chore: pin real wit-deps digests for nexum-host - #52
Open
mfw78 wants to merge 2 commits into
Open
Conversation
Replace the all-zero sha256/sha512 placeholders in wit/deps.toml with the real digests of the pinned nexum-runtime db39b6c1 tarball, and add the prefix field that selects wit/nexum-host inside the archive so wit-deps can resolve the whole-repo tarball. Regenerate wit/deps.lock from the url pin: the stale local path entry from the pre-carve monorepo is gone, and the recorded content digests are unchanged, which confirms the vendored wit/deps/nexum-host tree is byte-identical to the pinned rev. Add a wit-sync CI job that downloads a digest-verified wit-deps release binary, re-resolves with wit-deps update (lock skips the fetch and the digest check when the vendored tree already matches deps.lock), and fails on any diff against the checked-in wit/ tree. A just wit-sync recipe mirrors the job locally. Closes #45. AI Assistance: Claude Fable used for the whole change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
wit/deps.tomlnow carries the real tarball digests for the pinned nexum-runtimedb39b6c1archive (sha256b429b851..., sha512a8a96347...), replacing the all-zero placeholders, and adds theprefixfield (nexum-runtime-db39b6c1.../wit/nexum-host) needed to locate the WIT package inside the whole-repo GitHub tarball. A comment block documents the re-vendor flow (edit the rev, update digests, adjust prefix, runwit-deps update, commitdeps.toml/deps.lock/deps/together) in place of the old placeholder-digest apology.wit/deps.lockis regenerated from the URL pin: the stale pre-carvepath = "../../nexum/wit/nexum-host"entry is gone, replaced with the sameurl/prefixpair, and the lock's sha256/sha512 digests are unchanged from before the switch..github/workflows/ci.ymlgains awit-syncjob that downloads a digest-verified wit-deps v0.6.0 musl binary, runswit-deps update, and fails the build on any diff against the vendoredwit/tree;justfilegets a matchingwit-syncrecipe for local use and an updatedcirecipe comment noting that wit-sync runs separately since wit-deps is not in the dev shell.Why
Closes #45
The placeholder all-zero digests in
wit/deps.tomlmeantwit-depscould not actually verify the pinned nexum-runtime tarball, and the vendoredwit/deps/nexum-hosttree had no independent proof it matched the pin. Recording the real digests plus theprefixfield makes the pin resolvable and verifiable from a clean fetch, and the new CI/justfilewit-syncjob turns that verification into a gate instead of a manual, easy-to-skip step.Testing
Host disk was at capacity (
/and/tmpdown to a few MB free), so the full gate was run from a fresh clone in tmpfs (/dev/shm) instead of the working tree. No offline shortcuts were used: the repo was cloned from scratch, both branches fetched, and HEAD detached at the tip ofchore/wit-deps-digests. The diff againstorigin/chore/nexum-runtime-pin-bumptouches only.github/workflows/ci.yml,justfile,wit/deps.lock, andwit/deps.toml- no Rust crate, guest crate,videre-macros, or.witinterface source changed, socargo clippy/cargo test --doc/cargo docper touched crate are vacuous (zero touched crates) and were also not runnable given remaining disk space. Both tarball digests (b429b851.../a8a96347...) and the CI binary pin (0d28c03f...) were reproduced byte-exactly from independent downloads,wit-deps updateon a clean checkout is a true no-op withdeps.lock's content digests unchanged from the pre-changepath =lock (independently confirmed by a directdiff -ragainst the extracted tarball, showing the vendoredwit/deps/nexum-hosttree is byte-identical to the pinned rev), and thewit-sync` gate was confirmed to actually fail on a mispinned digest.AI Assistance
Implemented with claude-fable-5, red-teamed with claude-opus-5, PR opened with claude-sonnet-5.