Add Core 1 development credential path - #8
Conversation
- Add isolated userdebug credential client and protocol - Package dedicated Core-dev agent, proxy, and SELinux policy - Add contract tests and deterministic agent smoke support
devteapot
left a comment
devteapot
left a comment
There was a problem hiding this comment.
I found several concrete host regressions and scope/evidence issues. The security boundary itself is thoughtfully isolated, but the new validation surface currently does not run cleanly on the repository’s macOS host, and the progress ledger needs to remain a concise index.
| 0005-s5e8825-select-no-zygote-for-sos-core1.patch | ||
| 0006-s5e8825-allow-sos-core-tsp-enable.patch | ||
| 0007-s5e8825-chown-tsp-enabled.patch | ||
| declare -A SOURCE_PATCH_STATES=() |
There was a problem hiding this comment.
[P1] Keep a33xctl startup compatible with the supported macOS host
This top-level declare -A executes before command dispatch, but the macOS system Bash is 3.2 and has no associative arrays. I reproduced this with bash tests/a33xctl-host-test.sh: tools/a33xctl: line 870: declare: -A: invalid option. Because this declaration is global, even unrelated commands now abort at startup; the pre-existing associative array was local to a specific function and did not impose that failure on every command. Please use a Bash-3-compatible representation here, or add and enforce a newer-Bash bootstrap before any Bash-4-only syntax executes.
| // state after fork. Failure aborts spawn instead of leaking descriptors. | ||
| unsafe { | ||
| command.pre_exec(|| { | ||
| let result = libc::syscall(libc::SYS_close_range, 3_u32, u32::MAX, CLOSE_RANGE_CLOEXEC); |
There was a problem hiding this comment.
[P2] Gate the Linux-only syscall in host-test builds
core_child_fds is compiled under cfg(test) on non-Android hosts, but libc::SYS_close_range is not defined on macOS. On the repository’s macOS host, cargo test --locked -p core-agent-contract-test fails at this line before running any tests; the same module is also included in sos-experience library tests. Please cfg-gate the Linux/Android syscall path and use the existing fcntl fallback on other Unix hosts, or scope this contract package explicitly to Linux.
| let output = | ||
| Path::new(&env::var_os("OUT_DIR").expect("OUT_DIR")).join("core-dev-credential-cpp-client"); | ||
| let compiler = env::var_os("CXX").unwrap_or_else(|| "c++".into()); | ||
| let status = Command::new(compiler) |
There was a problem hiding this comment.
[P2] Do not unconditionally build Android/Linux C++ with the host compiler
This package is now a workspace member, but its build script always compiles the production client with the local host C++ compiler. On macOS, cargo test --locked -p core-dev-credential-protocol-test fails because the included client uses Linux/Bionic-only memset_explicit and SOCK_CLOEXEC. That makes the newly added contract suite—and workspace-wide tests—unbuildable on the documented macOS host. Please gate the harness to supported targets or provide host shims that preserve the production behavior being tested.
| @@ -8997,3 +8997,2167 @@ SHA-256 | |||
| run its separate one-sideload Core 1 no-Zygote readiness, exact Pi authority, | |||
| credential-clear, leak/crash/AVC, manifest, and soak gate. No Core hardware | |||
| claim is made here. | |||
|
|
|||
| ## 2026-08-18 — Harden Core Node startup and reduce credential transcription risk | |||
There was a problem hiding this comment.
[P2] Keep the progress ledger concise instead of committing the full iteration transcript
This PR appends 2,164 lines and 25 same-milestone entries (r1 through the final E2E) for one feature. The repository agreement says docs/progress.md is the concise chronological index and directs focused milestone detail elsewhere. Please retain a compact final entry with the decisive failures, accepted artifact/evidence identities, remaining risk, and next gate, and move any necessary run-by-run narrative to a focused report. The current volume obscures the actual decision and accounts for over 20% of this already-large PR.
| $(call inherit-product, $(SRC_TARGET_DIR)/product/core_no_zygote.mk) | ||
| else | ||
| $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit_only.mk) | ||
| -- |
There was a problem hiding this comment.
[P2] Make the recorded diff-check evidence true for the submitted branch
git diff --check origin/main...origin/pr/8 currently fails on this trailing space, even though many of the added progress entries state that git diff --check passed. Please remove the whitespace and rerun the recorded check against the exact submitted commit so the evidence ledger matches the branch reviewers receive.
1 participant
Summary
docs/progress.md.Testing
a33xctlhost/patch-series tests.