Browser guest: one signed Node for host and guest, and a stale-Chromium report before each release

Aperta
  • Qualcosa non va?
#475 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
debian, docker, node.js, rust
Ambito
build-system, release

Direzione di ricerca

Start with scripts/build/build-browser-vm-rootfs.sh, scripts/build/stage-browser-vm-target.sh, components.json, and scripts/release-upstream-recipes.json to trace how Node enters the guest image. Then inspect scripts/browser-vm-image-inputs.py and scripts/build/browser-vm-debian-lock.json, plus the release check for the Chromium pin. Done means the guest uses the recipe’s signed Linux Node artifact with its receipt and licence, image inputs change with the pin, and the release check reports pinned and current Chromium versions; validate the installed Browser journey on Apple Silicon.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

post-0.8.0

After 0.8.0. Part of #87 (Private Browser). Proposed by Sash on 21 Oct. Facts checked on release train 9f137a469 (21 Oct). Security details stay in private release and security tracking.

Current state

The Browser guest image installs Node from the Debian package set (scripts/build/build-browser-vm-rootfs.sh:297). The guest runs the Selkies control service and the VZ transport bootstrap with it (scripts/build/stage-browser-vm-target.sh:636, :780). The host uses a different Node: the signed release pins it by version and SHA-256 (components.json external.node, scripts/release-upstream-recipes.json). So two Node lines need separate updates, and the guest line follows Debian's schedule.

The guest Chromium packages are pinned by a Debian security snapshot (scripts/build/browser-vm-debian-lock.json). Each refresh changes the guest image inputs, so it needs an image rebuild and a Browser check on a Mac. Today the release owner finds a stale Chromium pin only by comparing it with Debian by hand.

What changes
  • The guest uses the common pinned Node version with the signed Linux artifact for its architecture, built into the image from release-upstream-recipes.json. Darwin hosts retain their signed Darwin artifact at that version. The Debian nodejs package leaves the image.
  • The release check reports how old the guest Chromium pin is against the current Debian security snapshot, so a release owner sees a stale pin before the freeze.
Acceptance criteria
  • The guest image contains one Node at the common pinned version. Its bytes match the signed Linux guest architecture recipe, with the recipe digest, artifact receipt and licence included in the image input closure. Test version and per-platform hash mismatch.
  • Changing the Node pin changes the guest image inputs (scripts/browser-vm-image-inputs.py), so release admission requires a rebuilt image.
  • The release check names the pinned and the current Debian security Chromium versions.
  • On an Apple Silicon Mac, Browser opens, renders a busy news site, plays video with audio, takes typing and clicks, and closes, on the rebuilt image installed by update.

After a shared guest change, each advertised host adapter needs the applicable installed journey on that exact guest. #217 owns release production, #87 owns the Mac journey, #90 owns the Jetson journey, and #293 owns the support verdict.

Owner

Sash (Browser).

Lingua principale
Rust
Stelle
6
Fork
2
Merge medio
1g 3h
PR unite (30g)
42

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di elastos/elastos-runtime

Tutte le issue di elastos/elastos-runtime

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.