Seal Chromium runtime libraries in the system runner image #7

Merged

noel merged 1 commit from fix/seal-chromium-runtime into main

2026-08-13 21:44:21 +00:00

noel commented

2026-08-13 21:43:57 +00:00

Owner

Why

Forgejo PR #1735 proved the sealed Chromium artifact could not start in the hosted runner image because ALSA, NSPR, and NSS runtime libraries were absent.

What

add four exact Ubuntu Noble package payloads to the sealed-input contract
verify SHA-256, Debian package name, version, and architecture before installation
install and assert the five required shared libraries with networking disabled

Verification

./test-system-hz-hermetic.sh
git diff --check
all four snapshot payload SHA-256 values verified locally
all four package identities, versions, and architectures verified inside the current Ubuntu runner image with --network none

Why Forgejo PR #1735 proved the sealed Chromium artifact could not start in the hosted runner image because ALSA, NSPR, and NSS runtime libraries were absent. What - add four exact Ubuntu Noble package payloads to the sealed-input contract - verify SHA-256, Debian package name, version, and architecture before installation - install and assert the five required shared libraries with networking disabled Verification - ./test-system-hz-hermetic.sh - git diff --check - all four snapshot payload SHA-256 values verified locally - all four package identities, versions, and architectures verified inside the current Ubuntu runner image with --network none

noel added 1 commit

2026-08-13 21:43:57 +00:00

fix(ci): seal Chromium runtime libraries e6c9f4efc5