Documentation
¶
Overview ¶
Package extbin is boxer's single sanctioned entry point for invoking external programs. Every host binary boxer can spawn is declared here as a Program and resolved through one policy, so "which external programs does this toolkit execute, and where are they found" is one auditable list — a Registry — rather than a grep across the tree. For a toolkit that ships airgapped and pins its own toolchain, that chokepoint is a supply-chain asset, not merely deduplication.
extbin resolves executables; it deliberately does not own process lifecycle. Program.Command returns a configured *exec.Cmd that the caller still drives — wiring stdio, stdin pipes, process groups (SysProcAttr), signals, and Start/Wait/Kill as it sees fit. Program.Output, Program.CombinedOutput and Program.Run are conveniences for the common "spawn and collect" case.
The codelint rule CS012 ("no direct os/exec outside extbin") enforces that every external-process resolution flows through this package; extbin itself is the one exempt caller of os/exec.
Index ¶
- Variables
- type Kind
- type Opts
- type Program
- func (p *Program) CombinedOutput(ctx context.Context, o Opts, args ...string) (out []byte, err error)
- func (p *Program) Command(ctx context.Context, o Opts, args ...string) (cmd *exec.Cmd, err error)
- func (p *Program) Output(ctx context.Context, o Opts, args ...string) (stdout []byte, err error)
- func (p *Program) Resolve() (path string, available bool)
- func (p *Program) Run(ctx context.Context, o Opts, args ...string) (err error)
Constants ¶
This section is empty.
Variables ¶
var ( // Go is the `go` binary itself (`go env`, `go build`). Reproducibility // comes from the go.mod toolchain directive + GOTOOLCHAIN. Go = Declare(Program{ Name: "go", Kind: GoToolchain, InstallHint: "the Go toolchain (https://go.dev/dl)", }) // SCC is the scc code-counter, pinned in go.mod's tool block and invoked as // `go tool scc`, falling back to an `scc` on PATH. SCC = Declare(Program{ Name: "scc", Kind: GoTool, Module: "github.com/boyter/scc/v3", InstallHint: "run via `go tool scc`, or install scc on PATH (https://github.com/boyter/scc)", }) )
Go toolchain.
var ( // Git backs the governance tooling (commitdigest, repo, doclint) and repo // introspection (scctree). Git = Declare(Program{ Name: "git", Kind: Host, InstallHint: "install git (https://git-scm.com)", }) // Pijul backs the pushout pijul adapter. Pijul = Declare(Program{ Name: "pijul", Kind: Host, InstallHint: "https://pijul.org/manual/installation.html", }) )
Version control.
var ( // TinyGo compiles the WASM survey probes. The airgap bundle ships a pinned // TinyGo distribution and points BOXER_TINYGO at it (ADR-0095), so an // offline target resolves the copy that was verified against the bundled Go // SDK rather than whatever PATH happens to offer. TinyGo = Declare(Program{ Name: "tinygo", Kind: Host, OverrideEnv: "BOXER_TINYGO", InstallHint: "https://tinygo.org/getting-started/install/", }) // Rustfmt formats generated Rust (egui2 driver output). Rustfmt = Declare(Program{ Name: "rustfmt", Kind: Host, InstallHint: "rustup component add rustfmt", }) // Cargo drives Rust builds in the deploy showcase. Cargo = Declare(Program{ Name: "cargo", Kind: Host, InstallHint: "install the Rust toolchain (https://rustup.rs)", }) // Bash runs shell build steps in the deploy showcase. Bash = Declare(Program{ Name: "bash", Kind: Host, InstallHint: "install bash", }) )
Language toolchains for code synthesis / analysis.
var ( Flamegraph = Declare(Program{ Name: "flamegraph", Kind: Host, InstallHint: "cargo install flamegraph", }) Valgrind = Declare(Program{ Name: "valgrind", Kind: Host, InstallHint: "install valgrind (https://valgrind.org)", }) Heaptrack = Declare(Program{ Name: "heaptrack", Kind: Host, InstallHint: "install heaptrack", }) )
Profiling wrappers for the imzero2 client (selected by BOXER_IMZERO_DEBUG_MODE).
var ( // Restorecon relabels SELinux contexts during deploy. Restorecon = Declare(Program{ Name: "restorecon", Kind: Host, InstallHint: "part of policycoreutils (SELinux)", }) // FcMatch resolves a font file path via fontconfig for the deploy showcase. FcMatch = Declare(Program{ Name: "fc-match", Kind: Host, InstallHint: "install fontconfig", }) // Systemctl restarts the service after an atomic deploy swap. Systemctl = Declare(Program{ Name: "systemctl", Kind: Host, InstallHint: "systemd (systemctl) is required on the deploy host", }) )
System / desktop utilities.
var ( // ClickHouseLocal runs one-shot SQL over local files (adr query, recordstore // exec, the chlocalpool worker, arrow formatting, mine-trends). Callers with // a configured binary path pass it via [Opts].Path. ClickHouseLocal = Declare(Program{ Name: "clickhouse-local", Kind: Host, OverrideEnv: "BOXER_CLICKHOUSE_LOCAL", InstallHint: "https://clickhouse.com/docs/en/install", }) )
Data / query engines.
