Repository navigation
Pin public Brotli headers for the final-image linkage probe - #378
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The final-image Brotli probe failed to compile because hosted runners do not provide Brotli development headers. Fetch only public header declarations from the existing SHA256- and size-pinned Ubuntu source archive, validate the exact decoder header hash, and pass their explicit include directory to the compiler. No decoder code is compiled into the probe, no development/runtime package is installed, and the probe still resolves and exercises the actual final-image libraries with networking disabled.
Validation: the exact preparation fragment downloaded and verified the pinned source, extracted all five header files and matched the decoder header hash. All seven affected backport consumer contracts passed, including rejection of a missing explicit header include. The prior run 40181390500 built the image successfully but stopped before startup/security/publication; its failure remains retained. Required checks and the unchanged normal publisher still apply.