Repository navigation
feat(sdk): qualify the fixed portable LLVM release inventory - #62
Conversation
(cherry picked from commit 0b775f446e01cf36192f4440c63b3bfb82d5f81a) (cherry picked from commit c5bd72cc7ca6cec777a538bbb07437470eb9910b) (cherry picked from commit 9b757c7ff69e037961f0630fb6161005dc4c971d)
(cherry picked from commit 157999a1c39567b8a146eb5651c23be4a8f23f8b) (cherry picked from commit 841a5034aa9d2a27a58e781759bd5c6f66674d0c) (cherry picked from commit 16086e1b98e73eb0ea2a0b564ffa812bd49a61ff)
(cherry picked from commit c22f88ac8c5c0c8a712dcf453b50a30f574d02ad) (cherry picked from commit e91e56c66b5cbc7494e69f338305c4caf9baeed9) (cherry picked from commit 4ad7e3b33330e8ffed917491f48d113c7b599b2d)
(cherry picked from commit 66bf9220bf971b1712daa4696d60695e5be88148) (cherry picked from commit dadfda7b3ff3632280f5c5ed543057d4e0f0300a) (cherry picked from commit d1406ebac9774a67b1e5910fdc2c1714156f1103)
Dependency Review✅ No vulnerabilities or license issues found.Scanned FilesNone |
|
@codex review Please review current commit |
|
@codex security review Please review current commit |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 14159147e4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review Please review current commit |
|
@codex security review Please review current commit |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
🎉 This PR is included in version 1.23.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
Summary
Qualify the released portable Classic LLVM SDK through a fixed
portable-finalcollector target forclassic-portable-build:1.22.0. Bind producereb1f6af78216adb4375826cdb70ef78a61ab403a, Classic consumerbd5317a03cdc82f029105c5dc26428b09fcd54b3, and the authenticated OCI index, Linux/amd64 manifest and config. Preserve all three historical 1.18.0 collector identities.Implementation / behavior
The hosted collector acquires metadata and bytes through its existing unstarted container. The final path retains seven metadata hashes, all twelve LLVM roles, the three protected CMake/Ninja/pkgconf identities, source/provider archives, producer records, Debian notices and common licenses. It binds source and shader contracts to the exact consumer and rejects incomplete or changed archive/provider declarations.
A separate non-root, read-only, network-disabled scanner independently enumerates the installed filesystem through protected descriptor-relative reads. Acceptance requires exact agreement with all acquired inventories, metadata and tools, plus successful cleanup. Its explicit execution receipt remains separate from the acquisition container's installed-identity-only receipt.
Add exactly one final row and its workflow matrix entry. The row pins index
sha256:74761e930f5d57face2d81efb0dc50dd4ce32ce1204810e56580bf68a5972ebc, platform manifestsha256:5e30957e54277bdaadeeffa42246258dc9df2086f3fb41f2125d041735ac72aa, and configsha256:c35dbeac2679d79dab524a13c9a3b74a8187878ecd3b3dff52bd2892418d7a79. An explicit three-name historical allowlist prevents a missing final policy from inheriting the historical producer fallback. Scanner cleanup accepts both stopped and already-stopped responses, then repeats the full exited-state ownership, image, command, mount and isolation fence before deletion. No caller image/path overrides or additional trusted workflow refs are introduced.Validation
umask 022fixture environment. Retained evidence preserves the earlier inherited-umask failure and corrected baseline separately.-xcommits onto the exact merged producer base. The actual 1.22.0 Linux release and five-image publication have separate authenticated self and independent acceptance receipts.c0da037bf9ba7a02ae6f9406ea6e8fcc3e35d187. Current-commit Codex code and security reviews completed with no findings; the earlier scanner cleanup finding is fixed and its conversation resolved.Limitations / follow-up
Source tests and release publication do not qualify installed inventories or filesystem equality. After merge, dispatch
qualify-released-linux-sdk.ymlon reviewedmain, then authenticate and inspect both actual final-target receipts and retained artifacts before adopting wrapper metadata/inventory pins. A later semantic release from this collector change does not retarget the fixed 1.22.0 row.Image Python, the producer OS and libraries remain trusted. This change does not establish wrapper export, physical GPU, gameplay, audible playback or legal completeness acceptance. Package acquisition and scanner execution remain confined to the hosted workflow; no local SDK pulls or image execution were used for this source change.