ci: cache pinned just release in Garage S3 (just/ prefix)
just.systems/install.sh downloads the just binary from
github.com/casey/just/releases/, which 502'd on #136. Same pattern as
go: pin JUST_VERSION=1.51.0, cache the release tarball, fall back to
GitHub on cache miss with --retry 3 --max-time 60. As a bonus the
version is now pinned (was floating-latest before).
S3 key: s3://docker-cache/just/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz
Pre-seeded the 1.51.0 tarball into S3 manually so the first run hits
cache immediately.
ci: cache Go tarball in Garage S3 (golang/ prefix)
go.dev/dl sometimes times out on the build VM. Cache Go in S3 keyed
by version: s3://docker-cache/golang/go${GO_VERSION}.linux-amd64.tar.gz.
- Cache HIT: pull from S3 (LAN, fast)
- Cache MISS: curl from go.dev with --retry 3 --max-time 300, install,
upload to S3 for next time
Applied to all three manifests. pure-lua.yml and c-enabled.yml now also
require S3 credentials, which slightly couples them to the same fate as
conformance.yml — acceptable tradeoff for the reliability gain since
the same flaky go.dev pull was the root cause.
ci: rotate S3 secret UUIDs after Garage key regen
Previous key (GKbe2275ca…) had a signature mismatch — secret pasted
into srht didn't match what Garage held. New key generated on Garage
and registered as two file secrets (s3-cache-key-id / s3-cache-key-
secret) at builds.srht.bigb.es/secrets.
ci: defensive whitespace strip on S3 secrets + length diagnostics
"Invalid signature" from Garage on #123. tr -d '[:space:]' strips any
trailing CR or whitespace that $(cat) preserves (cat only chops the
final \n). Add length-only diagnostics so the next failure mode is
distinguishable: a well-formed Garage v2.2 access key is GK + 24 hex
(26 chars); secret is typically 40 hex chars. Anything else points at
a registration swap or upstream corruption.
ci: install awscli v2 from upstream (noble dropped the system package)
Ubuntu noble removed the unmaintained 'awscli' v1 package; apt install
fails with 'no installation candidate'. Switch to the official v2
installer (curl + unzip + ./aws/install).
Also add AWS_REQUEST/RESPONSE_CHECKSUM env vars set to 'when_required'
— boto3 1.36+ defaults to sending CRC32 trailing checksums on every
PutObject, which older Garage releases don't validate. Disabling them
for non-mandatory operations keeps us compatible across the matrix.
Caught by srht job 121.
ci: conformance suite with Garage S3 image cache (7lf)
Two new srht.bigb.es manifests:
.builds/conformance.yml — auto-submits on push to master/tags. Pulls
the conformance Docker image from s3://docker-cache/ keyed by
sha256(docker/conformance.Dockerfile); on cache miss, builds it and
uploads. Runs both 'just conformance' and the C-runtime variant
against the cached image.
.builds/conformance-image-rebuild.yml — manual-submit only
(allow-refs: []). Force-rebuilds with --no-cache --pull and replaces
the S3 object. Use when the cached image needs refresh without a
Dockerfile change (base-image CVE, host docker upgrade, corrupted
upload).
Garage S3 specifics:
- addressing_style = path (Garage doesn't do virtual-host)
- signature_version = s3v4 (Garage rejects SigV2)
- region = garage (matches phoebe-lab/garage/config/garage.toml.tmpl)
- head-object for cache-hit check (s3 ls returns exit 0 on missing
keys; head-object 404s cleanly)
- Endpoint https://s3.bigb.es works from the build worker because
srht-build-1 (192.168.88.128) is in Authelia's *.bigb.es LAN-bypass
range (192.168.88.0/24)
Credentials come from two file secrets registered at
https://builds.srht.bigb.es/secrets, mounted as ~/.s3-cache-key-id and
~/.s3-cache-key-secret. Loaded under 'set +x' and persisted to
~/.buildenv via printf %q so subsequent tasks pick them up without
re-tracing.
The bucket 'docker-cache' and its bound key must exist on Garage with
read+write permission for the supplied access key — first push will
fail at the smoke-test 'aws s3 ls' line otherwise. (7lf)
ci: install Go 1.26 toolchain + cmake on builds.srht
Ubuntu noble's `golang` apt package is too old to satisfy go.mod's
toolchain directive — `go build` aborted with "toolchain not available".
Drop the apt package, install the official Go 1.26.3 tarball into
~/.local/go, and update go.mod / bench/go/go.mod accordingly. Also add
cmake + build-essential so `tt rocks install luatest` can build its
`checks` dependency.
c-accel: arch prereqs — compat contract, C-side strategy, build scaffolding
Three companion specs under docs/specs/ formalize the boundaries
established in docs/c-accel.md, unblocking bd-mq7 (descriptor → C
plan compiler):
* c_accel_compat.md (bd-47e) — pinpoints what must stay byte-equal
between PB_ENABLE_C unset and =1: public surface, generated
module wrappers, 64-bit cdata, WKT shapes, unknown fields,
extensions, errors. Calls out the lazy-view exclusion.
* c_accel_strategy.md (bd-z7x) — pb_plan struct layout, field-name
luaL_ref caching, 4 KB stack-backed pb_buf, cached per-field
stack indices (the 2× win from spike Phase B), sub-buffer over
backpatching, map/oneof/unknown handling.
* c_accel_build_packaging.md (bd-wky) — where the C module lives
(runtime/pb/c/), how it builds, what the rockspec gains, the CI
matrix shape.
Scaffolding that lands now:
* runtime/pb/init.lua — PB_ENABLE_C=1 opt-in pcall hook; the
loaded module (or nil) is exposed as pb.c_runtime for
introspection. Silent fallback when the module is absent.
* Justfile — `build-c` / `clean-c` recipes (stub erroring cleanly
until bd-ra6 lands runtime/pb/c/), new lua_cpath constant,
LUA_CPATH wired through `test` and `test-one`.
* .builds/{pure-lua,c-enabled}.yml — sourcehut CI manifests, one
per activation mode (sourcehut has no matrix; parallel jobs go
in separate files). ubuntu/noble images.
* .sourcehut/conformance.yml — outside .builds/ so it doesn't
auto-submit; trigger manually with `hut builds submit` before
releases.
* .gitignore — runtime/pb/c_runtime.{so,dylib} and runtime/pb/c/*.o.
745/745 tests pass with PB_ENABLE_C unset and PB_ENABLE_C=1
(silent fallback verified).
Closes bd-47e, bd-z7x, bd-wky. Unblocks bd-mq7.