SparkN0de-git - /page/commit.mu

Micron Document

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

| SparkN0de-git | SparkN0de |

Node / ReticulumProjects / MeshChatX.git / commits / 58bfaf3

Commit 58bfaf379e8e784893bbc3a8d431d322e6319adf

󰉖 Browse tree at this commit

Parents : 8566894

Author : Ivan <ivan@quad4.io>

Signature : Invalid signer <e46112d44649266d71fe2193e00a4710>, author is <ivan@quad4.io>

Date : 2026-07-16T13:34:30-05:00

chore: clean up Dockerfile and scripts to exclude Android platform paths from denylist checks

Changes

5 files changed, 30 insertions(+), 2 deletions(-)

M Dockerfile +1

M Dockerfile.hardened +1

R meshchatx.rsm

M scripts/ci/verify-package-contents-smoke.sh +19

M scripts/ci/verify-package-contents.sh +9 -2

Diff

diff --git a/Dockerfile b/Dockerfile

index cce44808..6918db77 100644

--- a/Dockerfile

+++ b/Dockerfile

@@ -65,6 +65,7 @@ COPY --from=build-frontend /src/meshchatx/public ./meshchatx/public

RUN pip install --no-cache-dir . && \

python scripts/patch_lxst_pyogg_ogg_ctypes.py && \

python scripts/docker-bake-lxst-filterlib-musl.py && \

+ rm -rf /opt/venv/lib/python*/site-packages/LXST/Platforms/android && \

find /opt/venv -type d -name "tests" -exec rm -rf {} + && \

find /opt/venv -type d -name "test" -exec rm -rf {} + && \

find /opt/venv -type d -name "__pycache__" -exec rm -rf {} + && \

diff --git a/Dockerfile.hardened b/Dockerfile.hardened

index 3fd2b845..e92e9c5e 100644

--- a/Dockerfile.hardened

+++ b/Dockerfile.hardened

@@ -55,6 +55,7 @@ COPY --from=build-frontend /src/meshchatx/public ./meshchatx/public

RUN pip install --no-cache-dir . && \

python scripts/patch_lxst_pyogg_ogg_ctypes.py && \

+ rm -rf /opt/venv/lib/python*/site-packages/LXST/Platforms/android && \

find /opt/venv -type d -name "tests" -exec rm -rf {} + && \

find /opt/venv -type d -name "test" -exec rm -rf {} + && \

find /opt/venv -type d -name "__pycache__" -exec rm -rf {} + && \

diff --git a/meshchatx.rsm b/meshchatx.rsm

index 6638bf4a..007ea419 100644

Binary files a/meshchatx.rsm and b/meshchatx.rsm differ

diff --git a/scripts/ci/verify-package-contents-smoke.sh b/scripts/ci/verify-package-contents-smoke.sh

index ef10c03e..6e128448 100755

--- a/scripts/ci/verify-package-contents-smoke.sh

+++ b/scripts/ci/verify-package-contents-smoke.sh

@@ -35,4 +35,23 @@ if bash "$SCRIPT" dir "$tmp/dirty"; then

exit 1

+mkdir -p "$tmp/lxst-android/lib/python3.14/site-packages/LXST/Platforms/android"

+echo ok >"$tmp/lxst-android/lib/python3.14/site-packages/LXST/Platforms/android/soundcard.py"

+echo "expect LXST Platforms/android paths to pass dir scan (APK-relevant)"

+bash "$SCRIPT" dir "$tmp/lxst-android"

+echo "expect MeshChatX android/app denylist to match app tree only"

+if ! printf '%s\n' "android/app/build.gradle" | grep -Eq '(^|/)android/(app|gradle)(/|$)'; then

+ echo "expected android/app denylist match" >&2

+ exit 1

+fi

+ echo "LXST Platforms/android must not match ANDROID_APP_DENY_RE" >&2

+ exit 1

+fi

+if ! printf '%s\n' "lib/python3.14/site-packages/LXST/Platforms/android/soundcard.py" | grep -Eq '(^|/)LXST/Platforms/android(/|$)'; then

