Documentation
¶
Overview ¶
Package ripgrep carries the static ripgrep the grep tool runs inside a sandbox (#827, an owner decision): one Linux binary per sandbox architecture, embedded in every executor and worker build, which the toolset writes into a sandbox the first time it greps there.
The binaries are upstream's own release archives, unmodified, pinned in assets/manifest.json by URL and sha256 — the musl builds, which are statically linked (x86_64 as static-pie), so one file runs on any Linux userland: glibc, musl, busybox, or none beyond a shell. Upstream publishes a musl archive for both architectures since 15.0.0, so nothing is built here. The archives are embedded still compressed, about 2 MB each, and opened in memory when a sandbox needs one.
They are not committed. `make ripgrep` (tools/ripgrepfetch) downloads the pinned archives into assets/, checking each digest, and every target that builds something that runs grep — the test gate, the eval suite, the worker release tarballs, the Dockerfile's build stage — runs it first. A build that skipped it still compiles, because the manifest alone satisfies the embed, and Open then answers ErrNotEmbedded: grep is a tool error in that build, never a second implementation. The embed is the whole directory — a pattern naming the archives would fail to compile without them — so the fetch also removes whatever else stands there, and a build it ran before carries the manifest and the pin alone. Open re-checks the digest on every call, so a stray file under the pinned name cannot be embedded and run in its place.
ripgrep is dual-licensed MIT and Unlicense; NOTICE at the repository root carries its license for the artifacts that embed it, and THIRD_PARTY_LICENSES the license texts of everything those static builds link (tools/thirdpartylicenses).
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNotEmbedded = errors.New("this build carries no ripgrep (it was built without `make ripgrep`)")
ErrNotEmbedded is Open's answer in a build whose assets were never fetched.
var Pinned = mustLoadManifest()
Pinned is the embedded manifest. It is read once, at init, like a regexp.MustCompile: the file is compiled in, so a malformed one fails every test that imports this package rather than a call in production.
Functions ¶
Types ¶
type Manifest ¶
type Manifest struct {
Version string `json:"version"`
Archives map[string]Archive `json:"archives"`
}
Manifest is assets/manifest.json: the ripgrep version, as `rg --version` prints it, and by Go architecture name the archive that carries it.
type Unusable ¶
Unusable is a sandbox architecture this build cannot hand rg to, and why.
func Check ¶
func Check() []Unusable
Check opens every pinned archive as an install would, and answers each that cannot be, in architecture order — every one, with ErrNotEmbedded, in a build made without `make ripgrep`. The executor and the worker call it at startup and warn once per architecture named, so a build whose grep can only answer with a tool error in a sandbox of that architecture says so in its log before a model finds out.
Source Files