| 1 | # Census overlay rootfs-apps-1-new (rootfs apps Plan 1: carlos ship --rootfs and --check, the console's rootfs ship door, release.ShipSpooled; spec docs/superpowers/specs/2026-10-24-rootfs-apps-design.md §5.1, §5.8), hand-written: the decisions census-propose refuses (AGENTS.md, The census). Loaded from the chain manifest after plans-3b-never-sleep (main's last at the merge of origin/main) and before plan14-root-reads-rootfs-apps-1.tsv, which census-propose wrote for the approvals. Every row carries rev3=census-ruling-rootfs-apps-1 from the start; the census owner rules on #280 (docs/superpowers/notes/census-proposal-rootfs-apps-1.md). |
| 2 | # 49 new units, each legacy accepted-legacy at J4, none a box unit. 43 run in the carlos CLI on a person's machine, as the person: 14 in the root package (cli.go shipNoteText, ship_rootfs.go, ship_runtime.go, ship_check.go, ship_check_probe.go; listeningPorts runs as the in-container probe inside the --check container) and 29 in internal/rootfsimage, imported only by those files. 2 are the console's (apiship_rootfs.go: the request body and its own spool). 2 are internal/release's, reached only from ShipSpooled (the console and the CLI's direct mode, each over a file it spooled itself), and 2 more in internal/release are matched on the word Command (release.Process's argv field). What they read: files the person named, scratch the CLI or the console made for itself, the probe cached under the user cache dir, the docker or podman CLI it runs; many read no file at all (a Command field, crypto/rand.Read, an io.Reader's Read, an in-memory tree lookup). Frozen declarations are added, so the seal moves; plans-3b-never-sleep's is checked first. |
| 3 | @legacy 4a9dbe55f930719356c73d38a7e92a62d7ff2e1ad88e267565989251d28b1292 cli.go shipNoteText legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the --notes-file the person named (os.ReadFile), moved out of runShip so the rootfs path shares it; decides nothing for root file:ReadFile@223 5ff92a8a2c69c43489ae0bb175b6ed77f591cd149bd726e8b1d9e77ce1279f54 |
| 4 | @legacy 099fcb9aceae22e32c976d4c47d3262d2d2a2a42445845d7968f6737615db50a internal/console/apiship_rootfs.go shipBody.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): new (rootfs Plan 1), reads the ship request's HTTP body under the door's byte limit (the reader's Read, not a file); decides nothing for root file:Read@19,file:Read@398 d14b28f4d7d27cef252623996b3f86e3c5d04bae08d4195abeabe341bda41c8d |
| 5 | @legacy 634167b960a3365935a447e49323ac0631fcd7a2382ccdf8e926e98526a566d9 internal/console/apiship_rootfs.go spoolRootfsPart legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): new (rootfs Plan 1), creates the upload's spool file (O_EXCL, 0600) in its own private directory under the console's seed scratch, reserved before the body is read and removed on every path; reads the incoming multipart part (the upload's bytes) and writes them to the spool, opened O_WRONLY; decides nothing for root file:OpenFile@114 46acf7814f63300522ec5b21936b02f63e29f1e6d22e8da8c60cb697a6584150 |
| 6 | @legacy 3c40d72a06c394dfff8ea2db6b5ef7a48235f29b144f7a771b90d851facb98c3 internal/release/rootfs.go type Process legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the release manifest's process type, compiled into every carlos binary: new (rootfs Plan 1); the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@23 fd439e6bfa93df12a105bccbe41604aae8b6c71248830884685f9fb25dc4cb17 |
| 7 | @legacy 0c20259a67f7c49d39171d96a06011770851af460270a30d7fb06ba04f553ed4 internal/release/rootfs.go validateProcess legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the shape rule for a manifest's processes, run at ship (console and CLI) and on decode: new (rootfs Plan 1); the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@242,file:Command@61,file:Command@80 66c6ce57518082f62c7a55895351cfc5ba65781e906074cb094b5f6c82c6d398 |
| 8 | @legacy f1662a273a07f1c63ef82adb6ff0a3208b3d29a6b4562fca5a50f4d4226d5395 internal/release/rootfs_ship.go hashSpooledFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the image file its caller spooled (the console's upload spool or the CLI's own scratch) to hash and size it once before publication; decides nothing for root file:Open@70 89fd0516bddd454293bb0cb78d06f60d969e2d80f74ed422a3f43bd6fd66bf27 |
| 9 | @legacy 94e3922bed4b0df1bde55554c09dc9765ee620e1125721673be25f4018646bd8 internal/release/rootfs_ship.go putImmutableFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the same spooled image file to stream it into the release bucket as a create-only put; on a lost race it hashes the existing object, never the box's state; decides nothing for root file:Open@106 a60dc283fe607f89671b55ff706fd3b656b303e356ac0060261c5cdbfd6855c6 |
| 10 | @legacy 9173125d07a721094c05ea5eeb9120477ec9f3e123ea2c4dec445877e79ef481 internal/rootfsimage/archive.go OpenArchive legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens the docker save or podman save archive the person named (or the one the CLI exported into its own scratch) and reads its entries in place as sections; nothing is extracted by name; decides nothing for root file:Open@226,file:Stat@73 c19ae55f5619df47cfe2afb53de8e408a173e234b26212c1b0eff3036f1f9397 |
| 11 | @legacy e96595389ea9636e30509372d9e34220005df126a618d40569c35b7e7671192d internal/rootfsimage/dir.go readDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, walks the directory the person named (EvalSymlinks of that root only, Stat, WalkDir, Readlink of each symlink, never followed); reads names, modes and link targets, the bytes later through Tree.Open; decides nothing for root; final review: refuses when the tree's entry or metadata budget is passed (add's error), the same reads file:EvalSymlinks@123,file:Readlink@1719,file:Stat@193,file:WalkDir@757 d5e66fdefdf4d203ce528ed30772dea6f22e3443c591123aff8a3c0d21622f8e |
| 12 | @legacy 4ce9c95915443f2c22c10b77c845a916a8f243ec516701e689a5573022a88cd4 internal/rootfsimage/errors.go CommandError.Error legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's sentence; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@237 b8d64424f4e118c297fa0982e245c29de171e9aa56287e264bef997f13ad08e4 |
| 13 | @legacy 980af1a9be9f489c84b9e5f9a94e36f45498107244ae279179acb33d81e580f1 internal/rootfsimage/errors.go type CommandError legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's type; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@35 9812608a0a0b885f8fdea0526df6e71896a61a3243be9dd16fac8019f8e6254c |
| 14 | @legacy cad0de2fa8dca1e2c35bdf3d04e30027f986f5fffff738454199007fd06bc7fd internal/rootfsimage/flatten.go boundedReader.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a layer's decompressed stream (from a blob of the person's image) and fails past the image's byte bound; the reader's Read, not a file; decides nothing for root file:Read@160,file:Read@24 7d5b4f8bac0a432cbfe1ece92b971aa8ee915be49d4b21475afb29dc0d023499 |
| 15 | @legacy 4adcd87a4cf55bcdb2c7fd8b6fbc1d387a8f1e69c98bfca3dce1063ff0bdd4ae internal/rootfsimage/framework.go FillConsole legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, fills in a known framework's console process from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@897 94952824384be27a5a8a6a003f48f0afaabd8a57c5b23900391b7aa6cffc728f |
| 16 | @legacy 38687b3a14749ceedc43514d8ba068c240ff5a46f929708434f0890d6729a380 internal/rootfsimage/oci.go OpenLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens the OCI layout directory the person named as an os.Root, so no blob or symlink leads out of it; decides nothing for root file:OpenRoot@66 82dd665eb26ac5d8f2c8aef7510b0d80fbc2817d8d63d3c2e3e1e4ee25bfdb35 |
| 17 | @legacy 8708098c5a62564e5167d96de9f80738857c2eaf06ec44ce541430e332010ca6 internal/rootfsimage/oci.go layoutStore.has legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats a file of the layout through its os.Root; decides nothing for root file:Stat@57 064049e649e466d9df1e478cd6e55b37f2227522752f864a851e197c2ffde3a5 |
| 18 | @legacy 8386a5a0c23c595ce2f016e28ff838f50cba8c3f2e3d1958be614518bff8f720 internal/rootfsimage/oci.go layoutStore.open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens a regular file of the layout through its os.Root, refusing anything else; decides nothing for root file:Open@345,file:Stat@116,file:Stat@449 6dbd8278e86f1c433285c1c0910bfd11b68f9119ff2e346b3f6e425ba99de7e4 |
| 19 | @legacy 927c5246cda1b1e5a8af125c5b8389627d3b3dcd73dd688d0ef46ef26f23d0eb internal/rootfsimage/oci.go ociReader.readBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads one blob of the person's image (an index, manifest or config, at most a fixed size), verified against its digest; decides nothing for root file:ReadAll@161 6f20a40de98390d87a7042061ddc00e54779b7044684d3a3b375e8b7b8a202c1 |
| 20 | @legacy 2ea8112ef0b8065b221e0c545e81656b06ab84f36da85f48ca67e077ce9e0c87 internal/rootfsimage/oci.go readFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads index.json or manifest.json of the person's layout or archive, at most maxJSONBytes; decides nothing for root file:ReadAll@242 e31050069c07a50df4faf17e527d390a44b57451b3e0ef8a8bd88489daab80b2 |
| 21 | @legacy c187fa6fa0464d0739b063159cfdbde65172dc4a859421257d915354d705c0e7 internal/rootfsimage/oci.go verifier.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a blob stream of the person's image and checks its sha256 digest at the end; the reader's Read, not a file; decides nothing for root file:Read@102,file:Read@19 3155388f7ec924e45ef345aaae668c1d4340648c673f1e4c4534597085778103 |
| 22 | @legacy 74c7b1cffea253f291e3294345f74211c0cbd5675924d397863c19eab9d7c17c internal/rootfsimage/processes.go ApplyImageConfig legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, merges the image config's env and working dir into the processes; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root; final review: keeps a ".." in the config's working dir for the resolver, the same Command fields file:Command@547,file:Command@572 c40aeac492cb68c58d8b5c9ab199680fb4a63c2cce30d76286d651a7df84c70a |
