Repository navigation
0.48.2-RC1 - #3860
Open
icanhasmath wants to merge 90 commits into
Open
0.48.2-RC1#3860icanhasmath wants to merge 90 commits into
icanhasmath wants to merge 90 commits into
Conversation
Version 0.48.0-RC1 - 2
Recognize hyphenated directory names in some Rust crates.
Recognize planning errors when evaluating a build expression.
…use the latest timestamp.
After dynamically evaluating a build plan, staging a commit needs to use the latest timestamp.
Co-authored-by: Nathan Rijksen <nathanr@activestate.com>
loosen version verification
Create MCP branch
Fixed failing CVE integration test.
Ecosystem namespaces will contain a mix of dynamically-imported artifacts and built artifacts. DI artifacts produced by the star-builder should invoke an ecosystem-specific installation procedure. Artifacts produced by other builders should be installed as normal. Note: uninstallation will not work because depot artifacts are not tied to builders. This will need to be addressed in a follow-up ticket.
Attach builders to artifacts.
Version 0.48.1-RC1
Replace mholt/archiver with mholt/archives.
Merge v0.48.1 to master.
Merve v0.48.1 to master.
Merge v0.48.1 to master
Merge v0.48.1-RC1 to master
Merge v48 into master
Merge version/0-48-1-RC1 to master.
…1-24 Merge 0.48.1-RC1 into master
Merge 0.48.1-RC1 into master.
It fails too often.
Skip uninstall integration test on Windows.
… WebSocket The build-log-streamer WebSocket previously opened with only an Origin header, so the server had no way to authorize the stream. When the caller is authenticated, offer the platform JWT via Sec-WebSocket-Protocol as 'bearer.<jwt>' alongside the real 'build-log-streamer.activestate.com.v1' subprotocol the server echoes back (its allow-list contains only the real subprotocol, so the token never appears in the upgrade response). The browser WebSocket API can't set custom request headers, so the dashboard carries the JWT the same way -- both clients stay symmetric. Also send the versioned State Tool User-Agent on the Upgrade so the server can see which client versions are connecting. The token is threaded as a plain string from the runtime options into Connect, so pkg/runtime gains no authentication dependency; an empty token means anonymous (unchanged behavior). Includes a real-handshake test that asserts the offered subprotocols, the negotiated subprotocol, and the User-Agent the server receives.
State Tool: forward platform JWT + version User-Agent on the build-log-streamer WebSocket
* Make serve-org-keys work in cmd shell as well as bash Add a batch twin of serve-org-keys constrained to cmd, and constrain the existing bash version to non-cmd shells, so the script resolves per shell the same way install-deps-dev does. * Run in cmd without openssl or bash Add --gen-cert to orgkeyserver.py so it generates its own self-signed cert/key via the cryptography package, removing the openssl dependency that on Windows only comes from git-bash. Update the cmd/batch variant to detect the Python interpreter (python, py -3, python3) and pass --gen-cert instead of shelling out to openssl. - Quote --org in the no-key branches (bash and batch) so org names with spaces or shell metacharacters are passed as data, matching the --key branches. - chmod the generated TLS private key to 0600 so it isn't world-readable. * Drop openssl entirely and have orgkeyserver.py always generate its self-signed cert. - Add CERT_DIR="test/ssl" constant; generate_self_signed(host) writes cert.pem/key.pem there and returns their paths. - Remove --tls-cert/--tls-key/--gen-cert; cert generation is now the default on every run. - Assume cryptography is present (bundled in the runtime); drop the ImportError guard. - Simplify both activestate.yaml variants to just run the script with --org (and optional --key); remove the openssl/mkdir prep. Resolve the cert dir to an absolute path in generate_self_signed(), and print the absolute key_service_ca path on startup so the value is copy-pasteable regardless of cwd. Docstring example updated to an absolute /path/to/test/ssl/cert.pem placeholder. * Bump project runtime commitID Update to a runtime that bundles cryptography, which serve-org-keys' orgkeyserver.py relies on for cert generation. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Add environment-variable overrides for all config options
Every registered config option can now be overridden by an environment
variable, so config can be applied machine-wide (all users) without a
shared config file and without sharing auth.
Each option gets a canonical override derived from its key, e.g.
"update.info.endpoint" -> ACTIVESTATE_CONFIG_UPDATE_INFO_ENDPOINT. The
five options that already had bespoke env vars (ACTIVESTATE_API_HOST,
ACTIVESTATE_CLI_ANALYTICS_PIXEL, ACTIVESTATE_NOTIFICATIONS_OVERRIDE,
ACTIVESTATE_TEST_UPDATE_URL, ACTIVESTATE_TEST_UPDATE_INFO_URL) keep
working as aliases; the canonical variable takes precedence when both
are set.
