[VFS] Verify one package tree for both lazy and eager use#1069
Draft
brandonpayton wants to merge 10 commits into
Draft
[VFS] Verify one package tree for both lazy and eager use#1069brandonpayton wants to merge 10 commits into
brandonpayton wants to merge 10 commits into
Conversation
Phase B-1 matrix build status —
|
| Package | Arch | Status | Sha |
|---|---|---|---|
| homebrew-bootstrap | wasm32 | built | 5abead30 |
| kandelo-sdk | wasm32 | built | 55c851c7 |
| mariadb-test | wasm32 | built | 0daddd6b |
| mariadb-vfs | wasm32 | built | cc0b7173 |
| mariadb-vfs | wasm64 | built | 981d439e |
| rootfs | wasm32 | built | 99655348 |
| shell | wasm32 | built | 44b3fddf |
| lamp | wasm32 | built | 12de3192 |
| node-vfs | wasm32 | built | b1651fa5 |
| wordpress | wasm32 | built | d0ae7cec |
Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.
brandonpayton
force-pushed
the
integration/package-deferred-tree-clean-qk044
branch
from
July 23, 2026 13:39
98c27c5 to
829f905
Compare
brandonpayton
changed the title
Derive one canonical typed-tree descriptor from an exact declared package ZIP output, then let image builds either preserve it as one first-use group or directly materialize that same descriptor and payload. Record source-tree versus runtime-tree distribution meaning so a tool source tree cannot be mistaken for a Homebrew bottle. Give Node the same relative lazy-asset URL resolution contract as the browser, preserve closed exact-byte acceptance, and teach Homebrew materialization evidence to distinguish its bottle groups from coexisting package trees without overlooking unexpected bottles. This changes no kernel or guest ABI.
Propagate real namespace lookup errors during package-tree preflight instead of treating every lstat failure as a missing path. Add focused package-tree coverage proving a digest-mismatched first fetch commits no member, remains retryable, and coalesces concurrent access into one fetch on both the failed attempt and the successful retry.
Pre-publication browser checks may read an artifact from a local or staging source while the VFS stores its final immutable HTTPS URL. Callers previously had to fetch and assemble that binding themselves, which made it too easy to associate incomplete or changed bytes with the trusted URL. Add a bounded loader that validates the complete source list before I/O, omits credentials, rejects redirects, streams exactly the declared length, verifies SHA-256, and only then returns canonical closed-asset bindings. Export the primitive and cover invalid identities, truncation, overflow, digest changes, aggregate limits, concurrency, and result ordering.
Abort peer fetches and wait for their response bodies to close when one verified source fails or the caller cancels. Validate and snapshot the full manifest before I/O, keep decoded bytes as the size authority, redact source queries from loader errors, and reject noncanonical URL fragments. Cover the contract with focused host tests and a real Chromium transport test for gzip decoding, omitted credentials, redirects, bounded streams, stream failure, and caller abort.
Regenerate the checked-in resolver bundle after the shared VFS and resolver changes in this combined tranche. This keeps CI and source-checkout consumers on the same implementation as the TypeScript source.
brandonpayton
force-pushed
the
integration/package-deferred-tree-clean-qk044
branch
from
July 23, 2026 14:58
829f905 to
476fa57
Compare
brandonpayton
changed the title
brandonpayton
changed the base branch from
main
to
integration/homebrew-bootstrap-after-atomic-qk044
July 23, 2026 14:58
brandonpayton
marked this pull request as draft
July 23, 2026 14:58
This was referenced Jul 23, 2026
Member
Author
|
Approval recorded for this generic VFS tranche. I will keep the PR draft and out of the merge queue until #1074 lands, then restack these same changes onto the immutable merge commit and require exact Node/Chromium and staging validation before merging. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The shell should be able to leave bottled software lazy, while CI can materialize the same package tree eagerly for a network-independent proof. Both modes must use the same verified archive inventory and bytes; otherwise an eager test would not prove what a lazy user receives.
This also closes failure-handling and transport gaps that would otherwise make lazy downloads difficult to retry or unsafe to stage before immutable release URLs exist.
What changes
Stack and merge rule
This is stacked on #1074 at its exact current head. After the packaging stack lands, I will restack this branch onto the immutable merge commit and rerun the final checks.
This changes the generic host/VFS runtime. It will not be merged without explicit approval, even if CI is green.
Evidence for the current exact stack
Head:
476fa57cdb791b63e4728e3ac8cb3b72e486ea00git diff --check: passedNo kernel, libc, or ABI contract changes. Exact post-restack CI is still required before merge.