Zayin/Ekklesia
3
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases 8 Wiki Activity

fix: support native package verifier scratch
CI / verify (pull_request) Successful in 1m10s
Details
CI / infrastructure-smoke (pull_request) Successful in 37s
Details
CI / migration-smoke (pull_request) Successful in 1m54s
Details
CI / package-release (pull_request) Successful in 36s
Details
CI / image-build (pull_request) Successful in 52s
Details
CI / deploy-smoke (same-origin) (pull_request) Successful in 51s
Details
CI / deploy-smoke (split) (pull_request) Successful in 1m31s
Details
CI / package-publication (pull_request) Successful in 51s
Details

Browse Source
This commit is contained in:
ekklesia
2026-10-09 18:05:04 -05:00
parent c5a6cdaf6a
commit 4be046c8d0
12 changed files with 330 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/module-development/README.md
+4 -1
View File
@@ -318,7 +318,10 @@ require exact agreement with Core. The legacy facade has not been removed.
`node core/dist/cli/verify-module-package.js <archive> --sha256-file <archive>.sha256`, run from an
Ekklesia installation (`/opt/ekklesia` in the image), checks a package against that platform without
installing it. Pass `--extract-to <new directory>` to receive the verified module directory.
[deploy/README.md](../../deploy/README.md#installed-modules) shows the whole installation.
[deploy/README.md](../../deploy/README.md#installed-modules) shows the supported hardened container
invocation; use it rather than inventing mount flags. Backend verification executes package code.
Its container is therefore the isolation boundary: general `/tmp` remains `noexec`, while a narrow,
bounded, ephemeral verifier scratch tmpfs permits execution so native addons can load.
The repository's boundary checks (`pnpm boundaries`) prove only source modules in a workspace. An
installed package normally has no source, so the platform cannot check it the same way. Your