Conversation
Upstream 325e4bc added runtime.platform.min_glibc so a host can refuse a Linux runtime its glibc cannot load. Packaging copied the runtime manifest through unchanged and never looked at the field, so a malformed or wrongly-attached floor would ship. Reject a min_glibc that is not a major.minor version or that is attached to a non-Linux runtime, and record the declared floor in upstream-provenance.json as runtime_min_glibc. The field stays optional. Absence makes no claim, and host and runtime always travel together in one product bundle, so a runtime predating the field is always paired with a host predating the check that would skip it. Releases through v0.76.2 verify exactly as before. Packaging does not re-derive the floor from ELF headers. verify_linux_min_glibc_consistency upstream owns that, and the runtime manifest is already digest-bound to the verified producer, so recomputing it here would duplicate the producer rather than check it.
|
Warning Review limit reachedNext included review available in 59 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai full review |
|
2 participants
Why
Upstream
325e4bcaddedruntime.platform.min_glibcso a host can refuse a Linux runtime its glibc cannot load. Packaging copies the runtime manifest through unchanged and never looked at the field, so a malformed or wrongly-attached floor would ship.Worth knowing how sharp the upstream edge is.
has_startup_compatibility_metadata(resolver.rs:404) treats a Linux runtime with nomin_glibcas ineligible, andnative_runtime.rs:609logs "Skipping locally installed Linux native runtime without platform.min_glibc metadata; reinstall or repackage it before startup". A package whose runtime lacks the field, installed next to a host that has the check, has no usable runtime at all.What changed
Extraction rejects a
min_glibcthat is not amajor.minorversion or that is attached to a non-Linux runtime, matching upstream'sparse_glibc_versionand its non-Linux bail. The declared floor lands inupstream-provenance.jsonasruntime_min_glibc, so release evidence carries it.Why absence is safe
The field stays optional, and that isn't a compromise. Host and runtime always travel together in one product bundle, so a runtime predating the field is always paired with a host predating the check that would skip it. The mismatch that bites can't be produced by this pipeline. Releases through v0.76.2 verify exactly as before.
What this deliberately does not do
It does not re-derive the floor from ELF headers. Upstream's
verify_linux_min_glibc_consistencyalready does that withreadelfand refuses to publish a misleading floor, and the runtime manifest is digest-bound to that verified producer before we read it. Recomputing here would duplicate the producer rather than check it, and would needreadelfin the packaging container.QA
tests/upstream-archive.test.ts, 17/17:2.35floor is accepted and surfaces in provenance2.35.1,2,"",two.35, the number2.35, andtrueare all rejected2.35floor on amacosruntime is rejectednullFull suite 168/171; the 2
workflow-provenancefailures reproduce on unmodifiedorigin/mainon macOS and were green on ubuntu CI in #30, #31, and #32.Note for review
The provenance object gains a key.
release-evidence.tscopies the file opaquely and the workflow'sjq -echecks named fields rather than an exact key set, so nothing downstream needed changing, but that's the thing worth a second pair of eyes.