| 23 | @legacy eb0946e4251047589ff151c848bd2d6d1fab3bf651436a02cd6fed94941b7723 internal/rootfsimage/processes.go ResolveCommands legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, looks each process's command up in the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@171,file:Command@230,file:Command@239 eb4611c838927abcee9390eb2088065490ff44a46bbd421ce071b9630f09a8d9 |
| 24 | @legacy 645a8572481d74bb18b892b0c972ec76d6bb7a580905ab993fc9a662a719828d internal/rootfsimage/processes.go jitOf legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, names the program a process runs, from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@56 af5faa5d1eb5e07e2f330dbdf08efbe89d7a4af73ac10c667029fbb2f751a60a |
| 25 | @legacy 2016b0945e612ce342558483f00f11b96022320877472c5b473baf5e79cf9047 internal/rootfsimage/processes.go shebangRuntime legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads at most the first shebangBytes of one script of the person's image through Tree.Open, for the JIT warning; decides nothing for root file:Open@60 46fd0d8c36717f12e1da2bc1bcdd4452b03077c5217cdb777181e618e69a9667 |
| 26 | @legacy 78f7744b11bdb013bf6ef3a05876746f33edd1db49351db7e4be67a2bcdefb17 internal/rootfsimage/progarch.go Tree.head legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads at most 20 bytes of a regular file of the person's directory source through Tree.Open, to name a program not built for linux/arm64; decides nothing for root file:Open@60 e7aa22afec3b4581c58c14ef25b1dff69ec7ce89ee10d7a62a18408c61d82792 |
| 27 | @legacy 4f2b03b8cb11cf9b0509ff577ecbfcbfdcf38cde637e24f04847ddc7e4223408 internal/rootfsimage/squashfs.go treeFS.Lstat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a lookup, reads no file; decides nothing for root file:Lstat@16,file:Stat@65 f3ba827c853bcf504c2931d880147b32c3c1fa328e453e36a3ad7258a81768ab |
| 28 | @legacy 21a567de8b1e8bce9f452ad04a1d65c3d7fe8adb66de4ec60c8ed17594e4c631 internal/rootfsimage/squashfs.go treeFS.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the tree; a regular file's bytes come through treeFS.ReadFile; decides nothing for root file:Open@16,file:ReadFile@204 51d5cb9d3a1655644a3f9d718fb14853964ab64c546cba1efe1ca9c287cf90f6 |
| 29 | @legacy 1da905f3bfdc194c42bad6fe5cfef528830e4bb1e4d8babe9ff77f5223c18614 internal/rootfsimage/squashfs.go treeFS.ReadDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a listing, reads no file; decides nothing for root file:ReadDir@16 06438d0c8d4806ae807aefe04fe2ca0882ed805b5df19cc4947d7be321d046ef |
| 30 | @legacy 6d2b7723ec229d29e753abab980830ac25f5e0e16d411c7400b222f621e82106 internal/rootfsimage/squashfs.go treeFS.ReadFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads exactly the size the tree recorded of a regular file through Tree.Open (the spool under the CLI's own scratch, or the person's directory source in place), refusing a file that changed size; decides nothing for root file:Open@139,file:Read@461,file:ReadFile@16 4d4f4214cd70d7f95e018c2284a6091490f67e0438461ae6d84f1e09268e6178 |
| 31 | @legacy dc4cb84cc9c7e128bb27901fbb2d6736d4b9c1cb8af56fcdf106e49f6aaf4a16 internal/rootfsimage/squashfs.go treeFS.Stat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a lookup, reads no file; decides nothing for root file:Stat@16 426d5d99a9b28a6c7e1b1650f60ee32dcb6df54a66715441c1f814f441e1c594 |
| 32 | @legacy 5bb2d77ffdfaa3abd24b2c7dba8bbfb4ebc9830763fd3b1b264fd9361b51f387 internal/rootfsimage/squashfs.go treeFile.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads bytes already in memory (from treeFS.ReadFile); reads no file; decides nothing for root file:Read@19 226e1cf7c0fb761b2d929a70f0ac48662678f0a6107b255192e881086ab438b8 |
| 33 | @legacy 26b8c71698044b42089fcba6558309a166015bb0e45125b1b7b33c0ac9754809 internal/rootfsimage/squashfs.go treeFile.Stat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, an in-memory entry's info; reads no file; decides nothing for root file:Stat@19 df4b21a4f97b380a56870d7b4d984dd5e46f31e1f407daa8426bb3c88ba6f082 |
| 34 | @legacy 4b77e79861d5320fd1ddc23cd27d94a5eb574b003e88e2053649230a7f7ec5ab internal/rootfsimage/squashfs.go writeSquashfs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the image file its caller created in its own scratch, for its size after writing; decides nothing for root file:Stat@1987 273105c82eedfdad9598f62da631268d6658abf2530a736f9e65cdd9e5b649aa |
| 35 | @legacy 874192cedc6e364d72be6d4b3a49c8c849eb1dde8ae37b49aa5e8ccd941de27d internal/rootfsimage/tar.go Tree.copyFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a regular file of the tree through Tree.Open (the spool under the CLI's own scratch, or the person's directory source) into the tar stream the --check import reads; decides nothing for root file:Open@67 d5284439478bde0664831320693f1cd3f9aa7a97890c32508c9b62f49d0cb531 |
