mkbundle/mkimage refuse a stale rootfs tarball unless explicitly overridden - #915
Merged
Conversation
mkbundle.sh and mkimage.sh only checked that os/build/pithead-root.tar existed, not that it matched the working tree. A leftover tarball from a previous build session looks identical to a fresh one, gets bundled and installed, and every downstream check comes up green while the old code is actually running — only a manual BUILD_COMMIT read on the box caught it once. Add verify_tarball_commit to the shared populate-slot.sh: extract the tarball's own opt/pithead/BUILD_COMMIT stamp and compare it to git rev-parse HEAD (dirty-suffixed the same way build-image.sh stamps it). Match proceeds; mismatch refuses by default, naming both commits, with PITHEAD_STALE_TARBALL_OK=1 as the explicit override — the same fail-closed shape the existing version/variant/signing guards use. Both mkbundle.sh and mkimage.sh call it right after their existing existence guard. Covered at tier 1 in tests/stack/run.sh with a fabricated fixture tarball (no image build needed): fresh match, foreign-commit refusal, the override, and a tarball with no stamp at all. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Root's git refuses another user's checkout (dubious ownership), and mkbundle/mkimage normally run under sudo — the guard would have refused every sudo build on a user-owned tree, the exact flow it exists to protect. Fall back to reading the commit as SUDO_USER; if the tree still cannot be read, refuse with a message that names the real cause instead of blaming staleness (fail closed, same explicit escape). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #896.
A present-but-stale
os/build/pithead-root.tarlooked identical to a fresh one — a bench deploy bundled the previous session's tarball, RAUC installed it, everything came up green, and only the manual BUILD_COMMIT check caught that the fix under test never shipped. The information was already inside the artifact.verify_tarball_commit()inpopulate-slot.sh(the file both consumers already share): onetar -xOofopt/pithead/BUILD_COMMIT, compared against the working tree with build-image.sh's exact-dirtysuffix. Match proceeds; mismatch refuses naming both commits;PITHEAD_STALE_TARBALL_OK=1is the explicit escape — the same fail-closed shape as the existing version/variant/signing guards.mkbundle.shandmkimage.shright after their existence guards.-c safe.directoryis documented as ignored from the command line) — the guard falls back to reading the commit asSUDO_USER, and an unreadable tree refuses with a message naming the real cause instead of blaming staleness.Tier-1 coverage with fabricated fixture tarballs: fresh accepted, stale refused (message names both commits + the override), missing stamp refused, unreadable tree refused fail-closed, override works on both refusal classes. Stack suite: 2182 passed, 0 failed.
Ponytail review: two refusal paths each keep their own override block — merging would save ~6 lines but collapse two different diagnoses into one message. Lean otherwise.
🤖 Generated with Claude Code