Skip to content

build(bwrap): commit the linked license texts instead of downloading them - #90

Merged
AlbSar merged 2 commits into
mainfrom
fix/bwrap-vendored-licenses
Oct 15, 2026
Merged

AlbSar merged 2 commits into
mainfrom
fix/bwrap-vendored-licenses

Conversation

@AlbSar

@AlbSar AlbSar commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

git.musl-libc.org (all of musl.libc.org) stopped answering on 2026-10-15; every cache-miss bubblewrap build failed with build-bwrap: fetch failed while reading the musl COPYRIGHT (main run 38752267610 / bwrap-bundle 38752267742 after PR #89).

  • musl and libcap license texts committed under packaging/bwrap/licenses, checked against the lock hashes; missing/altered text refuses before any download or Docker run (new test).
  • Lock URLs kept as provenance; bubblewrap source tarball still from the GitHub release.
  • Local proof: empty-cache build with musl unreachable → x86_64 binary 917f8e7f… = lock; bwrap-cache + pack-smoke-dist tests 14/14; typecheck, lint-arch, lint-docs, ESLint clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP

AlbSar and others added 2 commits October 15, 2026 17:47
…them

git.musl-libc.org (and all of musl.libc.org) stopped answering on
2026-10-15, so every cache-miss bubblewrap build failed with "fetch
failed" while reading the musl COPYRIGHT: the main run of PR #89 and
the first attempt of its PR run. The musl and libcap license texts are
now committed under packaging/bwrap/licenses and checked against the
lock hashes; a missing or altered text refuses the build before any
download or Docker run. The lock URLs stay as the provenance record.
refresh-bwrap already refuses version changes of licensed parts, so the
committed texts move together with the lock. The bubblewrap source
tarball still comes from the GitHub release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP
…them before any download (REVIEW2573)

P1: refresh-bwrap copied only CACHE_INPUTS and resolve.sh into its
scratch checkout, so the weekly pin refresh would stop at the first
--record build on the missing musl-COPYRIGHT. The scratch copy now
includes every lock-pinned license text (bwrap-cache licenseInput is
the one path rule for build, refresh and tests); the orchestration test
asserts the scratch driver sees them byte-exact.
P2: vendored texts are checked before the source download and before
any output directory is made; the test uses a cold cache and an
unreachable source URL, and a positive control proves the download is
reached only once the texts match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP
@AlbSar
AlbSar merged commit 421813e into main Oct 15, 2026
25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant