ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Confine package ownership changes to private mounts

Browse source
This commit is contained in:
ms2k 2026-07-27 03:31:58 +09:00
commit 8334fd379f
1 changed files with 402 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

33
tools/materialize-runsc
View file

@ -4,12 +4,19 @@ set -euo pipefail
root="$(cd "$(dirname "$0")/.." && pwd)"
revision=9f8f6c917885d9ef3d84c17280939c012dea0dfe
archive_checksum=9d96426115f1bf54ef09ba41964c73dc3c809743519c8442016b8dd3fce0889d
patch_file="$root/patches/gvisor-9f8f6c917-directory-handles.patch"
patch_checksum=541420eece9ec7efbef156bdb726744ead6b4d991d41c5560f4fdfe83fb2357a
patch_files=(
"$root/patches/gvisor-9f8f6c917-directory-handles.patch"
"$root/patches/gvisor-9f8f6c917-private-ownership.patch"
)
patch_checksums=(
541420eece9ec7efbef156bdb726744ead6b4d991d41c5560f4fdfe83fb2357a
79a8c98502d3bb7c254ffb0885dbd26afffac227d04a0091ff91383df0842561
)
patch_digest=5622a44af2d9e7561f5372844dc21cf6fb93b4fcd3fe70da7f545d403a84c612
bazel_version=8.3.1
module_lock="$root/patches/gvisor-9f8f6c917-MODULE.bazel.lock"
module_checksum=8402c7beb4baf2c666f4b78e400ea3f15514b56117598c2cb5411d6a35208d34
build_id=904ab3c9bd4c99a27181076f2c9ea2fecc041db5a728c999540d6664174d2cd4
build_id=b9ad6f93a8e890b5935061582b1a128682f3fd41c8053c54d0e44ff45d809971
archive="$root/.lazaret/cache/gvisor-$revision.tar.gz"
source="$root/.lazaret/vendor/gvisor-$build_id"
binary="$root/.lazaret/bin/lazaret-runsc-$build_id"
@ -33,14 +40,19 @@ for command in curl make patch sha256sum tar; do
command -v "$command" >/dev/null 2>&1 || fail "$command is required"
done
[[ -f "$patch_file" ]] || fail "missing patch: $patch_file"
[[ "$(sha256sum "$patch_file" | cut -d ' ' -f 1)" == "$patch_checksum" ]] ||
fail 'patch checksum mismatch'
for index in "${!patch_files[@]}"; do
patch_file="${patch_files[$index]}"
[[ -f "$patch_file" ]] || fail "missing patch: $patch_file"
[[ "$(sha256sum "$patch_file" | cut -d ' ' -f 1)" == "${patch_checksums[$index]}" ]] ||
fail "patch checksum mismatch: $patch_file"
done
[[ "$(printf '%s\n' "${patch_checksums[@]}" | sha256sum | cut -d ' ' -f 1)" == "$patch_digest" ]] ||
fail 'ordered patch digest mismatch'
[[ -f "$module_lock" ]] || fail "missing module lock: $module_lock"
[[ "$(sha256sum "$module_lock" | cut -d ' ' -f 1)" == "$module_checksum" ]] ||
fail 'module lock checksum mismatch'
stamp="$revision $archive_checksum $patch_checksum $bazel_version $module_checksum $build_id"
stamp="$revision $archive_checksum $patch_digest $bazel_version $module_checksum $build_id"
if [[ ! -f "$source/.lazaret-materialization" ]]; then
mkdir -p "$root/.lazaret/cache" "$root/.lazaret/vendor"
if [[ ! -f "$archive" ]]; then
@ -60,7 +72,9 @@ if [[ ! -f "$source/.lazaret-materialization" ]]; then
tar -xzf "$archive" -C "$temporary"
extracted="$temporary/gvisor-$revision"
[[ -d "$extracted" ]] || fail 'archive has an unexpected root directory'
patch --directory="$extracted" --strip=1 --batch --forward <"$patch_file"
for patch_file in "${patch_files[@]}"; do
patch --directory="$extracted" --strip=1 --batch --fuzz=0 --forward <"$patch_file"
done
[[ "$(tr -d '\n' <"$extracted/.bazelversion")" == "$bazel_version" ]] ||
fail 'Bazel version mismatch'
install -m 0644 "$module_lock" "$extracted/MODULE.bazel.lock"
@ -73,7 +87,8 @@ elif [[ "$(tr -d '\n' <"$source/.lazaret-materialization")" != "$stamp" ]]; then
fi
if [[ "$mode" == test ]]; then
make -C "$source" test TARGETS=//pkg/sentry/fsimpl/gofer:gofer_test
make -C "$source" test \
TARGETS='//pkg/sentry/fsimpl/gofer:gofer_test //runsc/fsgofer:lisafs_test'
fi
if [[ "$mode" != source ]]; then
make -C "$source" build TARGETS=//runsc:runsc