From 4e34105f725830f280f3ddee18f1342850dbb73e Mon Sep 17 00:00:00 2001 From: sechmachine <97589681+sechmachine727@users.noreply.github.com> Date: Wed, 22 Jul 2026 01:31:29 +0700 Subject: [PATCH] protocol: migrate module identity to private Gitea --- .gitea/workflows/verify.yml | 25 ++++++++++++++++++++++++ AGENTS.md | 11 +++++++++++ README.md | 7 +++++++ gen/protobuf/control-v1.pb | Bin 8213 -> 8224 bytes gen/protobuf/tunnel-v1.pb | Bin 9056 -> 9067 bytes go.mod | 2 +- proto/versevdi/control/v1/control.proto | 2 +- proto/versevdi/tunnel/v1/tunnel.proto | 2 +- tests/go/protocol_test.go | 2 +- tools/go-conformance/main.go | 2 +- 10 files changed, 48 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/verify.yml b/.gitea/workflows/verify.yml index d4c93cc..9fefb1e 100644 --- a/.gitea/workflows/verify.yml +++ b/.gitea/workflows/verify.yml @@ -13,6 +13,31 @@ concurrency: cancel-in-progress: true jobs: + module: + # This Linux job proves that private Gitea consumers can resolve the + # module identity and build the tagged Go package without a filesystem + # replacement. The full cross-language verifier remains macOS-bound. + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@v7 + - uses: actions/setup-go@v7 + with: + go-version: "1.26.5" + cache: true + cache-dependency-path: go.mod + - name: Verify private module identity and Go packages + shell: bash + run: | + test "$(go list -m -f '{{.Path}}')" = 'git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol' + if grep -Eq '^[[:space:]]*replace[[:space:]]' go.mod; then + echo 'Protocol module must not use a replace directive' >&2 + exit 1 + fi + go mod verify + go build ./... + go test ./... -count=1 + verify: # The Phase 3A full verifier includes Swift type-checking. The owner must # provide a macOS runner with the pinned toolchain from the handoff. diff --git a/AGENTS.md b/AGENTS.md index f88da98..82456b7 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -36,3 +36,14 @@ work from other owners. Do not push, merge, publish, or change release credentials unless the task separately authorizes it. A local immutable candidate tag is allowed only after matching Go/Rust/Swift fixture hashes and clean-checkout evidence; it is not a publication. + +## Private Go module identity + +- The canonical module path is + `git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol`. +- Generated Protobuf `go_package` options and Go consumers must use that path; + do not restore a GitHub import path or add a filesystem `replace` in a + consumer checkout. +- Consumers pin an exact immutable Protocol tag. The Protocol Gitea workflow + includes a Linux module job that verifies the module identity and builds all + Go packages; the macOS job remains the full Rust/Swift/conformance gate. diff --git a/README.md b/README.md index 0d67d07..a9ad097 100644 --- a/README.md +++ b/README.md @@ -25,3 +25,10 @@ Generated files under `gen/` are never edited by hand. `VERSION`, `compatibility.json`, and the content-addressed fixture manifest identify the release inputs. A Protocol release candidate is not valid until all consumers report the same fixture hash and clean-checkout regeneration evidence. + +## Private Go module + +The canonical Go module is +`git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol`. Private consumers must +resolve an exact Gitea tag and must not use a filesystem `replace`; the Gitea +workflow verifies this module identity and builds the Go packages on Linux. diff --git a/gen/protobuf/control-v1.pb b/gen/protobuf/control-v1.pb index 887b79034381c1d0664ba28049574d427a60d8c1..181606792620c207dba7572eb2698157c213c78b 100644 GIT binary patch delta 61 zcmbR0u)twMs3hab&0&%qOcJh9&gq#Ydc~>98M%qc8JT&hdYSopWqFfdODFO~adC1n Rac~PUvoS<%j*!{Q3;>nG6Epw- delta 50 zcmZ4BFx6p0s3haQ&0&%qOuSZ67U`KK8Kp^j$@#gHzey+Z_;Yb`F>!DUF|#rFZ%&rk G%M1XnD-QMm diff --git a/gen/protobuf/tunnel-v1.pb b/gen/protobuf/tunnel-v1.pb index f9ef9c29ef4643a6c1333a82a784b6c9efbff211..23d11776e980c4647e3bc11f8ccd81def4c174d6 100644 GIT binary patch delta 61 zcmaFh_S$Vjs3hZ*&0&&PnI)W~9MdyP^omoHGjbD?Gcxm1^)mDI%JL>#$j0+TaB*@m Rac~PUvoS<$UM#zp6#%hC6M_H$ delta 50 zcmaFu_P}jJs3c?O<}k^t%)Ay+X6czF8Kp^j$@#gHon_;Be7QKem^iqFnAsS7H?Nc3 G%L)L&&<{ia diff --git a/go.mod b/go.mod index d339038..9e1200f 100644 --- a/go.mod +++ b/go.mod @@ -1,3 +1,3 @@ -module github.com/sechmachine/VerseVDI-Protocol +module git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol go 1.26 diff --git a/proto/versevdi/control/v1/control.proto b/proto/versevdi/control/v1/control.proto index b48d45c..32502b9 100644 --- a/proto/versevdi/control/v1/control.proto +++ b/proto/versevdi/control/v1/control.proto @@ -4,7 +4,7 @@ package versevdi.control.v1; import "google/protobuf/timestamp.proto"; -option go_package = "github.com/sechmachine/VerseVDI-Protocol/gen/go/protocol"; +option go_package = "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol"; message VersionNegotiation { repeated string supported_versions = 1; diff --git a/proto/versevdi/tunnel/v1/tunnel.proto b/proto/versevdi/tunnel/v1/tunnel.proto index 5b2f66c..502869e 100644 --- a/proto/versevdi/tunnel/v1/tunnel.proto +++ b/proto/versevdi/tunnel/v1/tunnel.proto @@ -4,7 +4,7 @@ package versevdi.tunnel.v1; import "google/protobuf/timestamp.proto"; -option go_package = "github.com/sechmachine/VerseVDI-Protocol/gen/go/tunnel"; +option go_package = "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/tunnel"; message VersionNegotiation { repeated string supported_versions = 1; diff --git a/tests/go/protocol_test.go b/tests/go/protocol_test.go index 3977ec8..750ce6d 100644 --- a/tests/go/protocol_test.go +++ b/tests/go/protocol_test.go @@ -4,7 +4,7 @@ import ( "strings" "testing" - protocol "github.com/sechmachine/VerseVDI-Protocol/gen/go/protocol" + protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol" ) func TestManifestRejectsForbiddenAndUnknownFields(t *testing.T) { diff --git a/tools/go-conformance/main.go b/tools/go-conformance/main.go index 5134f09..fcbace4 100644 --- a/tools/go-conformance/main.go +++ b/tools/go-conformance/main.go @@ -10,7 +10,7 @@ import ( "strconv" "strings" - protocol "github.com/sechmachine/VerseVDI-Protocol/gen/go/protocol" + protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol" ) const (