| 36 | @legacy 3abc9f24b1bc610c76561df20f9734c826324ca51453552f5e4f1752985ae328 internal/rootfsimage/tree.go Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the source the person named (and its oci-layout file) to choose a layout, an archive or a directory; decides nothing for root file:Open@5,file:Stat@154,file:Stat@58 ca04f5016aa1e1c185940c7992b1a39cc167bfdae2e89287be87e9c353aa927d |
| 37 | @legacy 349b05675adef44a1a3331d79989fcef013cdf27b25dc3a0c0ac006dc8617599 internal/rootfsimage/tree.go Tree.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens a regular file of the tree: a spool file it wrote under the CLI's own scratch, or a file of the person's directory source; decides nothing for root file:Open@15,file:Open@165 c7d8f05180d3aa358720be290041d77f08bc631dddc46cb3631a437ec86c0e05 |
| 38 | @legacy 83559b0e34e8fb350aa97fb7bb77674b587eb72a29187b7673d310b2e72412b7 internal/rootfsimage/tree.go Tree.writeBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, creates a spool file (O_EXCL, 0600, named by a counter, never by the image) under the tree's spool in the CLI's own scratch (writes, does not read); decides nothing for root file:OpenFile@249 5ae91de79c050ab1be920de4e1cae3487f3bd933f61bee9841bc280b3762fdb6 |
| 39 | @legacy 1b8938c8d50e48ad187a7acde871b20cfda3b9af9dd3cec276dc5b76a51b679c ship_check.go const#2 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the paths a box gives an instance (/data/instances/check, /run/carlos/instances/check, the socket and the db) as they appear inside the --check container, on volumes the check made; the host's /data is never named or read; decides nothing for root data-literal@24 74baca97cbc13497d790d98c2ed43ce2123c27ccd9c40d6fc98b857d155aceb8 |
| 40 | @legacy 3a80febe2bc13dceef326bb1f3a71e91a738b8903fa172ac98dcb85302552631 ship_check.go rootfsCheck.runArgs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), builds the docker or podman run argv for one check container; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@770,file:Command@854 b21dca7ccd34f38f969f891ea6615f1f4c0057b342ecb44b2a2b2214cb9f46e4 |
| 41 | @legacy 355e3ead803016c7080595fccdeee34cc16e4764f1a3e8737d66a27e4b452337 ship_check.go runRootfsCheck legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the scanner matches crypto/rand.Read (four random bytes naming the check's containers and volumes); reads no file; decides nothing for root file:Read@143 e3b27e7e63eb6c6ccb38515261589a5f4dcb2f9cae2290db018d9b3bc66268b1 |
| 42 | @legacy 226180b993303675c54cc8da32c3c0de4642d484bdf14872e845eee6475911e3 ship_check_probe.go cachedCheckProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the sha256 it recorded beside the probe binary it cached under the user cache dir (<cache>/carlos/check-probe/<tag>/), to check the copy before mounting it, and fetches a signed, checksummed release asset when it is absent or damaged; decides nothing for root; final review: its atomic writes take the context, the same read file:ReadFile@289 0475c3c6803343f34acfb869441b51b06cef0d41bd0f85eb96f9b89700959520 |
| 43 | @legacy 6f2a41a1ba94310a52f7995beff204fc3523a34a526f9f1d757a2730a0d1b0b0 ship_check_probe.go checkProbeBinary legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), resolves the running carlos executable's own path (filepath.EvalSymlinks) to mount it as the in-container probe, or CARLOS_CHECK_PROBE when the person set it; decides nothing for root file:EvalSymlinks@271 6da69f2d06b63a702dc178d091c053d9c63e95aa851e17e64cd7381c5b4e29f0 |
| 44 | @legacy 7180f2f5a41ec9d0267aaab27b52927dadc64cd35e05c8c87f78a8e5dd6b7cdc ship_check_probe.go fileSHA256 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), opens the probe binary it cached under the user cache dir to hash it against its recorded sha256; decides nothing for root file:Open@58 4e45c59d7c9465d8033f993de91fa17e8d81e1e3e3dd9c959fb3aa0e1b743cda |
| 45 | @legacy fd8281363fa24883d43579d4d0189265631045ca68bcaa185c3910387482774f ship_check_probe.go listeningPorts legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), run as the in-container probe (carlos __rootfs-check-probe, uid 65534 inside the --check container, the carlos binary mounted read-only): opens /proc/net/tcp and /proc/net/tcp6 inside that container to name the ports web listens on when it misses the socket; never on a box; decides nothing for root file:Open@107 4b48f8b7a6b82fdb794d61f1451ba94a34ebd73abda84b2dac398e4822631e9a |
| 46 | @legacy 403933a3d332f17b70ce2f1e9b99ccf073e9063aaa65316ac68b92a558de9d09 ship_check_probe.go staticELF legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), opens the running carlos executable (debug/elf.Open) to see that it has no program interpreter before mounting it in the image; decides nothing for root file:Open@46 d1d0ff59e269d7f189d49ef2993e33c2a571cb118622c0cfcdb24ca479d87799 |
