@git.zone/tsrust 1.9.1 → 1.10.0

package/ts/mod_artifact/classes.artifactassembler.ts

@@ -7,14 +7,19 @@ import {
   captureGitSnapshot,
   getHostIdentity,
   isLocalProcessRunning,
+  MAX_PROVENANCE_SIDECAR_BYTES,
   PROVENANCE_SIDECAR_SUFFIX,
   ProvenanceStore,
 } from '../mod_provenance/index.js';
 
-const TRANSACTION_FORMAT = 'tsrust.artifact-assembly.v1';
+const LEGACY_TRANSACTION_FORMAT = 'tsrust.artifact-assembly.v1';
+const TRANSACTION_FORMAT = 'tsrust.artifact-assembly.v2';
 const LOCK_FORMAT = 'tsrust.artifact-assembly-lock.v1';
 const RECOVERY_CLAIM_FORMAT = 'tsrust.artifact-assembly-recovery.v1';
+const MANIFEST_FORMAT = 'tsrust.artifact-assembly-manifest.v1';
 const TRANSACTION_DIRECTORY = 'tsrust-assembly';
+export const MAX_ARTIFACT_BYTES = 2 * 1024 * 1024 * 1024;
+export const MAX_ASSEMBLY_INPUT_BYTES = 8 * 1024 * 1024 * 1024;
 const activeOwnerTokens = new Set<string>();
 const processOwnerTokens = new Set<string>();
 
@@ -69,13 +74,26 @@ interface IAssemblyPaths {
   recoveryClaimPath: string;
   statePath: string;
   stateTemporaryPath: string;
+  manifestPath: string;
+  manifestTemporaryPath: string;
   stagingDirectory: string;
   backupDirectory: string;
   failedDirectory: string;
 }
 
+interface IAssemblyManifestEntry {
+  name: string;
+  binarySha256: string;
+  sidecarSha256: string;
+}
+
+interface IAssemblyManifest {
+  format: typeof MANIFEST_FORMAT;
+  artifacts: IAssemblyManifestEntry[];
+}
+
 interface IAssemblyTransactionState {
-  format: typeof TRANSACTION_FORMAT;
+  format: typeof TRANSACTION_FORMAT | typeof LEGACY_TRANSACTION_FORMAT;
   pid: number;
   hostname: string;
   hostIdentity: string;
@@ -148,7 +166,7 @@ function isTransactionState(valueArg: unknown): valueArg is IAssemblyTransaction
   if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg)) return false;
   const value = valueArg as Record<string, unknown>;
   return (
-    value.format === TRANSACTION_FORMAT &&
+    (value.format === TRANSACTION_FORMAT || value.format === LEGACY_TRANSACTION_FORMAT) &&
     typeof value.pid === 'number' &&
     typeof value.hostname === 'string' &&
     typeof value.hostIdentity === 'string' &&
@@ -202,6 +220,28 @@ function isRecoveryClaim(valueArg: unknown): valueArg is IAssemblyRecoveryClaim
   );
 }
 
+function isAssemblyManifest(valueArg: unknown): valueArg is IAssemblyManifest {
+  if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg)) return false;
+  const value = valueArg as Record<string, unknown>;
+  return (
+    value.format === MANIFEST_FORMAT &&
+    Array.isArray(value.artifacts) &&
+    value.artifacts.length > 0 &&
+    value.artifacts.every((entry) => {
+      if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return false;
+      const candidate = entry as Record<string, unknown>;
+      return (
+        typeof candidate.name === 'string' &&
+        /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(candidate.name) &&
+        typeof candidate.binarySha256 === 'string' &&
+        /^[a-f0-9]{64}$/.test(candidate.binarySha256) &&
+        typeof candidate.sidecarSha256 === 'string' &&
+        /^[a-f0-9]{64}$/.test(candidate.sidecarSha256)
+      );
+    })
+  );
+}
+
 export class ArtifactAssembler {
   private options: IArtifactAssemblerOptions;
 
