Bootstrap verified Rust implementation workspace
This commit is contained in:
parent
08ce2aca24
commit
b438dd5201
32 changed files with 1646 additions and 0 deletions
5
.gitignore
vendored
5
.gitignore
vendored
|
|
@ -7,9 +7,14 @@ storage/
|
||||||
|
|
||||||
# Rust & Cargo
|
# Rust & Cargo
|
||||||
/target/
|
/target/
|
||||||
|
docs/protocol/states/
|
||||||
**/*.rs.bk
|
**/*.rs.bk
|
||||||
cargo-uninstall.log
|
cargo-uninstall.log
|
||||||
|
|
||||||
|
# Python verification tooling
|
||||||
|
__pycache__/
|
||||||
|
*.py[cod]
|
||||||
|
|
||||||
# Containers & Podman/Docker build
|
# Containers & Podman/Docker build
|
||||||
.container-cache/
|
.container-cache/
|
||||||
*.tar
|
*.tar
|
||||||
|
|
|
||||||
42
Cargo.lock
generated
Normal file
42
Cargo.lock
generated
Normal file
|
|
@ -0,0 +1,42 @@
|
||||||
|
# This file is automatically @generated by Cargo.
|
||||||
|
# It is not intended for manual editing.
|
||||||
|
version = 4
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "lazaret-client"
|
||||||
|
version = "0.0.0"
|
||||||
|
dependencies = [
|
||||||
|
"lazaret-core",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "lazaret-core"
|
||||||
|
version = "0.0.0"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "lazaret-escalation-client"
|
||||||
|
version = "0.0.0"
|
||||||
|
dependencies = [
|
||||||
|
"lazaret-core",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "lazaret-host-coordinator"
|
||||||
|
version = "0.0.0"
|
||||||
|
dependencies = [
|
||||||
|
"lazaret-core",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "lazaret-network-sidecar"
|
||||||
|
version = "0.0.0"
|
||||||
|
dependencies = [
|
||||||
|
"lazaret-core",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "lazaret-runtime-supervisor"
|
||||||
|
version = "0.0.0"
|
||||||
|
dependencies = [
|
||||||
|
"lazaret-core",
|
||||||
|
]
|
||||||
30
Cargo.toml
Normal file
30
Cargo.toml
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
[workspace]
|
||||||
|
members = [
|
||||||
|
"crates/lazaret-client",
|
||||||
|
"crates/lazaret-core",
|
||||||
|
"crates/lazaret-escalation-client",
|
||||||
|
"crates/lazaret-host-coordinator",
|
||||||
|
"crates/lazaret-network-sidecar",
|
||||||
|
"crates/lazaret-runtime-supervisor",
|
||||||
|
]
|
||||||
|
resolver = "3"
|
||||||
|
|
||||||
|
[workspace.package]
|
||||||
|
version = "0.0.0"
|
||||||
|
edition = "2024"
|
||||||
|
rust-version = "1.90"
|
||||||
|
license = "Apache-2.0"
|
||||||
|
|
||||||
|
[workspace.lints.rust]
|
||||||
|
unsafe_code = "forbid"
|
||||||
|
unused = { level = "deny", priority = -1 }
|
||||||
|
|
||||||
|
[workspace.lints.clippy]
|
||||||
|
all = { level = "deny", priority = -1 }
|
||||||
|
pedantic = { level = "deny", priority = -1 }
|
||||||
|
|
||||||
|
[profile.release]
|
||||||
|
codegen-units = 1
|
||||||
|
lto = "thin"
|
||||||
|
panic = "abort"
|
||||||
|
strip = "symbols"
|
||||||
16
crates/lazaret-client/Cargo.toml
Normal file
16
crates/lazaret-client/Cargo.toml
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
[package]
|
||||||
|
name = "lazaret-client"
|
||||||
|
version.workspace = true
|
||||||
|
edition.workspace = true
|
||||||
|
rust-version.workspace = true
|
||||||
|
license.workspace = true
|
||||||
|
|
||||||
|
[[bin]]
