Martin Vogel
b6a5d2c35b
Every release now carries .mcpb one-click-install bundles alongside the archives, and the MCP Registry entry lists them with per-file sha256: - package-release.sh (canonical) builds codebase-memory-mcp-<target>.mcpb for darwin/windows and the STATIC linux builds — manifest.json + the same staged (stripped, gated) binary + LICENSE + THIRD_PARTY_NOTICES.md. The glibc-dynamic linux targets stay archive-only: a dynamic binary defeats the one-click promise. - _build.yml / release-draft: bundles flow through provenance attestation, checksums.txt, cosign signing and the release asset list; checksums.txt is also preserved as a same-run artifact for the registry job. - verify: the canonical scan matrix grows to 14 containers; MCPB manifests are validated (parse, binary server, entry_point member, command binds the entry point). Bundle binaries dedupe to the archive scan objects, so the VT gate gains only the three distinct manifest.json files. - publish-mcp-registry: gen-mcpb-registry-entries.sh appends one mcpb package entry per bundle (release-asset URL + fileSha256 from the attested checksums) to server.json before mcp-publisher runs. Idempotent; a checksums file without bundles is a hard failure. - contracts: Step 0o pins the bundle shape at its producer on every leg, Step 0p pins the registry entries against the live server.json, and the extractor contract covers the 14-container matrix incl. broken-manifest fail-closed cases. The linux test image gains zip for the packager. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
43 lines
1.7 KiB
Docker
43 lines
1.7 KiB
Docker
# Mirrors the Ubuntu CI environment exactly:
|
|
# - Ubuntu 24.04 (same as GitHub Actions ubuntu-latest / ubuntu-24.04-arm)
|
|
# - GCC (system default) with ASan + UBSan + LeakSanitizer
|
|
# - libsqlite3-dev + zlib1g-dev (same as CI "Install deps" step)
|
|
#
|
|
# Build: docker build -t cbm-test test-infrastructure/
|
|
# Run: docker run --rm -v $(pwd):/src cbm-test
|
|
|
|
# Pinned by digest (supply-chain: no floating tags) — multi-arch manifest-list
|
|
# digest of ubuntu:noble as of 2026-07-23; bump deliberately, never to a tag.
|
|
FROM ubuntu:noble@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
|
|
|
|
# Minimal: gcc + zlib only. sqlite3 is vendored (compiled from source with ASan).
|
|
# curl + zsh mirror the GitHub runner images: the self-update tests shell out
|
|
# to curl, and the shell-activation tests exercise zsh rc files. zip backs
|
|
# scripts/package-release.sh (.mcpb bundles), which the MCPB bundle contract
|
|
# exercises on every leg.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
gcc g++ make \
|
|
zlib1g-dev \
|
|
pkg-config \
|
|
python3 \
|
|
git \
|
|
curl \
|
|
zsh \
|
|
ccache \
|
|
zip \
|
|
ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Verified compiler cache: content-keyed (compiler binary + preprocessed
|
|
# input), so a hit is provably the identical compilation — stale results are
|
|
# impossible by construction. The compose services mount a persistent volume
|
|
# at CCACHE_DIR and route compilers through the Debian masquerade dir.
|
|
ENV CCACHE_COMPILERCHECK=content
|
|
ENV PATH=/usr/lib/ccache:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
|
|
WORKDIR /src
|
|
|
|
# Default: run test.sh with GCC (mirrors CI exactly)
|
|
ENTRYPOINT ["scripts/test.sh"]
|
|
CMD ["CC=gcc", "CXX=g++"]
|