starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-10-19 16:03:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

build(ssh): use portable relay archives

Browse Source 
Co-authored-by: Orca <help@stably.ai>
This commit is contained in:
Jinwoo-H
2026-07-15 16:30:48 -04:00
co-authored by Orca
parent c5fe474e6f
commit c9f6da55e4
32 changed files with 295 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ssh-relay-runtime-artifacts.yml
+14 -7
View File
@@ -246,6 +246,7 @@ jobs:
node --check config/scripts/ssh-relay-runtime-post-sign-metadata.test.mjs
node --check config/scripts/ssh-relay-runtime-archive-extraction.mjs
node --check config/scripts/ssh-relay-runtime-archive-extraction.test.mjs
node --check config/scripts/ssh-relay-runtime-portable-archive.test.mjs
node --check config/scripts/ssh-relay-runtime-native-signing-stage-report.mjs
node --check config/scripts/ssh-relay-runtime-macos-signing.mjs
node --check config/scripts/ssh-relay-runtime-macos-signing.test.mjs
@@ -272,6 +273,7 @@ jobs:
config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
config/scripts/ssh-relay-node-zip-inspection.test.mjs \
config/scripts/ssh-relay-runtime-artifact.test.mjs \
config/scripts/ssh-relay-runtime-portable-archive.test.mjs \
config/scripts/ssh-relay-runtime-baseline.test.mjs \
config/scripts/ssh-relay-runtime-build.test.mjs \
config/scripts/ssh-relay-runtime-linux-build-evidence.test.mjs \
@@ -388,7 +390,7 @@ jobs:
--git-commit "$source_commit"
first_output="$output_root/first"
identity="$first_output/orca-ssh-relay-runtime-${{ matrix.tuple }}.identity.json"
archive=$(find "$first_output" -maxdepth 1 -name '*.tar.xz' -print -quit)
archive=$(find "$first_output" -maxdepth 1 -name '*.tar.br' -print -quit)
test -n "$archive"
executed_runtime="$output_root/readback-executed"
# Why: exercise only local verified bytes; release writes and remote consumers stay disconnected.
@@ -449,7 +451,7 @@ jobs:
--source-date-epoch "$source_date_epoch" \
--git-commit "$source_commit"
identity="$output/orca-ssh-relay-runtime-${{ matrix.tuple }}.identity.json"
archive=$(find "$output" -maxdepth 1 -name '*.tar.xz' -print -quit)
archive=$(find "$output" -maxdepth 1 -name '*.tar.br' -print -quit)
test -n "$archive"
/usr/bin/time -p node config/scripts/verify-ssh-relay-runtime.mjs \
--runtime-directory "$output/runtime" \
@@ -467,7 +469,7 @@ jobs:
--first-output-directory "$first_output" \
--second-output-directory "$second_output"
identity="$first_output/orca-ssh-relay-runtime-${{ matrix.tuple }}.identity.json"
archive=$(find "$first_output" -maxdepth 1 -name '*.tar.xz' -print -quit)
archive=$(find "$first_output" -maxdepth 1 -name '*.tar.br' -print -quit)
test -n "$archive"
executed_runtime="$output_root/readback-executed"
