Repository navigation
Stopped the version pass skipping ports in silence - #113
Merged
Merged
Conversation
The port stage matched a version only where "Version" was followed immediately by four dotted numbers. A port writing three numbers, or a stray letter before the first, was passed over and kept its old release, and the pass reported success either way. Four ports across the suite had gone stale that way, one of them for two consecutive releases. The pattern now accepts three or four numbers and tolerates a leading letter. A check follows it: any port header that names a release other than the one being prepared is listed and the pass stops, so a port the substitution cannot reach fails the release instead of shipping a version that misreports itself. Verified both ways against a FileX tree: with a port whose string the substitution cannot reach, the pass names the file and exits non-zero; with that string corrected, all four ports update and the pass completes. Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com>
fdesbiens
added a commit
that referenced
this pull request
Oct 2, 2026
* Added Win64/VS 2022 port for FileX (#94) - New port: ports/win64/vs_2022/inc/fx_port.h - Based on the Win32 port; updated ALIGN_TYPE to ULONG64 for 64-bit pointers, added FX_REGRESSION_TEST hooks from the Linux port, and bumped the port name string to Win64/Visual. - New CMake infrastructure: ports/win64/vs_2022/CMakeLists.txt - Exposes only the inc/ directory (port is header-only). - Updated test/cmake/CMakeLists.txt - Added MSVC guards: skip -m32 / GCC coverage flags; locate VS 2022 toolchain; build ThreadX from source alongside FileX via THREADX_SOURCE_DIR. - Updated test/cmake/regression/CMakeLists.txt - Added MSVC-compatible compile options (/W3 /Zi instead of -Wall -fprofile-arcs); added win64_compat include path for standalone + MSVC builds; added per-test TIMEOUT overrides for the two inherently long-running fault-tolerant tests on Windows. - Updated test/cmake/samples/CMakeLists.txt - Added MSVC-compatible flag handling. - New PowerShell scripts: scripts/build_fx.ps1, scripts/test_fx.ps1, scripts/fx_windows_common.ps1 - Support all 9 build configurations; -Clean, -Config, -Verbose flags; modelled on the ThreadX Win64 build/test scripts. - New Windows compatibility shims for standalone builds: test/regression_test/win64_compat/pthread.h test/regression_test/win64_compat/unistd.h - Minimal pthreads (CreateThread / WaitForSingleObject / TerminateThread) and usleep (Sleep) shims so standalone test files compile on MSVC. - Fixed test/regression_test/fx_ram_driver_test.c and .h - RAM driver: added bounds check so out-of-range sector READs use a safe scratch buffer instead of segfaulting. - MSVC: large test buffers (ram_disk_memory_large, large_data_buffer, and standalone-mode ram_disk_memory / ram_disk_memory1) moved from BSS to calloc() via a .CRT\ constructor. This avoids the MSVC PE image 2 GB hard limit (LNK1248) and eliminates demand-zero page- fault overhead that would otherwise slow the test suite. - Bulk-fixed 93 fault-tolerant test files - [FAULT_TOLERANT_SIZE] -> [FAULT_TOLERANT_SIZE > 0 ? FAULT_TOLERANT_SIZE : 1] so that MSVC C2466 (zero-length array) is not triggered when FX_ENABLE_FAULT_TOLERANT is not defined. - Fixed filextestcontrol.c: standalone test runner thread exit - The Win64 pthread shim makes pthread_exit() a no-op so that test_control_thread_entry() proceeds to exit(failed_tests), giving ctest the correct process exit code. - Fixed common/src/fx_utility_logical_sector_write.c - Added missing bounds guard to prevent sector-write past end of RAM disk during fault-tolerant interrupt simulation tests. All 9 build configurations pass 136/136 regression tests on Win64/VS 2022. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Flagged six FileX APIs as deprecated (#95) Added #pragma message compile-time warnings and updated DESCRIPTION blocks in: - fx_directory_long_name_get -> use _extended (buffer size) - fx_directory_short_name_get -> use _extended (buffer size) - fx_media_volume_get -> use _extended (buffer size) - fx_unicode_length_get -> use _extended (buffer size) - fx_unicode_name_get -> use _extended (buffer size) - fx_unicode_short_name_get -> use _extended (buffer size) All six functions omit a destination buffer length parameter and use a fixed or hardcoded limit, which can cause buffer overruns in the caller. The corresponding _extended variants accept an explicit buffer size and must be used instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Restored the comment boxes around the deprecation notes (#101) The deprecation notes added in #95 were pasted into the function header blocks without the surrounding box. Two of the six left a bare /* on the following line, which GCC rejects as "/*" within comment under -Werror, so the library no longer compiled and no regression test could be built. Each note is rewrapped inside the box at the width the rest of the header uses. The orphaned tail of the sentence the paste replaced is gone too: it restated the maximum written size that the new wording already gives. The library builds again and 136/136 pass in standalone_no_cache_fault_tolerant_build, against no build at all before. Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com> * Stopped the release script adding a Co-authored-by trailer (#108) prepare_release.sh committed the version passes with a Co-authored-by trailer naming an AI. That trailer asserts authorship an AI cannot hold: the human contributor signs the ECA and is solely responsible for the contribution. It is already in the published history, on the 6.5.1.202602 preparation. The commits now carry their subject alone. A version pass is mechanical sed output, so no agent produces it at run time; an agent that runs the script records its own Assisted-by trailer on that run instead. The script also gains the AI disclosure line it was missing. Ran the patched script against a scratch clone targeting 6.5.2.202603. Both commits come out with an empty trailer block, and the version constants and three port version strings update as before. Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com> * Merge commit from fork * fix: harden fault-tolerant log replay bounds Prevent attacker-controlled FAT log records from causing memory corruption during fault-tolerant recovery. - Bound directory-log copies to fx_media_bytes_per_sector, the actual destination sector size, instead of the whole cache allocation. - Use 64-bit offset-plus-length arithmetic to prevent wraparound. - Reject undersized FAT and directory log entries before typed access or payload-length subtraction. - Validate total_size against the structural minimum, configured maximum, and allocated fault-tolerant buffer before checksum processing. This prevents the replay-path OOB write and the enable-time OOB read caused by malformed on-disk fault-tolerant logs. Assisted By: GPT 5.6 * Corrected the fault-tolerant log bounds and kept clean logs mountable The replay bound rejected a log file that a reset had just written. A clean log records a total size of the header plus the FAT chain, and the enable path demanded one header more than that, so every re-mount of a media carrying an intact log returned FX_FILE_CORRUPT. The replay loop also measured the space left for log entries from the start of the log file rather than from the first entry, leaving the cursor able to run one content offset past the buffer. The minimum is now the size a reset writes, and the entry budget excludes the header, the FAT chain and the content header it sits behind. Neither change touches the destination bound that closes the out-of-bounds write. A new regression test stages a directory log whose copy lands past the destination sector, checks that a copy ending on the sector boundary is still accepted, and enables fault tolerance twice across a close and a re-open. 137/137 fault-tolerant tests pass; the new test fails on both defects independently when either is reverted. Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com> * Extended the fault-tolerant log bounds test to every guard The test shipped with this fix proved one of the four bounds the fix adds. Reverting fx_fault_tolerant_enable in its entirety, or either of the two remaining guards in fx_fault_tolerant_apply_logs, left the suite green. Three cases cover the rest. One shrinks the recorded log size so an entry claims more than the file holds, which is the accounting the old bound got wrong by the width of the header and the FAT chain. One declares a FAT log entry shorter than an entry, desynchronising the walk; a directory entry was not used because the copy bound catches that case one step on and returns the same status. One rewrites the log header on the media to record a full-size log and then enables fault tolerance over a two-sector buffer, which the interface accepts. Locating the header needed a second helper. log_data_sector names a sector one cluster past the header, so reusing it wrote to the wrong place and the case passed for the wrong reason. Reverting each of the four guards on its own now fails the test, as does reverting either source file whole. Nine configurations, 137 tests each, zero warnings, zero errors. Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com> --------- Co-authored-by: Haithem Rahmani <haithem.rahmani@st.com> * Completed FileX Windows simulator regression support (#100) Improved FileX Win32 build and regression support Completed and hardened the Win32 development and regression-test setup for FileX. - Added missing CMake support for the VS 2019 Win32 port - Corrected the Win32 FileX version information - Fixed regression-build issues and crashes with large media - Corrected buffer declarations for standalone and fault-tolerant configurations - Enabled large-address-aware Windows test executables - Shortened regression target paths to avoid Windows/MSVC path issues - Improved ThreadX path defaults and validation in the Windows build script - Added and standardized the required AI disclosure notices Assisted-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Codex (gpt-5.6-sol) <codex@openai.com> Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com> * Added a blame ignore list for the mechanical header and version passes (#102) Running git blame on a file header returns a tree-wide copyright, disclosure or version-constant pass rather than the commit that last touched the code. There have been 3 such passes in this repository since 2024, and every header line in the tree now points at one of them. Added .git-blame-ignore-revs listing those commits. GitHub applies the file to its blame view automatically; locally it takes one git config command, which the file documents in its own header. Additive. No source file is touched, and every listed commit was verified to be an ancestor of dev. Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com> * Linked FileX readers to published documentation (#105) The FileX README sent readers to archived Markdown documentation. I linked the overview to its published HTML guide and the general documentation entry to the latest release. Both replacement URLs returned HTTP 200; git diff --check passed. Assisted-by: Codex (gpt-6-astra) <noreply@openai.com> * Updated FileX contribution guide for current workflows (#107) * Updated FileX contribution guide for current workflows The existing guide omitted FileX build, test, and submission practices. The guide now covers the project process and FileX C99, Linux and Windows regression configurations, coverage, attribution, and release practices. It also states that the regression workflow does not run for pull requests to dev. Local Markdown links resolve and git diff --check passed. Build tests were not run for this documentation change. Assisted-by: Codex (gpt-6-sol) <noreply@openai.com> * Documented FileX dev regression and coverage gates The contributor guide described the old master-only workflow and coverage from selected Linux configurations. The guide now covers all nine Linux coverage configurations, the Win64 CI job, Win32 local testing, pinned dependencies, and the merged coverage floors. git diff --check passed. Build tests were not run for this documentation change. Assisted-by: Codex (gpt-6-sol) <noreply@openai.com> * Added visible spacing between contributor setup steps The ECA and Git setup items had no visible gap in GitHub Markdown. An indented line break now separates them while preserving list numbering. GitHub Markdown rendered the items in one list with the visible gap, and git diff --check passed. Assisted-by: Codex (gpt-6-sol) <noreply@openai.com> * Added a check that keeps the AI disclosure comment in its accepted form (#103) * Added a check that keeps the AI disclosure comment in its one accepted form Nothing enforced the disclosure convention. In the sibling repositories the drift it exists to prevent returned twice, once when a port merged after the normalisation pass carrying the older per-edit form, and once because that pass had covered source files only. This repository is currently clean, and this keeps it so. Added scripts/check_ai_disclosure.sh, which rejects the superseded per-edit form, a doubled comment marker, more than one disclosure line in a file, and any spelling of the line that is not exact. It runs from repo_checks.yml, a workflow with no path filter, because a source-path filter is what hid the build files elsewhere. The check passes on this repository as it stands. Each of its four rules was confirmed to fail on a tree with that defect reintroduced, and to pass once it was removed. Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com> * Exempted Markdown from the AI disclosure near-miss check The near-miss check matches the bare phrase "AI assistance" on any line that is not the accepted text. A contribution guide has to quote the accepted line and say when it applies, so #107 turns this check red although each of the two changes is green on its own. Markdown is now excluded from the near-miss check alone. A superseded form in a Markdown file is still caught by the first check, which looks for the product and model wording the fixed line replaced. Verified on dev with #107 merged: the check passes. It still fails on a planted near miss in a C source, on a planted superseded form in a Markdown file, and on a planted duplicate disclosure line. Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com> * Covered the fault-tolerant log guards left half-tested (#111) Three of the bounds added with GHSA-c8cj-fj9j-426v are only half covered. The replay guard that refuses a log recording less than the header, the FAT chain and the content header never takes its early return, and the enable guard is exercised only through its buffer-size condition. Three cases close them: a log recorded below the minimum the replay accepts, and enable over a log recording less than a reset one writes and over one recording more than the format allows. The last needs a buffer wider than the format maximum, because a smaller one is refused by the buffer condition first and the maximum condition is never reached; the test says so, since the obvious smaller buffer looks right and proves nothing. Reverting each of the three conditions on its own now fails the test. Nine configurations, zero warnings, zero errors. Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com> * Added Linux coverage and Win64 regression gates (#106) Added Linux coverage and Win64 regression gates FileX's regression workflow ran only on master, built four of the nine Linux coverage configurations, and never ran the Win64 simulator suite at all. It cloned ThreadX's default branch without pinning it, so a run validated FileX against whatever that branch happened to hold and never recorded which commit that was; an existing clone was reused without being refreshed, so a machine could go on building against a ThreadX from weeks earlier without saying so. Nothing enforced a coverage floor. The workflow now runs on dev as well as master, builds and tests all nine Linux coverage configurations, and adds a Win64 job. Coverage is collected from every configuration, merged, and gated at 99.9% of lines and 99.3% of branches. Pages deploys only after a successful master run. ThreadX is pinned by commit in three places that previously disagreed or floated: the revision file `run.sh` checks the working copy against, the reusable regression template, and the ThreadX the Win64 job checks out. All three name the ThreadX this release ships. `run.sh` fetches that exact revision and refuses to run against anything else, which closes the stale-clone case as well. GitHub actions are pinned by SHA, with Dependabot configured to move them. The branch floor sits one tenth of a percent below the measured rate rather than on it. The script compares whole tenths, so that is the nearest value that leaves any headroom at all, and a floor resting exactly on today's figure fails on the next commit that adds an uncovered branch rather than on a real regression. Most of what remains uncovered is in `fx_partition_offset_calculate.c`; filex#112 tracks covering it and raising the floor deliberately. Two MSVC build faults are fixed alongside, both found only once a Win64 build existed: the test RAM driver's header declared four buffers as arrays where its MSVC implementation allocates pointers, and five tests declared zero-length fault-tolerant buffers in configurations that disable the feature. Both now match the storage each configuration actually uses. The new partition-offset test takes two MISRA deviations. Rule 15.5, early returns, so each failure path can return a distinct code; and Rule 8.5, a local declaration of an internal function so the test can reach it directly. Nine Linux configurations and nine Win64 configurations, 138 tests each, all passing. Merged coverage 7651/7657 lines (99.92%) and 8228/8279 branches (99.38%). A forced failing test returned status 8; empty, missing and unfetchable coverage reports each failed as intended; installer retries stayed bounded. Actionlint, ShellCheck and whitespace checks pass. Assisted-by: Codex (GPT-6) <noreply@openai.com> Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com> * Stopped the version pass skipping ports in silence (#113) The port stage matched a version only where "Version" was followed immediately by four dotted numbers. A port writing three numbers, or a stray letter before the first, was passed over and kept its old release, and the pass reported success either way. Four ports across the suite had gone stale that way, one of them for two consecutive releases. The pattern now accepts three or four numbers and tolerates a leading letter. A check follows it: any port header that names a release other than the one being prepared is listed and the pass stops, so a port the substitution cannot reach fails the release instead of shipping a version that misreports itself. Verified both ways against a FileX tree: with a port whose string the substitution cannot reach, the pass names the file and exits non-zero; with that string corrected, all four ports update and the pass completes. Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com> * Prepared the FileX 6.5.2.202603 release (#114) * Updated version number constants * Updated port version strings * Brought the Windows port version strings into the release pass The Win32 and Win64 ports report their version as "FileX Win64/Visual 6.5.1.202602", with no "Version" between the port name and the number. Every other FileX port writes "Version" there, and prepare_release.sh keys on it, both to decide a file needs rewriting and to perform the substitution. Neither port was touched by the version pass, so 6.5.2.202603 would have shipped with its two Windows ports reporting the previous release at runtime. Both strings now carry "Version" and read 6.5.2.202603, which also means the release script finds them from now on without needing to know these two ports exist. Verified: all four FileX ports now report 6.5.2.202603, and no source file outside a banner comment mentions the previous version. Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com> --------- Co-authored-by: Haithem Rahmani <haithem.rahmani@st.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The port stage of
prepare_release.shmatched a version only whereVersionwas followed immediately by four dotted numbers. A port writing three numbers, or carrying a stray letter before the first, was passed over and kept its old release — and the pass printed its usual success either way.Four ports across the suite had gone stale that way. FileX's Win32 and Win64 ports omit the word
Versionentirely and were about to ship 6.5.2.202603 reporting the previous release at run time; ThreadX's RISC-V32/IAR port readsVersion G6.5.0.202601, stale for two consecutive releases; NetX Duo's Cortex-R5/GNU port readsVersion 6.4.1.The pattern now accepts three or four numbers and tolerates a leading letter. More to the point, a check follows it: any port header that names a release other than the one being prepared is listed by path and the pass stops. A port the substitution cannot reach now fails the release rather than shipping a version that misreports itself.
Verified both ways against a FileX tree. With a port whose string the substitution cannot reach, the pass names the file and exits non-zero. With that string corrected, all four ports update and the pass completes.