Repository navigation
Exercise real signed APT clients across Debian and Ubuntu - #153
Conversation
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 46ee432c0b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Fixed stale local test evidence: requested clients' old PASS/logs are cleared before Docker inspection, host compilation or image builds. Targeted failure regressions verify all three paths and preserve unrelated clients' results. The standalone scanner's CLI import-path warning is explained locally beside the existing path/identity checks. All four real APT CI clients passed on the preceding code; the revised runner will run again in CI. @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 266450e49c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Fixed the three remaining evidence findings: the gzip phase records origin requests and requires both binary/source .gz indexes without fallback; the full client selection rejects duplicate/colliding identifiers before any cleanup; relative evidence roots are canonicalized from the caller's directory. All four actual Debian/Ubuntu clients pass on the latest merged production source with these assertions. Bash 3.2 stub regressions cover collisions, relative binds and early info/compile/build failures; negative gzip assertion cases reject xz/plain fallbacks. Independent review found no remaining scoped blocker. @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1c8440e124
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Evidence identifiers now also reject case-folded tag collisions on case-insensitive filesystems; the regression preserves prior results and proves no Docker work starts for such selections. @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dcee6600d0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Build an isolated signed binary/source archive and run the actual apt-proxy binary with Debian Bookworm/Trixie and Ubuntu 22.04/24.04 clients. Validate signed updates, rejected metadata tampering, forced SHA256 by-hash and gzip fallback, installation, source downloads, exact ranges, 503/interruption recovery, and authenticated client/upstream HTTPS without disabling trust checks.
Prefetch/verify/export/import a complete snapshot, stop both origin and proxy, then perform signed update, reinstall and source downloads through the offline server. Assertions check payload bytes and prevent private requests or an earlier warm cache from masking failure paths. CI saves logs and assertion evidence for each client, even on failure. Digest-pinned references, registry ports, IPv6 registries and long names produce valid bounded local Docker tags. Identifier collisions are rejected before evidence cleanup; seven entrypoint regressions run in CI.
Validation: all four client jobs, CI and the security workflow pass on
fb23acacd0b0b3166eb592d3fa2bb760f4e62f65; its requested Codex review reports no major issues. Seven matrix entrypoint regression groups, shell syntax and diff checks pass. Local Linux arm64 runs also pass for all four public clients plus two authenticated private-repository samples with optional resource, mirror-health and Unix shared-cache policies enabled. These six runs reuse one clean application binary from #156 (ef9ece6d4262d19a24633059711f091b477b234b) and include origin-stopped offline cases; private responses remain uncached. CI uses its native Docker architecture. An interrupted transfer may require a second APT invocation after APT reports a checksum error; the test asserts safe complete recovery.Builds on merged #150 and includes the exact application changes from #156 so the client matrix exercises the reviewed request adapter, retry accounting and public cache dependency pin.