extbin

package
v0.0.21 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 21, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Overview

Package extbin is boxer's single sanctioned entry point for invoking external programs. Every host binary boxer can spawn is declared here as a Program and resolved through one policy, so "which external programs does this toolkit execute, and where are they found" is one auditable list — a Registry — rather than a grep across the tree. For a toolkit that ships airgapped and pins its own toolchain, that chokepoint is a supply-chain asset, not merely deduplication.

extbin resolves executables; it deliberately does not own process lifecycle. Program.Command returns a configured *exec.Cmd that the caller still drives — wiring stdio, stdin pipes, process groups (SysProcAttr), signals, and Start/Wait/Kill as it sees fit. Program.Output, Program.CombinedOutput and Program.Run are conveniences for the common "spawn and collect" case.

The codelint rule CS012 ("no direct os/exec outside extbin") enforces that every external-process resolution flows through this package; extbin itself is the one exempt caller of os/exec.

Index

Constants

This section is empty.

Variables

View Source
var (
	// Go is the `go` binary itself (`go env`, `go build`). Reproducibility
	// comes from the go.mod toolchain directive + GOTOOLCHAIN.
	Go = Declare(Program{
		Name:        "go",
		Kind:        GoToolchain,
		InstallHint: "the Go toolchain (https://go.dev/dl)",
	})

	// SCC is the scc code-counter, pinned in go.mod's tool block and invoked as
	// `go tool scc`, falling back to an `scc` on PATH.
	SCC = Declare(Program{
		Name:        "scc",
		Kind:        GoTool,
		Module:      "github.com/boyter/scc/v3",
		InstallHint: "run via `go tool scc`, or install scc on PATH (https://github.com/boyter/scc)",
	})
)

Go toolchain.

View Source
var (
	// Git backs the governance tooling (commitdigest, repo, doclint) and repo
	// introspection (scctree).
	Git = Declare(Program{
		Name:        "git",
		Kind:        Host,
		InstallHint: "install git (https://git-scm.com)",
	})

	// Pijul backs the pushout pijul adapter.
	Pijul = Declare(Program{
		Name:        "pijul",
		Kind:        Host,
		InstallHint: "https://pijul.org/manual/installation.html",
	})
)

Version control.

View Source
var (
	// TinyGo compiles the WASM survey probes. The airgap bundle ships a pinned
	// TinyGo distribution and points BOXER_TINYGO at it (ADR-0095), so an
	// offline target resolves the copy that was verified against the bundled Go
	// SDK rather than whatever PATH happens to offer.
	TinyGo = Declare(Program{
		Name:        "tinygo",
		Kind:        Host,
		OverrideEnv: "BOXER_TINYGO",
		InstallHint: "https://tinygo.org/getting-started/install/",
	})

	// Rustfmt formats generated Rust (egui2 driver output).
	Rustfmt = Declare(Program{
		Name:        "rustfmt",
		Kind:        Host,
		InstallHint: "rustup component add rustfmt",
	})

	// Cargo drives Rust builds in the deploy showcase.
	Cargo = Declare(Program{
		Name:        "cargo",
		Kind:        Host,
		InstallHint: "install the Rust toolchain (https://rustup.rs)",
	})

	// Bash runs shell build steps in the deploy showcase.
	Bash = Declare(Program{
		Name:        "bash",
		Kind:        Host,
		InstallHint: "install bash",
	})
)

Language toolchains for code synthesis / analysis.

View Source
var (
	Flamegraph = Declare(Program{
		Name:        "flamegraph",
		Kind:        Host,
		InstallHint: "cargo install flamegraph",
	})

	Valgrind = Declare(Program{
		Name:        "valgrind",
		Kind:        Host,
		InstallHint: "install valgrind (https://valgrind.org)",
	})

	Heaptrack = Declare(Program{
		Name:        "heaptrack",
		Kind:        Host,
		InstallHint: "install heaptrack",
	})
)

Profiling wrappers for the imzero2 client (selected by BOXER_IMZERO_DEBUG_MODE).

