From b4eb5e17ddf4a189321b288ec55026336a7c0195 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 27 Jul 2026 15:36:17 +0100 Subject: [PATCH] fix(governance): a stub Containerfile is not packaging MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #534 added sealed-container detection but accepted it on PRESENCE ALONE. That reproduces the exact fault this script exists to remove: standards#505's predecessor accepted any *.scm as "Guix detected", and the Guix predicate was tightened for precisely that reason. The container branch was left untightened. The estate scaffold ships a Containerfile template whose every install and build line is a commented `# TODO:` example — no active RUN, no ENTRYPOINT. It provides no environment whatsoever, yet satisfied the gate. Measured 2026-07-27 across hyper-repos + meta-repos: stub Containerfiles (no active RUN/ENTRYPOINT/CMD): 17 real Containerfiles: 43 So 17 repos were being reported compliant on the strength of an untouched template. Found while preparing to add Containerfiles to the 29 Nix-only repos the 2026-06-01 retirement made non-compliant — i.e. the sweep was about to mass produce artefacts that pass a gate known to be weak. The predicate is deliberately cheap and syntactic: at least one ACTIVE RUN / ENTRYPOINT / CMD. It cannot prove an image is useful, but it separates "someone filled this in" from "this is the untouched template", which is the distinction available at gate time. A stub now warns and falls through to the same treatment as no packaging at all. Red-teamed — six cases, measured: stub Containerfile, post-cutoff -> 1 warns, does not pass real Containerfile (RUN) -> 0 ✅ real Containerfile (ENTRYPOINT only) -> 0 ✅ stub + guix.scm -> 0 guix wins, no container warning stub + flake.nix, nix retired -> 1 correctly non-compliant only a COMMENTED-OUT RUN -> 1 not fooled by `# RUN ...` `bash -n` clean. Co-Authored-By: Claude Opus 5 --- scripts/check-package-policy.sh | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/scripts/check-package-policy.sh b/scripts/check-package-policy.sh index a42ee7f9..da109c91 100755 --- a/scripts/check-package-policy.sh +++ b/scripts/check-package-policy.sh @@ -127,11 +127,28 @@ if [ -n "$GUIX" ]; then exit 0 fi +# A Containerfile only counts if it BUILDS something. The estate scaffold ships +# a template whose every install/build line is a commented `# TODO:` example — +# measured 2026-07-27: 17 of 60 estate Containerfiles are that stub. Accepting +# them on presence alone reproduces exactly the fault this script was written to +# remove (standards#505 accepted any *.scm as "Guix detected"). A stub provides +# no environment, so it is not packaging. +# +# The predicate is deliberately cheap and syntactic: at least one ACTIVE +# RUN / ENTRYPOINT / CMD instruction. It cannot prove the image is useful, but +# it does separate "someone filled this in" from "this is the untouched +# template", which is the distinction that matters at gate time. if [ -n "$CONTAINER" ]; then - echo "✅ Sealed-container packaging detected (escape hatch): ${CONTAINER#"$ROOT"/}" - echo "::notice::Guix is the estate primary; a sealed container is the" \ - "accepted escape hatch for the not-in-Guix / non-free tail." - exit 0 + if grep -qE '^[[:space:]]*(RUN|ENTRYPOINT|CMD)[[:space:]]' "$CONTAINER"; then + echo "✅ Sealed-container packaging detected (escape hatch): ${CONTAINER#"$ROOT"/}" + echo "::notice::Guix is the estate primary; a sealed container is the" \ + "accepted escape hatch for the not-in-Guix / non-free tail." + exit 0 + fi + echo "::warning::${CONTAINER#"$ROOT"/} is the UNFILLED scaffold template —" \ + "every install/build step is a commented '# TODO:' example, so it" \ + "provides no environment and does not satisfy the policy." + CONTAINER="" fi # Nix-only. Under the 2026-05-18 ruling this is NOT compliance — Nix is not a