Skip to content

release(0.5.107): verify-FFI fold (#232) + canonical boot-prime (#238) — adopt persist v15.1.2 / verify v9.0.2 / edge v10.1.2 #240

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
emooreatx merged 2 commits into from
Jul 12, 2026
Merged

release(0.5.107): verify-FFI fold (#232) + canonical boot-prime (#238) — adopt persist v15.1.2 / verify v9.0.2 / edge v10.1.2 #240

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e544412
release(0.5.107): verify-FFI fold (#232) + canonical boot-prime (#238…
emooreatx Jul 12, 2026
fc122e7
ci: run the Verify-FFI fold smoke on every PR (conformance linux whee…
emooreatx Jul 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 63 additions & 0 deletions .github/workflows/build-wheels.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,27 @@ jobs:
pip install "maturin>=1.7,<2"
maturin build --release --strip --out dist
sccache --show-stats
- name: Verify-FFI fold smoke (CIRISServer#232 — symbols must survive the linker strip)
shell: bash
run: |
python -m pip install --force-reinstall --no-deps dist/*.whl
python - <<'PY'
import ctypes, ciris_server
p = ciris_server.verify_ffi_path()
print("verify_ffi_path ->", p)
lib = ctypes.CDLL(p)
need = [
"ciris_verify_ffi_link_anchor", "ciris_verify_jcs_canonicalize",
"ciris_verify_self_enc_pubkeys", "ciris_verify_self_enc_respond",
"ciris_verify_wrap_dek_for_recipient", "ciris_verify_unwrap_dek",
"ciris_verify_kex_respond_hybrid_with_public",
"ciris_verify_create_federation_identity",
"ciris_verify_locale_merkle_root", "ciris_verify_admit_attestation",
]
missing = [s for s in need if not hasattr(lib, s)]
assert not missing, "verify FFI symbols MISSING from _native (linker --gc-sections stripped the fold): %s" % missing
print("OK - verify FFI folded: %d symbols resolvable via ctypes from the built wheel" % len(need))
PY
- uses: actions/upload-artifact@v4
with:
name: wheels-${{ matrix.plat.name }}
Expand Down Expand Up @@ -269,6 +290,27 @@ jobs:
# backend), warmed on main by warm-release-cache.yml calling this same
# workflow. Restores main-scoped sccache objects on a tag publish.
sccache: true
- name: Verify-FFI fold smoke (CIRISServer#232 — symbols must survive the linker strip)
shell: bash
run: |
python -m pip install --force-reinstall --no-deps dist/*.whl
python - <<'PY'
import ctypes, ciris_server
p = ciris_server.verify_ffi_path()
print("verify_ffi_path ->", p)
lib = ctypes.CDLL(p)
need = [
"ciris_verify_ffi_link_anchor", "ciris_verify_jcs_canonicalize",
"ciris_verify_self_enc_pubkeys", "ciris_verify_self_enc_respond",
"ciris_verify_wrap_dek_for_recipient", "ciris_verify_unwrap_dek",
"ciris_verify_kex_respond_hybrid_with_public",
"ciris_verify_create_federation_identity",
"ciris_verify_locale_merkle_root", "ciris_verify_admit_attestation",
]
missing = [s for s in need if not hasattr(lib, s)]
assert not missing, "verify FFI symbols MISSING from _native (linker --gc-sections stripped the fold): %s" % missing
print("OK - verify FFI folded: %d symbols resolvable via ctypes from the built wheel" % len(need))
PY
- uses: actions/upload-artifact@v4
with:
name: wheels-macos-${{ matrix.target }}
Expand Down Expand Up @@ -368,6 +410,27 @@ jobs:
# Compiler cache (sccache over the GHA backend), warmed on main via
# warm-release-cache.yml. Restore-on-tag; harmless otherwise.
sccache: true
- name: Verify-FFI fold smoke (CIRISServer#232 — symbols must survive the linker strip)
shell: bash
run: |
python -m pip install --force-reinstall --no-deps dist/*.whl
python - <<'PY'
import ctypes, ciris_server
p = ciris_server.verify_ffi_path()
print("verify_ffi_path ->", p)
lib = ctypes.CDLL(p)
need = [
"ciris_verify_ffi_link_anchor", "ciris_verify_jcs_canonicalize",
"ciris_verify_self_enc_pubkeys", "ciris_verify_self_enc_respond",
"ciris_verify_wrap_dek_for_recipient", "ciris_verify_unwrap_dek",
"ciris_verify_kex_respond_hybrid_with_public",
"ciris_verify_create_federation_identity",
"ciris_verify_locale_merkle_root", "ciris_verify_admit_attestation",
]
missing = [s for s in need if not hasattr(lib, s)]
assert not missing, "verify FFI symbols MISSING from _native (linker --gc-sections stripped the fold): %s" % missing
print("OK - verify FFI folded: %d symbols resolvable via ctypes from the built wheel" % len(need))
PY
- uses: actions/upload-artifact@v4
with:
name: wheels-windows-x64
Expand Down
30 changes: 30 additions & 0 deletions .github/workflows/conformance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,36 @@ jobs:
maturin build --release --strip --out dist
ls -l dist/
sccache --show-stats
# ── Verify-FFI fold smoke (CIRISServer#232) ──────────────────────────────
# The same assertion build-wheels.yml runs on the macOS/Windows legs at
# release time — repeated HERE so it gates every PR/push on linux too, and
# so the smoke script itself is exercised long before it can fail a publish.
# We fold ciris-verify-ffi (rlib) into _native.so, but NOTHING in our Rust
# calls its #[no_mangle] fns (the agent reaches them via ctypes at runtime),
# so --gc-sections would happily dead-strip all ~84 ciris_verify_* symbols —
# per-platform-silently. Load the built wheel exactly the way the agent will
# and assert the surface actually resolves.
- name: Verify-FFI fold smoke (CIRISServer#232 — symbols must survive the linker strip)
shell: bash
run: |
python -m pip install --force-reinstall --no-deps dist/*.whl
python - <<'PY'
import ctypes, ciris_server
p = ciris_server.verify_ffi_path()
print("verify_ffi_path ->", p)
lib = ctypes.CDLL(p)
need = [
"ciris_verify_ffi_link_anchor", "ciris_verify_jcs_canonicalize",
"ciris_verify_self_enc_pubkeys", "ciris_verify_self_enc_respond",
"ciris_verify_wrap_dek_for_recipient", "ciris_verify_unwrap_dek",
"ciris_verify_kex_respond_hybrid_with_public",
"ciris_verify_create_federation_identity",
"ciris_verify_locale_merkle_root", "ciris_verify_admit_attestation",
]
missing = [s for s in need if not hasattr(lib, s)]
assert not missing, "verify FFI symbols MISSING from _native (linker --gc-sections stripped the fold): %s" % missing
print("OK - verify FFI folded: %d symbols resolvable via ctypes from the built wheel" % len(need))
PY
- uses: actions/upload-artifact@v4
with:
name: ciris_server-wheel-linux-x86_64
Expand Down
Loading
Loading