commit 867cd5d6c86416195785771b5ebcfb387d7ab8de
parent 45d4ad51a828705846f87350e94c22b3b6746f8a
Author: triesap <tyson@radroots.org>
Date: Sun, 6 Sep 2026 23:06:27 +0000
fix: remove excluded Nix target claims
- Narrow the service fixture to the supported Nix systems.
- Limit OCI image metadata to Linux x86_64.
- Bind both Nix surfaces into the Step 298 gate.
- Preserve the deferred Step 299 output boundary.
Diffstat:
4 files changed, 9 insertions(+), 7 deletions(-)
diff --git a/build/nix/service/fixture.nix b/build/nix/service/fixture.nix
@@ -951,8 +951,6 @@ in
assert
service.supportedSystems == [
"aarch64-darwin"
- "aarch64-linux"
- "x86_64-darwin"
"x86_64-linux"
];
assert nativeInputs.nativeBuildInputs == [ pkgs.coreutils ];
@@ -965,7 +963,6 @@ assert (
pkgs.stdenv.isLinux
->
ociImage.meta.platforms == [
- "aarch64-linux"
"x86_64-linux"
]
);
diff --git a/build/nix/service/oci.nix b/build/nix/service/oci.nix
@@ -10,8 +10,8 @@
}:
assert lib.assertMsg pkgs.stdenv.isLinux "service OCI images require a Linux builder";
assert lib.assertMsg (
- pkgs.stdenv.hostPlatform.isAarch64 || pkgs.stdenv.hostPlatform.isx86_64
-) "service OCI images support only aarch64-linux and x86_64-linux";
+ pkgs.stdenv.hostPlatform.isx86_64
+) "service OCI images support only x86_64-linux";
assert lib.assertMsg (
builtins.isString serviceName
&& builtins.stringLength serviceName <= 128
@@ -141,7 +141,6 @@ pkgs.dockerTools.buildLayeredImage {
meta = {
description = "Hardened rootless OCI image for ${serviceName}";
platforms = [
- "aarch64-linux"
"x86_64-linux"
];
};
diff --git a/contracts/rshr-202-step-298-gates.v1.json b/contracts/rshr-202-step-298-gates.v1.json
@@ -1 +1 @@
-{"gate_command_contract":[{"argv_template":["cargo","extbuild","run","--","uv","run","--offline","--no-project","python3","-B","tools/rshr_202_step_298_gate.py","--step={step}","--check-id={check_id}","--source-revision={source_revision}","--source-tree={source_tree}","--candidate-digest={candidate_digest}","--platform=macos_aarch64","--execution-request-sha256={execution_request_sha256}"],"assertion_id":["step_298_gate_01_14c62391f40dcf5a2e166bac481c9eb8f50052ee65403ddbd63df5cc82ec6843"],"check_id":"gate-01-14c62391f40dcf5a2e166bac481c9eb8f50052ee65403ddbd63df5cc82ec6843","environment_authority":{"cache_policy_id":"rshr-200-step-287-cache-policy.v1","cache_policy_sha256":"3e81d178bce97b6c349dfbb00c68fd6f620ac00b1a1c8d37b12e9998f3c9eaaa","cadence_policy_id":"rshr-200-step-287-cadence-policy.v1","cadence_policy_sha256":"d24903df8659ee3772297c84994911efe7d21cb8b988320ddc6ddce0431892a1","isolation":"extbuild_host_constrained","network":"disabled","network_policy_id":"none","network_policy_sha256":"none","resource_policy_id":"rshr-200-step-287-resource-policy.v1","resource_policy_sha256":"05d3c7a89185d3c55678d97955193fce2ed92b1eee5af99083d77ea64c98d14e"},"environment_names":["EXT_BUILD_CONFIG","EXT_BUILD_MACHINE_CONFIG","EXT_BUILD_ROOT","HOME","PATH","RUSTUP_TOOLCHAIN","TMPDIR"],"gate_definition_sha256":"14c62391f40dcf5a2e166bac481c9eb8f50052ee65403ddbd63df5cc82ec6843","required_platforms":["macos_aarch64"],"required_tools":["uv","python3","git","perl"],"result_schema":"radroots.services-hardening.rshr-200-step-check-result.v1","schema":"radroots.services-hardening.rshr-200-step-check-command.v1","step":298,"verifier_path":"tools/rshr_202_step_298_gate.py","verifier_sha256":"1e4719de5d317bd2caf1403940af7ae8a763efd6b0d952e80f84a97a75cead57"}],"schema":"radroots.lib.rshr-202-step-298-gates.v1","step":[298]}
+{"gate_command_contract":[{"argv_template":["cargo","extbuild","run","--","uv","run","--offline","--no-project","python3","-B","tools/rshr_202_step_298_gate.py","--step={step}","--check-id={check_id}","--source-revision={source_revision}","--source-tree={source_tree}","--candidate-digest={candidate_digest}","--platform=macos_aarch64","--execution-request-sha256={execution_request_sha256}"],"assertion_id":["step_298_gate_01_14c62391f40dcf5a2e166bac481c9eb8f50052ee65403ddbd63df5cc82ec6843"],"check_id":"gate-01-14c62391f40dcf5a2e166bac481c9eb8f50052ee65403ddbd63df5cc82ec6843","environment_authority":{"cache_policy_id":"rshr-200-step-287-cache-policy.v1","cache_policy_sha256":"3e81d178bce97b6c349dfbb00c68fd6f620ac00b1a1c8d37b12e9998f3c9eaaa","cadence_policy_id":"rshr-200-step-287-cadence-policy.v1","cadence_policy_sha256":"d24903df8659ee3772297c84994911efe7d21cb8b988320ddc6ddce0431892a1","isolation":"extbuild_host_constrained","network":"disabled","network_policy_id":"none","network_policy_sha256":"none","resource_policy_id":"rshr-200-step-287-resource-policy.v1","resource_policy_sha256":"05d3c7a89185d3c55678d97955193fce2ed92b1eee5af99083d77ea64c98d14e"},"environment_names":["EXT_BUILD_CONFIG","EXT_BUILD_MACHINE_CONFIG","EXT_BUILD_ROOT","HOME","PATH","RUSTUP_TOOLCHAIN","TMPDIR"],"gate_definition_sha256":"14c62391f40dcf5a2e166bac481c9eb8f50052ee65403ddbd63df5cc82ec6843","required_platforms":["macos_aarch64"],"required_tools":["uv","python3","git","perl"],"result_schema":"radroots.services-hardening.rshr-200-step-check-result.v1","schema":"radroots.services-hardening.rshr-200-step-check-command.v1","step":298,"verifier_path":"tools/rshr_202_step_298_gate.py","verifier_sha256":"828950a36acd01e995833fd24ccb5c8226d776e7d876e1890561c145598a54e2"}],"schema":"radroots.lib.rshr-202-step-298-gates.v1","step":[298]}
diff --git a/tools/rshr_202_step_298_gate.py b/tools/rshr_202_step_298_gate.py
@@ -59,6 +59,12 @@ EXPECTED_FILES = {
"build/nix/service/systems.nix": (
"d16e21827022a2315234f4c5e4b485017a36ecd90a5559b01d23331cdd505e46"
),
+ "build/nix/service/fixture.nix": (
+ "d9f4ec24762b2cadb4aed45518f81e53308d4e1bf7ff2708aec74a1485269402"
+ ),
+ "build/nix/service/oci.nix": (
+ "9111ce51465bbe45944b718e5e2477b43a08f8f7d9e29f43940a67e86e75daf1"
+ ),
"contracts/releases/target_matrix.toml": (
"28583b0a163e51468d9688b463902ec2cd22b59c99061630596839baf9396527"
),
