From 37a82ed91d1dd1e8786743b21bc2752809749212 Mon Sep 17 00:00:00 2001 From: Alexander Rymdeko-Harvey <8761706+killswitch-GUI@users.noreply.github.com> Date: Thu, 13 Aug 2026 23:26:55 +0000 Subject: [PATCH 1/2] chore(distribution): publish v0.10.8 metadata --- flake.nix | 10 +++++----- packaging/homebrew/Formula/colossus.rb | 8 ++++---- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/flake.nix b/flake.nix index 5a61a8ca..de2e9fbd 100644 --- a/flake.nix +++ b/flake.nix @@ -12,23 +12,23 @@ "x86_64-linux" ]; forAllSystems = nixpkgs.lib.genAttrs systems; - version = "0.10.7"; + version = "0.10.8"; releases = { aarch64-darwin = { target = "aarch64-apple-darwin"; - sha256 = "035d66323a2d07026266838a0799077e16e16e1f3d8d1f803a9f5f81ee2b7d5a"; + sha256 = "be2f6b6f2274a7e1b4db4b9856d1c4627f938b6afc77cab2ffc344bb5bef39b0"; }; x86_64-darwin = { target = "x86_64-apple-darwin"; - sha256 = "f5ccbce846efe485e411dd9dd7bc878d847719fc6012e001f84ea8c6142b68cc"; + sha256 = "6d6b5897bbd87afe9646dac8b34bde89a6ea5a50706bd376532dc8cc9a8ba25c"; }; aarch64-linux = { target = "aarch64-unknown-linux-musl"; - sha256 = "c226ce55c3a99ac4a1037b013e378b2c0a966e87bd114760fa26fab96a80eef8"; + sha256 = "c4f26bdeeb883f085289657b99bf41ce16a6e5529f000526018b9f821379c567"; }; x86_64-linux = { target = "x86_64-unknown-linux-musl"; - sha256 = "4d357af882825d0e033a22f0ec0f914d49fbb6bf34f8a8df2721da3d80841aae"; + sha256 = "9451a77d0d765c563c7d7aa0bab45f92bdb16e87bc956f7a3119b4aec60f3fba"; }; }; in { diff --git a/packaging/homebrew/Formula/colossus.rb b/packaging/homebrew/Formula/colossus.rb index efcb1421..5f4e6ef3 100644 --- a/packaging/homebrew/Formula/colossus.rb +++ b/packaging/homebrew/Formula/colossus.rb @@ -5,11 +5,11 @@ class Colossus < Formula on_macos do if Hardware::CPU.arm? - url "https://github.com/obscuritylabs/Colossus/releases/download/v0.10.7/colossus-0.10.7-aarch64-apple-darwin.tar.gz" - sha256 "035d66323a2d07026266838a0799077e16e16e1f3d8d1f803a9f5f81ee2b7d5a" + url "https://github.com/obscuritylabs/Colossus/releases/download/v0.10.8/colossus-0.10.8-aarch64-apple-darwin.tar.gz" + sha256 "be2f6b6f2274a7e1b4db4b9856d1c4627f938b6afc77cab2ffc344bb5bef39b0" else - url "https://github.com/obscuritylabs/Colossus/releases/download/v0.10.7/colossus-0.10.7-x86_64-apple-darwin.tar.gz" - sha256 "f5ccbce846efe485e411dd9dd7bc878d847719fc6012e001f84ea8c6142b68cc" + url "https://github.com/obscuritylabs/Colossus/releases/download/v0.10.8/colossus-0.10.8-x86_64-apple-darwin.tar.gz" + sha256 "6d6b5897bbd87afe9646dac8b34bde89a6ea5a50706bd376532dc8cc9a8ba25c" end end From 9aeb68a9928b0eef652a422e1a974d566dd03443 Mon Sep 17 00:00:00 2001 From: Alexander Rymdeko-Harvey <8761706+killswitch-GUI@users.noreply.github.com> Date: Fri, 14 Aug 2026 01:20:09 +0000 Subject: [PATCH 2/2] fix(ci): prewarm sanitized rootless Podman path --- .github/workflows/premerge.yml | 25 +++++++++++++----------- crates/colossus-cli/tests/ci_contract.rs | 5 +++++ 2 files changed, 19 insertions(+), 11 deletions(-) diff --git a/.github/workflows/premerge.yml