# Why: exercise only local verified bytes; release writes and remote consumers stay disconnected.
@@ -496,7 +498,7 @@ jobs:
test ! -e "$signing_stage/bin/node"
rm -rf -- "$signing_stage"
mkdir -p "$GITHUB_WORKSPACE/runtime-evidence/${{ matrix.tuple }}"
cp "$first_output"/*.tar.xz "$first_output"/*.spdx.json "$first_output"/*.provenance.json "$first_output"/*.identity.json \
cp "$first_output"/*.tar.br "$first_output"/*.spdx.json "$first_output"/*.provenance.json "$first_output"/*.identity.json \
"$signing_report" "$GITHUB_WORKSPACE/runtime-evidence/${{ matrix.tuple }}/"
- name: Upload unpublished artifact evidence
@@ -739,6 +741,8 @@ jobs:
if ($LASTEXITCODE -ne 0) { throw 'runtime archive extraction syntax check failed' }
node --check config/scripts/ssh-relay-runtime-archive-extraction.test.mjs
if ($LASTEXITCODE -ne 0) { throw 'runtime archive extraction test syntax check failed' }
node --check config/scripts/ssh-relay-runtime-portable-archive.test.mjs
if ($LASTEXITCODE -ne 0) { throw 'runtime portable archive test syntax check failed' }
node --check config/scripts/ssh-relay-runtime-native-signing-stage-report.mjs
if ($LASTEXITCODE -ne 0) { throw 'runtime signing stage report syntax check failed' }
node --check config/scripts/ssh-relay-runtime-macos-signing.mjs
@@ -775,6 +779,7 @@ jobs:
config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs `
config/scripts/ssh-relay-node-zip-inspection.test.mjs `
config/scripts/ssh-relay-runtime-artifact.test.mjs `
config/scripts/ssh-relay-runtime-portable-archive.test.mjs `
config/scripts/ssh-relay-runtime-baseline.test.mjs `
config/scripts/ssh-relay-runtime-build.test.mjs `
config/scripts/ssh-relay-runtime-linux-build-evidence.test.mjs `
@@ -1079,7 +1084,7 @@ jobs:
set -euo pipefail
evidence="$GITHUB_WORKSPACE/runtime-evidence/${{ matrix.tuple }}"
mapfile -d '' identities < <(find "$evidence" -maxdepth 1 -type f -name '*.identity.json' -print0)
mapfile -d '' archives < <(find "$evidence" -maxdepth 1 -type f -name '*.tar.xz' -print0)
mapfile -d '' archives < <(find "$evidence" -maxdepth 1 -type f -name '*.tar.br' -print0)
if (( ${#identities[@]} != 1 || ${#archives[@]} != 1 )); then
printf 'runtime baseline evidence is ambiguous: identities=%s archives=%s\n' \
"${#identities[@]}" "${#archives[@]}" >&2
@@ -1088,8 +1093,10 @@ jobs:
identity=${identities[0]}
archive=${archives[0]}
runtime="$RUNNER_TEMP/baseline-runtime/${{ matrix.tuple }}"
mkdir -p "$runtime"
tar -xJf "$archive" -C "$runtime"
node config/scripts/ssh-relay-runtime-archive-extraction.mjs \
--identity "$identity" \
--archive "$archive" \
--output-directory "$runtime"
node config/scripts/verify-ssh-relay-runtime.mjs \
--runtime-directory "$runtime" \
--identity "$identity" \
.github/workflows/ssh-relay-runtime-native-signing.yml
+1 -3
View File
@@ -63,8 +63,6 @@ jobs:
shell: bash
run: |
set -euo pipefail
brew list xz >/dev/null 2>&1 || brew install xz
command -v xz
test -x /usr/bin/codesign
security help >/dev/null
@@ -80,7 +78,7 @@ jobs:
set -euo pipefail
evidence="$RUNNER_TEMP/ssh-relay-runtime-build/${{ matrix.tuple }}"
identity="$evidence/orca-ssh-relay-runtime-${{ matrix.tuple }}.identity.json"
archive=$(find "$evidence" -maxdepth 1 -type f -name 'orca-ssh-relay-runtime-v1-*.tar.xz' -print)
archive=$(find "$evidence" -maxdepth 1 -type f -name 'orca-ssh-relay-runtime-v1-*.tar.br' -print)
test "$(printf '%s\n' "$archive" | sed '/^$/d' | wc -l | tr -d ' ')" = 1
runtime="$RUNNER_TEMP/ssh-relay-runtime-source/${{ matrix.tuple }}"
node config/scripts/ssh-relay-runtime-archive-extraction.mjs \