@@ -253,6 +293,10 @@ export class ArtifactAssembler {
 
       const candidates = await this.collectCandidates(sourceDirectories);
       await fs.promises.mkdir(paths.stagingDirectory, { mode: 0o700 });
+      const manifest: IAssemblyManifest = {
+        format: MANIFEST_FORMAT,
+        artifacts: [],
+      };
       for (const candidate of candidates) {
         const destinationBinary = path.join(
           paths.stagingDirectory,
@@ -275,12 +319,20 @@ export class ArtifactAssembler {
         if (JSON.stringify(copiedBuildInfo) !== JSON.stringify(candidate.buildInfo)) {
           throw new Error(`Artifact provenance changed while copying ${candidate.binaryPath}`);
         }
+        manifest.artifacts.push({
+          name: candidate.destinationName,
+          binarySha256: await ProvenanceStore.sha256(destinationBinary),
+          sidecarSha256: await ProvenanceStore.sha256(destinationSidecar),
+        });
       }
+      await this.writeManifest(paths, manifest);
+      await this.validatePublicationDirectory(paths.stagingDirectory, manifest);
       await fs.promises.chmod(paths.stagingDirectory, 0o755);
       await syncDirectory(paths.stagingDirectory);
       state = { ...state, phase: 'prepared' };
       await this.writeState(paths, state);
       await this.assertAssemblySourceUnchanged(paths.workspace);
+      await this.validatePublicationDirectory(paths.stagingDirectory, await this.readManifest(paths));
 
       if (state.hadExistingOutput) {
         state = { ...state, phase: 'movingOld' };
@@ -382,6 +434,8 @@ export class ArtifactAssembler {
       recoveryClaimPath: path.join(transactionParent, 'tsrust-assembly.recovery.lock'),
       statePath: path.join(transactionDirectory, 'state.json'),
       stateTemporaryPath: path.join(transactionDirectory, 'state.json.tmp'),
+      manifestPath: path.join(transactionDirectory, 'manifest.json'),
+      manifestTemporaryPath: path.join(transactionDirectory, 'manifest.json.tmp'),
       stagingDirectory: path.join(transactionDirectory, 'staging'),
       backupDirectory: path.join(transactionDirectory, 'backup'),
       failedDirectory: path.join(transactionDirectory, 'failed'),
@@ -737,7 +791,7 @@ export class ArtifactAssembler {
       if (!transaction.isDirectory() || transaction.isSymbolicLink()) {
         throw new Error(`Assembly transaction path is not a regular directory: ${pathsArg.transactionDirectory}`);
       }
-      const state = await this.readState(pathsArg);
+      let state = await this.readState(pathsArg);
       if (!state) {
         await fs.promises.rm(pathsArg.transactionDirectory, { recursive: true });
         await this.releaseLock(pathsArg, owner.ownerToken);
@@ -757,6 +811,9 @@ export class ArtifactAssembler {
         state.phase === 'published' ||
         state.phase === 'committed'
       ) {
+        if (state.format === LEGACY_TRANSACTION_FORMAT) {
+          state = await this.migrateLegacyCommittedTransaction(pathsArg, state);
+        }
         const cleanupPending = await this.completeCommittedTransaction(pathsArg, state);
         if (cleanupPending) {
           throw new Error(`Unable to clean committed assembly state: ${pathsArg.transactionDirectory}`);
@@ -825,12 +882,95 @@ export class ArtifactAssembler {
     await syncDirectory(pathsArg.transactionDirectory);
   }
 