|
||||||
|
name = "lazaret"
|
||||||
|
path = "src/main.rs"
|
||||||
|
|
||||||
|
[dependencies]
|
||||||
|
lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
|
||||||
|
|
||||||
|
[lints]
|
||||||
|
workspace = true
|
||||||
3
crates/lazaret-client/src/main.rs
Normal file
3
crates/lazaret-client/src/main.rs
Normal file
|
|
@ -0,0 +1,3 @@
|
||||||
|
fn main() {
|
||||||
|
let _ = lazaret_core::PROTOCOL_NAME;
|
||||||
|
}
|
||||||
9
crates/lazaret-core/Cargo.toml
Normal file
9
crates/lazaret-core/Cargo.toml
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
[package]
|
||||||
|
name = "lazaret-core"
|
||||||
|
version.workspace = true
|
||||||
|
edition.workspace = true
|
||||||
|
rust-version.workspace = true
|
||||||
|
license.workspace = true
|
||||||
|
|
||||||
|
[lints]
|
||||||
|
workspace = true
|
||||||
13
crates/lazaret-core/src/lib.rs
Normal file
13
crates/lazaret-core/src/lib.rs
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
#![doc = "Shared production interfaces for Lazaret processes."]
|
||||||
|
|
||||||
|
pub const PROTOCOL_NAME: &str = "lazaret";
|
||||||
|
|
||||||
|
#[cfg(test)]
|
||||||
|
mod tests {
|
||||||
|
use super::PROTOCOL_NAME;
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn protocol_name_is_stable() {
|
||||||
|
assert_eq!(PROTOCOL_NAME, "lazaret");
|
||||||
|
}
|
||||||
|
}
|
||||||
16
crates/lazaret-escalation-client/Cargo.toml
Normal file
16
crates/lazaret-escalation-client/Cargo.toml
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
[package]
|
||||||
|
name = "lazaret-escalation-client"
|
||||||
|
version.workspace = true
|
||||||
|
edition.workspace = true
|
||||||
|
rust-version.workspace = true
|
||||||
|
license.workspace = true
|
||||||
|
|
||||||
|
[[bin]]
|
||||||
|
name = "lazaret-escalation-client"
|
||||||
|
path = "src/main.rs"
|
||||||
|
|
||||||
|
[dependencies]
|
||||||
|
lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
|
||||||
|
|
||||||
|
[lints]
|
||||||
|
workspace = true
|
||||||
3
crates/lazaret-escalation-client/src/main.rs
Normal file
3
crates/lazaret-escalation-client/src/main.rs
Normal file
|
|
@ -0,0 +1,3 @@
|
||||||
|
fn main() {
|
||||||
|
let _ = lazaret_core::PROTOCOL_NAME;
|
||||||
|
}
|
||||||
16
crates/lazaret-host-coordinator/Cargo.toml
Normal file
16
crates/lazaret-host-coordinator/Cargo.toml
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
[package]
|
||||||
|
name = "lazaret-host-coordinator"
|
||||||
|
version.workspace = true
|
||||||
|
edition.workspace = true
|
||||||
|
rust-version.workspace = true
|
||||||
|
license.workspace = true
|
||||||
|
|
||||||
|
[[bin]]
|
||||||
|
name = "lazaret-host-coordinator"
|
||||||
|
path = "src/main.rs"
|
||||||
|
|
||||||
|
[dependencies]
|
||||||
|
lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
|
||||||
|
|
||||||
|
[lints]
|
||||||
|
workspace = true
|
||||||
3
crates/lazaret-host-coordinator/src/main.rs
Normal file
3
crates/lazaret-host-coordinator/src/main.rs
Normal file
|
|
@ -0,0 +1,3 @@
|
||||||
|
fn main() {
|
||||||
|
let _ = lazaret_core::PROTOCOL_NAME;
|
||||||
|
}
|
||||||
16
crates/lazaret-network-sidecar/Cargo.toml
Normal file
16
crates/lazaret-network-sidecar/Cargo.toml
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
[package]
|
||||||
|
