Repository navigation
Add a SessionStart hook for Claude Code cloud sessions - #52
Merged
Merged
Conversation
The cloud image has no .NET SDK, and Ubuntu's own dotnet-sdk-10.0 is the 1xx feature band, whose compiler is too old for ktsu.Sdk.Analyzers (CS9057). The hook installs the SDK global.json asks for into ~/.dotnet, puts it on the session's PATH and restores the solution. dotnet-install.sh is tried first. The default cloud network policy blocks builds.dotnet.microsoft.com, so the SDK falls back to the layers of the mcr.microsoft.com/dotnet/sdk image, which the policy allows. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGcrXbknJ2JWPDzNoNhPCw
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+84
to
+87
| for layer in $(jq -r '.layers[].digest' <<<"$manifest"); do | ||
| curl -fsSL -o "$work/layer.tgz" "$registry/blobs/$layer" | ||
| tar -xzf "$work/layer.tgz" -C "$root" --strip-components=3 --wildcards "$wanted" 2>/dev/null || true | ||
| done |
Contributor
Author
There was a problem hiding this comment.
Fixed in 0592171. Each layer is now checked with sha256sum against the digest its manifest names before it is extracted. A mismatch or a non-sha256 digest stops the install.
Generated by Claude Code
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGcrXbknJ2JWPDzNoNhPCw
matt-edmondson
force-pushed
the
claude/cloud-session-setup-luxi33
branch
from
October 20, 2026 12:06
cdb500e to
0592171
Compare
dotnet-install.sh is fetched and run with nothing to verify it against, and its host is blocked in cloud sessions anyway, so the installer now always takes the MCR route, whose layers are checked against their digests. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGcrXbknJ2JWPDzNoNhPCw
Contributor
Author
|
SonarCloud fails its quality gate on 40f1e77, with "C Security Rating on New Code". ktsu-dev/Sdk#80 shows the same finding on the same two scripts. sonarcloud.io is blocked from the cloud session I'm working in, so I can't read which rule fired. Once someone pastes it from the dashboard, I'll fix it here and on the other PRs. Generated by Claude Code |
This was referenced Oct 20, 2026
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017vfJW5jpiuVuBRXSgitSY1
curl -L follows a redirect to any protocol, so a registry redirect could downgrade a layer download to plain HTTP. --proto '=https' refuses that, and --tlsv1.2 refuses the old TLS versions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017vfJW5jpiuVuBRXSgitSY1
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017vfJW5jpiuVuBRXSgitSY1
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Matt · project thread
Before: a Claude Code cloud session had no .NET SDK, so nothing here could be built or tested. Ubuntu's own
dotnet-sdk-10.0package does not help either: it is the 10.0.1xx band, whose compiler is too old for ktsu.Sdk.Analyzers (CS9057 on every project).After: a SessionStart hook installs the SDK
global.jsonasks for (10.0.402 today) plus the .NET 8 and 9 runtimes into~/.dotnet, puts it on the session'sPATH, and runsdotnet restore. A session can build and test straight away.How:
.claude/hooks/install-dotnet.shtries the officialdotnet-install.shfirst. The default cloud network policy blocksbuilds.dotnet.microsoft.combut allowsmcr.microsoft.com, so it falls back to unpackingusr/share/dotnetfrom the officialmcr.microsoft.com/dotnet/sdkandruntimeimage layers. If the environment later allows the Microsoft host, the first route takes over with no change here. The hook does nothing outside cloud sessions and is a no-op once everything is installed. The same two files go to every ktsu repo in the Holotype project.Validated in a cloud container: the hook ran clean and
dotnet test --project SourceGeneratorToolkit.Test/SourceGeneratorToolkit.Test.csprojpassed 55/55.Note: no version tag in the commit, so KtsuBuild will pick the bump from the files changed. Add
[skip ci]or a tag on merge if a release for this is unwanted.Generated by Claude Code