mirror of
https://github.com/openglow-org/forgefirm.git
synced 2026-10-19 11:01:43 -07:00
ScottW514
03146a1529
pack-licenses.sh packs the image's license tree into one tar.gz and removes the tree. It piped tar into gzip under /bin/sh (dash, no pipefail): the pipeline's status is gzip's, and tar's is lost. The check that follows proves only that the bundle holds license.manifest. So a member tar cannot read leaves a bundle without that text, the build green, and the tree removed, the only copy of the text with it. tar now runs the compressor itself (-I 'gzip -9 -n'), so its exit status covers the read and the write. A failed pack removes the partial bundle and the script refuses, with the tree left for the build log; pack_licenses in forgefirm-image.bb fails do_rootfs on the refusal. The bundle's bytes do not change: tar feeds the same stream to the same gzip, and a tree packed by both forms gives one sha256. Proof: forgetest-ci "Unit tests" (`python -B -m unittest discover -s tests -v` in forgetest), on Ubuntu 24.04 with python 3.12 as an unprivileged user: test_image.py's PackLicensesTests gain test_a_license_text_tar_cannot_read_is_refused_and_the_tree_left (a text under zlib/ with mode 0: a nonzero exit, a message on stderr, no bundle, the manifest left); the class's 5 tests OK. Negative control on a scratch copy: the new case against the script without this change fails at assertRefused with an exit status of 0. At the shell, on a fixture tree with the unreadable member, the script without this change exits 0, leaves the bundle without the text and removes the tree; with it, the script exits 1, leaves no bundle and leaves the tree. On a readable tree both forms write byte-identical bundles (one sha256 for both). pyflakes reports no undefined name. Acceptance: every catalog test. pack-licenses.sh is under meta-forgefirm, whose content hash is part of the platform in every fingerprint, so the image that carries this change needs the whole catalog on the bench.