+  private async writeManifest(
+    pathsArg: IAssemblyPaths,
+    manifestArg: IAssemblyManifest,
+  ): Promise<void> {
+    const temporary = await fs.promises.open(pathsArg.manifestTemporaryPath, 'wx', 0o600);
+    try {
+      await temporary.writeFile(`${JSON.stringify(manifestArg, null, 2)}\n`, 'utf8');
+      await temporary.sync();
+    } finally {
+      await temporary.close();
+    }
+    await fs.promises.rename(pathsArg.manifestTemporaryPath, pathsArg.manifestPath);
+    await syncDirectory(pathsArg.transactionDirectory);
+  }
+
+  private async readManifest(pathsArg: IAssemblyPaths): Promise<IAssemblyManifest> {
+    const manifest = await fs.promises.lstat(pathsArg.manifestPath);
+    if (!manifest.isFile() || manifest.isSymbolicLink() || manifest.size > 16 * 1024 * 1024) {
+      throw new Error(`Assembly manifest is not a bounded regular file: ${pathsArg.manifestPath}`);
+    }
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(await fs.promises.readFile(pathsArg.manifestPath, 'utf8'));
+    } catch {
+      throw new Error(`Assembly manifest is invalid JSON: ${pathsArg.manifestPath}`);
+    }
+    if (!isAssemblyManifest(parsed)) {
+      throw new Error(`Assembly manifest has an invalid shape: ${pathsArg.manifestPath}`);
+    }
+    const names = parsed.artifacts.map((entry) => entry.name);
+    if (new Set(names).size !== names.length) {
+      throw new Error(`Assembly manifest contains duplicate artifacts: ${pathsArg.manifestPath}`);
+    }
+    return parsed;
+  }
+
+  private async validatePublicationDirectory(
+    directoryArg: string,
+    manifestArg: IAssemblyManifest,
+  ): Promise<void> {
+    const directory = await fs.promises.lstat(directoryArg);
+    if (!directory.isDirectory() || directory.isSymbolicLink()) {
+      throw new Error(`Assembly publication path is not a regular directory: ${directoryArg}`);
+    }
+    const expectedNames = manifestArg.artifacts
+      .flatMap((entry) => [entry.name, `${entry.name}${PROVENANCE_SIDECAR_SUFFIX}`])
+      .sort();
+    const actualNames = (await fs.promises.readdir(directoryArg)).sort();
+    if (JSON.stringify(actualNames) !== JSON.stringify(expectedNames)) {
+      throw new Error(`Assembly publication contents do not match the manifest: ${directoryArg}`);
+    }
+    let aggregateBytes = 0;
+    for (const entry of manifestArg.artifacts) {
+      const binaryPath = path.join(directoryArg, entry.name);
+      const sidecarPath = ProvenanceStore.sidecarPath(binaryPath);
+      const binary = await fs.promises.lstat(binaryPath);
+      const sidecar = await fs.promises.lstat(sidecarPath);
+      if (
+        !binary.isFile() ||
+        binary.isSymbolicLink() ||
+        (binary.mode & 0o111) === 0 ||
+        binary.size > MAX_ARTIFACT_BYTES ||
+        !sidecar.isFile() ||
+        sidecar.isSymbolicLink() ||
+        sidecar.size > MAX_PROVENANCE_SIDECAR_BYTES
+      ) {
+        throw new Error(`Assembly publication artifact is unsafe: ${binaryPath}`);
+      }
+      aggregateBytes += binary.size + sidecar.size;
+      if (aggregateBytes > MAX_ASSEMBLY_INPUT_BYTES) {
+        throw new Error('Assembly publication exceeds the aggregate size limit');
+      }
+      if (
+        (await ProvenanceStore.sha256(binaryPath)) !== entry.binarySha256 ||
+        (await ProvenanceStore.sha256(sidecarPath)) !== entry.sidecarSha256
+      ) {
+        throw new Error(`Assembly publication artifact changed: ${binaryPath}`);
+      }
+      await ProvenanceStore.readSidecar(binaryPath);
+    }
+  }
+
   private async assertAssemblySourceUnchanged(workspaceArg: string): Promise<void> {
     const snapshot = await captureGitSnapshot(workspaceArg);
     if (
       !snapshot.available ||
       snapshot.commit !== this.options.expectedGitCommit ||
-      snapshot.status.length > 0
+      snapshot.status.length > 0 ||
+      (snapshot.unsafeIndexFlags?.length || 0) > 0
     ) {
       throw new Error('Git source state changed before artifact publication');
     }
@@ -885,16 +1025,62 @@ export class ArtifactAssembler {
     await this.releaseLock(pathsArg, stateArg.ownerToken);
   }
 
