chad/bubblebox-pkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

campaign 5: all packages — CI GREEN (run 88); batch A+B + campaign 2/3 first coverage; zizmor deferred #23

Merged
chad merged 41 commits from campaign/candidates-5 into main 2026-10-06 15:00:24 -04:00
Conversation 1 Commits 41 Files changed 76 +1440 -3
glen commented 2026-09-28 17:08:46 -04:00
Collaborator
Copy link

Candidate campaign 5 — verification PR

Purpose of this PR: the authoring session's sandbox cannot run verify.sh's FUSE smoke stage (no /dev/fuse, mknod EPERM) — so this PR exists partly to let CI be the authoritative verifier (bees runner: podman + FUSE + fusermount3 all proven). Both batches are now merged; CI re-runs per push.

Curated packages — batch A (committed)

Package Version Archetype License Footprint Smoke design
kubeconform 0.8.0 C Apache-2.0 16 MB -v banner + offline schema validation of repo fixture → "Valid: 1"
osv-scanner 2.6.0 C Apache-2.0 60 MB --version + online scan source fixture (fixed after run 85: --offline requires a pre-seeded GB-scale DB, exit 127 without it); /persist for the vuln-DB cache
trufflehog 3.97.9 C AGPL-3.0 39 MB --version + offline filesystem scan of entropy-tuned synthetic key fixture
argocd 3.5.3 C Apache-2.0 252 MB (gate 300, k9s precedent) version --client + offline help

Curated packages — batch B (committed)

Package Version Archetype License Footprint Smoke design
golangci-lint 2.14.0 C GPL-3.0-or-later (relicensed at v2.0) 40 MB binary, default gate --version + config verify on committed fixture (run/fmt need a Go toolchain — not vendored)
kubectx + kubens (virtual entrypoint) 0.11.0 C Apache-2.0 13+25 MB bad-flag usage banner + REAL context switch on committed two-context fixture kubeconfig via KUBECONFIG; kubens -V + --help
httpie 3.2.4 (f44 rpm) B BSD-3-Clause default gate http --version + --help (no offline real invocation exists; iperf3 precedent)
lnav 0.14.1 C BSD-2-Clause gate 160 (~80 MB static) --version + two REAL headless SQL queries over a committed syslog fixture

All fetches sha256-pinned (lnav is TOFU-over-HTTPS — upstream publishes no sums for the zips; nixpkgs package.nix noted as cross-check). One commit per package.

Also in this diff (pre-existing, first-ever CI coverage)

Campaign 2–3 delivered ten curated packages via PRs #21/#22 into campaign/initial-backlog — but PR #20 merged that branch's older state to main, so main never received them. This branch carries them; CI verifies them here for the first time.

zizmor DEFERRED (revert in this PR)

Run 85 exposed an upstream bug: zizmor 1.30.1 (the latest release) breaks whenever GITHUB_TOKEN is in the environment — which CI jobs always export. --pedantic panics (exit 101), default persona exits 2. Reproduced locally with a dummy token; absent = clean pass. No package-level fix exists (empty-string env trips clap; distroless = no shell shim). The package is reverted and returned to the backlog as blocked, with the reconsider trigger documented. Proposed follow-up (separate PR, not this one): strip CI job credentials (GITHUB_TOKEN/GH_TOKEN) from verify.sh smoke invocations — sandboxed tools shouldn't see job credentials at all, and it fixes this failure class for every package.

