Browser guest: one signed Node for host and guest, and a stale-Chromium report before each release

Offen
  • Stimmt etwas nicht?
#475 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
35/100
Issue-Typ
Feature
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
debian, docker, node.js, rust
Bereich
build-system, release

Rechercherichtung

Start with scripts/build/build-browser-vm-rootfs.sh, scripts/build/stage-browser-vm-target.sh, components.json, and scripts/release-upstream-recipes.json to trace how Node enters the guest image. Then inspect scripts/browser-vm-image-inputs.py and scripts/build/browser-vm-debian-lock.json, plus the release check for the Chromium pin. Done means the guest uses the recipe’s signed Linux Node artifact with its receipt and licence, image inputs change with the pin, and the release check reports pinned and current Chromium versions; validate the installed Browser journey on Apple Silicon.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

post-0.8.0

After 0.8.0. Part of #87 (Private Browser). Proposed by Sash on 21 Oct. Facts checked on release train 9f137a469 (21 Oct). Security details stay in private release and security tracking.

Current state

The Browser guest image installs Node from the Debian package set (scripts/build/build-browser-vm-rootfs.sh:297). The guest runs the Selkies control service and the VZ transport bootstrap with it (scripts/build/stage-browser-vm-target.sh:636, :780). The host uses a different Node: the signed release pins it by version and SHA-256 (components.json external.node, scripts/release-upstream-recipes.json). So two Node lines need separate updates, and the guest line follows Debian's schedule.

The guest Chromium packages are pinned by a Debian security snapshot (scripts/build/browser-vm-debian-lock.json). Each refresh changes the guest image inputs, so it needs an image rebuild and a Browser check on a Mac. Today the release owner finds a stale Chromium pin only by comparing it with Debian by hand.

What changes
  • The guest uses the common pinned Node version with the signed Linux artifact for its architecture, built into the image from release-upstream-recipes.json. Darwin hosts retain their signed Darwin artifact at that version. The Debian nodejs package leaves the image.
  • The release check reports how old the guest Chromium pin is against the current Debian security snapshot, so a release owner sees a stale pin before the freeze.
Acceptance criteria
  • The guest image contains one Node at the common pinned version. Its bytes match the signed Linux guest architecture recipe, with the recipe digest, artifact receipt and licence included in the image input closure. Test version and per-platform hash mismatch.
  • Changing the Node pin changes the guest image inputs (scripts/browser-vm-image-inputs.py), so release admission requires a rebuilt image.
  • The release check names the pinned and the current Debian security Chromium versions.
  • On an Apple Silicon Mac, Browser opens, renders a busy news site, plays video with audio, takes typing and clicks, and closes, on the rebuilt image installed by update.

After a shared guest change, each advertised host adapter needs the applicable installed journey on that exact guest. #217 owns release production, #87 owns the Mac journey, #90 owns the Jetson journey, and #293 owns the support verdict.

Owner

Sash (Browser).

Vorherrschende Sprache
Rust
Sterne
6
Forks
2
Ø Merge
1 T. 3 Std.
Gemergte PRs (30 T.)
42

Entwicklungsumgebung

Dieses Projekt bietet weder Dev-Container noch Dockerfile noch Beitragsleitfaden – die Einrichtung liegt bei Ihnen. Beginnen Sie mit der README; die allgemeinen Schritte stehen in unserem Leitfaden für den ersten Beitrag.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus elastos/elastos-runtime

Alle Issues in elastos/elastos-runtime

Ähnliche Issues

Weitere Issues zu Rust

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.