novox/mesh-controller
Archived
9
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

An archive may be an upstream release pinned by URL and sha256, mirrored by the build seat (hq issue 345, ADR 0316) #251

Closed
mesh-admin wants to merge 2 commits from fix/345-reminder-test into main
pull from: fix/345-reminder-test
merge into: :main
Conversation 7 Commits 2 Files Changed 8
+947 -6
2 Commits
Author SHA1 Message Date
jochen 3647928668 Judge an upstream pin's host like any name, and harden the upstream unpack (review 35, hq issue 345)
mesh/delivery-group group fix/345-reminder-test rejected: a member's own check failed
Details
mesh/merge-gate pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every machine composes with the change as it did without …
Details
mesh/repo-check fail: its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.64s)
Details
mesh/delivery stopped: the pull request closed unmerged
Details 
The url was skipped by the installation check, so an installation's host or
an address passed; it is judged whole now, the vendor's host declared in the
artifact's names-on-purpose, and an address or a reserved name as the host
is refused. Only the version's dotted-quad reading is skipped. The unpack
caps its entries, drains xz before waiting for it, reads a pax global
header and a nested within's parents, and a redirect off https is not
followed.
 2026-10-12 13:25:18 +02:00
jochen 9d108feab8 Let an archive be an upstream release pinned by URL and sha256, mirrored by the build seat (hq issue 345, ADR 0316)
mesh/merge-gate pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every machine composes with the change as it did without …
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery-group group fix/345-reminder-test rejected: a member's own check failed
Details
mesh/delivery superseded: a newer head of the same pull request
Details 
A mail client's release is about 80 MB per version, too large to keep in a
repository at every upgrade, and an add-on whose licence forbids copying it
to third parties may not be in a repository at all. An archive artifact may
now name url, sha256 and version (and file or within) instead of from: the
build seat fetches it once, refuses it when its digest is not the pin's and
names both, keeps it in its workspace under the digest (a vendor that serves
only its newest version cannot break a later build of the same pin), and
packs it like any archive, so a node gets the mesh's own archive by digest
and never asks the vendor. The build seat's image carries xz, which Go's
standard library does not read. The installation check takes the vendor's
address and version of such a pin for the world's, as a registry is an
image's.
 2026-10-12 12:57:30 +02:00