From 07441545bab1241ba359eda5154236fbf775adfb Mon Sep 17 00:00:00 2001
From: Drew Newberry <anewberry@nvidia.com>
Date: Fri, 11 Sep 2026 15:16:22 -0700
Subject: [PATCH] fix(ci): validate sandbox binary linkage

Signed-off-by: Drew Newberry <anewberry@nvidia.com>
---
 .github/actions/build-rust-binary/action.yml | 21 ++++++++++++++++++--
 .github/workflows/build-binaries.yml         |  6 ++++++
 .github/workflows/build-sandbox-binaries.yml |  9 ++-------
 3 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/.github/actions/build-rust-binary/action.yml b/.github/actions/build-rust-binary/action.yml
index 74041e9fc..53bcfce2d 100644
--- a/.github/actions/build-rust-binary/action.yml
+++ b/.github/actions/build-rust-binary/action.yml
@@ -29,6 +29,10 @@ inputs:
     description: Additional flags passed to cargo build
     required: false
     default: ""
+  interpreter:
+    description: Expected ELF program interpreter, "none" for static, or "skip"
+    required: false
+    default: skip
 
 runs:
   using: composite
@@ -71,11 +75,24 @@ runs:
       env:
         INPUTS_BINARY: ${{ inputs.binary }}
         INPUTS_TRIPLE: ${{ inputs.triple }}
+        INPUTS_INTERPRETER: ${{ inputs.interpreter }}
       run: |
+        binary="target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY}"
         # Confirm the binary runs and reports the expected name.
-        target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY} --version | grep -q "^${INPUTS_BINARY} "
+        "$binary" --version | grep -q "^${INPUTS_BINARY} "
         # Confirm Syft can decode the embedded cargo-auditable metadata.
-        SYFT_CHECK_FOR_APP_UPDATE=false syft file:target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY} -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
+        SYFT_CHECK_FOR_APP_UPDATE=false syft "file:${binary}" -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
+        if [ "$INPUTS_INTERPRETER" != skip ]; then
+          actual_interpreter="$(readelf -l "$binary" | sed -n 's/.*Requesting program interpreter: \(.*\)]/\1/p')"
+          expected_interpreter="$INPUTS_INTERPRETER"
+          if [ "$expected_interpreter" = none ]; then
+            expected_interpreter=""
+          fi
+          if [ "$actual_interpreter" != "$expected_interpreter" ]; then
+            echo "error: expected interpreter '${expected_interpreter:-<none>}', got '${actual_interpreter:-<none>}'" >&2
+            exit 1
+          fi
+        fi
 
     - name: Upload ${{ inputs.binary }}
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml
index 4d95b525a..5c51f1ded 100644
--- a/.github/workflows/build-binaries.yml
+++ b/.github/workflows/build-binaries.yml
@@ -33,6 +33,11 @@ on:
         required: false
         type: string
         default: ""
+      interpreter:
+        description: Expected ELF program interpreter, "none" for static, or "skip"
+        required: false
+        type: string
+        default: skip
       checkout-ref:
         required: false
         type: string
@@ -67,3 +72,4 @@ jobs:
           image-tag: ${{ inputs['image-tag'] }}
           artifact-name: ${{ inputs['artifact-name'] }}
           extra-cargo-flags: ${{ inputs['extra-cargo-flags'] }}
+          interpreter: ${{ inputs.interpreter }}
diff --git a/.github/workflows/build-sandbox-binaries.yml b/.github/workflows/build-sandbox-binaries.yml
index e7c378bad..aa43840e8 100644
--- a/.github/workflows/build-sandbox-binaries.yml
+++ b/.github/workflows/build-sandbox-binaries.yml
@@ -31,25 +31,21 @@ jobs:
         include:
           - triple: x86_64-unknown-linux-musl
             runner: linux-amd64-cpu8
-            dev_shell: .#devShells.x86_64-linux.musl
             package: openshell-sandbox
             binary: openshell-sandbox
-            interpreter: ""
+            interpreter: none
           - triple: x86_64-unknown-linux-gnu
             runner: linux-amd64-cpu8
-            dev_shell: .#devShells.x86_64-linux.glibc-2-28
             package: openshell-supervisor
             binary: openshell-supervisor
             interpreter: /lib64/ld-linux-x86-64.so.2
           - triple: aarch64-unknown-linux-musl
             runner: linux-arm64-cpu8
-            dev_shell: .#devShells.aarch64-linux.musl
             package: openshell-sandbox
             binary: openshell-sandbox
-            interpreter: ""
+            interpreter: none
           - triple: aarch64-unknown-linux-gnu
             runner: linux-arm64-cpu8
-            dev_shell: .#devShells.aarch64-linux.glibc-2-28
             package: openshell-supervisor
             binary: openshell-supervisor
             interpreter: /lib/ld-linux-aarch64.so.1
@@ -59,7 +55,6 @@ jobs:
       binary: ${{ matrix.binary }}
       triple: ${{ matrix.triple }}
       runner: ${{ matrix.runner }}
-      dev-shell: ${{ matrix.dev_shell }}
       cargo-version: ${{ inputs.cargo-version }}
       image-tag: ${{ inputs.image-tag }}
       interpreter: ${{ matrix.interpreter }}