adminandClaude Fable 5
7b63765d69
- tooling/compile/compile_vstore.sh(新): 复制 compile_sdk.sh 改白名单 (api.py 入口明文+__init__.py,其余 12 模块 Cython .so+strip+elf 校验) - build_all.sh: 编译段追加 vstore 编译(SDK_PYTHON);冒烟段追加 import 检查; 组装段改复制编译产物(此前复制明文源码) - 实测: 编译 12 .so 成功;冒烟 health+search-chunks 正常;bash -n 过 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
103 lines
4.1 KiB
Bash
Executable File
103 lines
4.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# compile_vstore.sh —— 向量库服务(vstore)编译硬化。
|
|
# 白名单(明文):api.py(FastAPI 入口 + 运维可读面,与 sdk main.py 同理由) + __init__.py。
|
|
# 用法:compile_vstore.sh <source-root> <output-dir> [python]
|
|
set -euo pipefail
|
|
umask 027
|
|
|
|
SOURCE_ROOT="${1:?Usage: $0 <source-root> <output-dir> [python]}"
|
|
OUTPUT_DIR="${2:?Usage: $0 <source-root> <output-dir> [python]}"
|
|
PYTHON="${3:-python3}"
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
VISIBILITY_TOOL="${ELF_VISIBILITY_TOOL:-$SCRIPT_DIR/tools/elf_visibility.py}"
|
|
|
|
SOURCE_ROOT="$(realpath "$SOURCE_ROOT")"
|
|
OUTPUT_DIR="$(realpath -m "$OUTPUT_DIR")"
|
|
|
|
[[ -d "$SOURCE_ROOT" ]] || { echo "vstore source missing: $SOURCE_ROOT" >&2; exit 2; }
|
|
[[ -x "$PYTHON" ]] || { echo "Python is not executable: $PYTHON" >&2; exit 2; }
|
|
[[ -f "$VISIBILITY_TOOL" ]] || { echo "ELF visibility tool missing: $VISIBILITY_TOOL" >&2; exit 2; }
|
|
for command_name in gcc strip rsync; do command -v "$command_name" >/dev/null; done
|
|
|
|
case "$OUTPUT_DIR" in
|
|
"/"|"$(realpath -m "$HOME")"|"$SOURCE_ROOT")
|
|
echo "Unsafe output directory: $OUTPUT_DIR" >&2; exit 2 ;;
|
|
esac
|
|
[[ ! -e "$OUTPUT_DIR" ]] || { echo "Output exists; refusing to overwrite: $OUTPUT_DIR" >&2; exit 2; }
|
|
|
|
echo "[VSTORE 1/5] Copying source (excluding tests)"
|
|
mkdir -p "$OUTPUT_DIR/vstore"
|
|
rsync -a --exclude '__pycache__' --exclude 'test_*.py' --exclude 'tests' --exclude '.env' \
|
|
"$SOURCE_ROOT/" "$OUTPUT_DIR/vstore/"
|
|
# 修正工作根：编译对象是包内容，模块名 vstore.* 由 OUTPUT_DIR/vstore 承载
|
|
|
|
# 白名单明文:api.py(FastAPI 入口,uvicorn 以模块字符串加载的入口面)
|
|
# + __init__.py(包标记)。其余(vaul/chunks/embed/retrieval/parsing/backend/
|
|
# crypto/settings/flow 等)全部编译 .so。
|
|
WHITELIST_PY=("api.py")
|
|
_is_whitelisted() {
|
|
local rel="$1"
|
|
for w in "${WHITELIST_PY[@]}"; do [[ "$rel" == "$w" ]] && return 0; done
|
|
[[ "$(basename "$rel")" == "__init__.py" ]] && return 0
|
|
return 1
|
|
}
|
|
|
|
echo "[VSTORE 2/5] Discovering Python modules"
|
|
PY_FILES=()
|
|
while IFS= read -r -d '' path; do PY_FILES+=("$path"); done \
|
|
< <(find "$OUTPUT_DIR/vstore" -type f -name '*.py' -print0)
|
|
FILTERED=()
|
|
for py_file in "${PY_FILES[@]}"; do
|
|
rel="${py_file#"$OUTPUT_DIR/vstore"/}"
|
|
if _is_whitelisted "$rel"; then
|
|
echo " [whitelist] $rel (明文保留)"
|
|
continue
|
|
fi
|
|
FILTERED+=("$py_file")
|
|
done
|
|
PY_FILES=("${FILTERED[@]}")
|
|
TOTAL="${#PY_FILES[@]}"
|
|
(( TOTAL > 0 )) || { echo "No vstore modules selected" >&2; exit 3; }
|
|
|
|
INCLUDE_PY="$("$PYTHON" -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY") or "")')"
|
|
EXT_SUFFIX="$("$PYTHON" -c 'import sysconfig; print(sysconfig.get_config_var("EXT_SUFFIX") or ".so")')"
|
|
|
|
echo "[VSTORE 3/5] Cython preflight ($TOTAL modules)"
|
|
COUNT=0; FAILURES=0
|
|
for py_file in "${PY_FILES[@]}"; do
|
|
COUNT=$((COUNT+1))
|
|
directory="$(dirname "$py_file")"
|
|
module="$(basename "$py_file" .py)"
|
|
c_file="$directory/$module.c"
|
|
echo " [$COUNT/$TOTAL] ${py_file#"$OUTPUT_DIR/vstore"/}"
|
|
if ! "$PYTHON" -m cython -3 \
|
|
--directive always_allow_keywords=true,annotation_typing=False \
|
|
--no-docstrings "$py_file" -o "$c_file" 2>/dev/null; then
|
|
FAILURES=$((FAILURES+1))
|
|
fi
|
|
done
|
|
(( FAILURES == 0 )) || { echo "vstore Cython failed: $FAILURES" >&2; exit 3; }
|
|
|
|
echo "[VSTORE 4/5] GCC hidden visibility + strip"
|
|
COUNT=0
|
|
for py_file in "${PY_FILES[@]}"; do
|
|
COUNT=$((COUNT+1))
|
|
directory="$(dirname "$py_file")"
|
|
module="$(basename "$py_file" .py)"
|
|
c_file="$directory/$module.c"
|
|
so_file="$directory/$module$EXT_SUFFIX"
|
|
gcc -shared -pthread -fPIC -O2 -fvisibility=hidden \
|
|
-I"$INCLUDE_PY" -o "$so_file" "$c_file"
|
|
strip --strip-unneeded "$so_file"
|
|
"$PYTHON" -B "$VISIBILITY_TOOL" --hide-non-pyinit --check "$so_file" >/dev/null
|
|
rm -f -- "$c_file" "$py_file"
|
|
done
|
|
|
|
echo "[VSTORE 5/5] Final checks"
|
|
SO_COUNT="$(find "$OUTPUT_DIR/vstore" -type f -name '*.so' | wc -l)"
|
|
[[ "$SO_COUNT" -eq "$TOTAL" ]] || { echo "count mismatch: $TOTAL vs $SO_COUNT" >&2; exit 4; }
|
|
if find "$OUTPUT_DIR/vstore" -type f -name '*.c' -print -quit | grep -q .; then
|
|
echo "Generated C source remains" >&2; exit 4
|
|
fi
|
|
echo "VSTORE compile+harden complete: modules=$SO_COUNT output=$OUTPUT_DIR"
|