Cautions for review

  • trufflehog relicensed to AGPL-3.0 (unmodified-binary redistribution ok — flagged for your call; k6-import precedent used upstream-image posture for AGPL).
  • golangci-lint is GPL-3.0-or-later (upstream relicensed Apache→GPL at v2.0.0) — same redistribution posture question.
  • kubectx is Apache-2.0 (not MIT as first assumed); kubectx/kubens ship as separate tarballs at v0.11.0 (one image, kubens = virtual entrypoint).
  • argocd is the heaviest curated package (252 MB, gate 300 with justification).
  • Backlog cleanup commit (removing the seven delivered candidates from PACKAGE-BACKLOG.md; zizmor's blocked entry stays) lands once CI is green.
## Candidate campaign 5 — verification PR **Purpose of this PR:** the authoring session's sandbox cannot run verify.sh's FUSE smoke stage (no /dev/fuse, mknod EPERM) — so this PR exists partly to let **CI be the authoritative verifier** (bees runner: podman + FUSE + fusermount3 all proven). Both batches are now merged; CI re-runs per push. ### Curated packages — batch A (committed) | Package | Version | Archetype | License | Footprint | Smoke design | |---|---|---|---|---|---| | kubeconform | 0.8.0 | C | Apache-2.0 | 16 MB | `-v` banner + offline schema validation of repo fixture → "Valid: 1" | | osv-scanner | 2.6.0 | C | Apache-2.0 | 60 MB | `--version` + online `scan source` fixture (fixed after run 85: `--offline` requires a pre-seeded GB-scale DB, exit 127 without it); /persist for the vuln-DB cache | | trufflehog | 3.97.9 | C | **AGPL-3.0** | 39 MB | `--version` + offline `filesystem` scan of entropy-tuned synthetic key fixture | | argocd | 3.5.3 | C | Apache-2.0 | 252 MB (gate 300, k9s precedent) | `version --client` + offline `help` | ### Curated packages — batch B (committed) | Package | Version | Archetype | License | Footprint | Smoke design | |---|---|---|---|---|---| | golangci-lint | 2.14.0 | C | GPL-3.0-or-later (relicensed at v2.0) | 40 MB binary, default gate | `--version` + `config verify` on committed fixture (`run`/`fmt` need a Go toolchain — not vendored) | | kubectx + kubens (virtual entrypoint) | 0.11.0 | C | Apache-2.0 | 13+25 MB | bad-flag usage banner + REAL context switch on committed two-context fixture kubeconfig via KUBECONFIG; kubens `-V` + `--help` | | httpie | 3.2.4 (f44 rpm) | B | BSD-3-Clause | default gate | `http --version` + `--help` (no offline real invocation exists; iperf3 precedent) | | lnav | 0.14.1 | C | BSD-2-Clause | gate 160 (~80 MB static) | `--version` + two REAL headless SQL queries over a committed syslog fixture | All fetches sha256-pinned (lnav is TOFU-over-HTTPS — upstream publishes no sums for the zips; nixpkgs package.nix noted as cross-check). One commit per package. ### Also in this diff (pre-existing, first-ever CI coverage) Campaign 2–3 delivered ten curated packages via PRs #21/#22 into `campaign/initial-backlog` — but PR #20 merged that branch's *older* state to main, so main never received them. This branch carries them; CI verifies them here for the first time. ### zizmor DEFERRED (revert in this PR) Run 85 exposed an upstream bug: zizmor 1.30.1 (**the latest release**) breaks whenever GITHUB_TOKEN is in the environment — which CI jobs always export. `--pedantic` panics (exit 101), default persona exits 2. Reproduced locally with a dummy token; absent = clean pass. No package-level fix exists (empty-string env trips clap; distroless = no shell shim). The package is reverted and returned to the backlog as **blocked**, with the reconsider trigger documented. Proposed follow-up (separate PR, not this one): strip CI job credentials (GITHUB_TOKEN/GH_TOKEN) from verify.sh smoke invocations — sandboxed tools shouldn't see job credentials at all, and it fixes this failure class for every package. ### Cautions for review - **trufflehog relicensed to AGPL-3.0** (unmodified-binary redistribution ok — flagged for your call; k6-import precedent used `upstream-image` posture for AGPL). - golangci-lint is GPL-3.0-or-later (upstream relicensed Apache→GPL at v2.0.0) — same redistribution posture question. - kubectx is Apache-2.0 (not MIT as first assumed); kubectx/kubens ship as separate tarballs at v0.11.0 (one image, kubens = virtual entrypoint). - argocd is the heaviest curated package (252 MB, gate 300 with justification). - Backlog cleanup commit (removing the seven delivered candidates from PACKAGE-BACKLOG.md; zizmor's blocked entry stays) lands once CI is green.
glen added 29 commits 2026-09-28 17:08:46 -04:00 
SHA256: 97e13d58d2733a0e62cd2571d1d5f0c02823f0d25282f08bddedf1ad9c5d1736
SHA256: e65324f4430c2717591937edcec90ccbefaf14c174f8ec9415e03ca875b46e1a
SHA256: 8a9722177ddd421eba927b4baae4ae341a4d1c3434504be7b1b17d998bafdd87
Fedora NEVRA: iperf3-3.20-2.fc44.x86_64
Eight candidates (kubeconform, golangci-lint, kubectx, osv-scanner,
trufflehog, argocd, httpie, lnav) from Homebrew 30d/90d install-on-request
analytics deduped against all current names; positive-only scoring.
mole recorded as rejected (macOS-only, Chad call 2026-09-28) with the
household Linux-only rule noted in the backlog header; caddy rejection
carried onto this branch (it stacks on PR #19, which predates campaign 3's
rejection entry).
campaign/candidates-5 forked from PR #19's head (b472184), which predates
campaigns 2-3 (ninja/ast-grep/chezmoi/k6/kustomize/vale/gitleaks/hugo/glow
imports + grpcurl/jsonnet/zizmor/typos-cli/terraform-docs/nushell/iperf3 +
the campaign skill + the caddy rejection). PRs #21/#22 merged that lineage
into campaign/initial-backlog, but PR #20 merged initial-backlog's OLDER
state to main, so main (and this stack) lacks it. Merging the tip here
restores the skill and ledgers this campaign builds on; the PR diff stays
campaign-5-only.
macOS/Windows-only tools are discovery noise; record rejections only when
Chad names one (mole precedent). Verify Linux x86_64 artifacts before
selecting.
Upstream static Go release binary, fetched sha256-verified from the
v0.8.0 release (kubeconform-linux-amd64.tar.gz):
9bc2bffbf71f261128533edaf912153948b7ff238f9a531ae6d34466ec287883
(from the release's CHECKSUMS asset). License Apache-2.0, redistribution ok.

