Parse sealed Chromium library entries exactly #8

Merged

noel merged 1 commit from fix/chromium-runtime-ldconfig-check into main

2026-08-13 22:11:17 +00:00

noel commented

2026-08-13 22:11:08 +00:00

Owner

Parse the first ldconfig field with awk and require an exact library-name match.

Verification:

installed the four checksum-pinned packages in a disposable --network none copy of the current Ubuntu runner image
resolved libasound.so.2, libnspr4.so, libnss3.so, libnssutil3.so, and libsmime3.so exactly
./test-system-hz-hermetic.sh
git diff --check

The first sealed Chromium runtime build installed and audited all four exact packages successfully, then rejected the image because the library assertion expected a literal leading space while ldconfig indents entries with a tab. Parse the first ldconfig field with awk and require an exact library-name match. Verification: - installed the four checksum-pinned packages in a disposable --network none copy of the current Ubuntu runner image - resolved libasound.so.2, libnspr4.so, libnss3.so, libnssutil3.so, and libsmime3.so exactly - ./test-system-hz-hermetic.sh - git diff --check

noel added 1 commit

2026-08-13 22:11:08 +00:00

fix(ci): parse ldconfig entries exactly 20f0b68bc8