| 47 | @legacy a4f997e86200f5661fc320c0fa53678c7e941ceeddecfafa40b555691344b77d ship_check_probe.go writeFileAtomic legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), creates a temp file beside the probe it caches under the user cache dir and renames it into place (writes, does not read); decides nothing for root; final review: holds the ship's stop lifecycle while it writes, so a stop waits for the rename or the temp file's removal, the same CreateTemp file:CreateTemp@192 652b1687f40342d61f3e5c4f690eb6d83637b12c0456191073c3c3a6196115ab |
| 48 | @legacy 3a3fdc18e773848d3d2cead508bbd04ad05b789781aa7d7bdc2afcae187b864f ship_rootfs.go buildRootfs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), creates <scratch>/rootfs.squashfs (O_EXCL, 0600) in its own private scratch under the system temp dir, which runShip removes on every path and on a stop signal; Command is release.Process's argv field, not os/exec; the source is read through rootfsimage; decides nothing for root file:Command@1016,file:OpenFile@1379 410bdfc067caf4a02b84e6388302f4dcac16e1b913ae58a2af58cd0376f1b7bf |
| 49 | @legacy 213612395cfa923e8e5f395691fc2f28b167860fe81bd1b562535095771c23ad ship_rootfs.go readProcessesFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the --processes file the person named (os.ReadFile) and decodes it with release.DecodeProcesses; decides nothing for root file:ReadFile@87 88e5324d435c9aa9d027155e6b60afa2fbea74b65066f9db25704f3dda3320fa |
| 50 | @legacy 9d9018d9aefd19c57abd5d7f8ce5dbde717993d30235913f7566f55618d93edb ship_runtime.go execRunner legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), runs the docker or podman CLI (exec.CommandContext) found on PATH or named by CARLOS_CONTAINER_RUNTIME, as the person, for docker save of a local image name, the --check import, run, inspect, logs and removal; decides nothing for root; final review: holds the ship's stop lifecycle while the child runs, so a stop waits for it to be killed and reaped, the same CommandContext file:CommandContext@230 0b541b4e179d17512a72601d635bea1bc6eb7198cdf60e7b90a2aa52b46befc0 |
| 51 | @legacy 610f1e4501e73a6fb1fac81013e77c464c7695e2c37e3999302a96ad969944ce ship_runtime.go openRootfsSource legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), stats the source the person named; an existing path goes to rootfsimage.Open, a local image name is exported with the runtime to <scratch>/image.tar in its own scratch and opened there; Open is rootfsimage.Open; decides nothing for root file:Open@268,file:Stat@146 5d90d22dd97cb5cc12a1c4d58cebe365e592be325141c545d1bf42a7e98ec58d |
| 52 | cli.go shipNoteText legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the --notes-file the person named (os.ReadFile), moved out of runShip so the rootfs path shares it; decides nothing for root file:ReadFile@223 5ff92a8a2c69c43489ae0bb175b6ed77f591cd149bd726e8b1d9e77ce1279f54 |
| 53 | internal/console/apiship_rootfs.go shipBody.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): new (rootfs Plan 1), reads the ship request's HTTP body under the door's byte limit (the reader's Read, not a file); decides nothing for root file:Read@19,file:Read@398 d14b28f4d7d27cef252623996b3f86e3c5d04bae08d4195abeabe341bda41c8d |
| 54 | internal/console/apiship_rootfs.go spoolRootfsPart legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): new (rootfs Plan 1), creates the upload's spool file (O_EXCL, 0600) in its own private directory under the console's seed scratch, reserved before the body is read and removed on every path; reads the incoming multipart part (the upload's bytes) and writes them to the spool, opened O_WRONLY; decides nothing for root file:OpenFile@114 46acf7814f63300522ec5b21936b02f63e29f1e6d22e8da8c60cb697a6584150 |
| 55 | internal/release/rootfs.go type Process legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the release manifest's process type, compiled into every carlos binary: new (rootfs Plan 1); the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@23 fd439e6bfa93df12a105bccbe41604aae8b6c71248830884685f9fb25dc4cb17 |
| 56 | internal/release/rootfs.go validateProcess legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the shape rule for a manifest's processes, run at ship (console and CLI) and on decode: new (rootfs Plan 1); the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@242,file:Command@61,file:Command@80 66c6ce57518082f62c7a55895351cfc5ba65781e906074cb094b5f6c82c6d398 |
| 57 | internal/release/rootfs_ship.go hashSpooledFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the image file its caller spooled (the console's upload spool or the CLI's own scratch) to hash and size it once before publication; decides nothing for root file:Open@70 89fd0516bddd454293bb0cb78d06f60d969e2d80f74ed422a3f43bd6fd66bf27 |
