fix: support native package verifier scratch

2026-10-09 18:05:04 -05:00
parent c5a6cdaf6a
commit 4be046c8d0
12 changed files with 330 additions and 13 deletions
@@ -701,7 +701,10 @@ Module Package v1, a deterministic `.tar.gz` with its SHA-256.
 - **The verifier.** Core's `verifyModulePackage` reads the archive in memory and refuses links,
  special files, and escaping paths. It checks every digest and identity, the target and runtime,
  runs the platform's own module, schema, and migration validation, and loads the backend once in a
-  short-lived process with an empty environment. Only then does it extract anything.
+  short-lived process with an empty environment. Only then does it copy the package to a requested
+  output directory. In the hardened container invocation, `/tmp` remains `noexec`; the temporary
+  candidate lives on a dedicated, bounded executable tmpfs because a native addon's code must be
+  mapped executable to load.
  - **A native package's host checks.** It is accepted only on a host whose operating system, CPU,
    C library family and version, and Node-API version Node.js itself reports as compatible.
  - **ELF files.** Every ELF file in it must be built for the target's machine.