View Source
var (
	// Restorecon relabels SELinux contexts during deploy.
	Restorecon = Declare(Program{
		Name:        "restorecon",
		Kind:        Host,
		InstallHint: "part of policycoreutils (SELinux)",
	})

	// FcMatch resolves a font file path via fontconfig for the deploy showcase.
	FcMatch = Declare(Program{
		Name:        "fc-match",
		Kind:        Host,
		InstallHint: "install fontconfig",
	})

	// Systemctl restarts the service after an atomic deploy swap.
	Systemctl = Declare(Program{
		Name:        "systemctl",
		Kind:        Host,
		InstallHint: "systemd (systemctl) is required on the deploy host",
	})
)

System / desktop utilities.

View Source
var (
	// ClickHouseLocal runs one-shot SQL over local files (adr query, recordstore
	// exec, the chlocalpool worker, arrow formatting, mine-trends). Callers with
	// a configured binary path pass it via [Opts].Path.
	ClickHouseLocal = Declare(Program{
		Name:        "clickhouse-local",
		Kind:        Host,
		OverrideEnv: "BOXER_CLICKHOUSE_LOCAL",
		InstallHint: "https://clickhouse.com/docs/en/install",
	})
)

Data / query engines.

View Source
var PackageProps = packageprops.Props{
	WASMWASI:         packageprops.WASMCompiles,
	WASMJS:           packageprops.WASMCompiles,
	WASMFreestanding: packageprops.WASMCompiles,
}

PackageProps records this package's curated properties (ADR-0080). Seeded by `boxer code analysis golang wasmsurvey props generate`; curate by hand. The same group's `props verify` reconciles it. os/exec compiles for every WASM target (it fails only at run time); the package pulls in no cgo or blocked dependencies.

View Source
var (
	// Rclone is both halves of the lading store's SFTP-over-stdio seam
	// (ADR-0198 §SD9): it runs the head in place of ssh to reach the store,
	// and ladingremote.Serve spawns `rclone serve sftp --stdio` on the other
	// side to snapshot a remote. That second half is shipped code, not a test
	// fixture — this declaration is the resolution chokepoint for it, which is
	// what makes the spawn auditable from here rather than from a call site.
	Rclone = Declare(Program{
		Name:        "rclone",
		Kind:        Host,
		OverrideEnv: "BOXER_RCLONE",
		InstallHint: "https://rclone.org/install/",
	})
)

Storage transports.

Functions

This section is empty.

Types

type Kind

type Kind uint8

Kind selects a Program's resolution policy.

const (
	// Host is an ambient binary looked up on PATH — the bulk of boxer's
	// external dependencies (git, clickhouse-local, tinygo, rustfmt, …). Such
	// binaries are, by nature, not pinned; declaring them here at least makes
	// the set enumerable and gives each a uniform override + install hint.
	Host Kind = iota
	// GoTool is a module tool pinned in go.mod's tool block. It is invoked as
	// `go tool <Name>` (reproducible, version-matched) and falls back to a
	// `<Name>` binary on PATH when the module tool cache is unavailable.
	GoTool
	// GoToolchain is the `go` binary itself (`go env`, `go build`). Its
	// reproducibility comes from the go.mod toolchain directive + GOTOOLCHAIN.
	GoToolchain
	// Local is a caller-supplied executable path — a freshly built artifact or
	// a configured client binary. [Opts].Path is required; there is no PATH
	// lookup. The registry entry records the role, not a fixed path.
	Local
)

func (Kind) String

func (k Kind) String() string

String returns the lowercase kind name (host, gotool, gotoolchain, local), suitable for a table column or a log field.