| 58 | internal/release/rootfs_ship.go putImmutableFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the same spooled image file to stream it into the release bucket as a create-only put; on a lost race it hashes the existing object, never the box's state; decides nothing for root file:Open@106 a60dc283fe607f89671b55ff706fd3b656b303e356ac0060261c5cdbfd6855c6 |
| 59 | internal/rootfsimage/archive.go OpenArchive legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens the docker save or podman save archive the person named (or the one the CLI exported into its own scratch) and reads its entries in place as sections; nothing is extracted by name; decides nothing for root file:Open@226,file:Stat@73 c19ae55f5619df47cfe2afb53de8e408a173e234b26212c1b0eff3036f1f9397 |
| 60 | internal/rootfsimage/dir.go readDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, walks the directory the person named (EvalSymlinks of that root only, Stat, WalkDir, Readlink of each symlink, never followed); reads names, modes and link targets, the bytes later through Tree.Open; decides nothing for root; final review: refuses when the tree's entry or metadata budget is passed (add's error), the same reads file:EvalSymlinks@123,file:Readlink@1719,file:Stat@193,file:WalkDir@757 d5e66fdefdf4d203ce528ed30772dea6f22e3443c591123aff8a3c0d21622f8e |
| 61 | internal/rootfsimage/errors.go CommandError.Error legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's sentence; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@237 b8d64424f4e118c297fa0982e245c29de171e9aa56287e264bef997f13ad08e4 |
| 62 | internal/rootfsimage/errors.go type CommandError legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's type; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@35 9812608a0a0b885f8fdea0526df6e71896a61a3243be9dd16fac8019f8e6254c |
| 63 | internal/rootfsimage/flatten.go boundedReader.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a layer's decompressed stream (from a blob of the person's image) and fails past the image's byte bound; the reader's Read, not a file; decides nothing for root file:Read@160,file:Read@24 7d5b4f8bac0a432cbfe1ece92b971aa8ee915be49d4b21475afb29dc0d023499 |
| 64 | internal/rootfsimage/framework.go FillConsole legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, fills in a known framework's console process from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@897 94952824384be27a5a8a6a003f48f0afaabd8a57c5b23900391b7aa6cffc728f |
| 65 | internal/rootfsimage/oci.go OpenLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens the OCI layout directory the person named as an os.Root, so no blob or symlink leads out of it; decides nothing for root file:OpenRoot@66 82dd665eb26ac5d8f2c8aef7510b0d80fbc2817d8d63d3c2e3e1e4ee25bfdb35 |
| 66 | internal/rootfsimage/oci.go layoutStore.has legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats a file of the layout through its os.Root; decides nothing for root file:Stat@57 064049e649e466d9df1e478cd6e55b37f2227522752f864a851e197c2ffde3a5 |
| 67 | internal/rootfsimage/oci.go layoutStore.open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens a regular file of the layout through its os.Root, refusing anything else; decides nothing for root file:Open@345,file:Stat@116,file:Stat@449 6dbd8278e86f1c433285c1c0910bfd11b68f9119ff2e346b3f6e425ba99de7e4 |
| 68 | internal/rootfsimage/oci.go ociReader.readBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads one blob of the person's image (an index, manifest or config, at most a fixed size), verified against its digest; decides nothing for root file:ReadAll@161 6f20a40de98390d87a7042061ddc00e54779b7044684d3a3b375e8b7b8a202c1 |
| 69 | internal/rootfsimage/oci.go readFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads index.json or manifest.json of the person's layout or archive, at most maxJSONBytes; decides nothing for root file:ReadAll@242 e31050069c07a50df4faf17e527d390a44b57451b3e0ef8a8bd88489daab80b2 |
| 70 | internal/rootfsimage/oci.go verifier.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a blob stream of the person's image and checks its sha256 digest at the end; the reader's Read, not a file; decides nothing for root file:Read@102,file:Read@19 3155388f7ec924e45ef345aaae668c1d4340648c673f1e4c4534597085778103 |
| 71 | internal/rootfsimage/processes.go ApplyImageConfig legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, merges the image config's env and working dir into the processes; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root; final review: keeps a ".." in the config's working dir for the resolver, the same Command fields file:Command@547,file:Command@572 c40aeac492cb68c58d8b5c9ab199680fb4a63c2cce30d76286d651a7df84c70a |
| 72 | internal/rootfsimage/processes.go ResolveCommands legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, looks each process's command up in the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@171,file:Command@230,file:Command@239 eb4611c838927abcee9390eb2088065490ff44a46bbd421ce071b9630f09a8d9 |