name = "lazaret-network-sidecar"
|
||||||
|
version.workspace = true
|
||||||
|
edition.workspace = true
|
||||||
|
rust-version.workspace = true
|
||||||
|
license.workspace = true
|
||||||
|
|
||||||
|
[[bin]]
|
||||||
|
name = "lazaret-network-sidecar"
|
||||||
|
path = "src/main.rs"
|
||||||
|
|
||||||
|
[dependencies]
|
||||||
|
lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
|
||||||
|
|
||||||
|
[lints]
|
||||||
|
workspace = true
|
||||||
3
crates/lazaret-network-sidecar/src/main.rs
Normal file
3
crates/lazaret-network-sidecar/src/main.rs
Normal file
|
|
@ -0,0 +1,3 @@
|
||||||
|
fn main() {
|
||||||
|
let _ = lazaret_core::PROTOCOL_NAME;
|
||||||
|
}
|
||||||
16
crates/lazaret-runtime-supervisor/Cargo.toml
Normal file
16
crates/lazaret-runtime-supervisor/Cargo.toml
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
[package]
|
||||||
|
name = "lazaret-runtime-supervisor"
|
||||||
|
version.workspace = true
|
||||||
|
edition.workspace = true
|
||||||
|
rust-version.workspace = true
|
||||||
|
license.workspace = true
|
||||||
|
|
||||||
|
[[bin]]
|
||||||
|
name = "lazaret-runtime-supervisor"
|
||||||
|
path = "src/main.rs"
|
||||||
|
|
||||||
|
[dependencies]
|
||||||
|
lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
|
||||||
|
|
||||||
|
[lints]
|
||||||
|
workspace = true
|
||||||
3
crates/lazaret-runtime-supervisor/src/main.rs
Normal file
3
crates/lazaret-runtime-supervisor/src/main.rs
Normal file
|
|
@ -0,0 +1,3 @@
|
||||||
|
fn main() {
|
||||||
|
let _ = lazaret_core::PROTOCOL_NAME;
|
||||||
|
}
|
||||||
24
deny.toml
Normal file
24
deny.toml
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
[advisories]
|
||||||
|
yanked = "deny"
|
||||||
|
|
||||||
|
[bans]
|
||||||
|
multiple-versions = "deny"
|
||||||
|
wildcards = "deny"
|
||||||
|
|
||||||
|
[licenses]
|
||||||
|
allow = [
|
||||||
|
"Apache-2.0",
|
||||||
|
"BSD-2-Clause",
|
||||||
|
"BSD-3-Clause",
|
||||||
|
"ISC",
|
||||||
|
"MIT",
|
||||||
|
"Unicode-3.0",
|
||||||
|
"Zlib",
|
||||||
|
]
|
||||||
|
confidence-threshold = 0.93
|
||||||
|
unused-allowed-license = "allow"
|
||||||
|
|
||||||
|
[sources]
|
||||||
|
unknown-git = "deny"
|
||||||
|
unknown-registry = "deny"
|
||||||
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
||||||
11
docs/development.md
Normal file
11
docs/development.md
Normal file
|
|
@ -0,0 +1,11 @@
|
||||||
|
# Development and verification
|
||||||
|
|
||||||
|
The Cargo workspace separates shared production logic from process entry points. `lazaret-core` is the initial library boundary. The `lazaret` Client, `lazaret-host-coordinator`, `lazaret-runtime-supervisor`, `lazaret-network-sidecar`, and `lazaret-escalation-client` executables are thin binary packages; process behavior belongs in libraries so it can be verified without invoking private binary internals.
|
||||||
|
|
||||||
|
`support/work-packages.toml` is the dependency authority. `support/model-refinements.toml` assigns every modeled action and configured property to production packages and verification levels. `support/external-tools.toml` fixes the baseline host and tool contracts, including whether an unavailable capability fails or skips a level. `docs/implementation-dependencies.md` is generated from the package registry.