+  private async migrateLegacyCommittedTransaction(
+    pathsArg: IAssemblyPaths,
+    stateArg: IAssemblyTransactionState,
+  ): Promise<IAssemblyTransactionState> {
+    let manifest: IAssemblyManifest;
+    if (await lstatOptional(pathsArg.manifestPath)) {
+      manifest = await this.readManifest(pathsArg);
+    } else {
+      const output = await lstatOptional(pathsArg.outputDirectory);
+      const staging = await lstatOptional(pathsArg.stagingDirectory);
+      const publicationDirectory = output
+        ? pathsArg.outputDirectory
+        : staging
+          ? pathsArg.stagingDirectory
+          : undefined;
+      if (!publicationDirectory) {
+        throw new Error(
+          `Legacy committed assembly has no publication directory: ${pathsArg.transactionDirectory}`,
+        );
+      }
+      const candidates = await this.collectCandidates([publicationDirectory]);
+      const artifacts: IAssemblyManifestEntry[] = [];
+      for (const candidate of candidates) {
+        artifacts.push({
+          name: candidate.destinationName,
+          binarySha256: await ProvenanceStore.sha256(candidate.binaryPath),
+          sidecarSha256: await ProvenanceStore.sha256(candidate.sidecarPath),
+        });
+      }
+      manifest = {
+        format: MANIFEST_FORMAT,
+        artifacts,
+      };
+      await fs.promises.rm(pathsArg.manifestTemporaryPath, { force: true });
+      await this.writeManifest(pathsArg, manifest);
+    }
+    const migratedState: IAssemblyTransactionState = {
+      ...stateArg,
+      format: TRANSACTION_FORMAT,
+    };
+    await this.writeState(pathsArg, migratedState);
+    return migratedState;
+  }
+
   private async completeCommittedTransaction(
     pathsArg: IAssemblyPaths,
     stateArg: IAssemblyTransactionState,
   ): Promise<boolean> {
+    const manifest = await this.readManifest(pathsArg);
     const output = await lstatOptional(pathsArg.outputDirectory);
     const staging = await lstatOptional(pathsArg.stagingDirectory);
     if (!output) {
       if (!staging || !staging.isDirectory() || staging.isSymbolicLink()) {
         throw new Error(`Committed artifact publication is incomplete: ${pathsArg.transactionDirectory}`);
       }
+      await this.validatePublicationDirectory(pathsArg.stagingDirectory, manifest);
       await fs.promises.rename(pathsArg.stagingDirectory, pathsArg.outputDirectory);
       await syncDirectory(pathsArg.workspace);
     } else {
@@ -904,6 +1090,7 @@ export class ArtifactAssembler {
       if (staging) {
         throw new Error(`Committed assembly has both staging and output directories: ${pathsArg.transactionDirectory}`);
       }
+      await this.validatePublicationDirectory(pathsArg.outputDirectory, manifest);
     }
     return this.cleanupCommittedTransaction(pathsArg, { ...stateArg, phase: 'published' });
   }
@@ -935,6 +1122,7 @@ export class ArtifactAssembler {
     );
     const expectedBinaries = new Set(this.options.expectedBinaries);
     const candidates = new Map<string, IArtifactCandidate>();
+    let aggregateInputBytes = 0;
 
     for (const sourceDirectory of sourceDirectoriesArg) {
       const source = await fs.promises.lstat(sourceDirectory);
@@ -961,6 +1149,9 @@ export class ArtifactAssembler {
         if ((binary.mode & 0o111) === 0) {
           throw new Error(`Artifact is not executable: ${entryPath}`);
         }
+        if (binary.size > MAX_ARTIFACT_BYTES) {
+          throw new Error(`Artifact exceeds the size limit: ${entryPath}`);
+        }
 
         const buildInfo = await ProvenanceStore.readSidecar(entryPath);
         assertArtifactName(buildInfo.binary, 'provenance binary name');
@@ -997,6 +1188,11 @@ export class ArtifactAssembler {
           throw new Error(`Artifact inputs contain a duplicate ${destinationName}`);
         }
         const sidecarPath = path.join(sourceDirectory, sidecarName);
+        const sidecar = await fs.promises.lstat(sidecarPath);
+        aggregateInputBytes += binary.size + sidecar.size;
+        if (aggregateInputBytes > MAX_ASSEMBLY_INPUT_BYTES) {
+          throw new Error('Artifact assembly inputs exceed the aggregate size limit');
+        }
         candidates.set(key, {
           binaryPath: entryPath,
           sidecarPath,

package/ts/mod_artifact/index.ts

@@ -1,5 +1,7 @@
 export {
   ArtifactAssembler,
+  MAX_ARTIFACT_BYTES,
+  MAX_ASSEMBLY_INPUT_BYTES,
   type IArtifactAssemblerOptions,
   type IArtifactAssemblyResult,
   type IArtifactTarget,

package/ts/mod_cargo/classes.cargorunner.ts

@@ -57,7 +57,7 @@ export class CargoRunner {
     }
 
     const profile = options.debug ? '' : ' --release';
-    const targetFlag = options.target ? ` --target ${options.target}` : '';
+    const targetFlag = options.target ? ` --target ${this.shellQuote(options.target)}` : '';
     const lockedFlag = options.locked === true ? ' --locked' : '';
     const rustflags = [...(options.rustflags || [])];
     if (options.crtStatic) {
@@ -65,7 +65,7 @@ export class CargoRunner {
     }
     const rustflagsPrefix = rustflags.length ? `RUSTFLAGS=${this.shellQuote(rustflags.join(' '))} ` : '';
     const targetDirPrefix = options.targetDir ? `CARGO_TARGET_DIR=${this.shellQuote(options.targetDir)} ` : '';
-    const command = `${this.envPrefix}cd ${this.rustDir} && ${targetDirPrefix}${rustflagsPrefix}cargo build${profile}${targetFlag}${lockedFlag}`;
+    const command = `${this.envPrefix}cd ${this.shellQuote(this.rustDir)} && ${targetDirPrefix}${rustflagsPrefix}cargo build${profile}${targetFlag}${lockedFlag}`;
 
     console.log(`Running: ${targetDirPrefix}${rustflagsPrefix}cargo build${profile}${targetFlag}${lockedFlag}`);
     const result = await this.shell.exec(command);
@@ -85,13 +85,18 @@ export class CargoRunner {
    * Ensures a rustup target is installed. If not present, installs it via `rustup target add`.
    */
   public async ensureTarget(triple: string): Promise<void> {
+    if (!triple || triple.length > 255 || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(triple)) {
+      throw new Error(`Invalid Rust target: ${JSON.stringify(triple)}`);
+    }
     const listResult = await this.shell.execSilent(`${this.envPrefix}rustup target list --installed`);
     const installedTargets = listResult.stdout.split('\n').map((l) => l.trim());
     if (installedTargets.includes(triple)) {
       return;
     }
     console.log(`Installing rustup target: ${triple}`);
-    const addResult = await this.shell.exec(`${this.envPrefix}rustup target add ${triple}`);
+    const addResult = await this.shell.exec(
+      `${this.envPrefix}rustup target add ${this.shellQuote(triple)}`,
+    );
     if (addResult.exitCode !== 0) {
       throw new Error(`Failed to install rustup target ${triple}`);
     }
@@ -99,7 +104,7 @@ export class CargoRunner {
 
   public async clean(options: { targetDir?: string } = {}): Promise<ICargoRunResult> {
     const targetDirPrefix = options.targetDir ? `CARGO_TARGET_DIR=${this.shellQuote(options.targetDir)} ` : '';
-    const command = `${this.envPrefix}cd ${this.rustDir} && ${targetDirPrefix}cargo clean`;
+    const command = `${this.envPrefix}cd ${this.shellQuote(this.rustDir)} && ${targetDirPrefix}cargo clean`;
     const result = await this.shell.exec(command);
 