| 73 | internal/rootfsimage/processes.go jitOf legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, names the program a process runs, from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@56 af5faa5d1eb5e07e2f330dbdf08efbe89d7a4af73ac10c667029fbb2f751a60a |
| 74 | internal/rootfsimage/processes.go shebangRuntime legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads at most the first shebangBytes of one script of the person's image through Tree.Open, for the JIT warning; decides nothing for root file:Open@60 46fd0d8c36717f12e1da2bc1bcdd4452b03077c5217cdb777181e618e69a9667 |
| 75 | internal/rootfsimage/progarch.go Tree.head legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads at most 20 bytes of a regular file of the person's directory source through Tree.Open, to name a program not built for linux/arm64; decides nothing for root file:Open@60 e7aa22afec3b4581c58c14ef25b1dff69ec7ce89ee10d7a62a18408c61d82792 |
| 76 | internal/rootfsimage/squashfs.go treeFS.Lstat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a lookup, reads no file; decides nothing for root file:Lstat@16,file:Stat@65 f3ba827c853bcf504c2931d880147b32c3c1fa328e453e36a3ad7258a81768ab |
| 77 | internal/rootfsimage/squashfs.go treeFS.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the tree; a regular file's bytes come through treeFS.ReadFile; decides nothing for root file:Open@16,file:ReadFile@204 51d5cb9d3a1655644a3f9d718fb14853964ab64c546cba1efe1ca9c287cf90f6 |
| 78 | internal/rootfsimage/squashfs.go treeFS.ReadDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a listing, reads no file; decides nothing for root file:ReadDir@16 06438d0c8d4806ae807aefe04fe2ca0882ed805b5df19cc4947d7be321d046ef |
| 79 | internal/rootfsimage/squashfs.go treeFS.ReadFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads exactly the size the tree recorded of a regular file through Tree.Open (the spool under the CLI's own scratch, or the person's directory source in place), refusing a file that changed size; decides nothing for root file:Open@139,file:Read@461,file:ReadFile@16 4d4f4214cd70d7f95e018c2284a6091490f67e0438461ae6d84f1e09268e6178 |
| 80 | internal/rootfsimage/squashfs.go treeFS.Stat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a lookup, reads no file; decides nothing for root file:Stat@16 426d5d99a9b28a6c7e1b1650f60ee32dcb6df54a66715441c1f814f441e1c594 |
| 81 | internal/rootfsimage/squashfs.go treeFile.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads bytes already in memory (from treeFS.ReadFile); reads no file; decides nothing for root file:Read@19 226e1cf7c0fb761b2d929a70f0ac48662678f0a6107b255192e881086ab438b8 |
| 82 | internal/rootfsimage/squashfs.go treeFile.Stat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, an in-memory entry's info; reads no file; decides nothing for root file:Stat@19 df4b21a4f97b380a56870d7b4d984dd5e46f31e1f407daa8426bb3c88ba6f082 |
| 83 | internal/rootfsimage/squashfs.go writeSquashfs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the image file its caller created in its own scratch, for its size after writing; decides nothing for root file:Stat@1987 273105c82eedfdad9598f62da631268d6658abf2530a736f9e65cdd9e5b649aa |
| 84 | internal/rootfsimage/tar.go Tree.copyFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a regular file of the tree through Tree.Open (the spool under the CLI's own scratch, or the person's directory source) into the tar stream the --check import reads; decides nothing for root file:Open@67 d5284439478bde0664831320693f1cd3f9aa7a97890c32508c9b62f49d0cb531 |
| 85 | internal/rootfsimage/tree.go Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the source the person named (and its oci-layout file) to choose a layout, an archive or a directory; decides nothing for root file:Open@5,file:Stat@154,file:Stat@58 ca04f5016aa1e1c185940c7992b1a39cc167bfdae2e89287be87e9c353aa927d |
| 86 | internal/rootfsimage/tree.go Tree.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens a regular file of the tree: a spool file it wrote under the CLI's own scratch, or a file of the person's directory source; decides nothing for root file:Open@15,file:Open@165 c7d8f05180d3aa358720be290041d77f08bc631dddc46cb3631a437ec86c0e05 |
| 87 | internal/rootfsimage/tree.go Tree.writeBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, creates a spool file (O_EXCL, 0600, named by a counter, never by the image) under the tree's spool in the CLI's own scratch (writes, does not read); decides nothing for root file:OpenFile@249 5ae91de79c050ab1be920de4e1cae3487f3bd933f61bee9841bc280b3762fdb6 |
| 88 | ship_check.go const#2 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the paths a box gives an instance (/data/instances/check, /run/carlos/instances/check, the socket and the db) as they appear inside the --check container, on volumes the check made; the host's /data is never named or read; decides nothing for root data-literal@24 74baca97cbc13497d790d98c2ed43ce2123c27ccd9c40d6fc98b857d155aceb8 |
