Repository navigation
fix(ci): qualify actual native AppImage assembly (RUST-CI-045) - #58
Merged
Merged
Conversation
added 2 commits
November 12, 2026 09:40
Install external file explicitly for both native AppImage profiles. Exercise the production packaging helper with the pinned runtime, bounded assembly and no-FUSE extraction, verifying neutral payload bytes as a non-root image probe. Refs: emulebb/emulebb-rust#302, emulebb/emulebb-rust#322
…-CI-045) Share native recipe arguments with the trusted producer and load an exact source-owned local image for read-only PR conformance. Exercise the complete non-root offline probe, retaining the existing OCI identity test and pinned bases. Refs: emulebb/emulebb-rust#302, emulebb/emulebb-rust#322
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepared GNU Linux packages compiled successfully but AppImage assembly failed because appimagetool invokes external
file, which the image did not install. Add the explicit dependency to both native AppImage profiles and replace version-only acceptance with real synthetic assembly through the production packaging helper, using the verified pinned runtime. Extract without FUSE and verify every expected neutral payload file by SHA-256, without executing the payload.Assembly uses the existing GNU timeout process-group model; extraction has a bounded timeout. The surrounding production probe remains native, non-root, read-only and offline, with its existing tool/runtime/material checks. Both profiles declare
filebecause both use the same AppImage assembly path.Share existing native Docker recipe/label/pinned-base argument construction between trusted publication and read-only PR conformance. Both native GitHub CPU runners build and locally load the full recipe at the exact PR head, then run the complete strengthened probe as UID10000 with no network. Preserve the small OCI identity proof, pinned Docker/BuildKit inputs and all existing publication guards. This conformance path publishes no image and makes no attestation claim.
Validation: 120 focused Python tests passed; one existing Linux-only GNU timeout test skipped on Windows. Normal commit/push privacy, hygiene, actionlint and direct-test hooks passed. Hosted native AMD64/ARM64 conformance passed at exact source eeed7b9: complete prepared recipe, Docker 29.6.1, UID10000, actual AppImage assembly, no-FUSE extraction and verified payload/runtime hashes on both CPUs. Publication jobs correctly skipped. All exact-head checks passed, including both Windows baselines, CodeQL and workflow checks; publication jobs correctly skipped. No local Docker or Cargo run was performed.
Parent-coordinated blocking repair for Rust PR #322. New trusted-main producer output and refreshed Rust consumer pins/packaging qualification remain parent-owned follow-up after merge.
Refs: emulebb/emulebb-rust#302, emulebb/emulebb-rust#322 (RUST-CI-045)