ZacharyZhang-NY
86e3724310
- .github/workflows/release.yml: on tag v* build all 5 targets (macOS
arm64/x86_64, Linux arm64/x86_64 incl. free arm runners, Windows
x86_64) with the release-dist profile, archive kigi-<version>-<triple>
with LICENSE/NOTICE/THIRD-PARTY-NOTICES, generate SHA256SUMS, publish
the release (prerelease for tags containing '-'), with a tag↔workspace
version guard.
- install.sh / install.ps1 (repo root): platform detection, latest or
--version download from GitHub Releases, SHA-256 verification against
SHA256SUMS, install into the kigi home's downloads/ + bin/kigi symlink
(the same layout the self-updater manages), smoke test, PATH guidance.
- kigi-update rewritten onto the GitHub Releases API (documented wire
shape; stable=/latest, alpha=semver-max across the list, pinned=/tags):
SHA-256 gate before any binary swap, tar.gz/zip extraction per
platform, atomic bin/kigi symlink swap, channel/rollback semantics and
the KIGI_AUTO_UPDATE gate preserved verbatim; every x.ai/GCS/npm
endpoint deleted, npm/gh-release installers removed, legacy grok/agent
links retired on install. kigi-env owns the update base URL with a
KIGI_UPDATE_BASE_URL override (this is what the test artifact server
injects).
- .cargo/config.toml: removed the non-portable neoverse-v2 CPU pin on
Linux arm64 (fleet-specific); RELRO/NX hardening link-args now apply
to the gnu targets too, matching the release-dist profile's contract.
- THIRD-PARTY-NOTICES regenerated via cargo-about (about.toml +
template); the M0 hand-built file is dropped and README points at the
generated one. docs/RELEASE.md carries the release checklist.
- Deleted xAI-era leftovers: kigi-tui/scripts/install*.{sh,ps1} (x.ai
CDN) and the @xai-official/grok npm skeleton (PRD F8: no npm).
Gates: fmt clean; workspace check/clippy 0/0 (--locked, -D warnings);
kigi-update 58 lib + 86 integration tests green; deny ok;
release-dist build of kigi-bin succeeds and reports 'kigi 0.1.0'.
99 lines
3.6 KiB
TOML
99 lines
3.6 KiB
TOML
# link-arg
|
|
# https://pyo3.rs/v0.17.1/building_and_distribution.html#macos
|
|
|
|
# force-unwind-tables
|
|
# https://github.com/rust-lang/backtrace-rs/issues/397
|
|
|
|
# rustflags are not additive. we have differing flags per arch,
|
|
# so we must repeat flags in each target section
|
|
|
|
[target.x86_64-apple-darwin]
|
|
rustflags = [
|
|
"-C",
|
|
"link-arg=-undefined",
|
|
"-C",
|
|
"link-arg=dynamic_lookup",
|
|
"-C",
|
|
"force-unwind-tables=yes",
|
|
"-C",
|
|
"link-args=-ObjC",
|
|
]
|
|
|
|
[target.aarch64-apple-darwin]
|
|
rustflags = [
|
|
"-C",
|
|
"link-arg=-undefined",
|
|
"-C",
|
|
"link-arg=dynamic_lookup",
|
|
"-C",
|
|
"force-unwind-tables=yes",
|
|
"-C",
|
|
"link-args=-ObjC",
|
|
]
|
|
|
|
[target.x86_64-unknown-linux-gnu]
|
|
rustflags = [
|
|
"-C", "force-unwind-tables=yes",
|
|
# Binary hardening (SECURITY): Full RELRO + non-executable stack
|
|
# These flags prevent: GOT overwrite attacks, lazy binding exploits, stack shellcode
|
|
# IMPORTANT: If changing build system (e.g. from cargo to Bazel-only),
|
|
# ensure equivalent linker hardening is applied to production binaries.
|
|
"-C", "link-arg=-Wl,-z,relro,-z,now,-z,noexecstack",
|
|
]
|
|
|
|
# NOTE: no target-cpu pin. Release artifacts (PRD F8) must run on ordinary
|
|
# aarch64 hardware; the default baseline for the target is the portable
|
|
# choice. (The upstream grok-build tree pinned target-cpu=neoverse-v2 here —
|
|
# a server-CPU tune from xAI's build fleet that would emit instructions
|
|
# unavailable on common Cortex-A cores.)
|
|
[target.aarch64-unknown-linux-gnu]
|
|
rustflags = [
|
|
"-C", "force-unwind-tables=yes",
|
|
# Binary hardening (SECURITY): Full RELRO + non-executable stack — see
|
|
# x86_64-unknown-linux-gnu above.
|
|
"-C", "link-arg=-Wl,-z,relro,-z,now,-z,noexecstack",
|
|
]
|
|
|
|
[target.x86_64-unknown-linux-musl]
|
|
rustflags = [
|
|
"-C", "force-unwind-tables=yes",
|
|
# Binary hardening (SECURITY): Full RELRO + non-executable stack
|
|
# These flags prevent: GOT overwrite attacks, lazy binding exploits, stack shellcode
|
|
# IMPORTANT: If changing build system (e.g. from cargo to Bazel-only),
|
|
# ensure equivalent linker hardening is applied to production binaries.
|
|
"-C", "link-arg=-Wl,-z,relro,-z,now,-z,noexecstack",
|
|
]
|
|
|
|
[target.aarch64-unknown-linux-musl]
|
|
rustflags = [
|
|
"-C", "target-cpu=generic",
|
|
"-C", "force-unwind-tables=yes",
|
|
# Binary hardening (SECURITY): Full RELRO + non-executable stack
|
|
# These flags prevent: GOT overwrite attacks, lazy binding exploits, stack shellcode
|
|
# IMPORTANT: If changing build system (e.g. from cargo to Bazel-only),
|
|
# ensure equivalent linker hardening is applied to production binaries.
|
|
"-C", "link-arg=-Wl,-z,relro,-z,now,-z,noexecstack",
|
|
]
|
|
|
|
[target.x86_64-pc-windows-msvc]
|
|
rustflags = ["-C", "force-unwind-tables=yes", "-C", "target-feature=+crt-static"]
|
|
|
|
[target.aarch64-pc-windows-msvc]
|
|
rustflags = ["-C", "force-unwind-tables=yes", "-C", "target-feature=+crt-static"]
|
|
|
|
|
|
# jemalloc page size for Apple Silicon (macOS aarch64 uses 16KB pages = 2^14).
|
|
# This target-prefixed env var is consumed by tikv-jemalloc-sys's build.rs
|
|
# and only takes effect when TARGET=aarch64-apple-darwin. Other targets
|
|
# (x86_64, linux) are unaffected — they check their own prefix first and
|
|
# fall back to the default 4KB page size.
|
|
# Some aarch64 Linux hosts use 64KB kernel pages = 2^16; set the matching
|
|
# env vars below for those platforms.
|
|
# See: https://github.com/tikv/jemallocator/issues/122
|
|
[env]
|
|
SYSTEM_DEPS_DAV1D_BUILD_INTERNAL = "auto"
|
|
AARCH64_APPLE_DARWIN_JEMALLOC_SYS_WITH_LG_PAGE = "14"
|
|
AARCH64_UNKNOWN_LINUX_GNU_JEMALLOC_SYS_WITH_LG_PAGE = "16"
|
|
AARCH64_UNKNOWN_LINUX_MUSL_JEMALLOC_SYS_WITH_LG_PAGE = "16"
|
|
AARCH64_UNKNOWN_LINUX_MUSL_JEMALLOC_SYS_WITH_BACKGROUND_THREADS = "0"
|