Skip to content

build: containerize hax for local use - #326

Open
cfm wants to merge 4 commits into
mainfrom
284-containerize-hax
Open

build: containerize hax for local use#326
cfm wants to merge 4 commits into
mainfrom
284-containerize-hax

Conversation

@cfm

@cfm cfm commented Jul 30, 2026

Copy link
Copy Markdown
Member

Closes #284 by:

  1. consolidating where we specify toolchain versions: the version of cargo-hax available must match the installed version of hax-lib, and F* is defined once in a new versions.env; and
  2. having make extract run in a hax container when prefixed with CONTIANER=1. This is optional: for example, CI is unchanged and continues to use the cargo-hax and fstar binaries installed via GitHub Actions.

As we found in #238 (comment), it's possible to run a version of cargo-hax that's just subtly incompatible with the installed hax-lib and therefore fails in mysterious and confounding ways. This should make that state a little harder to get into by accident.

cfm added 2 commits July 30, 2026 16:45
- hax: "cargo pkgid" via "make hax-lib-version"
- F*: "versions.env" (after "lint-tools/versions.env")
@cfm cfm added this to SecureDrop Jul 30, 2026
@cfm cfm moved this to In Progress in SecureDrop Jul 30, 2026
@cfm
cfm requested a review from Copilot July 31, 2026 00:31

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR aims to make local hax extraction more reliable by centralizing tool version declarations and optionally running extraction inside a version-tagged hax container, reducing the likelihood of subtle cargo-hax/hax-lib incompatibilities.

Changes:

  • Introduces versions.env to define the F* version in one place.
  • Updates protocol-minimal/Makefile to read versions from versions.env and optionally run make extract in a hax:$HAX_VERSION container when CONTAINER is set.
  • Updates .github/workflows/hax.yml to resolve F*/hax versions dynamically and feed them into hax-actions.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File Description
securedrop-protocol/protocol-minimal/versions.env Adds a single source of truth for the F* version used by Make and CI.
securedrop-protocol/protocol-minimal/Makefile Adds containerized extraction support and version compatibility checks.
.github/workflows/hax.yml Makes CI derive tool versions from repo state instead of hardcoding them in the workflow.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread securedrop-protocol/protocol-minimal/Makefile
Comment thread securedrop-protocol/protocol-minimal/Makefile Outdated
Comment thread .github/workflows/hax.yml
This no longer requires a local Dockerfile to layer Make on top of
cryspen/hax's Dockerfile, but I'll leave that commit in history in case
it's useful in the future.
@cfm
cfm force-pushed the 284-containerize-hax branch from ca45688 to 82ce958 Compare July 31, 2026 00:35
@cfm
cfm marked this pull request as ready for review July 31, 2026 00:35
@cfm
cfm requested review from a team as code owners July 31, 2026 00:35
@cfm cfm moved this from In Progress to Ready For Review in SecureDrop Jul 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Ready For Review

Development

Successfully merging this pull request may close these issues.

consider containerizing local hax

2 participants