Files
tty7/.github/scripts/assert-static.sh
l0ng-ai 208454e202 feat(remote): remote workspaces — a window that is one machine
Split the framework-free half of tty7 into `tty7-core` and add a headless
`tty7-server` built on it, so a workspace's filesystem, git and session state
can live on another machine while the GUI stays where it is.

- `crates/tty7-core`: wire protocol, session daemon, PTY, native SSH engine and
  the domain model, with no gpui dependency. Module paths are unchanged.
- `crates/tty7-server`: the same daemon with no GUI attached, linked fully
  static against musl and pushed onto the remote box. One dependency, on
  purpose — a second one the GUI also needs belongs in core.
- `Host` trait + `HostId`/`HostRegistry`: every fs/git/watch call a workspace
  makes goes through the machine it belongs to. `LocalHost` answers on this
  box, `RemoteHost` over a routed control connection.
- `ui::host_ops`: the GUI's single door to a `Host`. Host calls block, so all
  of them run on the background executor with the result landed on the UI
  thread; de-duplication, staleness and error reporting live here rather than
  at each call site. Enforced by a CI grep.
- Connect flow: home page → pick a configured SSH host → the machine's own
  workspace list → a window bound to one workspace on it. Workspace switcher
  groups by machine, this computer included.
- CI: static musl builds of `tty7-server` for x86_64/aarch64 via
  cargo-zigbuild, a host-boundary grep, and version stamping factored out of
  the nightly workflow. Both new jobs are non-required so branch protection
  does not wedge open PRs.

Design and the interface contract it was built to are in
`docs/2026-07-27-remote-workspace-{design,impl-contract}.md`.
2026-07-28 10:59:46 +08:00

56 lines
2.0 KiB
Bash
Executable File

#!/bin/bash
# Usage: assert-static.sh <path-to-elf>
# Fail unless the binary is a fully static ELF — no dynamic loader, no shared
# library dependencies.
#
# This is the mechanical guard behind D10 (docs/2026-07-27-remote-workspace-design.md):
# one `tty7-server` binary is pushed to arbitrary remote machines and must run
# there regardless of what libc, and what *version* of it, that machine has. A
# build that silently picked up a dynamic dependency would still pass a
# compile-only CI job and then fail on the first old box a user connects to —
# far from the change that caused it. Cheap to assert, expensive to discover.
set -euo pipefail
BIN="$1"
if [ ! -f "$BIN" ]; then
echo "::error::assert-static.sh: $BIN does not exist"
exit 1
fi
echo "--- file ---"
file "$BIN"
echo "--- readelf -d ---"
readelf -d "$BIN" || true
fail=0
# `file` says "statically linked" for a classic static binary and "static-pie
# linked" for a position-independent one. Rust's musl targets have shipped both
# shapes depending on toolchain version, and both are equally self-contained, so
# accept either — but nothing else.
if ! file "$BIN" | grep -Eq 'statically linked|static-pie linked'; then
echo "::error::$BIN is not statically linked (D10 requires a self-contained binary)"
fail=1
fi
# The decisive check: a static binary has no PT_INTERP segment, i.e. no
# request for /lib/ld-musl-*.so or ld-linux-*.so. This catches the case `file`
# alone would not, where a dynamic loader is still required.
if readelf -l "$BIN" | grep -q 'Requesting program interpreter'; then
echo "::error::$BIN requires a dynamic loader (PT_INTERP present) — not a static build"
fail=1
fi
# Belt and braces: no DT_NEEDED entries, i.e. no shared libraries to resolve.
if readelf -d "$BIN" 2>/dev/null | grep -q 'NEEDED'; then
echo "::error::$BIN has shared-library dependencies (DT_NEEDED) — not a static build"
fail=1
fi
if [ "$fail" -ne 0 ]; then
exit 1
fi
echo "✅ $BIN is a static binary ($(du -h "$BIN" | cut -f1))"