Skip to content

chore: delete two uncalled public functions to restore the footprint ceiling #5372

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
auser wants to merge 1 commit into from
Closed

chore: delete two uncalled public functions to restore the footprint ceiling #5372

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 0 additions & 24 deletions crates/mvm-build/src/runtime_layer.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -526,30 +526,6 @@ pub fn stage_runtime_layer(
Ok(stage)
}

/// Compose authenticated runtime archives without Nix or a builder VM.
///
/// This prepares reusable filesystem input only. It cannot be booted, signed as
/// an application, or installed as a `.mvmpkg` without the signed base, an
/// application entrypoint, policy admission, verity and final bundle signing.
/// A directory may recur across layers, but no file or symlink may overlap.
///
/// # Errors
///
/// Refuses revoked or changed archives, unresolved dependencies, path
/// collisions, and any tar semantics not faithfully retained by extraction.
pub fn compose_runtime_layers(
archives: &[&VerifiedRuntimeLayerArchive],
) -> Result<ComposedRuntimeLayers, RuntimeLayerStageError> {
if archives.is_empty() || archives.len() > MAX_LAYERS {
return Err(RuntimeLayerStageError::InconsistentLayers);
}
let arch = &archives[0].descriptor().manifest().runtime_layer.guest_arch;
let pins = runtime_pins(archives, arch)?;
let mut composed = ComposedRuntimeLayers::new(pins)?;
add_runtime_archives(&mut composed, archives)?;
Ok(composed)
}

/// Compose precisely the authenticated layers a v2 application requests.
///
/// The host selects the generic base profile; the author cannot choose a
Expand Down
14 changes: 0 additions & 14 deletions crates/mvm-vmm/src/vsock_egress_bridge/egress_gate.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -440,20 +440,6 @@ impl EgressGate {
}
}

/// Decide a TCP connect to an already-resolved address.
///
/// When the address belongs to a pinned host, the verdict carries that
/// host's whole admitted address set (IPv4 first), not just the single
/// address requested. A guest that resolved a dual-stack host locally and
/// dialed the numeric IPv6 (macOS `getaddrinfo` returns IPv6 first) then
/// falls over to the pinned IPv4 sibling when the IPv6 route is unreachable
/// instead of stranding the connect — the same happy-eyeballs behaviour the
/// hostname path already gets. Every offered address is independently
/// policy-checked, so widening the set never admits an unpinned target.
pub fn decide_addr(&self, ip: IpAddr, port: u16) -> EgressVerdict {
self.decide_addr_for_proto(Proto::Tcp, ip, port)
}

/// Decide a guest connect request — either a numeric `"<ip>:<port>"` or a
/// `"<hostname>:<port>"` (DNS-over-vsock: the `socks5h` client sends a name and
/// the host resolves it here against the pin registry, never the guest). A
Expand Down
Loading