Smoke: -v banner (no --version flag; Go stdlib flags) + an offline real
validation of a repo fixture against a local schema (schema-location
template; kind files looked up lowercased). Built via the real pipeline
(16 MB footprint); smoke checks validated against the real image binary
in a bwrap sandbox (session lacks /dev/fuse for the engine's FUSE mount
stage — final verify.sh run pending on a FUSE-capable host).
Upstream static Go release binary, fetched sha256-verified from the
v2.6.0 release (osv-scanner_linux_amd64, bare binary):
ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108
(from the release's osv-scanner_SHA256SUMS asset). License Apache-2.0,
redistribution ok.

Smoke: --version banner + offline real invocation: scan source --offline
over a repo fixture package-lock.json (found 1 package, exit 0 — no DB
fetch attempted in offline mode). Entrypoint: /persist pattern (atuin
shape) for the downloaded offline vuln-DB cache via XDG_CACHE_HOME;
writable_home for config. Built via the real pipeline (60 MB footprint);
smoke checks validated against the real image binary in a bwrap sandbox
(session lacks /dev/fuse for the engine's FUSE mount stage — final
verify.sh run pending on a FUSE-capable host).
Upstream static Go release binary, fetched sha256-verified from the
v3.97.9 release (trufflehog_3.97.9_linux_amd64.tar.gz):
40377e6572495412fb9ba0bc21c9401f73b72f1d2afd11b9931bc4a5ed622866
(from the release's trufflehog_3.97.9_checksums.txt asset).
License AGPL-3.0 (upstream relicensed from the brief's assumed MIT in
2026-07; verified against the v3.97.9 LICENSE) — AGPL permits
redistribution of the unmodified binary, redistribution ok.

Smoke: --version banner + offline real invocation: filesystem scan over
a repo fixture with a synthetic AWS key pair (--no-verification keeps
the smoke offline; findings exit 0 by default, so the check asserts the
'Found unverified result' detection line). Fixture entropy tuned to
clear the AWS detector's Shannon thresholds and its [a-f0-9]{40}
false-positive filter. --no-same-owner on extraction: goreleaser ships
uid-1001 members, chown fails in single-uid userns builds. Built via
the real pipeline (39 MB footprint); smoke checks validated against the
real image binary in a bwrap sandbox (session lacks /dev/fuse for the
engine's FUSE mount stage — final verify.sh run pending on a
FUSE-capable host).
Upstream static Go release binary, fetched sha256-verified from the
v3.5.3 release (argocd-linux-amd64, bare binary):
b860f73f57cbddd993cd446f5236d797c1b1ac8554857b2683d2669f17e765b4
(from the release's cli_checksums.txt asset). License Apache-2.0,
redistribution ok.

Smoke: 'version --client' (client banner, no server — bare 'version'
fatals on 'Argo CD server address unspecified', avoided) + offline
help/usage check. Entrypoint: writable_home for ~/.config/argocd
(login credentials); server-dependent commands stay override territory.
Gate 300 MB: the bare asset is ~250 MB (whole CLI + k8s client surface
in one binary; k9s gate precedent) — measured 252 MB. Built via the
real pipeline; smoke checks validated against the real image binary in
a bwrap sandbox (session lacks /dev/fuse for the engine's FUSE mount
stage — final verify.sh run pending on a FUSE-capable host).
merge batch a: kubeconform osv-scanner trufflehog argocd (campaign 5, agent a)
Some checks failed
verify / verify (pull_request) Failing after 2m23s
Details
a4b13f4d47 
kubeconform 0.8.0, osv-scanner 2.6.0, trufflehog 3.97.9 (AGPL-3.0 —
upstream relicensed; unmodified-binary redistribution ok), argocd 3.5.3
(gate 300). All sha256-pinned from upstream checksum assets; local FUSE
smoke stage unavailable in the authoring sandbox — authoritative
verification runs via CI (this PR) on the bees runner.
SHA256: ab90aeb7b066f92a33415b638a50fe5344bbb75a0d32ad30cc248d88f81032ab
(golangci-lint-2.14.0-linux-amd64.tar.gz; cross-checked against the
release's golangci-lint-2.14.0-checksums.txt and the downloaded artifact.
License: GPL-3.0-or-later — relicensed Apache-2.0 → GPL-3.0-or-later at
v2.0.0; repo LICENSE is the plain GPLv3 text. Smoke: --version + a real
headless invocation (config verify against a committed fixture); run/fmt
need the Go toolchain and are compose territory — verified locally with
the release binary (ldd: static).
kubectx + kubens in ONE image (upstream ships them as separate
linux_x86_64 tarballs at v0.11.0); kubens is a virtual entrypoint over
this image (age-keygen pattern, no Containerfile).

