no-mistakes(review): record source commit per asset and gate release on agreement

Author: anvanster

scripts/build-linux-arm64.sh

@@ -43,6 +43,11 @@
 # Usage:
 #   ./scripts/build-linux-arm64.sh            # build + verify + stage
 #   ./scripts/build-linux-arm64.sh --no-stage # build + verify only
+#
+#   CODEGRAPH_ALLOW_DIRTY=1 ./scripts/build-linux-arm64.sh
+#       Build from whatever is in the tree, skipping the commit check below.
+#       Implies --no-stage: a binary nobody can trace must not reach the
+#       staging directory, where it would look exactly like a release build.
 
 set -euo pipefail
 
@@ -74,7 +79,9 @@ CHECK_PROVENANCE=1
 if [ "${CODEGRAPH_ALLOW_DIRTY:-0}" = "1" ]; then
   CHECK_PROVENANCE=0
 else
-  EXPECTED_GIT_SHORT="$(git -C "$REPO_ROOT" rev-parse --short HEAD 2>/dev/null || true)"
+  # An explicit length rather than `--short`, whose default the host user's
+  # core.abbrev can change while the container's git has no such setting.
+  EXPECTED_GIT_SHORT="$(git -C "$REPO_ROOT" rev-parse --short=12 HEAD 2>/dev/null || true)"
   if [ -z "$EXPECTED_GIT_SHORT" ]; then
     echo "ERROR: $REPO_ROOT is not a git checkout, so the engine cannot say what" >&2
     echo "produced it. Build from a checkout, or set CODEGRAPH_ALLOW_DIRTY=1 for a" >&2
@@ -222,7 +229,16 @@ if [ "$CHECK_PROVENANCE" = "1" ]; then
       echo "and cannot be traced back to a released commit." >&2
       exit 1 ;;
   esac
-  if [ "$GOT_GIT" != "$EXPECTED_GIT_SHORT" ]; then
+  if [ "${#GOT_GIT}" -lt 7 ]; then
+    echo "ERROR: the binary's stamp '$GOT_GIT' is too short to name a commit." >&2
+    exit 1
+  fi
+  # By prefix: the container's git and the host's git abbreviate independently,
+  # so the same commit can legitimately come back at two different lengths.
+  same_commit=0
+  case "$EXPECTED_GIT_SHORT" in "$GOT_GIT"*) same_commit=1 ;; esac
+  case "$GOT_GIT" in "$EXPECTED_GIT_SHORT"*) same_commit=1 ;; esac
+  if [ "$same_commit" -eq 0 ]; then
     echo "ERROR: the binary claims commit $GOT_GIT, but the host is at" >&2
     echo "$EXPECTED_GIT_SHORT. The release assets would disagree on their source." >&2
     exit 1
@@ -235,9 +251,15 @@ CONTAINER
 BUILT="$BUILD_DIR/release/codegraph-server"
 [ -f "$BUILT" ] || { echo "ERROR: no binary at $BUILT" >&2; exit 1; }
 
-if [ "${1:-}" = "--no-stage" ]; then
+if [ "${1:-}" = "--no-stage" ] || [ "$CHECK_PROVENANCE" -eq 0 ]; then
   echo
   echo "Built (not staged): $BUILT"
+  if [ "$CHECK_PROVENANCE" -eq 0 ]; then
+    echo
+    echo "Not staged: CODEGRAPH_ALLOW_DIRTY=1 skipped the commit check, and an"
+    echo "unverified binary in $STAGE_DIR would be indistinguishable"
+    echo "from a release build. Commit the tree and re-run to stage."
+  fi
   exit 0
 fi
 
@@ -249,5 +271,8 @@ echo "Staged: $STAGE_DIR/$ASSET"
 
 # Provenance is recorded where it is known. publish-release-assets.sh treats an
 # unstamped binary in the staging directory as stale, because vscode/bin/ is not
-# cleaned between releases.
-"$REPO_ROOT/scripts/stamp-binary.sh" "$ASSET" "$VERSION"
+# cleaned between releases, and refuses a set of assets whose commits disagree.
+# The commit is passed rather than read back from the binary: an x86_64 host
+# cannot execute what it just cross-built, and the container already proved this
+# binary agrees with this checkout.
+"$REPO_ROOT/scripts/stamp-binary.sh" "$ASSET" "$VERSION" "$EXPECTED_GIT_SHORT"

scripts/publish-release-assets.sh

@@ -120,14 +120,42 @@ echo
 #
 # Provenance is recorded where it is knowable rather than guessed here: each
 # binary is stamped into MANIFEST by the build that produced it, on the host
-# that could actually run `--version`. Scraping version strings out of a
+# that could actually run `--info`. Scraping version strings out of a
 # cross-platform image was tried and is not reliable - the engine does not
 # store its version as a standalone string on every target, so good binaries
 # were reported as stale.
 MANIFEST="$VSCODE_BIN/BUILD-MANIFEST"
 
+# The binary name is the last field, so a line whose second field is that name
+# is one written before the manifest carried a commit at all.
+manifest_line() {
+  [ -f "$MANIFEST" ] || return 0
+  awk -v b="$1" '$NF == b { print; exit }' "$MANIFEST"
+}
+
+manifest_version() {
+  local line ver
+  line="$(manifest_line "$1")"
+  if [ -n "$line" ]; then
+    read -r ver _ <<< "$line"
+    printf '%s\n' "$ver"
+  fi
+}
+
+manifest_commit() {
+  local line ver commit
+  line="$(manifest_line "$1")"
+  if [ -n "$line" ]; then
+    read -r ver commit _ <<< "$line"
+    if [ "$commit" != "$1" ]; then
+      printf '%s\n' "$commit"
+    fi
+  fi
+}
+
 missing=0
 stale=0
+COMMITS=()
 for bin in "${BINARIES[@]}" "$WINDOWS_SIDECAR"; do
   if [ ! -f "$VSCODE_BIN/$bin" ]; then
     printf '  ✗ %-36s MISSING\n' "$bin"
@@ -143,12 +171,19 @@ for bin in "${BINARIES[@]}" "$WINDOWS_SIDECAR"; do
     continue
   fi
 
-  if [ -f "$MANIFEST" ] && grep -qxF "$VERSION  $bin" "$MANIFEST"; then
-    printf '  ✓ %-36s %s  (%s)\n' "$bin" "$size" "$VERSION"
-  else
-    recorded="$(grep -F "  $bin" "$MANIFEST" 2>/dev/null | awk '{print $1}' | tr '\n' ' ' || true)"
-    printf '  ✗ %-36s %s  NOT STAMPED %s\n' "$bin" "$size" "${recorded:+(manifest says: $recorded)}"
+  recorded_version="$(manifest_version "$bin")"
+  recorded_commit="$(manifest_commit "$bin")"
+
+  if [ "$recorded_version" != "$VERSION" ]; then
+    printf '  ✗ %-36s %s  NOT STAMPED %s\n' \
+      "$bin" "$size" "${recorded_version:+(manifest says: $recorded_version)}"
     stale=1
+  elif [ -z "$recorded_commit" ]; then
+    printf '  ✗ %-36s %s  NO COMMIT RECORDED\n' "$bin" "$size"
+    stale=1
+  else
+    printf '  ✓ %-36s %s  (%s @ %s)\n' "$bin" "$size" "$VERSION" "$recorded_commit"
+    COMMITS+=("$recorded_commit")
   fi
 done
 
@@ -168,20 +203,65 @@ fi
 if [ "$stale" -ne 0 ]; then
   cat >&2 <<EOF
 
-ERROR: at least one binary is not stamped as $VERSION in
+ERROR: at least one binary is not stamped as $VERSION with a source commit in
 $VSCODE_BIN/BUILD-MANIFEST.
 
 vscode/bin/ is not cleaned between releases, so an unstamped binary is assumed
 to be left over from an earlier one. Rebuild it and record it with:
 
-  ./scripts/stamp-binary.sh <name> <version>
+  ./scripts/stamp-binary.sh <name> <version> [commit]
+
+A binary stamped with no commit was recorded before the manifest carried one;
+re-stamp it, from the host that can run it or with the commit stated, so the
+set can be checked for agreement.
 
 Publishing an unverified binary would produce a release whose checksums are
 perfectly valid for the wrong build - the hardest kind of mistake to notice.
 EOF
   exit 1
 fi
 
+# ------------------------------------------------------ one commit, all assets
+# A shared version number is not a shared source. Each platform is built on its
+# own host, so five binaries can all be stamped $VERSION and still come from
+# five different trees - and then a bug reported against $VERSION on Linux and
+# one reported against $VERSION on macOS describe different software under the
+# same name. Compared by prefix: each host's git abbreviates commits to its own
+# length, so the same commit legitimately appears as 7 and 12 hex digits.
+ref_commit=""
+for c in "${COMMITS[@]}"; do
+  if [ -z "$ref_commit" ] || [ "${#c}" -lt "${#ref_commit}" ]; then
+    ref_commit="$c"
+  fi
+done
+
+commit_mismatch=0
+for c in "${COMMITS[@]}"; do
+  case "$c" in "$ref_commit"*) ;; *) commit_mismatch=1 ;; esac
+done
+
+if [ "$commit_mismatch" -ne 0 ]; then
+  {
+    echo
+    echo "ERROR: the staged binaries were not all built from the same commit."
+    echo
+    for bin in "${BINARIES[@]}"; do
+      printf '  %-36s %s\n' "$bin" "$(manifest_commit "$bin")"
+    done
+    cat <<EOF
+
+Everything in one release has to come from one tree, or the tag names a build
+that never existed as a whole. Rebuild the assets that disagree from the commit
+being released - see cross-platform-builds.md for the per-platform hosts - and
+re-stamp them with ./scripts/stamp-binary.sh.
+EOF
+  } >&2
+  exit 1
+fi
+
+echo
+printf '  all %d engine binaries built from %s\n' "${#COMMITS[@]}" "$ref_commit"
+
 # ---------------------------------------------------------------- checksums
 # An engine binary runs on the user's machine with their permissions, so the
 # client verifies what it downloaded. TLS alone does not cover a mirror, a

scripts/stamp-binary.sh

@@ -2,30 +2,39 @@
 # Copyright 2026 Andrey Vasilevsky <anvanster@gmail.com>
 # SPDX-License-Identifier: Apache-2.0
 #
-# Record which version a staged engine binary was built from.
+# Record which version and which commit a staged engine binary was built from.
 #
 # vscode/bin/ is a staging directory that is not cleaned between releases, so a
 # binary left over from an earlier version is indistinguishable from a fresh
 # one by inspection. Scraping the version out of the image does not work
 # reliably across targets - the engine does not store it as a standalone string
 # everywhere, and good binaries get reported as stale.
 #
-# So provenance is recorded at the point where it is actually known: whoever
-# stages a binary states what produced it. publish-release-assets.sh refuses to
-# publish anything not stamped for the version being released.
+# The version alone is not provenance. Five binaries built on five different
+# hosts can all be 0.20.1 and still come from five different trees, which is a
+# release whose assets disagree with each other and with the tag it was cut
+# from. So the commit is recorded beside the version, and
+# publish-release-assets.sh refuses a set that does not agree on one.
+#
+# The commit is taken from the binary itself wherever the staging host can run
+# it: the engine bakes it in at build time and prints it from `--info`, which
+# makes it a measurement rather than a claim. A cross-built asset cannot be
+# executed on the host that stages it, so there it has to be stated.
 #
 # Usage:
-#   ./scripts/stamp-binary.sh codegraph-server-linux-x64 0.20.0
+#   ./scripts/stamp-binary.sh codegraph-server-darwin-arm64 0.20.1
+#   ./scripts/stamp-binary.sh codegraph-server-linux-x64 0.20.1 a1b2c3d4e5f6
 #
 set -euo pipefail
 
