Fix native package verification on hardened noexec /tmp #88

Merged

Zayin_Admin merged 1 commits from fix/verifier-exec-scratch into main 2026-10-09 23:36:12 +00:00

Conversation 1 Commits 1 Files Changed 12

+330 -13

ekklesia-bot commented 2026-10-09 23:05:25 +00:00

Member

Copy Link

Copy Source

Summary

• add an explicit Core execution-scratch option and CLI environment configuration for runtime package probes
• keep /tmp noexec while the canonical verifier mounts a bounded, ephemeral, nodev,nosuid,exec tmpfs at /run/ekklesia-verifier
• report missing, read-only, or Linux noexec scratch as MODULE_PACKAGE_VERIFIER_SCRATCH_UNAVAILABLE instead of package load corruption
• document that backend probing executes package code and that the hardened verifier container is the isolation boundary

Regression coverage

The image check builds the existing sharp 0.35.5 / libvips 1.3.4 native proof package and exercises real mount behavior. It proves the otherwise-valid package cannot load its addon from actual noexec /tmp, verifies it through the supported exec scratch, runs a real sharp image operation from the extracted package alone, rejects missing/read-only/noexec scratch clearly, runs concurrent verification, and checks cleanup. Core tests cover pure-JS verification, success/failure cleanup, unsafe-path ordering, and CLI configuration; existing missing-dependency, Node-API, glibc, and package-alone resolution coverage remains green.

Verification

• pnpm --filter @ekklesia/core exec vitest run tests/module-package-verification.test.ts tests/verify-module-package-cli.test.ts
• pnpm --filter @ekklesia/module-pack exec vitest run tests/native-target.test.ts
• pnpm exec vitest run --config vitest.config.ts tests/ci-scripts.test.ts
• bash scripts/check-image.sh
• pnpm verify

pnpm test:package-release was not run because no published package contents changed. Migration integration was not run because no database or migration behavior changed. There is no version bump, package/manifest format change, publication, tag, or Signage change.

## Summary - add an explicit Core execution-scratch option and CLI environment configuration for runtime package probes - keep `/tmp` `noexec` while the canonical verifier mounts a bounded, ephemeral, `nodev,nosuid,exec` tmpfs at `/run/ekklesia-verifier` - report missing, read-only, or Linux `noexec` scratch as `MODULE_PACKAGE_VERIFIER_SCRATCH_UNAVAILABLE` instead of package load corruption - document that backend probing executes package code and that the hardened verifier container is the isolation boundary ## Regression coverage The image check builds the existing sharp 0.35.5 / libvips 1.3.4 native proof package and exercises real mount behavior. It proves the otherwise-valid package cannot load its addon from actual `noexec` `/tmp`, verifies it through the supported exec scratch, runs a real sharp image operation from the extracted package alone, rejects missing/read-only/noexec scratch clearly, runs concurrent verification, and checks cleanup. Core tests cover pure-JS verification, success/failure cleanup, unsafe-path ordering, and CLI configuration; existing missing-dependency, Node-API, glibc, and package-alone resolution coverage remains green. ## Verification - `pnpm --filter @ekklesia/core exec vitest run tests/module-package-verification.test.ts tests/verify-module-package-cli.test.ts` - `pnpm --filter @ekklesia/module-pack exec vitest run tests/native-target.test.ts` - `pnpm exec vitest run --config vitest.config.ts tests/ci-scripts.test.ts` - `bash scripts/check-image.sh` - `pnpm verify` `pnpm test:package-release` was not run because no published package contents changed. Migration integration was not run because no database or migration behavior changed. There is no version bump, package/manifest format change, publication, tag, or Signage change.

ekklesia-bot added 1 commit 2026-10-09 23:05:26 +00:00

fix: support native package verifier scratch 4be046c8d0

Zayin_Admin approved these changes 2026-10-09 23:36:06 +00:00

Zayin_Admin merged commit 505c9e8c0a into main 2026-10-09 23:36:12 +00:00

Zayin_Admin deleted branch fix/verifier-exec-scratch 2026-10-09 23:36:12 +00:00

ekklesia-bot referenced this pull request 2026-10-09 23:52:43 +00:00

chore(release): prepare 0.2.3 #89

Sign in to join this conversation.

Reviewers

No Reviewers

Zayin_Admin

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Joey Zayin_Admin ekklesia-bot

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Zayin/Ekklesia#88