55 lines
3.2 KiB
Markdown
55 lines
3.2 KiB
Markdown
|
# Native runtime build-input provenance
|
||
|
|
|
||
|
|
Checksum-valid historical runtime caches can be incompatible with the current
|
||
|
|
worker protocol. The Linux archive check detected this when an old worker
|
||
|
|
encoded documents but rejected the foreground `--role query` option. Source
|
||
|
|
release preparation now records and checks build-input identity before staging
|
||
|
|
or packaging a normal Windows/Linux runtime.
|
||
|
|
|
||
|
|
`runtime-libraries.json` includes `build_provenance`, schema 1, the pinned
|
||
|
|
llama.cpp commit and SHA-256 of six bounded inputs: worker.cpp, native
|
||
|
|
CMakeLists.txt, build_runtime.py and the three runtime patches. Only CRLF line
|
||
|
|
endings in these build inputs are canonicalized to LF, allowing the same
|
||
|
|
source revision to compare across checkouts. Indexed user-file bytes and their
|
||
|
|
extraction provenance are unaffected.
|
||
|
|
|
||
|
|
The builder captures provenance before CMake compilation and rejects changes
|
||
|
|
observed afterward before publishing a new inventory. Staging requires it for
|
||
|
|
normal distributions; Windows and Linux archive packagers require it as well.
|
||
|
|
Missing or stale provenance fails with an explicit normal-runtime rebuild
|
||
|
|
instruction before staged resources or an existing archive are replaced.
|
||
|
|
Internal explicit CPU tooling retains its legacy optional-inventory path.
|
||
|
|
|
||
|
|
This is a stale-cache guard, not a signature, complete upstream source audit,
|
||
|
|
proof that a binary implements its claimed protocol, or a hardware-parity test.
|
||
|
|
Real query-role and installed-layout inference checks remain necessary.
|
||
|
|
Direct Tauri commands do not replace the documented build/stage preparation.
|
||
|
|
Existing published packages and user installations do not run this source-build
|
||
|
|
check and were not altered retroactively.
|
||
|
|
|
||
|
|
## Recorded evidence, 2026-10-13
|
||
|
|
|
||
|
|
- 69 tests passed across provenance, builder, staging, Windows packaging and
|
||
|
|
Linux packaging suites; one platform-specific staging test remained skipped.
|
||
|
|
The same suites passed under optimized Python. Regressions reject a valid old
|
||
|
|
inventory without provenance, changed source and oversized inputs, while
|
||
|
|
preserving existing archives. Build-source CRLF/LF equivalence is checked.
|
||
|
|
- Actual normal Windows `auto` build and transactional staging passed.
|
||
|
|
Worker SHA-256 remains
|
||
|
|
`c01cb3ec13cfca722ee768e8350e1399a8b9a4d14a24a35adc3473a5cfc82a73`;
|
||
|
|
all 25 Windows DLL hashes also match the previously tested release exactly.
|
||
|
|
New staged inventory SHA-256:
|
||
|
|
`7fde510984b4635ce127d25ad91aab9a391300d7968ac71e4f201cc8edd052e8`.
|
||
|
|
- An actual historical extracted Windows inventory was rejected by normal
|
||
|
|
staging preflight for missing provenance. Its files were only read.
|
||
|
|
- Actual normal Linux `auto` build passed on Ubuntu 24.04 WSL. The packager
|
||
|
|
verified 21 runtime inventory/files and all six source identities against the
|
||
|
|
current repository, including checkout line-ending differences.
|
||
|
|
Worker SHA-256 remains
|
||
|
|
`b52d50a1e676bd4bf64124daff1c4ce83d86a8bde01e4eaf09838cbb24a4c28f`.
|
||
|
|
New inventory SHA-256:
|
||
|
|
`de6e06c68815b35d83c6acbde468d100413f47c74536f0d4219a9edcbeb01a86`.
|
||
|
|
|
||
|
|
These normal builds retain GPU modules plus CPU fallback; no GPU inference was
|
||
|
|
executed. macOS inventory integration, cross-compilation and actual GPU checks
|
||
|
|
remain open. Published Windows and Linux assets retain their original hashes.
|