-if [ $# -ne 2 ]; then
-  echo "usage: $(basename "$0") <binary-name> <version>" >&2
+if [ $# -lt 2 ] || [ $# -gt 3 ]; then
+  echo "usage: $(basename "$0") <binary-name> <version> [commit]" >&2
   exit 2
 fi
 
 BINARY="$1"
 VERSION="$2"
+COMMIT="${3:-}"
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 BIN_DIR="${CODEGRAPH_BIN_DIR:-$REPO_ROOT/vscode/bin}"
@@ -36,14 +45,72 @@ if [ ! -f "$BIN_DIR/$BINARY" ]; then
   exit 1
 fi
 
+# Two abbreviations of the same commit, made by different git versions on
+# different hosts, differ in length rather than content.
+same_commit() {
+  case "$1" in "$2"*) return 0 ;; esac
+  case "$2" in "$1"*) return 0 ;; esac
+  return 1
+}
+
+# Failure here is the ordinary cross-built case, not an error: a linux binary
+# staged on macOS cannot execute, which is exactly why [commit] exists.
+SELF_REPORTED=""
+if [ -x "$BIN_DIR/$BINARY" ]; then
+  info="$("$BIN_DIR/$BINARY" --info 2>/dev/null || true)"
+  SELF_REPORTED="$(printf '%s\n' "$info" | sed -n '1s/.*(\(.*\)).*/\1/p')"
+fi
+
+if [ -n "$SELF_REPORTED" ] && [ -n "$COMMIT" ] && ! same_commit "$COMMIT" "$SELF_REPORTED"; then
+  echo "ERROR: $BINARY reports commit $SELF_REPORTED, but $COMMIT was given." >&2
+  echo "The binary is the only witness of what actually built it, so the" >&2
+  echo "argument cannot override it. Stage the binary you meant to stage." >&2
+  exit 1
+fi
+
+# They agree by here, so keep whichever abbreviation names the commit more
+# precisely.
+if [ "${#SELF_REPORTED}" -gt "${#COMMIT}" ]; then
+  COMMIT="$SELF_REPORTED"
+fi
+
+if [ -z "$COMMIT" ]; then
+  echo "ERROR: no commit recorded for $BINARY." >&2
+  echo "This host cannot run it, so the commit it was built from has to be" >&2
+  echo "stated. From the checkout it was built on:" >&2
+  echo >&2
+  echo "  $(basename "$0") $BINARY $VERSION \$(git rev-parse --short=12 HEAD)" >&2
+  exit 1
+fi
+
+case "$COMMIT" in
+  unknown*)
+    echo "ERROR: $BINARY reports commit '$COMMIT' - it was built somewhere git" >&2
+    echo "could not be read, so nothing can say which source produced it." >&2
+    exit 1 ;;
+  *-dirty)
+    echo "ERROR: $BINARY reports commit '$COMMIT' - it was built from a modified" >&2
+    echo "tree and cannot be traced back to a released commit." >&2
+    exit 1 ;;
+  *[!0-9a-f]*)
+    echo "ERROR: '$COMMIT' is not a commit hash." >&2
+    exit 1 ;;
+esac
+
+if [ "${#COMMIT}" -lt 7 ]; then
+  echo "ERROR: commit '$COMMIT' is too short to name one commit; use at least 7" >&2
+  echo "hex digits, as \`git rev-parse --short\` produces." >&2
+  exit 1
+fi
+
 touch "$MANIFEST"
 # One line per binary: re-stamping replaces the previous entry rather than
 # appending, so the manifest can never claim two versions for one file.
 tmp="$(mktemp)"
 grep -vF "  $BINARY" "$MANIFEST" > "$tmp" 2>/dev/null || true
-printf '%s  %s\n' "$VERSION" "$BINARY" >> "$tmp"
-sort -k2 "$tmp" > "$MANIFEST"
+printf '%s  %s  %s\n' "$VERSION" "$COMMIT" "$BINARY" >> "$tmp"
+sort -k3 "$tmp" > "$MANIFEST"
 rm -f "$tmp"
 
-echo "Stamped $BINARY as $VERSION"
+echo "Stamped $BINARY as $VERSION ($COMMIT)"
 cat "$MANIFEST"