fix: remove duplicate helper preflight - #61
Draft
0cwa wants to merge 19 commits into
Draft
Conversation
…ate#320) Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
…create#319) Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
Verify locked artifacts with exact hash, size, and OpenSSH signatures before hostile-archive extraction. Revalidate cache and installs, publish atomically, and execute direct tool calls from post-verified sealed file descriptors. Co-Authored-By: ruflo-bot <ruflo-bot@users.noreply.github.com>
Batch enabled executable acquisition before legacy downloads, reject legacy acquisition paths, clear stale disabled bindings, and route PixeneOS-owned avbroot calls through sealed descriptor execution. Co-Authored-By: ruflo-bot <ruflo-bot@users.noreply.github.com>
Describe sealed direct execution, compatibility-only helper PATH resolution, deterministic reports, and the remaining trusted-runner gate before real OTA integration. Co-Authored-By: ruflo-bot <ruflo-bot@users.noreply.github.com>
Keep repository identity validation at the pre-download boundary and make the later contract check runtime-only. Split focused tests so identity and smoke failures are independently covered. Co-Authored-By: ruflo-bot <ruflo-bot@users.noreply.github.com>
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
helper_repository_preflightcall fromhelper_contract_preflight.patch.py --helpruntime smoke check.Why
The helper Git
HEADwas checked twice. The first check is the useful pre-download safety gate; the second added no new protection and mixed repository identity with runtime contract validation.This keeps the simple lifecycle:
It intentionally does not change OTA ownership, workflows, providers, ROM profiles, bootstrap/trust, module selection, F-Droid behavior, or private tool permissions.
Validation
bash -npassed across tracked shell files.git diff --checkpassed.Remote GrapheneOS and LineageOS CI should validate the published branch through the normal PR workflows.