b/.github/workflows/premerge.yml index 4b46ae9b..1bc60b8c 100644 --- a/.github/workflows/premerge.yml +++ b/.github/workflows/premerge.yml @@ -495,21 +495,24 @@ jobs: proxy=$(podman image inspect colossus-oci-proxy:acceptance --format '{{.Id}}') case "$proxy" in sha256:*) ;; *) proxy="sha256:$proxy" ;; esac echo "proxy=$proxy" >> "$GITHUB_OUTPUT" - # Pay rootless Podman's one-time container bootstrap here instead of inside the - # first sandboxed process, whose runtime budget is enforced by the suite. The - # sandbox always runs workloads as `--userns=keep-id --user :`, and the - # first such container materializes an id-mapped copy of the workload image in - # Podman's store, so mirror those flags to keep that cost outside the budget too. - # Mirror the sandbox's resource limits, capability drop, and bind mount as well so - # the cgroup and id-mapped mount setup they trigger is also charged to this step. + # Pay the one-time rootless Podman setup under a separate bounded readiness + # budget. Mirror the sandbox's cleared environment, runtime path, workload, + # user namespace, resource limits, bind mount, working directory, and shell + # write so the later 90-second success budget measures an already-ready runtime. + # The live suite retains its separate 12-second enforcement budget. warmup="$(mktemp --directory)" - podman run --rm --pull=never --network=none --read-only \ - --userns=keep-id --user "$(id -u):$(id -g)" \ + timeout --foreground --kill-after=10s 300s \ + env -i PATH=/usr/bin /usr/bin/podman run --rm --pull=never \ + --userns=keep-id --user "$(id -u):$(id -g)" --network=none --read-only \ --cap-drop=ALL --security-opt=no-new-privileges \ + --name colossus-podman-readiness \ --pids-limit=16 --memory=134217728 \ --mount "type=bind,source=$warmup,target=$warmup" \ - --workdir "$warmup" --entrypoint /bin/true \ - python:3.13-slim@sha256:e544a7fcbdf8555eceda66bf86cafb006c736339f76141918bcb812f3174c00a + --workdir "$warmup" \ + python:3.13-slim@sha256:e544a7fcbdf8555eceda66bf86cafb006c736339f76141918bcb812f3174c00a \ + /bin/sh -c 'printf ready > podman-readiness.txt && cat podman-readiness.txt' + test "$(cat "$warmup/podman-readiness.txt")" = ready + rm "$warmup/podman-readiness.txt" rmdir "$warmup" - name: Run live Podman OCI escape and recovery suite env: diff --git a/crates/colossus-cli/tests/ci_contract.rs b/crates/colossus-cli/tests/ci_contract.rs index c67abd86..49776679 100644 --- a/crates/colossus-cli/tests/ci_contract.rs +++ b/crates/colossus-cli/tests/ci_contract.rs @@ -267,6 +267,11 @@ fn premerge_requires_an_authorized_label_and_representative_platforms() { "for attempt in 1 2 3", "docker pull \"${{ matrix.image }}\"", "cargo xtask check dependencies", + "timeout --foreground --kill-after=10s 300s", + "env -i PATH=/usr/bin /usr/bin/podman run", + "--name colossus-podman-readiness", + "printf ready > podman-readiness.txt && cat podman-readiness.txt", + "test \"$(cat \"$warmup/podman-readiness.txt\")\" = ready", ] { assert!( source.contains(required),