mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 16:11:29 +00:00
shankar0123
8e84527ba2
CI's cross-platform-build (windows-latest) job has been red for
several runs:
internal/deploy/ownership.go:205 — undefined: syscall.Stat_t
Root cause:
`syscall.Stat_t` is the Unix-specific POSIX stat-struct shape
(linux / darwin / freebsd / openbsd / netbsd / dragonfly /
solaris all expose it). On Windows GOOS, the syscall package
defines `syscall.Win32FileAttributeData` instead, which carries
no uid/gid fields. Any production tsx that names `syscall.Stat_t`
unconditionally fails to compile on GOOS=windows.
The function was added pre-cross-platform-matrix and never had
to compile for Windows; CI's `cross-platform-build` job (added
by Phase 3 TEST-H2) is what surfaced it. The ubuntu / macos
matrix runs stayed green because both GOOSes expose the type.
Fix (standard Go per-platform build-tag split):
Move `unixOwnerFromStat(fi os.FileInfo) (uid, gid int, ok bool)`
out of ownership.go into per-OS sibling files:
internal/deploy/ownership_unix.go //go:build unix
internal/deploy/ownership_windows.go //go:build windows
ownership_unix.go: same impl as before. Uses `syscall.Stat_t`.
Covers every Unix-y GOOS via Go 1.19+'s `unix` build constraint
(linux + darwin + freebsd + openbsd + netbsd + dragonfly +
solaris).
ownership_windows.go: stub that returns (-1, -1, false). Windows
has no native uid/gid; file ownership is expressed via SIDs +
ACLs (`syscall.Win32FileAttributeData`), which the deploy
package's call sites can't translate into uid/gid anyway. All
four callers — applyOwnership (ownership.go:75),
preserveSourceOwner (atomic.go:237), and two test sites — ALREADY
handle ok=false by falling back to Plan.Defaults / runtime
umask. Stub returning false is the correct platform contract.
ownership.go: drop the `syscall` import (no longer needed there)
+ replace the function body with a doc comment pointing to the
per-OS files so future readers know where the impl lives.
Note: the agent binary still compiles + runs on Windows; the
chown/chmod codepaths in the deploy package gate on
`runningAsRoot()` (os.Geteuid() == 0) which is also Unix-only in
practice — Windows agents run as a service under a SID that
doesn't translate to a uid anyway, so ownership operations on
Windows naturally no-op.
Verification (Go toolchain wired in sandbox, sub-platform builds
ran locally):
• gofmt -l on all three touched files — clean
• GOOS=linux GOARCH=amd64 go build ./internal/deploy/... — exit 0
• GOOS=darwin GOARCH=amd64 go build ./internal/deploy/... — exit 0
• GOOS=windows GOARCH=amd64 go build ./internal/deploy/... — exit 0
• GOOS=windows GOARCH=amd64 go build ./cmd/{server,agent,cli,mcp-server}/...
— exit 0 (all four CI matrix targets)
• go vet ./internal/deploy/... — exit 0
• staticcheck ./internal/deploy/... — zero findings
• go test -short -count=1 ./internal/deploy/... — ok 0.216s (the
four callers' tests all still pass on Linux)
Ground-truth: origin/master tip 622c19c (TEST-H3 just pushed)
verified via GitHub API BEFORE commit.
Falsifiable proof for the next CI run: the windows-latest leg of
cross-platform-build should turn green. The ubuntu-latest and
macos-latest legs were already green; this fix doesn't touch
their build path.
36 lines
1.4 KiB
Go
36 lines
1.4 KiB
Go
// Copyright 2026 certctl LLC. All rights reserved.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
//go:build windows
|
|
|
|
// Windows stub for unixOwnerFromStat. Windows has no uid/gid concept
|
|
// the way Unix does — file ownership is expressed via SIDs (Security
|
|
// Identifiers) and ACLs (Access Control Lists), and os.FileInfo.Sys()
|
|
// returns *syscall.Win32FileAttributeData which carries no
|
|
// ownership data the deploy package's existing call sites can use.
|
|
//
|
|
// All four callers — applyOwnership at ownership.go:75,
|
|
// preserveSourceOwner at atomic.go:237, and two test sites — already
|
|
// handle the ok=false return path by falling back to Plan.Defaults
|
|
// or the runtime's umask. Returning false here is the correct
|
|
// platform contract: "no native ownership available on this
|
|
// platform; use the supplied defaults."
|
|
//
|
|
// Hotfix #16 (2026-05-14): created to unblock the
|
|
// cross-platform-build Windows matrix in CI, which had been
|
|
// red since the agent's deploy package gained ownership-
|
|
// preservation semantics. The agent binary still compiles for
|
|
// Windows; ownership operations on Windows are no-ops (which
|
|
// matches operator expectations — the certctl-agent's
|
|
// chown/chmod codepaths gate on `runningAsRoot()` and Windows
|
|
// runs the agent as a service under a SID that doesn't
|
|
// translate to a uid anyway).
|
|
|
|
package deploy
|
|
|
|
import "os"
|
|
|
|
func unixOwnerFromStat(_ os.FileInfo) (uid int, gid int, ok bool) {
|
|
return -1, -1, false
|
|
}
|