type Opts

type Opts struct {
	// Dir is the working directory; empty inherits the current process's.
	Dir string
	// Path overrides binary resolution with an explicit executable path. It is
	// the highest-priority source for any kind, and is required for Local
	// programs.
	Path string
	// Env sets the child environment, exactly like exec.Cmd.Env: nil inherits
	// the parent's, non-nil replaces it wholesale. Callers wanting
	// os.Environ()+X or key-overrides compute that slice here.
	Env []string
}

Opts configures a single invocation.

type Program

type Program struct {
	// Name is the invocation/lookup name for Host and GoTool programs (e.g.
	// "git", "scc"). For Local programs it is a role label used only to key the
	// audit registry. Must be unique across all declarations.
	Name string
	// Kind is the resolution policy.
	Kind Kind
	// Module is the go.mod tool-block module path for a GoTool (e.g.
	// "github.com/boyter/scc/v3"), recorded to cross-reference the SBOM.
	// Ignored for other kinds.
	Module string
	// OverrideEnv, when non-empty, names an environment variable whose value —
	// an absolute path — takes precedence over PATH lookup. Host and
	// GoToolchain only. It is the hook a future hermetic/airgap mode can
	// require so no external binary is resolved from an ambient PATH.
	OverrideEnv string
	// InstallHint is appended to the not-found error, telling an operator how
	// to satisfy the dependency.
	InstallHint string
}

Program is a declared external-program dependency of boxer. Declare programs as package-level vars via Declare; the set of declarations is the audit surface.

func Declare

func Declare(p Program) (handle *Program)

Declare registers p and returns a stable handle to it. It panics on an empty Name or a duplicate — declarations are package-init constants, so a clash is a programming error worth failing loudly at startup rather than resolving ambiguously at run time.

func Registry

func Registry() (programs []*Program)

Registry returns every declared program, sorted by Name. This is the machine-readable audit surface: everything boxer is wired to be able to spawn.

func (*Program) CombinedOutput

func (p *Program) CombinedOutput(ctx context.Context, o Opts, args ...string) (out []byte, err error)

CombinedOutput runs p and returns stdout and stderr interleaved, with the same GoTool fallback as Program.Output.

func (*Program) Command

func (p *Program) Command(ctx context.Context, o Opts, args ...string) (cmd *exec.Cmd, err error)

Command resolves p under o and returns an *exec.Cmd with the context, working directory, environment and args applied — ready for the caller to wire stdio / SysProcAttr and then Start or Run. Use this whenever the invocation needs streaming, stdin, process-group control, or custom signal handling.

For a GoTool this returns the pinned `go tool <Name>` form only. The PATH fallback is a run-time behaviour, so it applies to Program.Output, Program.CombinedOutput and Program.Run, which can observe a failed run; a caller that streams a GoTool gets the pinned form (pass Opts.Path to force a specific binary).

func (*Program) Output

func (p *Program) Output(ctx context.Context, o Opts, args ...string) (stdout []byte, err error)

Output runs p and returns its stdout. Stderr is captured and folded into the error on failure. For a GoTool, a failed `go tool` invocation falls back to a PATH binary of the same Name.

func (*Program) Resolve

func (p *Program) Resolve() (path string, available bool)

Resolve reports where p currently resolves on this host and whether it is available, without running it — the read-only counterpart to Program.Command, for introspection and supply-chain attestation.

path is the concrete executable file to attest, when there is one: the PATH lookup for a Host program, the `go` binary for GoToolchain, and — for a GoTool — the PATH binary of the same name if present. A GoTool that resolves only via the pinned `go tool <Name>` form reports (path="", available=true): its artifact lives in the go build cache and is attested by Program.Module + go.sum rather than a file hash. A Local program needs a caller-supplied path and reports ("", false).

func (*Program) Run

func (p *Program) Run(ctx context.Context, o Opts, args ...string) (err error)

Run runs p and discards stdout; stderr is folded into the error on failure. It is a convenience for fire-and-forget invocations whose exit status is the only thing of interest.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL