From d1eb45d613f504d7363230420f14a0c8126fe125 Mon Sep 17 00:00:00 2001 From: Jinwoo-H Date: Tue, 14 Jul 2026 18:18:31 -0400 Subject: [PATCH] build(ssh): bound linker path diagnostic Co-authored-by: Orca --- config/scripts/ssh-relay-runtime-toolchain.mjs | 3 ++- config/scripts/ssh-relay-runtime-toolchain.test.mjs | 7 +++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/config/scripts/ssh-relay-runtime-toolchain.mjs b/config/scripts/ssh-relay-runtime-toolchain.mjs index c2f24ca8d30..4d4cef54ca6 100644 --- a/config/scripts/ssh-relay-runtime-toolchain.mjs +++ b/config/scripts/ssh-relay-runtime-toolchain.mjs @@ -200,7 +200,8 @@ export function sshRelayRuntimeWindowsMsvcToolsetVersion(path) { segments[msvcIndex + 2]?.toLowerCase() !== 'bin' || segments.at(-1)?.toLowerCase() !== 'link.exe' ) { - throw new Error('Resolved Windows linker is not in a bounded MSVC toolset path') + const diagnostic = segments.slice(-12).join(win32.sep).slice(-512) || '' + throw new Error(`Resolved Windows linker is not in a bounded MSVC toolset path: ${diagnostic}`) } // Why: hosted link.exe has no version resource; its resolved toolset path plus byte hash is exact. return `MSVC ${version}` diff --git a/config/scripts/ssh-relay-runtime-toolchain.test.mjs b/config/scripts/ssh-relay-runtime-toolchain.test.mjs index 655a75e9615..4f172b5dd24 100644 --- a/config/scripts/ssh-relay-runtime-toolchain.test.mjs +++ b/config/scripts/ssh-relay-runtime-toolchain.test.mjs @@ -58,6 +58,13 @@ describe('SSH relay runtime build provenance', () => { ).toThrow(/^Runtime build tool did not report a bounded version line: unexpected x{490}/) }) + it('bounds rejected Windows linker path diagnostics', () => { + const path = String.raw`C:\${'unexpected\\'.repeat(100)}link.exe` + expect(() => sshRelayRuntimeWindowsMsvcToolsetVersion(path)).toThrow( + /^Resolved Windows linker is not in a bounded MSVC toolset path: .{1,512}$/ + ) + }) + it('pins GitHub builder identity to the exact source commit', () => { expect( sshRelayRuntimeBuilderIdentity({