     return {

package/ts/mod_cli/classes.tsrustcli.ts

@@ -22,6 +22,7 @@ import {
   type IGitSnapshot,
 } from '../mod_provenance/index.js';
 import { ToolchainManager } from '../mod_toolchain/index.js';
+import { NativeMatrixBuilder } from '../mod_matrix/index.js';
 import { commitinfo } from '../00_commitinfo_data.js';
 import {
   configuredAssemblyTargets,
@@ -52,6 +53,7 @@ export class TsRustCli {
   constructor(cwd: string = process.cwd()) {
     this.cwd = cwd;
     this.cli = new plugins.smartcli.Smartcli();
+    this.cli.addVersion(commitinfo.version);
     const smartconfigInstance = new plugins.smartconfig.Smartconfig(this.cwd);
     this.config = smartconfigInstance.dataFor<ITsrustConfig>('@git.zone/tsrust', { targets: [] });
     this.registerCommands();
@@ -62,6 +64,7 @@ export class TsRustCli {
     this.registerCleanCommand();
     this.registerPruneCommand();
     this.registerAssembleCommand();
+    this.registerMatrixCommand();
     this.registerInspectCommand();
   }
 
@@ -93,7 +96,9 @@ export class TsRustCli {
       projectName,
       projectVersion,
       gitCommit: gitSnapshotArg.commit,
-      gitDirty: gitSnapshotArg.available ? gitSnapshotArg.status.length > 0 : undefined,
+      gitDirty: gitSnapshotArg.available
+        ? gitSnapshotArg.status.length > 0 || (gitSnapshotArg.unsafeIndexFlags?.length || 0) > 0
+        : undefined,
       builtAt: new Date().toISOString(),
       tsrustVersion: commitinfo.version,
     };
@@ -464,7 +469,7 @@ export class TsRustCli {
       if (!gitSnapshot.available || gitSnapshot.commit === 'unknown') {
         throw new Error('Artifact assembly requires a Git checkout');
       }
-      if (gitSnapshot.status.length > 0) {
+      if (gitSnapshot.status.length > 0 || (gitSnapshot.unsafeIndexFlags?.length || 0) > 0) {
         throw new Error('Artifact assembly requires a clean Git worktree');
       }
       const { projectName, projectVersion } = this.readProjectIdentity();
@@ -487,6 +492,33 @@ export class TsRustCli {
     });
   }
 
+  private registerMatrixCommand(): void {
+    this.cli.addCommand('matrix').subscribe(async (argvArg) => {
+      const operation = String((argvArg as any)._?.[1] || '');
+      if (operation !== 'check' && operation !== 'build') {
+        throw new Error('Usage: tsrust matrix <check|build>');
+      }
+      const matrixBuilder = new NativeMatrixBuilder({
+        workspace: this.cwd,
+        config: this.config,
+      });
+      if (operation === 'check') {
+        const result = await matrixBuilder.check();
+        console.log(
+          `Matrix builders are ready for ${result.targets.join(', ')} on ${result.workers.join(', ')}`,
+        );
+        return;
+      }
+      if (operation === 'build') {
+        const result = await matrixBuilder.build();
+        console.log(
+          `Built and assembled ${result.assembly.artifactCount} artifacts for ${result.targets.join(', ')}`,
+        );
+        return;
+      }
+    });
+  }
+
   private registerCleanCommand(): void {
     this.cli.addCommand('clean').subscribe(async (_argvArg) => {
       // Clean cargo build

package/ts/mod_cli/helpers.targets.ts

@@ -1,3 +1,5 @@
+import type { ITsrustMatrixConfig } from '../mod_matrix/helpers.matrixconfig.js';
+
 export const targetAliasMap: Record<string, string> = {
   linux_amd64: 'x86_64-unknown-linux-gnu',
   linux_arm64: 'aarch64-unknown-linux-gnu',
@@ -29,6 +31,7 @@ export interface ITsrustConfig {
   remapLocalPaths?: boolean;
   targetDir?: string;
   pruneAfterBuild?: boolean;
+  matrix?: ITsrustMatrixConfig;
 }
 
 export interface INormalizedTarget {