Repository navigation
feat(xtcp2): debug writers as build-time opt-ins (FP-1) - #293
Merged
Merged
Conversation
The netlink capture writer (-writeFiles / -capturePath) writes raw
inet_diag replies, every socket's addresses, to disk; the file:
destination writes records wherever configuration points it. Both were
compiled into every binary, including the production slim flavors.
- capture writer behind //go:build capture, with a no-op stub; no flavor
or image carries the tag, only the new xtcp2-capture attr
- file: destination behind //go:build dest_file, compiled into the full
(development) flavor only; stderr split into its own untagged file
- xtcp.CheckBuildSupport: -writeFiles > 0 or -dest file: on a build
without the tag exits 64 before anything binds, naming the tag;
ConfigService.Set refuses it with FailedPrecondition
- armed capture logs a warning and sets xtcp2_debug_capture_enabled;
a capture build reports +capture in its version line
- nix: debugDestinations / optInOnlyTags in versions.nix, extraTags in
mkGoBinary, test-go-flavor-{file,capture} legs, and a flavor-tags
check that no slim flavor carries either tag (go version -m)
Focused container hardening FP-1 (A5).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The debug writers moved behind -tags capture and -tags dest_file, so no lint tier type-checked them. All three tiers now set both tags, matching the `all` leg of the Go test flavor matrix. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Owner
Author
|
randomizedcoder
added a commit
that referenced
this pull request
Nov 12, 2026
Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase F1, FP-1 of the focused container hardening plan (#291). Stack: FP-1 → FP-2 → FP-3; FP-4 is separate.
-tags captureand thefile:destination behind-tags dest_file; the default build has neither.-writeFiles > 0,-dest file:) exits 64 with a rebuild hint;ConfigService.Setrefuseswrite_files > 0the same way.xtcp2_debug_capture_enabled 1. The version string says+capturewhenever the tag is compiled in.dest_fileis in the full flavor only;captureis in no shipped flavor or image, only.#xtcp2-capture.checks.flavor-tags: no slim flavor carries a debug tag; the full flavor hasdest_file;xtcp2-capturehascapture. Newcaptureandfilelegs in the Go test flavor matrix.cmd/xtcp2/exit.go), reused by FP-2 and FP-3.Tests: table-driven
exit_test.go(capture_not_compiled,file_not_compiled,writefiles_zero_default, ...),Setguard rows, tagged capture tests.🤖 Generated with Claude Code