fix(deps): bump tramiton to v0.4.1 (proot-safe firmware build) #158

2026-07-13T11:06:39Z

sharang commented

2026-07-13 11:06:39 +00:00

Follow-up to #157. Real firmware builds failed on the deployment with:

cp: setting permissions for '././app': No such file or directory
builder for '…tramiton-firmware.drv' failed with exit code 1

nix-portable ran fine (unprivileged, proot — user namespaces are off in the container) and downloaded the toolchain, but tramiton's buildPhase did cp -r ${./src}/. ., which sets each copied entry's mode from the read-only nix-store source; that syscall returns ENOENT under proot.

tramiton v0.4.1 changes it to cp -r --no-preserve=mode (the following chmod -R +w . already makes the tree writable), so the build runs identically under bwrap and proot. This bumps all three tramiton crates (core/repro/sbom) to v0.4.1.

Once deployed, re-running a firmware scan should log Firmware SBOM: sealed reproducible build instead of the analysis-only fallback.

Local: clippy (agent) clean against v0.4.1.

Follow-up to #157. Real firmware builds failed on the deployment with: ``` cp: setting permissions for '././app': No such file or directory builder for '…tramiton-firmware.drv' failed with exit code 1 ``` nix-portable ran fine (unprivileged, proot — user namespaces are off in the container) and downloaded the toolchain, but tramiton's buildPhase did `cp -r ${./src}/. .`, which sets each copied entry's mode from the read-only nix-store source; that syscall returns ENOENT under proot. **tramiton v0.4.1** changes it to `cp -r --no-preserve=mode` (the following `chmod -R +w .` already makes the tree writable), so the build runs identically under bwrap and proot. This bumps all three tramiton crates (core/repro/sbom) to v0.4.1. Once deployed, re-running a firmware scan should log `Firmware SBOM: sealed reproducible build` instead of the analysis-only fallback. Local: clippy (agent) clean against v0.4.1.

sharang added 1 commit 2026-07-13 11:06:40 +00:00

fix(deps): bump tramiton to v0.4.1 (proot-safe firmware build)

CI / Check (pull_request) Successful in 5m36s

Details

CI / Detect Changes (pull_request) Has been skipped

Details

CI / Deploy Agent (pull_request) Has been skipped

Details

CI / Deploy Dashboard (pull_request) Has been skipped

Details

CI / Deploy Docs (pull_request) Has been skipped

Details

CI / Deploy MCP (pull_request) Has been skipped

Details

fbb557a243

v0.4.1 fixes the reproducible-build buildPhase to `cp --no-preserve=mode`, so
firmware builds succeed under proot (nix-portable's fallback when user
namespaces are unavailable in the container). Without it every phase-2 firmware
build failed with `cp: setting permissions … No such file or directory` and fell
back to the analysis-only SBOM.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sharang merged commit 71aceafa26 into main

2026-07-13 11:21:44 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#158