Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ww: protect public install outputs

Browse Source
This commit is contained in:
Hojun-Cho
2026-08-21 04:11:01 +09:00
parent ce91f6662c
commit 1b71250ad5
7 changed files with 1064 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
docs/spec.md
View File

@@ -335,6 +335,22 @@ ImportPath = ident { "." ident } .
output. Output paths and directory metadata never become package, import,
graph, action,
symbol, artifact, `.wwi`, or persistence identity.
Every caller-visible build installation checks its destination after all
applicable compile, assemble, archive, and link producers finish. Ordinary
`stat` follows symlinks. An existing directory rejects as
`ww: build output "PATH" already exists and is a directory`; an existing
nonempty regular file rejects as `... is not an object file` unless its
leading bytes identify a Go 1.26.5 object/output form. The recognized table
is archive, ELF, Mach-O, PE, Plan 9, WASM, and XCOFF magic; WW additionally
recognizes its compiler-owned `//ww:module ` interface prefix. An absent
path, an empty regular reservation, or a non-directory non-regular path may
be replaced. A published non-main archive and its `.wwi` sidecar are checked
as one WW request transaction, so arbitrary caller text in either
destination preserves both old outputs and the committed persistent
generation. This safety check is output disposition only: it does not enter
package/import loading, graph or action identity, artifact bytes, or
invalidation.
Assembly-only `-S` retains the directory form's command-action selection and
no-main rejection, but it reaches no install action: destination length,
duplicate publication names, implicit destination collision, and output
@@ -714,12 +730,17 @@ paths, and retained binary names remain presentation or loader metadata and do
not become canonical package or action identity.
The retained file is an executable, byte-identical copy of the private
runnable. It joins package artifacts and statuses in the request-wide atomic
publication transaction. Build, link, stage, or install failure preserves old
destinations and removes temporary stages and invocation-created output
prefixes. Test execution starts only after that transaction commits, so a
runtime failure leaves an explicitly retained binary. A no-test product
publishes no binary and does not create a directory solely for one.
runnable. A compile-only retained binary joins package artifacts and statuses
in the request-wide atomic publication transaction. Build, link, stage, or
install failure preserves old destinations and removes temporary stages and
invocation-created output prefixes. For a running `-o` request, the private
binary executes first. Only a successful run enters the guarded install
action; a failed, signalled, timed-out, interrupted, or unstartable run
publishes no new copy and preserves any prior destination. The post-run guard
uses the same directory/nonempty-regular/object-magic rule as `ww build`.
Successful products in a multi-package running request install independently;
their visible result order remains package order. A no-test product publishes
no binary and does not create a directory solely for one.
`-w` may persist the unchanged semantic actions for either `-c` or running
retention without changing publication identity or introducing a test-result
cache.