact, the binary, the digest, the size and
the path of the archive, which stays in the workspace's `artifacts` directory: publishing it is the builder's, in a later
release. An artifact that is not a Go bundle fails the step naming it.
release. An artifact that is neither a Go bundle nor an archive fails the step naming it.
The same tool packs an archive artifact of any module's tree, whatever its language (ADR 0478 §1, issue 1589): the
directory named by `from`, or a file pinned by `url` and `sha256`, packed with the same `Pack` as the build agent's `pack`
(`testdata/captured/README` says how its digest was captured). A pinned file is fetched, checked against its sha256 (a
mismatch fails the step naming both digests) and laid out as the artifact says (`file`, or unpacked from `within`; gzip and
bzip2, not yet xz); it runs no command and needs no Go.