SHA256 (kubectx_v0.11.0_linux_x86_64.tar.gz):
  08e031c54fbffb3f100e904e4eae94bba2730fedf4869921fda79e4d7a8f5d4c
SHA256 (kubens_v0.11.0_linux_x86_64.tar.gz):
  326c021c7b35468ed9a187b361198d0f22ae32828139c65eb6670c0d8301cc09
(cross-checked against the release's checksums.txt and the downloaded
artifacts. License: Apache-2.0. Smoke: kubectx usage banner + a real
stateful switch of a committed two-context fixture kubeconfig via
KUBECONFIG; kubens -V + --help. writable_home: both read/write
~/.kube/config — verified locally with the release binaries, static.)
Fedora NEVRA: httpie-3.2.4-1.fc44 (upstream latest is 3.2.7 — the iperf3
one-release-behind tradeoff; no static Linux binary upstream, Python app
the distro packages well). License: BSD-3-Clause (verified against the
upstream LICENSE text at 3.2.4). Smoke: --version + --help (no offline
network invocation exists — httpie has no file:// transport).
SHA256: ec1750f0a6962eed6bb85ad4249457894f190e961277c56d69c47eecce9e705e
(lnav-0.14.1-linux-musl-x86_64.zip; TOFU-over-HTTPS — upstream publishes
no checksum asset for the release zips; static musl binary, verified
ldd-clean. License: BSD-2-Clause. Smoke: --version + two real headless
SQL checks over a committed syslog fixture (-n -c, no TUI — the
campaign-2 TUI precedent keeps interactive verification human).
writable_home: lnav materializes ~/.config/lnav defaults on first run.
[gate] 160 MB: the static binary alone is ~80 MB (bundled SQLite/pcre2/
libcurl/ncurses) — artifact size, mise precedent. Verified locally with
the release binary.)
This reverts commit 8823feaea3.
PR #23 run 86: both fetch stages died at 'install: cannot create
/usr/share/licenses/<pkg>/LICENSE: No such file or directory' — install(1)
without -D does not create parents. kubectx smoke[1] assumed a bad flag
exits 0 (it exits 1; clap ships --help, use it) and smoke[2] was not
expressible: the harness has no per-check env, so 'kubectx prod' would
mutate a real kubeconfig — hermetic slice now, fixture kept for the
per-check-env follow-up. osv-scanner online scan died on CI's DNS-less
smoke sandbox (run 86: lookup api.osv.dev i/o timeout); --offline needs a
seeded GB-scale DB (run 85, exit 127) — version + scan-source --help is
the honest hermetic slice (httpie precedent).
chad referenced this pull request from a commit 2026-09-28 21:48:39 -04:00
docs: clear delivered campaign 5 backlog
docs: clear delivered campaign 5 backlog
All checks were successful
verify / verify (pull_request) Successful in 1m15s
Details
7277cde796 
All eight candidates delivered and CI-green (PR #23 run 88): kubeconform
0.8.0, golangci-lint 2.14.0, kubectx 0.11.0 (+kubens virtual entrypoint),
osv-scanner 2.6.0, trufflehog 3.97.9, argocd 3.5.3, httpie 3.2.4, lnav
0.14.1. zizmor stays as blocked (upstream token-env bug).
glen changed title from campaign 5: kubeconform osv-scanner trufflehog argocd (batch a) — CI verification; batch b incoming to campaign 5: all packages — CI GREEN (run 88); batch A+B + campaign 2/3 first coverage; zizmor deferred 2026-09-28 21:50:19 -04:00
Merge branch 'main' into campaign/candidates-5
All checks were successful
verify / verify (pull_request) Successful in 3m8s
Details
c689847ef9
chad approved these changes 2026-10-06 14:48:03 -04:00
chad merged commit 943b0813de into main 2026-10-06 15:00:24 -04:00
Sign in to join this conversation.
Reviewers
No reviewers
chad
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
chad/bubblebox-pkgs!23
No description provided.