Repository navigation
shaderc preflight: forward the override into --docker, check the executable bit, run before package install #387
Description
What
Three Codex P2s on #385 were deferred under the three-review-round cap. None is a fail-open hole in the shaderc preflight (that one — the --watch rebuild bypass — was fixed in 24b4b5d), but each is a real gap in the same validation and worth closing together.
| # | thread | gap |
|---|---|---|
| 1 | discussion_r4043675751 |
--docker builds do not receive the LABELLE_SHADERC override. The host validates a path that the containerised build never sees, so a project that passes preflight on the host can still compile shaders with the wrong (or no) compiler inside the container. |
| 2 | discussion_r4043675755 |
The preflight accepts a non-executable regular file. statFile now rejects directories and missing paths, but not mode bits — a file with -rw-r--r-- passes validation and fails opaquely at exec time, which is the outcome the preflight exists to prevent. |
| 3 | discussion_r4043675761 |
The preflight runs after package installation. A bad override is reported only once the (slow, network-bound) install step has completed. Running it before install fails faster and keeps the diagnostic next to the thing the user typed. |
Fix
- (1) Forward the override into the container environment, or validate that it is reachable from the container's filesystem view and say so in the diagnostic. Decide which and document it — silently mapping a host path into a container is its own trap.
- (2) Check the executable bit (
mode & 0o111on POSIX; on Windows, the existing extension-based executability rule) in the samepreflightWithused by the cold and watched paths, so both stay in lockstep. - (3) Move the cold-path call ahead of package installation; the watched path already runs it after hooks and before generation.
Acceptance
- A
--dockerbuild with an invalid override fails at preflight with the named value, not inside the container - A non-executable regular file is rejected with a diagnostic naming the path and the missing permission
- With an invalid override,
labelle buildfails before any package is fetched (assert on the install step never running, not on timing) - All three exercised through
preflightWith, with a force-failed test each — not by reading the code
Refs: #385 (the --watch bypass fix and the three deferred threads).
Activity