Overrides are resolved in config.Instance.Get (env > stored > default)
so they actually take effect everywhere, not just in display. Values are
coerced to the option's type. Only registered options are eligible, which
keeps credentials (e.g. apiToken, not a registered option) out of scope.
`state config` now reports the effective value and a Source column
showing the overriding env var name, "local", or "default"; JSON output
gains source, env, and envVar fields.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Address PR review: validate env override values; add locale strings
- EnvOverride now strictly coerces env values to the option's type and
ignores invalid ones (unparseable bool/int, out-of-set enum), so a
mis-typed variable falls back to the stored/default value instead of
silently becoming a zero value. Mirrors the validation `state config
set` already performs.
- Add the config_source_local and config_source_default locale strings
used by the Source column instead of relying on the fallback path.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Fix TestList integration test for new Source column
The `*` marker that denoted a locally-set value was replaced by the
Source column, so `state config` now shows "optin.buildscripts true
local" instead of "true*". Update TestList to assert the "local" source
(and the new "Source" header) instead of the removed "true*" marker.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Add integration test for environment as config source
TestListEnvSource overrides optin.buildscripts via its canonical env var
(ACTIVESTATE_CONFIG_OPTIN_BUILDSCRIPTS) without running `state config
set`, then asserts the override takes effect and is reported as coming
from the environment.
The human-readable table confirms the non-default value; the source is
asserted via JSON output ("source":"environment" plus the overriding env
var name), which is robust against the table wrapping long variable
names.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Address review feedback from mitchell-as
- Fold RegisterOptionWithEnv into RegisterOption via a variadic
envAliases parameter; drop the separate function. Keep the note that
envAliases are only for legacy env vars without the ACTIVESTATE_CONFIG_*
prefix.
- Use real, user-facing config options in doc/test examples (api.host,
security.prompt.level) instead of the test-only update endpoints.
- Trim the Instance.Get comment to just note env precedence; drop the
machine-wide framing.
- Remove the unnecessary comment in config get.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
state-remote-installer.exe was triggering a Windows UAC elevation prompt;
when an admin authenticated it, the State Tool installed under the admin
account instead of the invoking user. The binary shipped with no embedded
application manifest, so it declared no requestedExecutionLevel and was
subject to Windows' UAC installer-detection heuristic (which auto-flags
executables whose filename contains "install" for elevation).
Add a single shared application manifest declaring asInvoker/uiAccess=false
and embed it into every State Tool executable via goversioninfo:
- state, state-svc: ManifestPath added to the shared versioninfo.json
template (internal/assets/contents), which is stamped into each
binary's versioninfo.json at preprocess time.
- state-remote-installer: committed versioninfo.json repointed to the
shared manifest (replacing the ad-hoc local manifest).
- state-installer, state-exec, state-mcp: had no resource embedding at
all; added //go:generate goversioninfo, versioninfo.json generation in
preprocess, and a Windows-guarded `go generate` in their build steps.
This opts every binary out of installer-detection auto-elevation so they
run with the invoking user's token. Verified by cross-building each cmd
for windows and confirming the asInvoker manifest is present in the
embedded resource.syso.
Note: this is prevention for new installs. A "Run as administrator" choice
already cached under AppCompatFlags\Layers (RUNASADMIN) overrides the
manifest and must be cleared separately on affected machines.
CS-2357
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ler-uac CS-2357-Declare asInvoker execution level for remote installer
* Resolve link paths once per tree instead of once per file smartlink.Link resolved both src and dest via ResolveUniquePath for every entry it recursed into. On Windows ResolveUniquePath calls GetLongPathName, which is a syscall, so installing a runtime with many files performed two extra syscalls per file - a major contributor to slow Windows installs. The tree root is already resolved by LinkContents (and now by the public Link), and descendant paths are built by joining an already-resolved parent with real (long) entry names, so they need no further resolution. Split the recursion into an unexported link() worker that assumes resolved inputs and does not re-resolve, keeping resolution only for the rare symlink-to-file case where the pre-existing behavior links to the dereferenced target. Also treat an "already exists" error from linkFile the same as the existing TargetExists skip, so concurrent deploys of a shared file degrade to the documented "first one wins" behavior rather than failing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Deploy linked artifacts concurrently instead of serializing them DeployViaLink held the depot-wide fsMutex for the entire link operation, so even though the install worker pool runs several artifacts at once, the actual file linking was serialized to one artifact at a time. On Windows, where each link is an individual (relatively slow) syscall, this made the install phase far slower than it needed to be. Linking touches no shared in-memory depot state (Exists guards its own map via mapMutex and depotPath is immutable after construction), directory creation is idempotent, and smartlink now treats an already-existing target as a skip, so it is safe to run without the lock. Drop it from DeployViaLink so linking parallelizes across the worker pool. DeployViaCopy keeps the lock: two artifacts copying the same file would race on os.Create and could corrupt the destination. That path is only used for artifacts needing file transforms, when hard links are unsupported, or in portable mode, so it remains the less common case. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Hold a read lock while linking so copies can't write through links Linking without the depot lock let a concurrent copy deployment write through a link created moments earlier: copyFiles checks the destination is free, a link to another artifact's depot file appears there, and os.Create then truncates and overwrites that depot file, corrupting the shared cache. TestConcurrentCopyAndLinkKeepDepotIntact reproduces it in every run without the lock. Make fsMutex an RWMutex: DeployViaLink holds it for reading, so links still run concurrently, while copies, Put and Undeploy hold it for writing. Also fix the non-constant format string in DeployViaCopy, which made go test's vet step fail the whole package. Add smartlink tests for an existing target, concurrent links to the same destination, and the Link refactor's handling of directories and symlinks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Skip per-file metadata calls when linking link() checked each file with IsDir, IsSymlink, MkdirUnlessExists on its parent and TargetExists before linking it, plus another IsDir inside the Windows linkFile. Each is a file open on Windows. Instead: - take the entry type from the directory listing (os.ReadDir already has it), so only symlinks need a Stat; - rely on the parent directory existing, since the recursion creates it (Link creates it for its single entry); - drop the TargetExists pre-check and treat the link call's "already exists" error as the skip, which already covered concurrent links; - check for a directory only on the symlink-to-directory path, which is the only one that can pass one to linkFile. A regular file now costs one syscall: the link itself. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bump github.com/klauspost/compress (indirect, via mholt/archives) from v1.18.0 to v1.18.7, the first patched release for GHSA-259r-337f-4rfw (integer overflow and out-of-bounds write in s2). Re-vendored. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Support dependencies for encrypted private ingredients `state publish --build` can now declare and edit the dependencies of an encrypted private ingredient: - Read [project].dependencies from pyproject.toml and publish them as runtime dependencies on language/python packages, with names normalized by the inventory API. Version ranges carry over (~= and ==X.* are expanded). OS and Python version markers become conditions (kernel/Windows|Linux|Darwin, language/python); unsupported markers are skipped with a notice. The wheel's METADATA records them as Requires-Dist. - Read the --meta file before building, so a meta file's name, version and description feed the wheel (flags > meta file > pyproject.toml). - Add `state export ingredient-meta <namespace>/<name>[@Version]`, which writes an existing ingredient's meta file for use with --edit --meta. Fix --edit along the way: keep the meta file's dependencies and authors instead of overwriting them with the previous revision's, keep inherited dependency types and conditions, add the private-builder dependency only once, and reject author/description changes on an existing version up front instead of failing in the API. InventoryRequirementsToString no longer panics on requirements without a version. Add a readme walking through the publish and edit workflow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Address review: keep inherited deps, edit the meta file's version - When every pyproject.toml dependency is skipped, keep the dependencies already in place (on --edit, those inherited from the previous revision) instead of replacing them with an empty list. - Let a meta file's version select the version to publish or edit, like --version (which still takes precedence). An exported meta file passed back with `state publish --edit --meta` without --build was editing the latest version instead of the exported one. Add tests for both, for the up-front author/description rejection on --edit, for InventoryRequirementsToString with requirements missing a version or comparator, and for inherited conditions that carry requirements. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Beta release 0.48.2-RC1 (PROD-240).
This is
masteras of 44e750f plus the changelog.masterfollows on from the 0.48.1 beta merge-back (904939d,Merge branch 'version/0-48-2-RC1'), and the changes merged since then are:version.txtalready reads0.48.2-RC1. The commit count againstbetais large because the RC branches reachmasteras merges with different hashes. Only the three PRs above are new.Merging this stages the release. After that come Windows signing,
state run promote-staging-to-production, verifying withinstall.sh -b beta, and merging back intomaster.Changelog
Added
state publish --buildnow reads[project].dependenciesfrompyproject.tomland publishes them as runtimedependencies of the encrypted private ingredient. Version ranges carry over, and OS and Python version markers become
dependency conditions (unsupported markers are skipped with a notice).
state export ingredient-meta <namespace>/<name>[@version], which writes an existing ingredient's meta file foruse with
state publish --edit --meta.Changed
file, and artifacts are linked concurrently.
--metafile's name, version, and description now feed the built wheel (flags take precedence over the meta file,which takes precedence over
pyproject.toml).Fixed
state publish --editno longer overwrites the meta file's dependencies and authors with the previous revision's,keeps inherited dependency types and conditions, and rejects author or description changes on an existing version
up front.
state publish --edit --metawith an exported meta file now edits the version named in the file rather than thelatest version.
Security
github.com/klauspost/compressto v1.18.7 to remediate CVE-2026-63209 (GHSA-259r-337f-4rfw).