Files
rea/scripts/verify-packed-bridge.mjs
Ysopwnableandabdooo2235 f0d175dace fix(verifiers): read packed bridge without extraction
Parse only the exact regular packed Python bridge member without extracting into the caller-owned private runtime root. Preserve required Ghidra admission, typed callers, native lease ownership and cleanup on success or failure.

Validation: 263 focused real tar/Python/ownership and CI selection checks, 42 official WABT packaged CLI/MCP cases, full check:ci/check:fast/actionlint, real-package alternating measurements and exact-head hosted CI passed. The required Windows lane exercises the retained native lease without skipping missing authority.

Fixes #4134.

Co-authored-by: abdooo2235 <abdalrhmantheiv15@gmail.com>
2026-10-17 10:35:31 +00:00

36 lines
1.3 KiB
JavaScript

import { execFile } from "node:child_process";
import { promisify } from "node:util";
import { GHIDRA_BRIDGE_SOURCES } from "../src/ghidra/GhidraBridgeSources.ts";
const exec = promisify(execFile);
const packedHopperBridge = "package/bridge/hopper_bridge.py";
const packedCutterBridge = "package/bridge/cutter/rea_bridge.py";
/** Check shipped bridge files; real-provider lanes verify runtime behavior. */
export async function verifyPackedBridge({ tarball, packedFiles }) {
for (const path of [
packedHopperBridge,
packedCutterBridge,
...Object.values(GHIDRA_BRIDGE_SOURCES).map(
(name) => `package/bridge/ghidra/${name}`,
),
]) {
if (!packedFiles.includes(path)) throw new Error(`package omitted ${path}`);
}
// Read the packed source without extracting into the caller's leased root.
await exec("python3", [
"-c",
[
"import ast, sys, tarfile",
"with tarfile.open(sys.argv[1]) as archive:",
" member = archive.getmember(sys.argv[2])",
" if not member.isfile():",
" raise ValueError(f'{member.name} is not a regular file')",
" with archive.extractfile(member) as source:",
" ast.parse(source.read().decode('utf-8'), filename=sys.argv[2])",
].join("\n"),
tarball,
packedHopperBridge,
]);
}