fix(deps): preflight runtime dependencies - #2557
Conversation
37bdd24 to
796dd4d
Compare
796dd4d to
b437ae7
Compare
kongche-jbw
changed the title
95e98b9 to
05f48a5
Compare
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 05f48a5ee2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # source build requires the same Node version as copilot-shell. | ||
| echo 'sec-core|node|language-runtime|node --version|nodejs|nodejs||>=20|' | ||
| else | ||
| echo "$record" |
There was a problem hiding this comment.
When a user-mode source install runs on a supported minimal Debian/RPM host without systemctl, this unchanged manifest record makes the full preflight abort before installing sec-core. However, src/agent-sec-core/Makefile's install-all target does not include install-systemd-user; that unit is only installed by install-all-for-rpmbuild, so the source-installed files do not require systemd. Adapt or omit this system-only dependency for the source-build path instead of blocking ./scripts/build-all.sh --component sec-core.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 35746f1d. The source-build dependency adapter now omits the sec-core systemd manifest entry because make install neither installs nor manages that unit. Source-build CI no longer preinstalls or verifies systemd, and a regression assertion covers the filtered dependency.
| as_root $PKG_INSTALL jq || warn "jq not installed (sec-core helper/signing dependency)" | ||
|
|
||
| info "Installing runtime dependencies: ${packages[*]}" | ||
| if ! as_root "${install_command[@]}" "${packages[@]}"; then |
There was a problem hiding this comment.
On a fresh or cleaned Debian/Ubuntu system install, the first package mutation is now apt-get install without a preceding apt-get update, so missing dependencies can fail with “Unable to locate package” even though the configured repositories provide them; the subsequent re-probe then aborts the install. apt-get --help describes update as “Retrieve new lists of packages,” so run it before this aggregated deb transaction, as the existing Node and CI setup paths already do.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 35746f1d. DEB system preflight now runs one apt-get update before the aggregated install and exits before package mutation if the refresh fails. Tests cover both call ordering and the failure short-circuit.
05f48a5 to
899421a
Compare
- Aggregate manifests and block system changes before dependency setup. - Preserve user-local source provisioning, then re-probe every runtime. - Parse manifest keys safely and batch native system package installs. Fixes: 6e4a741 ("refactor(build): introduce unified build workflow") Signed-off-by: kongche-jbw <kongche.jbw@alibaba-inc.com>
899421a to
35746f1
Compare
Forrest-ly
left a comment
Forrest-ly
left a comment
There was a problem hiding this comment.
Code review for commit 35746f1 — approving.
What I verified
- Ran
tests/test-build-all-runtime-deps.shlocally against this commit: 28/28 pass. - Ran
runtime_dependencies_for_manifestagainst all 8 real component manifests: emits exactly the expected 15 records; agent-memory and os-skills correctly contribute zero. - Preflight ordering confirmed in code and tests: platform capabilities are checked before user source setup; system mode blocks platform-capability / language-runtime blockers before any package mutation; one deduplicated APT transaction preceded by
apt-get update(failure stops before mutation); re-probe after install; install phase re-verifies before any component file lands. - The two earlier automated findings (sec-core
systemdexclusion for source builds, APT refresh before the aggregated install) are both addressed in this commit with regression tests. - User mode never calls
as_rootfor runtime packages; system probes use the fixedRUNTIME_SYSTEM_PATH, so a user-local nvm Node cannot satisfy the system contract; the emitted retry command is absolute and preserves--system/--deps-only/--ignore-deps(covered for--component memory). - agent-memory code is untouched; it participates via the generic manifest-driven preflight (it declares no dependencies), so no new requirements are introduced for memory installs.
- The ws-ckpt probe change (
btrfs version→mkfs.btrfs --version) matches what the removed installer actually required (cmd_exists mkfs.btrfs).
Non-blocking suggestions
scripts/build-all.sh:2128,2150— thelocal -nnamerefs are the script's first bash ≥ 4.3 dependency. On bash 4.2 hosts (CentOS/Anolis 7 era) the preflight would error out instead of reporting. Likely acceptable given the ws-ckpt/sight kernel floors and EL7 EOL, but worth confirming EL7 is out of support scope, or documenting a minimum bash version.- User-visible behavior change worth a release note: missing runtime dependencies now hard-fail user-mode installs, where bwrap/gpg/jq previously only warned. Intentional per the PR body, but users will notice.
- The awk TOML reader assumes single-line
packages = { ... }inline tables and no|character in any field. Current manifests comply and the 15-record assertion guards against drift, but consider a one-line comment nearruntime_dependencies_for_manifestspelling out these constraints so future manifest edits don't silently drop records.
Nice work on the aggregated reporting, the strict order-of-operations guarantees, and the test coverage.
2 participants
Why
build-all.shcould build or begin installation before discovering missing runtimedependencies such as
bwrap. It also checked only sec-core, so users could hitthe same one-at-a-time failure pattern in other selected components.
What changed
and report all missing capabilities together.
and mapping source-specific Node and OpenSSL requirements.
such as nvm, then re-probe every runtime and report remaining gaps once.
mutation, refresh APT indexes for DEB hosts, install native packages in one
deduplicated transaction, and re-probe.
user nvm never satisfies the system contract, and no external repository is added.
for host tools such as
mkfs.btrfsandmodprobe.--deps-onlyand--ignore-deps.Related issue
Related to #2520. The direct
linux-sandboxdiagnostic remains separate.User / Agent impact
Default user builds retain automatic Node setup through nvm. Missing runtime
dependencies are still reported together before component files are installed.
System installs require language runtimes to be present in the fixed system PATH;
ordinary native packages may be installed automatically after all blockers pass.
Risk and compatibility
System mode may refresh APT metadata and invoke the detected package manager once
for missing native runtime packages, but it never configures NodeSource or another
external repository. User mode never invokes privileged runtime package
installation; its existing user-local source dependency installers remain available.
Validation
bash -n scripts/build-all.sh tests/test-build-all-runtime-deps.sh./tests/test-build-all-runtime-deps.sh(28/28)cargo test -p anolisa-core manifest --locked(93 passed)deb/rpminline-table keysmkfs.btrfsmkfs.btrfsis unavailablegit diff --checkDocumentation and rollback
No documentation changes are required. Revert commit
35746f1dto restore theprevious component-specific behavior.