fix(release): anchor RPM package paths before extraction cd - #28
Merged
Merged
Conversation
Seal run 36171579110: the managed-package lifecycle gates passed (the previous rpm2cpio payload-judgement fix worked), which let the "Build managed DEB/RPM packages" step run for the first time - and it failed with "RPM payload extraction produced no terraphim-agent" seconds after nFPM created the file. Root cause: verify_rpm's host branch extracts with `cd "$tmp" && rpm2cpio "$pkg"`, and the workflow invokes the producer with a relative --out-dir, so the relative package path resolved inside $tmp and rpm2cpio reported the package as missing. docker_rpm_tool already anchored its path with realpath; the host branch now does the same, and inspect_rpm in the native gate anchors its package path for the same guarantee. Verified locally against the exact production invocation shape (producer + relative --out-dir): pre-fix reproduces the hosted ENOENT failure byte-for-byte; post-fix the producer passes end-to-end (DEB and RPM for both binaries, host rpm2cpio extraction, docker lintian/rpmlint policies, inventory assembly, atomic publish rename). Wrong-arch, REQUIRE_INSTALL policy, canonical-input strip, and inspect_rpm repro suites all green. Refs #337
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Seal run 36171579110 failed in the "Build managed DEB/RPM packages" step on both
musl lanes with:
nFPM created the RPM seconds earlier, so the file existed. The workflow invokes
the producer with a relative
--out-dir client-managed-packages/${TARGET};verify_rpmthen extracted the payload with(cd "$tmp" && rpm2cpio "$pkg" ...),so the relative package path resolved against
$tmpand reported the freshlybuilt package as missing.
This build step never ran before: run 1 (36164026957) died at the lifecycle gate
(old rpm2cpio hard-fail, fixed in #27), which left the build step SKIPPED. Run 2's
gate passed, exposing the latent path bug.
Changes
build-client-packages.shverify_rpm(): anchor the package path withrealpathbefore anycd, exactly asdocker_rpm_toolalready does.test_client_nfpm_native.shinspect_rpm(): same defensive anchor aftermkdir -p "$extract"(callers pass absolute paths today; this keeps that aguarantee rather than an accident).
Verification
/tmp/relprod-driver.shruns the real producer end-to-end with the exact CIinvocation shape (relative
--out-dir client-managed-packages/x86_64-unknown-linux-musl,stripped
cc -sELF stand-ins, nfpm 2.47.0,SOURCE_DATE_EPOCH):(exit 1, ENOENT on the rpm2cpio line).
payload+SHA checks, docker lintian/rpmlint policies satisfied, 5 outputs
published (2 deb, 2 rpm, package-sha256sums.txt).
bash -nclean on both scripts.fail-closed).
cd ... &&across nfpm/release scripts: exactly these twohazardous sites; all other
cds are root resolution or safe in-dir patterns.test_client_nfpm_native_actual.shaudited (the next first-time runner):builds upgrade-transition packages into absolute
$TMP/out-upgradeandinstalls from the original cwd; no cd hazard with the relative
PACKAGE_DIR.Refs #337