+ echo "expected LXST Platforms/android docker denylist match" >&2

+ exit 1

+fi

echo "verify-package-contents smoke OK"

diff --git a/scripts/ci/verify-package-contents.sh b/scripts/ci/verify-package-contents.sh

index bb2a6dd5..b76850a5 100755

--- a/scripts/ci/verify-package-contents.sh

+++ b/scripts/ci/verify-package-contents.sh

@@ -49,17 +49,24 @@ record_hit() {

# Shared denylist patterns (grep -E against relative paths).

# Bytecode (__pycache__) is denied for frozen/wheel/dir but not docker:

# Dockerfiles run compileall on purpose for faster cold start.

+# Do not use a bare /(^|/)android(/|$)/ pattern: LXST ships

+# LXST/Platforms/android for mobile hosts. That path must remain allowed in

+# APKs and must not false-fail Docker scans of site-packages.

COMMON_DENY_RE='(^|/)\.git(/|$)|(^|/)node_modules(/|$)|(^|/)\.pnpm-store(/|$)|(^|/)\.venv(/|$)|(^|/)vendor/offline(/|$)|(^|/)vendor/lxmfy/tests(/|$)|(^|/)vendor/lxmfy/docs(/|$)|(^|/)vendor/lxmfy/docker(/|$)|(^|/)\.github(/|$)|(^|/)docs/agents(/|$)|(^|/)screenshots(/|$)|(^|/)\.pytest_cache(/|$)|(^|/)mutants(/|$)|(^|/)coverage(/|$)'

BYTECODE_DENY_RE='(^|/)__pycache__(/|$)'

+# MeshChatX Android app sources (gradle/app tree), not LXST.Platforms.android.

FROZEN_DENY_RE="${COMMON_DENY_RE}|${BYTECODE_DENY_RE}|(^|/)lib/meshchatx/public(/|$)|(^|/)lib/meshchatx/src/frontend/.+\.vue$|(^|/)lib/meshchatx/src/frontend/.+\.css$|(^|/)lib/setuptools(/|$)|(^|/)lib/pydoc_data(/|$)|(^|/)lib/numpy/.*/tests(/|$)|(^|/)lib/numpy/tests(/|$)"

-DOCKER_DENY_RE="${COMMON_DENY_RE}|(^|/)meshchatx/src/frontend/.+\.vue$|(^|/)meshchatx/src/frontend/.+\.css$|(^|/)tests(/|$)|(^|/)electron(/|$)|(^|/)android(/|$)"

+DOCKER_DENY_RE="${COMMON_DENY_RE}|${ANDROID_APP_DENY_RE}|(^|/)meshchatx/src/frontend/.+\.vue$|(^|/)meshchatx/src/frontend/.+\.css$|(^|/)tests(/|$)|(^|/)electron(/|$)|(^|/)LXST/Platforms/android(/|$)"

WHEEL_DENY_RE="${COMMON_DENY_RE}|${BYTECODE_DENY_RE}|(^|/)meshchatx/src/frontend/.+\.vue$|(^|/)meshchatx/src/frontend/.+\.css$|(^|/)tests(/|$)"

-APK_DENY_RE="${COMMON_DENY_RE}|${BYTECODE_DENY_RE}|(^|/)tests(/|$)|(^|/)electron(/|$)|(^|/)\.github(/|$)"

+APK_DENY_RE="${COMMON_DENY_RE}|${BYTECODE_DENY_RE}|${ANDROID_APP_DENY_RE}|(^|/)tests(/|$)|(^|/)electron(/|$)|(^|/)\.github(/|$)"

DIR_DENY_RE="${COMMON_DENY_RE}|${BYTECODE_DENY_RE}"

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────