Repository navigation
R10 witness owed: the ensure-from-recipe arm of ensureBaseImage (base not local, executor present) needs a credential-less live run #43
Description
Problem
candy/plugin-build/buildkit.go now ensures an image's BASE before the buildctl run (opencharly/charly#949, the ensure half). Two of its three arms are pinned live/unit here; the third — the one the issue is actually about — has no in-repo witness:
| arm | state | witness |
|---|---|---|
no ARG BASE_IMAGE / scratch |
proven | TestEnsureBaseImage_NoOpForScratchAndEmpty |
| base already in the run engine's store | proven | TestEnsureBaseImage_PresentBaseIsANoOp (against a real local ref) |
| base not local, drive holds no executor | proven | TestEnsureBaseImage_RefusesWithoutAnExecutor |
base not local, executor present → ensureViaResolveAndBuild (resolve → pull → build locally) |
NOT proven end to end | ensure.go path, no witness |
What is owed
One live run on a host of the shape the issue describes: no registry credential, a containerfile whose ARG BASE_IMAGE names a remote org image that is not in the store, and that base's recipe present in the project — the build must then complete by building the base locally instead of dying with the registry's auth error.
The pieces that make it work now exist on main: the drive pushes every image it builds to the local charly registry (RegistryMirror, DaemonOptions), so a base built through the ensure contract is resolvable by buildkit through that mirror. What is missing is the measurement.
Why it is filed rather than worked around
Proving it needs a credential-less registry plus a project carrying the remote base's recipe — a venue this repo's gate cannot construct (its live BuildKit test drives the drive directly and skips visibly without the toolchain). Per R1 the finding is recorded; per HC the proof is not separable from that venue.
Agent: plugins
Assisted-by: DeepSeek Harness deepseek-v4.1-flash (analysed on a live system)
Activity
test(build): pin the ensure decision's refusing and warm-store arms (…
fix(build): prove the resolving arm through an ensure seam, and paste…
feat(build): ensure an image's BASE before BuildKit resolves it (char…