gate

Overview ¶

Command gate is the release pipeline's ship-refusal + positive functional gate for the embedded moat-init binaries (plan §5). Run AFTER `go generate ./internal/initbin` (go run recompiles, so the embedded bytes reflect the current embed/ files):

1. Ship refusal: refuse if either embedded blob is still the committed fail-closed stub — a release must never ship a stub as a container entrypoint candidate.
2. Checksum: the embedded bytes must match checksums.txt (catches a stale or hand-edited blob).
3. Functional: on a linux host, exec the host-arch binary with --plan against a fixed environment and require the privilege-drop and MOAT_INIT_FILES-scrub lines. Checksum matching alone cannot catch a regenerated-but-defective blob (wrong commit, truncated output) whose checksums.txt was regenerated alongside it — execing the binary can.

Wired into the goreleaser before hooks; exits non-zero with a diagnostic on any gate failure.