| 89 | ship_check.go rootfsCheck.runArgs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), builds the docker or podman run argv for one check container; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@770,file:Command@854 b21dca7ccd34f38f969f891ea6615f1f4c0057b342ecb44b2a2b2214cb9f46e4 |
| 90 | ship_check.go runRootfsCheck legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the scanner matches crypto/rand.Read (four random bytes naming the check's containers and volumes); reads no file; decides nothing for root file:Read@143 e3b27e7e63eb6c6ccb38515261589a5f4dcb2f9cae2290db018d9b3bc66268b1 |
| 91 | ship_check_probe.go cachedCheckProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the sha256 it recorded beside the probe binary it cached under the user cache dir (<cache>/carlos/check-probe/<tag>/), to check the copy before mounting it, and fetches a signed, checksummed release asset when it is absent or damaged; decides nothing for root; final review: its atomic writes take the context, the same read file:ReadFile@289 0475c3c6803343f34acfb869441b51b06cef0d41bd0f85eb96f9b89700959520 |
| 92 | ship_check_probe.go checkProbeBinary legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), resolves the running carlos executable's own path (filepath.EvalSymlinks) to mount it as the in-container probe, or CARLOS_CHECK_PROBE when the person set it; decides nothing for root file:EvalSymlinks@271 6da69f2d06b63a702dc178d091c053d9c63e95aa851e17e64cd7381c5b4e29f0 |
| 93 | ship_check_probe.go fileSHA256 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), opens the probe binary it cached under the user cache dir to hash it against its recorded sha256; decides nothing for root file:Open@58 4e45c59d7c9465d8033f993de91fa17e8d81e1e3e3dd9c959fb3aa0e1b743cda |
| 94 | ship_check_probe.go listeningPorts legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), run as the in-container probe (carlos __rootfs-check-probe, uid 65534 inside the --check container, the carlos binary mounted read-only): opens /proc/net/tcp and /proc/net/tcp6 inside that container to name the ports web listens on when it misses the socket; never on a box; decides nothing for root file:Open@107 4b48f8b7a6b82fdb794d61f1451ba94a34ebd73abda84b2dac398e4822631e9a |
| 95 | ship_check_probe.go staticELF legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), opens the running carlos executable (debug/elf.Open) to see that it has no program interpreter before mounting it in the image; decides nothing for root file:Open@46 d1d0ff59e269d7f189d49ef2993e33c2a571cb118622c0cfcdb24ca479d87799 |
| 96 | ship_check_probe.go writeFileAtomic legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), creates a temp file beside the probe it caches under the user cache dir and renames it into place (writes, does not read); decides nothing for root; final review: holds the ship's stop lifecycle while it writes, so a stop waits for the rename or the temp file's removal, the same CreateTemp file:CreateTemp@192 652b1687f40342d61f3e5c4f690eb6d83637b12c0456191073c3c3a6196115ab |
| 97 | ship_rootfs.go buildRootfs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), creates <scratch>/rootfs.squashfs (O_EXCL, 0600) in its own private scratch under the system temp dir, which runShip removes on every path and on a stop signal; Command is release.Process's argv field, not os/exec; the source is read through rootfsimage; decides nothing for root file:Command@1016,file:OpenFile@1379 410bdfc067caf4a02b84e6388302f4dcac16e1b913ae58a2af58cd0376f1b7bf |
| 98 | ship_rootfs.go readProcessesFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the --processes file the person named (os.ReadFile) and decodes it with release.DecodeProcesses; decides nothing for root file:ReadFile@87 88e5324d435c9aa9d027155e6b60afa2fbea74b65066f9db25704f3dda3320fa |
| 99 | ship_runtime.go execRunner legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), runs the docker or podman CLI (exec.CommandContext) found on PATH or named by CARLOS_CONTAINER_RUNTIME, as the person, for docker save of a local image name, the --check import, run, inspect, logs and removal; decides nothing for root; final review: holds the ship's stop lifecycle while the child runs, so a stop waits for it to be killed and reaped, the same CommandContext file:CommandContext@230 0b541b4e179d17512a72601d635bea1bc6eb7198cdf60e7b90a2aa52b46befc0 |
| 100 | ship_runtime.go openRootfsSource legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), stats the source the person named; an existing path goes to rootfsimage.Open, a local image name is exported with the runtime to <scratch>/image.tar in its own scratch and opened there; Open is rootfsimage.Open; decides nothing for root file:Open@268,file:Stat@146 5d90d22dd97cb5cc12a1c4d58cebe365e592be325141c545d1bf42a7e98ec58d |
| 101 | |
amadan