sandbox: allow reading /elpe (the content-addressed store) during evaluation — Image.read_sysusers parses packages' sysusers.d from the store; it's the /nix analogue, read-only, no secrets
Created by pmeunier on Aug 4, 2026, 8:32 PM
State:
3T4FMUMTPEL4TDCLSHOIDFUVMP33MZWRLSKT362N2DS3TE3F62PQCresolve conflict: integrate anchored /pattern .ignore fix into refactored parse_ignore_line (keep default_src_ignores)
Created by pmeunier on Aug 4, 2026, 8:29 PM
State:
EQSQBGNESLWAAQ2274V2CY4OKP3K2CMC2V5D3W5LCCXEWVM3TBGACelpe local_src: honor anchored /pattern in .ignore (leading-slash gitignore anchoring); the 168MB root log leaked into every src copy despite /log in .ignore, causing hash churn + a Cargo.lock perm race
Created by pmeunier on Aug 4, 2026, 8:26 PM
State:
FMO2Y3BON4JLAJZICKXOJBGE627UIMNCRF3ADVOO4BJWKD56V7XQCsbom: U2(b) full lean — CycloneDX only; drop SPDX serialisers, elpe sbom cmd, lock -sbom
Created by pmeunier on Aug 4, 2026, 8:23 PM
State:
GGOTAICYZECNTUCPDOPTUSQWNCXOHPSZRPI4LLUB3DSFAJID5CAQCimage: retry_store — harden read_sysusers against the frontend/backend store permission race (EACCES)
Created by pmeunier on Aug 4, 2026, 8:22 PM
State:
BNB2H37SVKFBWS4ULHXXUDANU4IY4N4BRRSK4K5HG5NXSFS3SU2QCimage: generations Phase 1 — Image.system toplevel (generation identity), /run/current-system + /etc/elpe snapshot, faithful service round-trip in configuration.ml
Created by pmeunier on Aug 4, 2026, 8:15 PM
State:
DJAY3WWFXE3KX7UILXAFE53Y5WAUFOA32QYMA2CO6VXBWQKAEJSACelfedit: keep trailing DT_NEEDED on runpath-only edits (fixes libLLVM.so.21 losing libedit/libzstd/libxml2 NEEDED -> rustc 'undefined symbol: history' in nix-free backend rebuild)
Created by pmeunier on Aug 4, 2026, 5:58 PM
State:
7BFXB547JWGVXO3534IRUU7OETAGFI6QIRZULL32ZCMDLJLG66WACsbom: U2(a) emit declarative dep graph in of_lock exports (SPDX DEPENDS_ON + CycloneDX dependencies)
Created by pmeunier on Aug 4, 2026, 5:53 PM
State:
FKSMWIESRAOTUAZU4PMT6POZCJIFAXRJ6BMGOY4RH4XIOAR5PUGACsandbox_stubs.c: define _GNU_SOURCE before includes so O_PATH is declared (frontend dune build was failing to compile the landlock stub)
Created by pmeunier on Aug 4, 2026, 5:52 PM
State:
RFKISQC2DSIUVK5XVPYWQTVGU6M7ZNTUSSULLDHJFQA3LRBCJR5QCelpe: sandbox evaluation of untrusted build.ml (seccomp: no net/exec; landlock: writes confined to CWD, no $HOME reads) armed before Dynlink
Created by pmeunier on Aug 4, 2026, 5:48 PM
State:
HIOHXD46IJZXQTOT4B6LTPKNRXEZEGVLCJWUGYBQIF27XRZASJOAClocal_src: restore full default-ignore (elpe.*.lock + *.cmi/cmo/cmx/o) — e2e-verified the .cmi/.cmo exclusion is NECESSARY for update->build input-hash convergence, not just cosmetic (compiler output isn't byte-stable across the update->build boundary); the input-hash must cover real sources, not build artifacts
Created by pmeunier on Aug 4, 2026, 5:48 PM
State:
BT77SOV2D5VYBFKQWVC3NDNP2HAHBFI4OHZHZOX5ANBDXUGYAK4QClock: regenerate example locks in CycloneDX format
Created by pmeunier on Aug 4, 2026, 5:47 PM
State:
XISLX4VZOMQJUHTU6OMODQXKQW4DOJ6MZDHVHFT64UMOV2357UUACResolve order conflict: merge HashMismatch terminal arm with the watcher-abort deadlock fix
Created by pmeunier on Aug 4, 2026, 5:41 PM
State:
6FPBDBKNH6C3TRUZQY5QK45JK3JYPL3UA2FNWIHA26J57YSRJZBQCB.3 polish: surface HashMismatch kind + scope local_src ignore to locks only
Created by pmeunier on Aug 4, 2026, 5:38 PM
State:
RH2OVPHTWB2SJCZ5LBNDYF32UQMUOBB3KCT72XTHQGB4PSFVFUOQClock: regenerate elpe's aarch64 lock in CycloneDX format
Created by pmeunier on Aug 4, 2026, 5:38 PM
State:
PKKGABFP7EZYZT3YXI67WR2QX23GCCYGHRIU3VC3SPFS5H5HXVCACtest: resolve conflict — keep both lock roundtrip and bootstrap codegen tests
Created by pmeunier on Aug 4, 2026, 5:33 PM
State:
6PHOE2JBWIRBQGHIIFTKAITQABVMKLA4PDDJEORKXDWQO5VLL7XQClock: regenerate elpe's x86_64 lock in CycloneDX format
Created by pmeunier on Aug 4, 2026, 5:32 PM
State:
A5YVWWSJ5FZWLOL5MKVZ5B7G5SFB4XOXYUSBFCWGI5BPM2TZWG4QCimage: Image.bootstrap — nixos-install-style installer into mounted /mnt + /mnt/boot, with generated self-describing configuration.ml
Created by pmeunier on Aug 4, 2026, 5:31 PM
State:
G24XZJADJVDSMKINUCTGTAB2NFLOYMAD3X3FMQGYDMV72OCOPZPAClock: line-oriented canonical CycloneDX (one component/dep per line)
Created by pmeunier on Aug 4, 2026, 5:28 PM
State:
6TPGMWAKJU6BNKI5SUTMBWI5LS6YDQ2CSRPF4MYE2SWYMBQ7GKPQClocal_src: default-ignore elpe.*.lock + *.cmi/cmo/cmx/o so writing a co-located output lock (or compile artifacts) can't change the src input-hash and invalidate its own pins; factor parse_ignore_line out of read_ignore
Created by pmeunier on Aug 4, 2026, 5:24 PM
State:
P4LG53SD7SFXXNVKJPK2HZOCM4RVLJ455KRAORFWTENIAQRKKAUACimage_service: services contribute typed activations; openssh declares its sshd privsep user (§3.4 long tail)
Created by pmeunier on Aug 4, 2026, 5:20 PM
State:
DNDYAHWFTMWKYLOOGYFLYYIQA5GFHA3MRIZUKHU2OTTA63EKJTAQC