funman300
c03702707b
The binary records only the commit it was built from -- no dirty-tree flag. Cargo will not re-run a build script because another crate's source changed, so a compiled-in 'clean' claim can be stale and is not a safeguard; that was verified on the Blaze host. scripts/verify-build-identity.sh establishes both facts at LAUNCH, where they cannot go stale: the stamped commit equals HEAD, and the migration crates are clean. It REFUSES rather than warns, because for a migration gate a warning on stderr is something to scroll past. --identity prints the stamp without valid configuration. The launcher must be able to establish which commit a binary came from BEFORE deciding whether to run it; requiring a correct environment first would invert the check. redirector.sh mirrors sidecar.sh: refuses to start with an orphan present or the port busy, matches the resolved executable rather than the command line (pgrep -f matches any shell mentioning the name), and stop PROVES the process is gone and the port free. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
47 lines
1.6 KiB
Bash
Executable File
47 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Is this binary trustworthy as gate evidence?
|
|
#
|
|
# verify-build-identity.sh <binary-commit>
|
|
#
|
|
# Two independent facts, both established HERE at launch rather than trusted
|
|
# from inside the binary:
|
|
#
|
|
# 1. the stamped commit equals the checkout's real HEAD
|
|
# 2. the migration crates have no uncommitted changes
|
|
#
|
|
# A compiled-in cleanliness flag cannot do this: cargo will not re-run a build
|
|
# script because another crate's source changed, so it can read "clean" for a
|
|
# binary built from edited sources. Verified on the Blaze host.
|
|
#
|
|
# REFUSES (exit non-zero) rather than warning. For a migration gate a warning on
|
|
# stderr is not a safeguard — it is something to scroll past.
|
|
set -uo pipefail
|
|
cd "$(dirname "$(readlink -f "$0")")/.."
|
|
|
|
STAMPED="${1:-}"
|
|
[[ -n "$STAMPED" ]] || { echo "usage: verify-build-identity.sh <binary-commit>" >&2; exit 2; }
|
|
|
|
CRATES=(openfut-protocol-blaze openfut-adapter-fifa17 openfut-host-config
|
|
openfut-blaze-host openfut-redirector-host)
|
|
|
|
rc=0
|
|
HEAD_NOW="$(git rev-parse --short=7 HEAD 2>/dev/null || echo unknown)"
|
|
|
|
if [[ "$STAMPED" != "$HEAD_NOW" ]]; then
|
|
echo "REFUSING: binary was built from $STAMPED but HEAD is $HEAD_NOW" >&2
|
|
echo " Rebuild before treating this run as evidence." >&2
|
|
rc=1
|
|
fi
|
|
|
|
DIRT="$(git status --porcelain --untracked-files=no -- "${CRATES[@]}" 2>/dev/null)"
|
|
if [[ -n "$DIRT" ]]; then
|
|
echo "REFUSING: migration crates have uncommitted changes:" >&2
|
|
sed 's/^/ /' <<<"$DIRT" >&2
|
|
rc=1
|
|
fi
|
|
|
|
if [[ $rc -eq 0 ]]; then
|
|
echo "build identity OK: commit $STAMPED == HEAD, migration crates clean"
|
|
fi
|
|
exit $rc
|