From cbd71e2fc72c80f6e54f33c1bc9d778727d814f8 Mon Sep 17 00:00:00 2001 From: scama Date: Sat, 12 Sep 2026 20:46:22 +1000 Subject: [PATCH] fix: accept bundled native runtime licenses --- TODO.md | 7 +++++++ scripts/upstream-archive.ts | 2 +- tests/upstream-archive.test.ts | 12 ++++++++++++ 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/TODO.md b/TODO.md index c0244e0..f255944 100644 --- a/TODO.md +++ b/TODO.md @@ -1,5 +1,12 @@ # Production Readiness TODO +- [ ] Accept producer-declared native runtime license material in verified + product bundles so v0.76.1 CUDA packaging can complete without weakening the + existing checksum, entry-type, tree-digest, or single-runtime checks. + QA: focused archive fixtures accept `licenses/NVIDIA-CUDA-LICENSE.txt`, the + full TypeScript suite passes, matrix validation remains green, actionlint + passes, and a protected v0.76.1 packaging rerun completes every required job. + - [x] Preserve NVIDIA's installed NCCL version when preparing CUDA dependencies. QA: reproduce the held-package failure with the exact ARM64 CUDA 12 base; verify the fixed installer preserves NCCL, tests cover absent and installed diff --git a/scripts/upstream-archive.ts b/scripts/upstream-archive.ts index 0db40c1..bc474c3 100755 --- a/scripts/upstream-archive.ts +++ b/scripts/upstream-archive.ts @@ -67,7 +67,7 @@ export function validateArchiveEntries(entries: string[]): void { if (!match) throw new Error(`unexpected product archive entry: ${path}`); const [, runtimeId, relative] = match; if (!runtimeIdPattern.test(runtimeId)) throw new Error(`unsafe native runtime id: ${runtimeId}`); - if (relative !== "manifest.json" && relative !== "README.md" && !relative.startsWith("lib/") && !relative.startsWith("tools/")) { + if (relative !== "manifest.json" && relative !== "README.md" && !relative.startsWith("lib/") && !relative.startsWith("licenses/") && !relative.startsWith("tools/")) { throw new Error(`unexpected native runtime entry: ${path}`); } runtimeIds.add(runtimeId); diff --git a/tests/upstream-archive.test.ts b/tests/upstream-archive.test.ts index bf16c32..c33578d 100644 --- a/tests/upstream-archive.test.ts +++ b/tests/upstream-archive.test.ts @@ -123,6 +123,18 @@ test("rejects unsafe runtime IDs before accepting runtime paths", () => { ]), /runtime id/); }); +test("accepts bundled native runtime license material", () => { + assert.doesNotThrow(() => validateArchiveEntries([ + "mesh-bundle/mesh-llm", + "mesh-bundle/product-manifest.json", + "mesh-bundle/host-imports.json", + "mesh-bundle/native-runtimes/linux-cuda/manifest.json", + "mesh-bundle/native-runtimes/linux-cuda/README.md", + "mesh-bundle/native-runtimes/linux-cuda/lib/libllama.so", + "mesh-bundle/native-runtimes/linux-cuda/licenses/NVIDIA-CUDA-LICENSE.txt", + ])); +}); + test("keeps sha256Tree digest compatible with the original tree format", async (t) => { const data = await fixture(t); const runtime = resolve(data.directory, "stage/mesh-bundle/native-runtimes/linux-cpu");