record(CONTAINER-LIBSSL): the container image was finally BUILT, and the first build found #1517 (#1517, #1521) - #1524
Merged
Conversation
…so the shipped image can actually reach the hub (#1517) `docker/Dockerfile` added `libssl3` to the runtime stage for the HuggingFace fetch (#1280) and never added `libssl-dev` to a builder stage. `builder-toolchain` and `builder-cuda` installed `binutils build-essential ca-certificates cmake curl file git ninja-build python3` and nothing more, so CMake logged `Could NOT find OpenSSL (missing: OPENSSL_CRYPTO_LIBRARY OPENSSL_INCLUDE_DIR)` and took the downgrade `CMakeLists.txt:2440-2482` defines: a warning, `VLLM_CPP_HF_DOWNLOAD` forced OFF, and a green build. `ldd` on the shipped `vllm-server` named only `libstdc++ libm libgcc_s libc`. The image carried a runtime `libssl3` that nothing linked, and the comment claiming otherwise was false for every image the file produced. `.github/workflows/release.yml` had the same omission where it matters more. `cuda_x86` and `cuda_arm64` build inside `nvidia/cuda:13.3.0-devel-ubuntu24.04` with the identical package list, so the published CUDA archives shipped the fetch disabled too. `cpu_x86`, `cpu_arm64` and `vulkan_x86` were correct only because the `ubuntu-latest` runner image happens to preinstall the package. That is an accident, not a decision, and nothing defended it, so all five lanes now name the package themselves. `scripts/check-build-runtime-deps.py` refuses the class rather than this one instance. A Dockerfile stage that runs a release build script must reach `libssl-dev` through its own or an ancestor stage's apt install, and some runtime stage must carry `libssl3`; either half alone is the defect this fixes. A release job that runs a build script must name the package or appear in `EXEMPT_LANES` with a recorded reason, so a new lane belongs to neither set and reddens the gate. The five exemptions are real: the literal-static musl lane resolves the feature OFF on purpose, and the two macOS and two Windows lanes have no apt and carry their TLS debt under `## Owed` already. Run against the two files as `origin/main` carried them, the checker names exactly the eight defective stages and lanes and exits 1. Against this tree it exits 0. FOLLOWING_AGENTS_PROTOCOL Following-Agents-Protocol: true AI-Assisted: true Assisted-by: Claude:Opus-5 [Claude Code]
Bring the branch up to date before its final gate. The incoming range touches `.agents/specs/qwen38-27b-bf16-gate.md` only, so nothing this row owns was merged and `.agents/issue-index.md` is byte-identical to the version this branch appended to. FOLLOWING_AGENTS_PROTOCOL Following-Agents-Protocol: true AI-Assisted: true Assisted-by: Claude:Opus-5 [Claude Code]
…the first build found #1517 (#1517, #1521) `.agents/specs/hf-model-download.md` carried an `## Owed` bullet saying W5 shipped `libssl3` and the hub-reach audit without ever building an image, so the audit had never executed. That debt is discharged, and the measurement was red: the first real execution refused the image with `hub reach: this image cannot speak HTTPS`. The bullet now records what the build found rather than that a build is owed, and carries the red-to-green pair measured on 20 August 2026 from one tree with one variable, both images deleted afterwards. `docs/guides/hugging-face-access.md` said the container image "carries both halves already: `libssl3` for the library and `ca-certificates` for the trust store". Both of those are runtime parts. The half that was missing was `libssl-dev` at build time, which is the only reason the server links OpenSSL at all, so the sentence named two halves of a pair that had three parts and asserted a property the images did not have. #1521 is filed and NOT fixed here. Sharing the lane's BuildKit cache mount between the red control and the green build made the second configure read the first one's `CMakeCache.txt`, report OpenSSL found with an empty version, and die at generate on a missing `OpenSSL::SSL` target rather than take the documented downgrade. `docker/reset-stale-build-cache.sh` stamps the compiler, CMake and CUDA, none of which moved. The control was rebuilt with its own mount id. It moves cache-invalidation semantics, so it needs its own spec and fresh review. FOLLOWING_AGENTS_PROTOCOL Following-Agents-Protocol: true AI-Assisted: true Assisted-by: Claude:Opus-5 [Claude Code]
…t apply the union driver, so the forward merge is made here (#1517) GitHub reported this pull request as conflicting while `git merge` here reports a clean automatic merge. The difference is `.agents/issue-index.md`, which carries `merge=union` in `.gitattributes`. The forge does not apply that driver, so two branches that each append a row read as a conflict there and merge cleanly here. The keyed records are verified by hand rather than accepted from the clean automatic merge, which `AGENTS.md` section `## Records` forbids relying on. The index union holds: 493 rows on this branch, 492 on `origin/main`, 491 at the merge base, and 494 after the merge, which is 493 plus 492 minus 491. `scripts/check-issue-index-append-only.py` and `scripts/check-agent-record.py` both exit 0, the latter reporting `ENGINE=168 MODEL=377 QUANT=84 KERNEL=57 BACKEND=85 ANCHOR-ROT=38`. No file needed a scoped edit re-applied, because `origin/main` moved only by the relative-redirect fix, which touches no record this branch also edits. FOLLOWING_AGENTS_PROTOCOL Following-Agents-Protocol: true AI-Assisted: true Assisted-by: Claude:Opus-5 [Claude Code]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
.agents/specs/hf-model-download.mdcarried an## Owedbullet saying W5 shippedlibssl3and the hub-reach audit without ever building an image, so the audit hadnever executed. That debt is discharged, and the measurement was red: the first
real execution refused the image with
hub reach: this image cannot speak HTTPS.The bullet now records what the build found rather than that a build is owed, and
carries the red-to-green pair measured on 20 August 2026 from one tree with one
variable, both images deleted afterwards.
docs/guides/hugging-face-access.mdsaid the container image "carries bothhalves already:
libssl3for the library andca-certificatesfor the truststore". Both of those are runtime parts. The half that was missing was
libssl-devat build time, which is the only reason the server links OpenSSL atall, so the sentence named two halves of a pair that had three parts and asserted
a property the images did not have.
#1521 is filed and NOT fixed here. Sharing the lane's BuildKit cache mount between
the red control and the green build made the second configure read the first one's
CMakeCache.txt, report OpenSSL found with an empty version, and die at generateon a missing
OpenSSL::SSLtarget rather than take the documented downgrade.docker/reset-stale-build-cache.shstamps the compiler, CMake and CUDA, none ofwhich moved. The control was rebuilt with its own mount id. It moves
cache-invalidation semantics, so it needs its own spec and fresh review.
FOLLOWING_AGENTS_PROTOCOL
Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: Claude:Opus-5 [Claude Code]