WIP: Harden VFS frame validation and service integration #3
No reviewers
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/vfsd!3
Loading…
Reference in a new issue
No description provided.
Delete branch "feature/posix-compat"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary and rationale
Correct the standalone service link so it uses the existing linker script and rejects linker warnings. The previous command could return Cargo success while producing an ELF with entry zero and no declared service entrypoint.
Tracking and scope
e8fab347cdcec8a3f6a58e4f5522166059de4fd4onfeature/posix-compat.e2b1cf5995bcf6334839cda9a013e90fa97787d5.Architecture, authority and failure behavior
The final cargo rustc invocation explicitly selects linker.ld and --fatal-warnings. It adds no capability or runtime authority. The static script's deployment-capacity placeholders do not establish a deployable dynamic service or guest readiness.
The original warning-producing exit-zero command and zero-entry ELF are retained. Ordinary runtime/smoke artifacts require their defined service entry and referenced state-arena symbol. The intentional force-fail feature stops before arena initialization; its optimized artifact retains the correct entry and 4 KiB allocated writable NOBITS arena section while its unused conditional symbol may be absent. This source-grounded distinction preserves the original failed universal-symbol assertion without changing production code or forcing unused symbols into it.
Validation evidence
Coherent realm image service prerequisites — 18 September 2026: Signed
d87c9732f1eeb47356933e53e381a00d96a30a5cselects the original shared wire/startup dependency graph. Direct Rust implementation bytes are unchanged. All 6 default, all-feature and separate production development/release configurations pass 136 unit tests per configuration, strict host/native Clippy and freestanding linking with fatal linker warnings. Formatting, private-item rustdoc and Markdown pass, with zero warnings. Original push/PR CI is under observation. Matching catalog adoption and real consumer VMs remain requirements; complete realm and full in-guest build acceptance remain open.Runtime consumer dependency alignment — 15 September 2026
Signed
bd013ca3cb7d42443bcf9f47c3ff807fbcdbd7e8aligns the existing dependency selections with the original signed runtime graph. This checkpoint changes Cargo selections and the roadmap; this repository's Rust implementation files are unchanged. Formatting, strict Clippy, private rustdoc and canonical documentation checks pass without warnings. Default/all-feature development/release tests pass 136 default / 136 all-feature tests. Independent production configurations also pass strict host/native Clippy and native builds:vfsd-runtime: 136 development / 136 release tests. There are 8 supported native builds in total. Both emitted runtime/smoke provider-read fixed-frame proofs and their negative fixtures pass under the unchanged deployment stack limit. Indirect control flow and descendant/recursive usage remain outside this proof. Push/review CI 82/83 passes with complete classified logs and no final warnings. The product catalog, product VM acceptance and guest build remain pending.Explicit Rust/Cargo 1.97.1 passes formatting, strict default/all-feature host and runtime/all-feature freestanding Clippy, warning-denied host builds and rustdoc. Both host suites pass 136 tests. Six runtime/smoke/all-feature debug/release final links are warning-free and have their declared entry. Deliberately omitting the script with fatal warnings returns Cargo 101.
Original Cargo package IDs and 339 dependency source blobs were reverified, with unchanged lock bytes and no cross-repository path substitutions. Markdown, whitespace and eighteen workflow shell blocks plus embedded Python syntax pass. All authored code remains below 1,000 lines and the crate already denies missing_docs. The existing provider-frame step is unchanged; its thirteen models and both runtime/smoke PIC frame checks pass.
No new guest feature is introduced. These host checks do not explain the separately tracked quota VM timeout or demonstrate a build inside EriX.
Review checklist
Coherent dependency checkpoint — 20 September 2026: signed/pushed commit 4c5e73237bdcb0f5769e5b5bd1ff70cb695e9142 aligns original shared dependency pins with the explicit installer-rights contract. Only the manifest and roadmap change; local implementation, APIs and authority policy are unchanged. Four strict 136-unit configurations, four native builds with the maintained linker layout, host/native Clippy, formatting, private rustdoc and dependency checks pass without warnings. Original CI 86/87 passes with four complete hashed logs (149,192 bytes), zero warning candidates.
Full catalog equality and actual consumer-image validation remain required under Integration regression 68. The broader work remains tracked by phase completion, including native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations. This dependency checkpoint does not close full lifecycle, frame or self-hosting acceptance.
Acknowledged terminal service dependencies — 21 September 2026: signed adb1f3aa6f866e0918c103c4f4be93a5bab820e7 selects the original shared libraries for repeated terminal observation, exact acknowledgement and final CPU measurements under Kernel design 20. All 4 strict 136-test selected development/release feature configurations, warning-denied host/native builds with the maintained linker layout, host/native Clippy, private rustdoc, applicable doctests, formatting and dependency/Markdown checks pass. All authored code remains below 1,000 lines. Original CI 88, 89 passes; complete hashed logs total 149,253 bytes with zero warning candidates. Full service CPU/profiler VM acceptance and guest builds remain open in Phase 6 completion.
Explicit provider-frame tool custody — 21 September 2026:
Signed 378181a5840fab0433e350cf6519e729f9283fdc requires explicit absolute selections for the regular disassembler, original Integration ownership helpers and a new evidence directory. There is no executable-name fallback or inherited caller environment; the selected child receives only a fixed locale, closed stdin and the ELF directory. The existing process owner enforces the unchanged thirty-second deadline, an explicit output budget (32 MiB by default) and descendant cleanup. Tool/helper identities, streams, original exit/failure status and cleanup outcomes are retained. Unexpected diagnostics fail proof admission.
All thirteen parser controls and eight actual tool-boundary controls pass, including environment/PATH shadowing, rejected tool and input leaves, cached helper substitution, nonzero execution, diagnostics, output refusal and evidence preservation. Actual runtime and smoke PIC checks each measure 167,632 fixed-frame bytes under the unchanged 245,760-byte ceiling and 262,144-byte deployment stack. Four prior strict 136-test Rust configurations remain applicable to byte-identical Rust, manifest and linker inputs. Formatting, workflow syntax, dependency policy and component Markdown pass; the initial documentation lint errors and their corrections remain retained.
The CLI, CI, README and architecture are updated together; the technical manual documents the same boundary. Original CI 90/91 is monitored separately. Local byte receipts do not isolate hostile writers sharing the host account or extend the fixed-frame gate to complete indirect/recursive stack proof. Full service VM and native external-toolchain/guest-build acceptance remain open in Phase 6 completion.
Original explicit-tool CI acceptance — 21 September 2026: signed 378181a5840fab0433e350cf6519e729f9283fdc passes both original CI 90/91. Four complete hashed logs total 158,176 bytes with zero warnings. The actual emitted runtime/smoke gates, 13 parser controls and 8 tool-boundary controls pass. This closes the bounded host-tool correction; full guest and whole-program frame acceptance remain separate.
WIP: Correct standalone service linking and reject linker warningsto WIP: Harden VFS frame validation and service integrationView command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.