|
||||||
|
|
||||||
|
Run `tools/verify-v1`, `tools/verify-v2`, `tools/verify-v3`, `tools/verify-v4`, or `tools/verify-v5`. Each higher level includes the lower levels. V1 is host-local and includes format, Clippy, tests, dependency policy, registry drift, and both TLC models. Physical suites register commands in `support/integration-tests.toml`; an empty level is an explicit skip. A registered scenario may skip only when every missing capability has `policy = "skip"` in the external-tool manifest.
|
||||||
|
|
||||||
|
Normal verification is offline: Cargo receives `--offline` and cargo-deny receives `--frozen`. `tools/dev refresh-advisories` is the explicit online operation that updates the local RustSec database and then verifies advisories offline. The zero-third-party baseline still runs cargo-deny bans, license, and source checks on every verification.
|
||||||
|
|
||||||
|
Run `tools/dev generate` after changing the work-package registry. `tools/dev generate --check` fails when the committed dependency view differs.
|
||||||
159
docs/implementation-dependencies.md
Normal file
159
docs/implementation-dependencies.md
Normal file
|
|
@ -0,0 +1,159 @@
|
||||||
|
# Implementation dependencies
|
||||||
|
|
||||||
|
Generated from `support/work-packages.toml`; do not edit this file directly.
|
||||||
|
|
||||||
|
| Package | Deliverable | Depends on | Verification |
|
||||||
|
| --- | --- | --- | --- |
|
||||||
|
| `IP-00` | Repository scaffold and verification | — | V1, V2, V3, V4, V5 |
|
||||||
|
| `IP-01` | Typed schema and protocol records | `IP-00` | V1 |
|
||||||
|
| `IP-02` | Trusted-host configuration | `IP-00`, `IP-01` | V1, V2 |
|
||||||
|
| `IP-03` | Linux primitives | `IP-00`, `IP-01` | V1, V2 |
|
||||||
|
| `IP-04` | Ignored-workspace contract | `IP-00` | V1, V2, V5 |
|
||||||
|
| `IP-10` | Domain Store | `IP-01`, `IP-02`, `IP-03` | V1, V2, V4 |
|
||||||
|
| `IP-11` | Storage Catalog | `IP-01`, `IP-02`, `IP-03` | V1, V2, V4 |
|
||||||
|
| `IP-12` | OCI transport and layer preparer | `IP-02`, `IP-03`, `IP-11` | V1, V2, V4 |
|
||||||
|
| `IP-13` | State Anchor | `IP-02`, `IP-03`, `IP-10`, `IP-11`, `IP-12` | V1, V2, V4 |
|
||||||
|
| `IP-14` | Derived network policy | `IP-01`, `IP-02` | V1 |
|
||||||
|
| `IP-15` | Protocol cryptography and codecs | `IP-01`, `IP-02`, `IP-03` | V1, V2 |
|
||||||
|
| `IP-16` | OCI specification and runsc command builder | `IP-01`, `IP-02`, `IP-03` | V1 |
|
||||||
|
| `IP-20` | Ignored-workspace router and Git Sentry | `IP-02`, `IP-03`, `IP-04`, `IP-10` | V1, V2, V4, V5 |
|
||||||
|
| `IP-21` | Runtime Supervisor and runsc ownership | `IP-03`, `IP-13`, `IP-16` | V2, V3, V4 |
|
||||||
|
| `IP-22` | Network installation and connectivity helper | `IP-03`, `IP-10`, `IP-14`, `IP-21` | V2, V3, V4 |
