Repository navigation
Conversation
-->
✱ stlc build✅ go code · compare
✅ python code · compare
✅ typescript code · compare
Diagnostics: ❗ 0 new / 1 total error, 💡 0 new / 5 total note
Build metadata
This comment is auto-generated by stlc and is kept up to date as you push. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 4849059. Configure here.
| meta, err := m.loadMetadata(entry.Name()) | ||
| if err != nil { | ||
| return fmt.Errorf("check Mac identity admission: %w", err) | ||
| } |
There was a problem hiding this comment.
Identity admission fails on metadata errors
Medium Severity
checkMacOSIdentityAvailable treats any loadMetadata failure as fatal, including missing metadata for an in-progress create. A concurrent Linux or macOS create that has already made a guest directory but not yet written metadata causes an unrelated macOS start or create to fail admission.
Reviewed by Cursor Bugbot for commit 4849059. Configure here.
| } | ||
| if exit, ok := e.(*exec.ExitError); !ok || exit.ExitCode() != 1 { | ||
| return nil, fmt.Errorf("cannot verify storage is closed: %v", e) | ||
| } |
There was a problem hiding this comment.
lsof probe leaks process groups
Medium Severity
The import lsof probe runs through exec.CommandContext without a dedicated process group and without SIGKILLing that group on every completion path. Context cancel only stops the wrapper, so lsof descendants can leak after success, ErrWaitDelay, or a wrapper that exits first.
Triggered by learned rule: Subprocess binary probes must use process groups and kill on all completion paths
Reviewed by Cursor Bugbot for commit 4849059. Configure here.
chruffins
changed the title
|
Live QA of the reviewed combined PR1–3 sources plus PR4 patches on Apple silicon passed normal authenticated HTTP create from a digest-pinned, previously HTTP-pulled installed macOS OCI artifact (registry offline). Verified actual macOS 27.0.1/26A434 cold boot over pinned-key SSH, inherited 4CPU/8GiB template defaults, duplicate-identity HTTP409, live-guest API restart recovery with unchanged guest boot time, HTTP stop/start with fresh boot time and durable guest-only marker, and unchanged full SHA256 of the immutable materialized base disk+aux afterward. Stop/start here used system-agent-disabled fallback, not verified graceful root-agent shutdown. QA used an isolated data dir/slot; original instance/API/storage were untouched and the QA VM/API ended stopped. Runtime issue found: the long QA data directory generated an overlong AF_UNIX socket path. VZ reported VM started, then control listener failed |
|
Simplification update at e6e6ab7: shared bounded complete-machine bundle decoding and one macOS request-default preparation; shared concrete create/start network + boot-config preparation. macOS preserves template MAC and avoids Linux allocation/proxy/config-disk dependencies; Linux rollback and request preservation have synthetic tests. Focused instance/API/image race tests passed 3 runs. Identity leases and stopped-storage/export requirements remain. All PRs remain draft. This is source-level/synthetic validation, not a new live boot or production build proof. Default Codex independent review was attempted but is still blocked by authentication (HTTP401). Published atomically after checking reviewer heads with explicit per-ref force-with-lease; prior heads preserved locally. |
chruffins
changed the title
fe64b62 to
321aedb
Compare
Experimental, administrator-provisioned macOS guests on Apple silicon through the normal image and instance APIs. Unsupported operations are rejected explicitly. Per-operation status: docs/macos-support.md.
321aedb to
7d5aeec
Compare
This branch has not been deployed
1 participant
Summary
PR 1 of 6 for experimental macOS guests on Apple silicon, through the normal image and instance APIs. VZ only. This is not production macOS support. Base:
main.cmd/import-macos: imports a stopped bundle by cloning disk and aux, hashing content and config, and publishing a local readydarwin/arm64image.sizeorvcpusthat differs from the image is rejected (400).macos_onlymode: no Linux kernel or initrd downloads, builders, or Caddy/DNS; Linux creates are rejected. Loopbacklisten_addressfor the HTTP API.hypemanandvmm(VZ shim log) sources. Memory reclaim reports macOS guests asunsupported.Per-operation status is in
docs/macos-support.md. Other PR docs link to it instead of repeating the unsupported list.Validation
Sequential runs on an Apple M5 host with 16 GiB, using an installed macOS template:
vmmlogs stream. Reclaim returnsunsupportedwith no balloon change.mkfs.ext4or Docker Hub access, which the test host does not have.Limitations
Runningmeans the VMM is running, not that the guest is ready. Readiness and orderly guest shutdown come with PR 3.Security fixes in this revision
golang.org/x/netandgolang.org/x/sysare back to the versions onmain(v0.55.0 and v0.45.0). The previous revision downgraded them to v0.53.0 and v0.43.0. The downgrade reintroduced GHSA-5cv4-jp36-h3mw, a denial-of-service bug in the HTML parser fixed in x/net v0.55.0. The otherx/modules were aligned tomaintoo.IngressResolver.ResolveInstanceIP). Their addresses are observed NAT leases, so the public route must not reach them. Test:TestIngressResolverRefusesMacOSGuest.