4 Commits

Include renames

Author	SHA1	Message	Date
jochen	01fc9e1d73	Read xz with a real dictionary maximum (review 65, hq issue 345) ... ulikunitz/xz's ReaderConfig.DictCap is a minimum: a stream asking for a 1 GiB or 4 GiB dictionary was given it. github.com/therootcompany/xz, a port of xz-embedded, takes a maximum and refuses a block whose LZMA2 dictionary is larger before allocating it. 64 MiB, xz's largest preset.	2026-10-12 15:39:34 +02:00
jochen	10f76cafc4	Read an xz release in Go, so the build seat needs no xz tool (hq issue 345) ... Betterbird's pinned .tar.xz failed on the build seat with "this build seat has no xz to read it": the seat's image is the catalogue's build-agent recipe, which installs git and docker-cli alone, and xz had been added only to cmd/mesh-builder/Dockerfile, which the seat does not build from. The stream is now read with github.com/ulikunitz/xz (vendored), its dictionary capped at xz's own largest preset, and what it unpacks to bounded as before; the xz line in the unused Dockerfile is taken back out.	2026-10-12 15:10:52 +02:00
jochen	b0c4b849a7	Judge an upstream pin's host like any name, and harden the upstream unpack (review 35, hq issue 345) ... The url was skipped by the installation check, so an installation's host or an address passed; it is judged whole now, the vendor's host declared in the artifact's names-on-purpose, and an address or a reserved name as the host is refused. Only the version's dotted-quad reading is skipped. The unpack caps its entries, drains xz before waiting for it, reads a pax global header and a nested within's parents, and a redirect off https is not followed.	2026-10-12 13:51:35 +02:00
jochen	b849af53dd	Let an archive be an upstream release pinned by URL and sha256, mirrored by the build seat (hq issue 345, ADR 0316) ... A mail client's release is about 80 MB per version, too large to keep in a repository at every upgrade, and an add-on whose licence forbids copying it to third parties may not be in a repository at all. An archive artifact may now name url, sha256 and version (and file or within) instead of from: the build seat fetches it once, refuses it when its digest is not the pin's and names both, keeps it in its workspace under the digest (a vendor that serves only its newest version cannot break a later build of the same pin), and packs it like any archive, so a node gets the mesh's own archive by digest and never asks the vendor. The build seat's image carries xz, which Go's standard library does not read. The installation check takes the vendor's address and version of such a pin for the world's, as a registry is an image's.	2026-10-12 13:51:35 +02:00