|
||||||
|
| `IP-23` | Host-private control face | `IP-02`, `IP-10`, `IP-15` | V1, V2 |
|
||||||
|
| `IP-24` | Escalation mailbox and execution | `IP-03`, `IP-10`, `IP-15`, `IP-23` | V1, V2, V3, V4 |
|
||||||
|
| `IP-30` | Core Host Coordinator lifecycle | `IP-10`, `IP-11`, `IP-12`, `IP-13`, `IP-14`, `IP-15`, `IP-16`, `IP-21`, `IP-22`, `IP-23` | V1, V2, V3 |
|
||||||
|
| `IP-31` | Non-interactive Client CLI | `IP-02`, `IP-16`, `IP-23`, `IP-30` | V1, V3 |
|
||||||
|
| `IP-40` | Minimal non-interactive runtime slice | `IP-30`, `IP-31` | V3 |
|
||||||
|
| `IP-32` | Recovery and prepared-artifact GC | `IP-30`, `IP-40` | V1, V2, V4 |
|
||||||
|
| `IP-33` | Session Terminal engine | `IP-10`, `IP-21`, `IP-23`, `IP-30`, `IP-40` | V1, V2, V4 |
|
||||||
|
| `IP-34` | Interactive Client CLI | `IP-31`, `IP-33` | V1, V3 |
|
||||||
|
| `IP-35` | State inspection and reset | `IP-10`, `IP-13`, `IP-20`, `IP-32` | V1, V2, V4 |
|
||||||
|
| `IP-41` | Workspace, Git, and persistence slice | `IP-20`, `IP-32`, `IP-40` | V3, V5 |
|
||||||
|
| `IP-42` | Interactive and multi-session slice | `IP-33`, `IP-34`, `IP-40` | V3 |
|
||||||
|
| `IP-43` | Host-escalation slice | `IP-24`, `IP-34`, `IP-42` | V3 |
|
||||||
|
| `IP-44` | Durability and hostile-failure gate | `IP-32`, `IP-35`, `IP-40`, `IP-41`, `IP-42`, `IP-43` | V4 |
|
||||||
|
| `IP-45` | Release qualification | `IP-44` | V5 |
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
graph TD
|
||||||
|
IP_00["IP-00 Repository scaffold and verification"]
|
||||||
|
IP_01["IP-01 Typed schema and protocol records"]
|
||||||
|
IP_02["IP-02 Trusted-host configuration"]
|
||||||
|
IP_03["IP-03 Linux primitives"]
|
||||||
|
IP_04["IP-04 Ignored-workspace contract"]
|
||||||
|
IP_10["IP-10 Domain Store"]
|
||||||
|
IP_11["IP-11 Storage Catalog"]
|
||||||
|
IP_12["IP-12 OCI transport and layer preparer"]
|
||||||
|
IP_13["IP-13 State Anchor"]
|
||||||
|
IP_14["IP-14 Derived network policy"]
|
||||||
|
IP_15["IP-15 Protocol cryptography and codecs"]
|
||||||
|
IP_16["IP-16 OCI specification and runsc command builder"]
|
||||||
|
IP_20["IP-20 Ignored-workspace router and Git Sentry"]
|
||||||
|
IP_21["IP-21 Runtime Supervisor and runsc ownership"]
|
||||||
|
IP_22["IP-22 Network installation and connectivity helper"]
|
||||||
|
IP_23["IP-23 Host-private control face"]
|
||||||
|
IP_24["IP-24 Escalation mailbox and execution"]
|
||||||
|
IP_30["IP-30 Core Host Coordinator lifecycle"]
|
||||||
|
IP_31["IP-31 Non-interactive Client CLI"]
|
||||||
|
IP_40["IP-40 Minimal non-interactive runtime slice"]
|
||||||
|
IP_32["IP-32 Recovery and prepared-artifact GC"]
|
||||||
|
IP_33["IP-33 Session Terminal engine"]
|
||||||
|
IP_34["IP-34 Interactive Client CLI"]
|
||||||
|
IP_35["IP-35 State inspection and reset"]
|
||||||
|
