From 2242ae3c46a8fbc15239a0a885eb30449a1c5b99 Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 12 Nov 2026 11:21:29 +0100 Subject: [PATCH] Area 4 (join 11): buildstep reads no bus, not even through buscalls The builder's published package reached the bus library through buildstep, whose KeptBuildsOf took mesh-sdk's buscalls.ObjectInfo, and buscalls now imports nats.go for its seat chunks. buildstep's layouts, keys and codecs are read by modules that never touch the bus (its own guard), so the kept build of one object is judged from the object's own fields (KeptBuildOf, SortKept) and the build module lists its store itself. The guard now also refuses a bus library reached through an import, the kind that let this in. Builds: design 47 G (join 11 area 4: builds TestThePackageReachesNoBus, buildstep's bus-free guard) Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h --- .../mesh-delivery-sdk/buildstep/ask_test.go | 15 ++++++++--- .../buildstep/busfree_test.go | 12 +++++++++ .../buildstep/keptartifact.go | 26 +++++++++---------- 3 files changed, 36 insertions(+), 17 deletions(-) diff --git a/modules/mesh-delivery-sdk/buildstep/ask_test.go b/modules/mesh-delivery-sdk/buildstep/ask_test.go index 258b5215..b94b15b1 100644 --- a/modules/mesh-delivery-sdk/buildstep/ask_test.go +++ b/modules/mesh-delivery-sdk/buildstep/ask_test.go @@ -11,7 +11,6 @@ import ( "testing" "time" - "git.novox.be/novox/mesh-sdk/go/buscalls" "git.novox.be/novox/mesh-sdk/go/catalogue" ) @@ -350,9 +349,17 @@ func TestDeclinesNeedsAndLevelDigest(t *testing.T) { hex := strings.Repeat("a", 64) name, desc := KeptObject(KeptFor{Module: "demo", Fp: "fp1"}, "ace", "sha256:"+hex) at := time.Date(2026, 11, 10, 10, 0, 0, 0, time.UTC) - kept := KeptBuildsOf([]buscalls.ObjectInfo{{Name: name, Size: 9, Description: desc, Modified: at}, - {Name: "bb", Description: `{"module":"demo","fp":"fp1","node":"g14"}`}}, "ace") - if len(kept) != 1 || kept[0].Digest != hex || kept[0].Bytes != 9 { + var kept []KeptBuild + for _, o := range []struct { + name, desc string + size uint64 + }{{"cc", `{"module":"demo","fp":"fp0","node":"ace"}`, 1}, {name, desc, 9}, {"bb", `{"module":"demo","fp":"fp1","node":"g14"}`, 3}, {"dd", "not json", 4}} { + if k, ok := KeptBuildOf(o.name, o.desc, o.size, at, "ace"); ok { + kept = append(kept, k) + } + } + SortKept(kept) + if len(kept) != 2 || kept[0].Digest != hex || kept[0].Bytes != 9 || !kept[0].LastUsed.Equal(at) || kept[1].Digest != "cc" { t.Fatalf("kept on ace: %+v", kept) } claims := func(m string) (bool, error) { diff --git a/modules/mesh-delivery-sdk/buildstep/busfree_test.go b/modules/mesh-delivery-sdk/buildstep/busfree_test.go index 3fae9d50..2b736983 100644 --- a/modules/mesh-delivery-sdk/buildstep/busfree_test.go +++ b/modules/mesh-delivery-sdk/buildstep/busfree_test.go @@ -3,6 +3,7 @@ package buildstep import ( "go/parser" "go/token" + "os/exec" "path/filepath" "strconv" "strings" @@ -30,4 +31,15 @@ func TestThePackageIsFreeOfTheBus(t *testing.T) { } } } + // Nor through a package it imports: a mesh-sdk package that came to import the bus library (buscalls' seat chunks) took + // the builder's published package onto the bus through this one (join 11). + out, err := exec.Command("go", "list", "-deps", ".").Output() + if err != nil { + t.Fatalf("go list: %v", err) + } + for _, p := range strings.Fields(string(out)) { + if strings.HasPrefix(p, "github.com/nats-io/") { + t.Errorf("buildstep depends on %s", p) + } + } } diff --git a/modules/mesh-delivery-sdk/buildstep/keptartifact.go b/modules/mesh-delivery-sdk/buildstep/keptartifact.go index 0282f781..56e91504 100644 --- a/modules/mesh-delivery-sdk/buildstep/keptartifact.go +++ b/modules/mesh-delivery-sdk/buildstep/keptartifact.go @@ -7,7 +7,6 @@ import ( "strings" "time" - "git.novox.be/novox/mesh-sdk/go/buscalls" "git.novox.be/novox/mesh-sdk/go/catalogue" ) @@ -60,19 +59,20 @@ func KeptObject(k KeptFor, node, digest string) (name, description string) { return strings.TrimPrefix(digest, "sha256:"), string(desc) } -// KeptBuildsOf are the builds node keeps among a store's objects, by digest. -func KeptBuildsOf(infos []buscalls.ObjectInfo, node string) []KeptBuild { - out := []KeptBuild{} - for _, i := range infos { - var k KeptBuild - if i.Deleted || json.Unmarshal([]byte(i.Description), &k) != nil || k.Node != node { - continue - } - k.Digest, k.Bytes, k.LastUsed = i.Name, i.Size, i.Modified.UTC() - out = append(out, k) +// KeptBuildOf is the build node keeps under one object of a store, by its name (the digest), description, size and last change, +// or false when the object names none of node's. The object's form is the build module's store's: this package reads no bus. +func KeptBuildOf(name, description string, size uint64, modified time.Time, node string) (KeptBuild, bool) { + var k KeptBuild + if json.Unmarshal([]byte(description), &k) != nil || k.Node != node { + return KeptBuild{}, false } - slices.SortFunc(out, func(a, b KeptBuild) int { return strings.Compare(a.Digest, b.Digest) }) - return out + k.Digest, k.Bytes, k.LastUsed = name, size, modified.UTC() + return k, true +} + +// SortKept orders kept builds by digest, the order kept-artifact's readers list them in. +func SortKept(kept []KeptBuild) { + slices.SortFunc(kept, func(a, b KeptBuild) int { return strings.Compare(a.Digest, b.Digest) }) } // ClaimsStoreOf reads the seat mesh-catalog's answer of one module (CatalogModuleVerb): whether its manifest claims the