sean/builder-images
Watch
1
0
Fork
You've already forked builder-images
 0
Code Issues Pull requests Projects Releases 144 Packages Wiki Activity

Promote c9d37581b6 to main #364

Merged
binjovi-bot merged 4 commits from trunk into main 2026-09-14 14:08:58 +00:00
Conversation 0 Commits 4 Files changed 3 +515
binjovi-bot commented 2026-09-14 14:08:57 +00:00
Collaborator
Copy link
No description provided. 
Add the ibmi-analyst image. It runs Ghidra 11.1.2 with the PowerAS
processor extension over IBM i program objects for the recovery pipeline.
It is the fleet's only Java and Python carve-out: the pinned sean/rpg-demo
toolkit is an upstream tool here, and every gate is bash and jq.

Contents, all fetched at image build time:
- Ghidra 11.1.2 from the GitHub release, checked by byte count and sha256.
  The macOS and Windows native directories go; both Linux ones stay.
- PowerAS commit 0eca5b1, built with Gradle 9.5.1 (sha256 from
  gradle.org/release-checksums) in a build-platform stage, unzipped into
  Ghidra/Extensions, with the PowerPC:BE:64:AS sleigh compiled once.
- sean/rpg-demo commit cd07b7f: recovery/*.py, the JSON contracts,
  TOOL.md, and recovery/ghidra (exporters, tools.json, README).
- zelnet v0.10.17, copied by digest from ibmi-builder:v23.
- java-17-openjdk-devel: analyzeHeadless launches with the jdk java type
  and compiles Java scripts at run time, so a JRE is not sufficient.

Gates: Java 17 with jdk.compiler; the tools.json pins agree with the
Dockerfile; the toolkit help and a failing verify; the PowerAS synthetic
processor test with the exact marker; the twelve-byte evidence input
through all three exporters and the bundle builder, byte-identical to the
rpg-demo evidence listing; the tool lock written before and unchanged after
both Ghidra runs; and recover-object failing closed on a non-save-file.

The AlmaLinux JDK links conf/, lib/security/, and lib/tzdb.dat outside its
tree. The toolkit's tool lock refuses such links, so the build replaces
them with copies.

Claude-Session: https://claude.ai/code/session_01HPdKaFBKQVs8hzfgXMrnwV
AlmaLinux 10 AppStream has java-21-openjdk and java-25-openjdk only. The
first Build failed with "No match for argument: java-17-openjdk-devel".
Ghidra 11.1.2 declares application.java.min=17 with no maximum, Gradle
9.5.1 runs on JDK 21, and the PowerAS build targets sourceCompatibility
17, so install java-21-openjdk-headless and java-21-openjdk-devel and
assert 21 in the gates. The tools.json check no longer asserts the macOS
Java 17.0.19 record; it asserts the field is present.

Claude-Session: https://claude.ai/code/session_01HPdKaFBKQVs8hzfgXMrnwV
The Ghidra 11.1.2 release zip ships native binaries for linux_x86_64,
mac_arm_64, mac_x86_64, and win_x86_64 only. The second Build failed on
the ARM64 decompiler assertion. Build the Linux ARM64 natives in the
build stage with support/buildNatives: the decompiler and sleigh, lzfse,
and the two GNU demanglers. Gradle 8.14.3 (sha256 from
gradle.org/release-checksums) drives that build, because Ghidra's native
build uses the legacy software model that Gradle 9 does not carry. Copy
the executables from <module>/build/os/linux_arm_64/ into
<module>/os/linux_arm_64/, remove only the build/ and .gradle/
directories the native build created, and assert every binary. The unzip
step now asserts that the zip has no linux_arm_64 directory, so a future
zip that ships one forces a deliberate review.

Claude-Session: https://claude.ai/code/session_01HPdKaFBKQVs8hzfgXMrnwV
fix(ibmi-analyst): keep the shell out of the deleted PowerAS tree
All checks were successful
binjovi/ci Binjovi completed the frozen plan
Details
c9d37581b6
 
The third Build built the ARM64 natives and the PowerAS extension, then
failed in the sleigh compile: the RUN had changed into /tmp/PowerAS and
removed it, so the Ghidra launcher started Java from a deleted working
directory, could not run LaunchSupport, and asked for a JDK path with no
TTY. Run Gradle with --project-dir instead of cd, so the working
directory stays valid.

Both dnf install steps now pass --setopt=install_weak_deps=False.
java-21-openjdk-devel requires the full java-21-openjdk, whose weak
dependencies are a desktop stack (pipewire, xdg-desktop-portal, polkit,
systemd-udev, fonts). The runtime asserts that pipewire and
xdg-desktop-portal are absent.

Claude-Session: https://claude.ai/code/session_01HPdKaFBKQVs8hzfgXMrnwV
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/builder-images!364
No description provided.