IP_41["IP-41 Workspace, Git, and persistence slice"]
|
||||||
|
IP_42["IP-42 Interactive and multi-session slice"]
|
||||||
|
IP_43["IP-43 Host-escalation slice"]
|
||||||
|
IP_44["IP-44 Durability and hostile-failure gate"]
|
||||||
|
IP_45["IP-45 Release qualification"]
|
||||||
|
IP_00 --> IP_01
|
||||||
|
IP_00 --> IP_02
|
||||||
|
IP_01 --> IP_02
|
||||||
|
IP_00 --> IP_03
|
||||||
|
IP_01 --> IP_03
|
||||||
|
IP_00 --> IP_04
|
||||||
|
IP_01 --> IP_10
|
||||||
|
IP_02 --> IP_10
|
||||||
|
IP_03 --> IP_10
|
||||||
|
IP_01 --> IP_11
|
||||||
|
IP_02 --> IP_11
|
||||||
|
IP_03 --> IP_11
|
||||||
|
IP_02 --> IP_12
|
||||||
|
IP_03 --> IP_12
|
||||||
|
IP_11 --> IP_12
|
||||||
|
IP_02 --> IP_13
|
||||||
|
IP_03 --> IP_13
|
||||||
|
IP_10 --> IP_13
|
||||||
|
IP_11 --> IP_13
|
||||||
|
IP_12 --> IP_13
|
||||||
|
IP_01 --> IP_14
|
||||||
|
IP_02 --> IP_14
|
||||||
|
IP_01 --> IP_15
|
||||||
|
IP_02 --> IP_15
|
||||||
|
IP_03 --> IP_15
|
||||||
|
IP_01 --> IP_16
|
||||||
|
IP_02 --> IP_16
|
||||||
|
IP_03 --> IP_16
|
||||||
|
IP_02 --> IP_20
|
||||||
|
IP_03 --> IP_20
|
||||||
|
IP_04 --> IP_20
|
||||||
|
IP_10 --> IP_20
|
||||||
|
IP_03 --> IP_21
|
||||||
|
IP_13 --> IP_21
|
||||||
|
IP_16 --> IP_21
|
||||||
|
IP_03 --> IP_22
|
||||||
|
IP_10 --> IP_22
|
||||||
|
IP_14 --> IP_22
|
||||||
|
IP_21 --> IP_22
|
||||||
|
IP_02 --> IP_23
|
||||||
|
IP_10 --> IP_23
|
||||||
|
IP_15 --> IP_23
|
||||||
|
IP_03 --> IP_24
|
||||||
|
IP_10 --> IP_24
|
||||||
|
IP_15 --> IP_24
|
||||||
|
IP_23 --> IP_24
|
||||||
|
IP_10 --> IP_30
|
||||||
|
IP_11 --> IP_30
|
||||||
|
IP_12 --> IP_30
|
||||||
|
IP_13 --> IP_30
|
||||||
|
IP_14 --> IP_30
|
||||||
|
IP_15 --> IP_30
|
||||||
|
IP_16 --> IP_30
|
||||||
|
IP_21 --> IP_30
|
||||||
|
IP_22 --> IP_30
|
||||||
|
IP_23 --> IP_30
|
||||||
|
IP_02 --> IP_31
|
||||||
|
IP_16 --> IP_31
|
||||||
|
IP_23 --> IP_31
|
||||||
|
IP_30 --> IP_31
|
||||||
|
IP_30 --> IP_40
|
||||||
|
IP_31 --> IP_40
|
||||||
|
IP_30 --> IP_32
|
||||||
|
IP_40 --> IP_32
|
||||||
|
IP_10 --> IP_33
|
||||||
|
IP_21 --> IP_33
|
||||||
|
IP_23 --> IP_33
|
||||||
|
IP_30 --> IP_33
|
||||||
|
IP_40 --> IP_33
|
||||||
|
IP_31 --> IP_34
|
||||||
|
IP_33 --> IP_34
|
||||||
|
IP_10 --> IP_35
|
||||||
|
IP_13 --> IP_35
|
||||||
|
IP_20 --> IP_35
|
||||||
|
IP_32 --> IP_35
|
||||||
|
IP_20 --> IP_41
|
||||||
|
IP_32 --> IP_41
|
||||||
|
IP_40 --> IP_41
|
||||||
|
IP_33 --> IP_42
|
||||||
|
IP_34 --> IP_42
|
||||||
|
IP_40 --> IP_42
|
||||||
|
IP_24 --> IP_43
|
||||||
|
IP_34 --> IP_43
|
||||||
|
IP_42 --> IP_43
|
||||||
|
IP_32 --> IP_44
|
||||||
|
IP_35 --> IP_44
|
||||||
|
IP_40 --> IP_44
|
||||||
|
IP_41 --> IP_44
|
||||||
|
IP_42 --> IP_44
|
||||||
|
IP_43 --> IP_44
|
||||||
|
IP_44 --> IP_45
|
||||||
|
```
|
||||||
4
rust-toolchain.toml
Normal file
4
rust-toolchain.toml
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
[toolchain]
|
||||||
|
channel = "1.90.0"
|
||||||
|
components = ["clippy", "rustfmt"]
|
||||||
|
profile = "minimal"
|
||||||
128
support/external-tools.toml
Normal file
128
support/external-tools.toml
Normal file
|
|
@ -0,0 +1,128 @@
|
||||||
|
schema = 1
|
||||||
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||||
|
|
||||||
|
[[command]]
|
||||||
|
id = "python"
|
||||||
|
program = "python3"
|
||||||
|
args = ["--version"]
|
||||||
|
version_pattern = '^Python 3\.(1[1-9]|[2-9][0-9])\.'
|
||||||
|
policy = "fail"
|
||||||
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||||
|
diagnostic = "Python 3.11 or newer is required for repository verification."
|
||||||
|
|
||||||
|
[[command]]
|
||||||
|
id = "rustc"
|
||||||
|
program = "rustc"
|
||||||
|
args = ["--version"]
|
||||||
|
version_pattern = '^rustc 1\.90\.0 '
|
||||||
|
policy = "fail"
|
||||||
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||||
|
diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."
|
||||||
|
|
||||||
|
[[command]]
|
||||||
|
id = "cargo"
|
||||||
|
program = "cargo"
|
||||||
|
args = ["--version"]
|
||||||
|
version_pattern = '^cargo 1\.90\.0 '
|
||||||
|
policy = "fail"
|
||||||
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||||
|
diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."
|
||||||
|
|
||||||
|
[[command]]
|
||||||
|
id = "cargo-deny"
|
||||||
|
program = "cargo-deny"
|
||||||
|
args = ["--version"]
|
||||||
|
version_pattern = '^cargo-deny 0\.20\.2$'
|
||||||
|
policy = "fail"
|
||||||
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||||
|
diagnostic = "Install cargo-deny 0.20.2 with its locked dependency graph."
|
||||||
|
|
||||||
|
[[command]]
|
||||||
|
id = "git"
|
||||||
|
program = "git"
|
||||||
|
args = ["--version"]
|
||||||
|
version_pattern = '^git version 2\.'
|
||||||
|
policy = "fail"
|
||||||
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||||
|
diagnostic = "Git 2.x is required for generated-file drift checks."
|
||||||
|
|
||||||
|
[[command]]
|
||||||
|
id = "tlc"
|
||||||
|
program = "tlc"
|
||||||
|
args = ["-h"]
|
||||||
|
version_pattern = 'Version 2\.19 '
|
||||||
|
accepted_exit_codes = [0, 1]
|
||||||
|
policy = "fail"
|
||||||
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||||
|
diagnostic = "Install the TLC 2.19 launcher on PATH."
|
||||||
|
|
||||||
|
[[command]]
|
||||||
|
id = "runsc"
|
||||||
|
program = "runsc"
|
||||||
|
args = ["--version"]
|
||||||
|
version_pattern = '^runsc version release-20260622\.0\nspec: 1\.2\.1$'
|
||||||
|
policy = "skip"
|
||||||
|
levels = ["V3", "V4", "V5"]
|
||||||
|
diagnostic = "The selected composition is qualified on runsc release-20260622.0."