var PackageProps = packageprops.Props{ WASMWASI: packageprops.WASMCompiles, WASMJS: packageprops.WASMCompiles, WASMFreestanding: packageprops.WASMCompiles, }
PackageProps records this package's curated properties (ADR-0080). Seeded by `boxer code analysis golang wasmsurvey props generate`; curate by hand. The same group's `props verify` reconciles it. os/exec compiles for every WASM target (it fails only at run time); the package pulls in no cgo or blocked dependencies.
var ( // Rclone is both halves of the lading store's SFTP-over-stdio seam // (ADR-0198 §SD9): it runs the head in place of ssh to reach the store, // and ladingremote.Serve spawns `rclone serve sftp --stdio` on the other // side to snapshot a remote. That second half is shipped code, not a test // fixture — this declaration is the resolution chokepoint for it, which is // what makes the spawn auditable from here rather than from a call site. Rclone = Declare(Program{ Name: "rclone", Kind: Host, OverrideEnv: "BOXER_RCLONE", InstallHint: "https://rclone.org/install/", }) )
Storage transports.
Functions ¶
This section is empty.
Types ¶
type Kind ¶
type Kind uint8
Kind selects a Program's resolution policy.
const ( // Host is an ambient binary looked up on PATH — the bulk of boxer's // external dependencies (git, clickhouse-local, tinygo, rustfmt, …). Such // binaries are, by nature, not pinned; declaring them here at least makes // the set enumerable and gives each a uniform override + install hint. Host Kind = iota // GoTool is a module tool pinned in go.mod's tool block. It is invoked as // `go tool <Name>` (reproducible, version-matched) and falls back to a // `<Name>` binary on PATH when the module tool cache is unavailable. GoTool // GoToolchain is the `go` binary itself (`go env`, `go build`). Its // reproducibility comes from the go.mod toolchain directive + GOTOOLCHAIN. GoToolchain // Local is a caller-supplied executable path — a freshly built artifact or // a configured client binary. [Opts].Path is required; there is no PATH // lookup. The registry entry records the role, not a fixed path. Local )
type Opts ¶
type Opts struct {
// Dir is the working directory; empty inherits the current process's.
Dir string
// Path overrides binary resolution with an explicit executable path. It is
// the highest-priority source for any kind, and is required for Local
// programs.
Path string
// Env sets the child environment, exactly like exec.Cmd.Env: nil inherits
// the parent's, non-nil replaces it wholesale. Callers wanting
// os.Environ()+X or key-overrides compute that slice here.
Env []string
}
Opts configures a single invocation.
type Program ¶
type Program struct {
// Name is the invocation/lookup name for Host and GoTool programs (e.g.
// "git", "scc"). For Local programs it is a role label used only to key the
// audit registry. Must be unique across all declarations.
Name string
// Kind is the resolution policy.
Kind Kind
// Module is the go.mod tool-block module path for a GoTool (e.g.
// "github.com/boyter/scc/v3"), recorded to cross-reference the SBOM.
// Ignored for other kinds.
Module string
// OverrideEnv, when non-empty, names an environment variable whose value —
// an absolute path — takes precedence over PATH lookup. Host and
// GoToolchain only. It is the hook a future hermetic/airgap mode can
// require so no external binary is resolved from an ambient PATH.
OverrideEnv string
// InstallHint is appended to the not-found error, telling an operator how
// to satisfy the dependency.
InstallHint string
}
Program is a declared external-program dependency of boxer. Declare programs as package-level vars via Declare; the set of declarations is the audit surface.
func Declare ¶
Declare registers p and returns a stable handle to it. It panics on an empty Name or a duplicate — declarations are package-init constants, so a clash is a programming error worth failing loudly at startup rather than resolving ambiguously at run time.
func Registry ¶
func Registry() (programs []*Program)
Registry returns every declared program, sorted by Name. This is the machine-readable audit surface: everything boxer is wired to be able to spawn.
func (*Program) CombinedOutput ¶
func (p *Program) CombinedOutput(ctx context.Context, o Opts, args ...string) (out []byte, err error)
CombinedOutput runs p and returns stdout and stderr interleaved, with the same GoTool fallback as Program.Output.
func (*Program) Command ¶
Command resolves p under o and returns an *exec.Cmd with the context, working directory, environment and args applied — ready for the caller to wire stdio / SysProcAttr and then Start or Run. Use this whenever the invocation needs streaming, stdin, process-group control, or custom signal handling.
For a GoTool this returns the pinned `go tool <Name>` form only. The PATH fallback is a run-time behaviour, so it applies to Program.Output, Program.CombinedOutput and Program.Run, which can observe a failed run; a caller that streams a GoTool gets the pinned form (pass Opts.Path to force a specific binary).
func (*Program) Output ¶
Output runs p and returns its stdout. Stderr is captured and folded into the error on failure. For a GoTool, a failed `go tool` invocation falls back to a PATH binary of the same Name.
func (*Program) Resolve ¶
Resolve reports where p currently resolves on this host and whether it is available, without running it — the read-only counterpart to Program.Command, for introspection and supply-chain attestation.
path is the concrete executable file to attest, when there is one: the PATH lookup for a Host program, the `go` binary for GoToolchain, and — for a GoTool — the PATH binary of the same name if present. A GoTool that resolves only via the pinned `go tool <Name>` form reports (path="", available=true): its artifact lives in the go build cache and is attested by Program.Module + go.sum rather than a file hash. A Local program needs a caller-supplied path and reports ("", false).