2ed3dabe66
A PC job is published from a worktree by packaging/ota/publish-jobs.sh and never passes CI before it runs; tonight the root-socket fault came back from a job on a branch without the check. `add --kind run` now runs, on the script being published and before anything is signed: tools/ci/bash-body-check.sh for a PowerShell script (every inline bash body parses; a body it cannot read fails, never skips), `bash -n` for a .sh script, and tools/ci/prover-socket-check.sh for both (a root prover run kills sp1-gpu-server and unlinks its socket). A failure refuses the publish with the check's output; a missing check file refuses too. Kinds without a script (fetch, collect, restart, update-now, shard-benchmark, build) are untouched. tools/ci/prover-socket-check.sh is copied from proving-v1 (344cba8; master lacks it) with two additions: file arguments check those files only (the publisher's call), and an allow list for packaging/ota/test-publish-jobs.sh, which carries a known-bad root prover script on purpose. Its ci.yml step is left to proving-v1 to avoid a duplicate. packaging/ota/test-publish-jobs.sh: four refusals (a lost quote in a PowerShell bash body, an unreadable body, a .sh with a lost quote, a root prover script without the cleanup) and the envelope unchanged after a refusal. 32 passed, 0 failed on this Mac with the main checkout's signer. packaging/README-ship.md: the publish-time gate. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
24 lines
1.9 KiB
Bash
Executable file
24 lines
1.9 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# The root-socket class (5 October 2026, 20:00Z): a PC 2 job ran igneum-prove-host as root inside WSL2, which started
|
|
# an sp1-gpu-server whose socket /tmp/sp1-cuda-0.sock stayed root-owned after the job; the live prover (the app's user)
|
|
# then failed every shard with "CudaClientError: Connect(PermissionDenied)" until the socket was gone. Rule: every
|
|
# playbook that runs the prover host as root on a shared card kills the server AND unlinks its socket (at the start
|
|
# and at the end), or runs as the app's user. This check fails CI when a script runs `igneum-prove-host` under a
|
|
# `-u root` WSL session without both lines. With file arguments it checks those files only (the jobs publisher runs it
|
|
# on the script being published, packaging/ota/publish-jobs.sh add --kind run; a PC job never passes CI before it runs).
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/../.."
|
|
fail=0
|
|
# the publisher's test writes a known-bad root prover script on purpose, to prove the publish refuses it
|
|
ALLOW='^packaging/ota/test-publish-jobs\.sh$'
|
|
list_files() { if [ $# -gt 0 ]; then printf '%s\n' "$@"; else git ls-files 'tools/**' 'relay/playbooks/**' 'proving/**' 'packaging/**' | grep -E '\.(sh|ps1|mjs)$'; fi; }
|
|
while IFS= read -r f; do
|
|
[[ "$f" =~ $ALLOW ]] && continue
|
|
# a playbook that only runs `--mode id` or `--mode verify` starts no GPU server; the prove modes do
|
|
if grep -qE 'igneum-prove-host' "$f" && grep -qE -- '--mode (compressed|chain|aggregate|block|shard|all)\b' "$f" && grep -qE -- '-u root' "$f"; then
|
|
if ! grep -qE 'pkill -f sp1-gpu-server' "$f"; then echo "prover-socket: $f runs the prover host as root without killing sp1-gpu-server"; fail=1; fi
|
|
if ! grep -qE 'rm -f /tmp/sp1-cuda-' "$f"; then echo "prover-socket: $f runs the prover host as root without unlinking /tmp/sp1-cuda-*.sock"; fail=1; fi
|
|
fi
|
|
done < <(list_files "$@")
|
|
[ "$fail" = 0 ] && echo "prover-socket: every root prover playbook kills the GPU server and unlinks its socket"
|
|
exit $fail
|