|
||||||
|
|
||||||
|
[[command]]
|
||||||
|
id = "fuse-overlayfs"
|
||||||
|
program = "fuse-overlayfs"
|
||||||
|
args = ["--version"]
|
||||||
|
version_pattern = '^fusermount3 version: 3\.18\.2\nfuse-overlayfs: version 1\.16\nFUSE library version 3\.18\.2\nusing FUSE kernel interface version 7\.45$'
|
||||||
|
policy = "skip"
|
||||||
|
levels = ["V2", "V3", "V4", "V5"]
|
||||||
|
diagnostic = "Install the qualified fuse-overlayfs 1.16 and FUSE 3.18.2 stack."
|
||||||
|
|
||||||
|
[[command]]
|
||||||
|
id = "slirp4netns"
|
||||||
|
program = "slirp4netns"
|
||||||
|
args = ["--version"]
|
||||||
|
version_pattern = '^slirp4netns version 1\.3\.1\ncommit: .+\nlibslirp: 4\.9\.1\nSLIRP_CONFIG_VERSION_MAX: 6\nlibseccomp: 2\.6\.0$'
|
||||||
|
policy = "skip"
|
||||||
|
levels = ["V2", "V3", "V4", "V5"]
|
||||||
|
diagnostic = "Install the qualified slirp4netns 1.3.1 and libslirp 4.9.1 stack."
|
||||||
|
|
||||||
|
[[feature]]
|
||||||
|
id = "linux-x86_64"
|
||||||
|
probe = "linux-x86_64"
|
||||||
|
policy = "skip"
|
||||||
|
levels = ["V2", "V3", "V4", "V5"]
|
||||||
|
diagnostic = "Physical and composition suites currently support Linux x86_64."
|
||||||
|
|
||||||
|
[[feature]]
|
||||||
|
id = "kernel"
|
||||||
|
probe = "kernel-at-least"
|
||||||
|
minimum = "6.8"
|
||||||
|
policy = "skip"
|
||||||
|
levels = ["V2", "V3", "V4", "V5"]
|
||||||
|
diagnostic = "Linux 6.8 or newer supplies the qualified namespace and pidfd baseline."
|
||||||
|
|
||||||
|
[[feature]]
|
||||||
|
id = "user-namespaces"
|
||||||
|
probe = "user-namespace"
|
||||||
|
program = "unshare"
|
||||||
|
sysctl_path = "/proc/sys/user/max_user_namespaces"
|
||||||
|
policy = "skip"
|
||||||
|
levels = ["V2", "V3", "V4", "V5"]
|
||||||
|
diagnostic = "Enable functional unprivileged user namespace creation for physical runtime tests."
|
||||||
|
|
||||||
|
[[feature]]
|
||||||
|
id = "subordinate-ids"
|
||||||
|
probe = "subordinate-ids"
|
||||||
|
minimum_count = 65536
|
||||||
|
uidmap_program = "newuidmap"
|
||||||
|
gidmap_program = "newgidmap"
|
||||||
|
unshare_program = "unshare"
|
||||||
|
policy = "skip"
|
||||||
|
levels = ["V2", "V3", "V4", "V5"]
|
||||||
|
diagnostic = "Configure usable 65,536-ID subordinate UID/GID ranges and mapping helpers for the current user."
|
||||||
|
|
||||||
|
[[feature]]
|
||||||
|
id = "fuse-device"
|
||||||
|
probe = "open-character-device"
|
||||||
|
path = "/dev/fuse"
|
||||||
|
access = "read-write"
|
||||||
|
policy = "skip"
|
||||||
|
levels = ["V2", "V3", "V4", "V5"]
|
||||||
|
diagnostic = "Expose an openable read-write /dev/fuse device to run physical filesystem suites."
|
||||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue