mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-04 10:48:20 +00:00
Martin Vogel
c360440203
The ui-* archives are byte-identical copies of the canonical ones, published after verify so they inherit the hash-bound VirusTotal verdicts. They were absent from checksums.txt, and publish-legacy-aliases.sh documented that as intentional: "checksums.txt covers the canonical names current installers request." That reasoning has a hole. The aliases exist only for 0.9.x updaters (#1538), and those verify the NAME they asked for. So the alias fixed the 404 and moved the failure one step later - the updater downloads the archive, cannot find its name in checksums.txt, and refuses: warning: codebase-memory-mcp-ui-darwin-arm64.tar.gz not found in checksums.txt error: refusing to install an unverified download Reported by AmooAti in #1134. Confirmed on the live v0.10.4 release: eight ui-* archives published, zero of them listed. Every pre-0.10 user who answered the old variant chooser with "ui" is hard-blocked from updating by any path. The same digest is now emitted under the legacy name before the attestation step, so the attested artifact covers both names. No new bytes and no new scan surface: an alias is a copy, so its sha256 is by construction the one already computed. The rule lives in scripts/ci/append-legacy-alias-checksums.sh rather than inline in the workflow, because the venue-parity contract requires it: a venue may provision, plumb artifacts, or call a canonical leg script, and text transformation is none of those. Keeping it beside publish-legacy-aliases.sh also puts the two halves of the alias rule in one place, which matters because they must stay in step - .tar.gz and .zip only, never an already-ui-* name. It fails closed when it matches nothing, since a name with no asset is as broken as an asset with no name. Validated against the real v0.10.4 checksums file: the generated set is exactly the eight ui-* assets that release published - no phantom names, none missing - and the empty case exits non-zero. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
scripts/ci/ — venue plumbing (single implementations)
Support scripts that keep the venues in the SAME shape. Each exists because
the logic used to live inline in workflow YAML or was hand-duplicated between
CI and the local infrastructure — both of which the venue-parity contract
(tests/test_venue_parity_contract.sh) now forbids. Everything here answers
--help (PowerShell: comment-based help, Get-Help <script>).
| script | job | called by |
|---|---|---|
new-protected-temp-root.ps1 |
Create the owner-stamped, inheritance-protected per-user TEMP root the daemon/install suites require (shared /tmp and default runner TEMP grant Authenticated-Users mutation rights, which the trust policy correctly refuses — running there produces security refusals, not signal). -ProtectDir stamps build dirs the same way. |
_test.yml, _soak.yml, vm-run-tests.sh |
clean-test-residue.ps1 |
Sweep cbm-* residue from the Windows VM and assert runner-like free disk (default 14 GB — the GitHub runner's SSD). Long-path \\?\ fallback for the guard suites' adversarial trees; every removal VERIFIED (an earlier version counted attempts and reported 86 swept while 11 GB remained). BLOCKS below the floor: a disk that fills mid-run reads as a product bug. |
win.sh before every build/run |
preflight-docker.sh |
Same idea for Colima/docker: prune runner-unlike residue, assert free space on the filesystem backing the docker data root (not the VM's /). Build cache + named volumes KEPT (the local analogue of actions/cache); --deep drops them. |
test-infrastructure/run.sh |
check-glibc-compat.sh |
Run a linux binary in debian:bullseye (glibc 2.31) — the portable binary must start on old glibc. | _smoke.yml portable legs |
generate-sbom.py |
The release SPDX SBOM (vendored versions reviewable here, diffable by vendoring PRs — was inline YAML). | release.yml |
require-all-green.sh |
The aggregate gate: fail unless every needed job succeeded or legitimately skipped (was inline YAML). | pr.yml ci-ok |
verify-shard-union.sh |
Prove sharded test legs lost nothing: shard count agreement, indices 1..n, identical suite lists, union of slices == full list (was inline YAML). | _test.yml shard-completeness |
prepare-release-candidates.sh |
Copy one linker output into stripped/unstripped candidates, finalize signatures, composition-check them without execution, and record their hashes. | _build.yml, local artifact smoke |
stage-release-candidates.py |
Admit exactly eight candidate artifacts / sixteen byte-distinct binaries into the content-addressed VirusTotal scan set. | _build.yml |
select-release-candidates.py |
Apply the reviewed tuple-local VT truth table, or the explicit dry-run stripped default, and atomically copy one content-bound binary per target. | _build.yml |
verify-release-selection.py |
Recompute the selection policy and prove every executable member in all 14 public containers equals its selected SHA-256. | _build.yml, release.yml final draft verification |
check-virustotal.sh |
Poll and validate the exact candidate scan set, enforce engine coverage and the narrow documented Microsoft !ml policy, and emit content-bound results evidence. |
_build.yml |