Say the build tool packs archives, give the module a client for pinned files, and record how the digests were captured (issue 1589)

2026-10-21 09:12:55 +00:00
parent 640c6f9b0c
commit bfd6b7c7ce
3 changed files with 22 additions and 1 deletions
@@ -94,4 +94,10 @@ module's directory, by the installed go (`GOTOOLCHAIN=local`) from the module ca
 (`GOPROXY=off`). The binary is named as the build agent names it. The output directory is packed with mesh-sdk's `Pack`,
 as the build agent packs; two build nodes on the same toolchain give the same digest for the same tree (ADR 0477 §6). The step ends with the artifact, the binary, the digest, the size and
 the path of the archive, which stays in the workspace's `artifacts` directory: publishing it is the builder's, in a later
-release. An artifact that is not a Go bundle fails the step naming it.
+release. An artifact that is neither a Go bundle nor an archive fails the step naming it.
+
+The same tool packs an archive artifact of any module's tree, whatever its language (ADR 0478 §1, issue 1589): the
+directory named by `from`, or a file pinned by `url` and `sha256`, packed with the same `Pack` as the build agent's `pack`
+(`testdata/captured/README` says how its digest was captured). A pinned file is fetched, checked against its sha256 (a
+mismatch fails the step naming both digests) and laid out as the artifact says (`file`, or unpacked from `within`; gzip and
+bzip2, not yet xz); it runs no command and needs no Go.
@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"net/http"
 	"time"

 	"git.novox.be/novox/mesh-sdk/go/buildstep"
@@ -34,6 +35,9 @@ type Module struct {
 	// both outside the account's home (ADR 0466 §1); Home is the account's home.
 	Run               forgekey.Runner
 	Home, Work, Cache string
+	// HTTP fetches the files an archive artifact is pinned to (url and sha256); a client of its own with a fifteen-minute
+	// timeout when nil. A test serves its own.
+	HTTP *http.Client
 	// UnitBound is the unit level's bound; zero is UnitBound. A test lowers it to see a level over its bound.
 	UnitBound time.Duration
 	// IntegrationBounds are the integration level's bounds; zero values are IntegrationSetup and IntegrationRun.
@@ -8,3 +8,14 @@ outside the tree as go list describes it.

 toolchain-go-entry.txt is lines 155-191 of mesh-control's internal/builder/toolchain.go at origin/main 073ccc29 (fetched
 2026-10-20): the Go entry of today's build agent's recipe, which the build step's flags are compared with.
+
+repos/archive is a module tree (modules/demo, an archive artifact "files" from `files`, with an executable and a nested
+file). Its digest, sha256:9503d3f9...6443, is what mesh-controller's `pack` (internal/builder/builder.go, the function
+build-agent packs every archive with) answers for modules/demo/files: captured on 2026-10-21 for issue 1589 by a
+throwaway test beside `pack` in a detached worktree of origin/main c8539bf3 that called `pack` on that directory and
+printed the sha256 of its bytes (not kept).
+upstream-release.tar.gz is a tar made with `tar --sort=name --mtime=@0 --owner=0 --group=0 -czf` of release/app/x.txt and
+release/app/bin/tool (mode 755). Its pinned sha256 is 2c9e5753...7e95 (`sha256sum`). The digests of the archive packed from
+it are what build-agent's `unpackUpstream(file, dir, "release/app")` followed by `pack(dir)` answers (9bacf4aa...790f),
+and what `pack` answers for a directory holding the file as `tool.bin` (`file: tool.bin`; 0d605adb...716b), captured the
+same way and the same day.