BootProof: Kodni ishonchli ishga tushurish uchun yangi “Run” tugmasi

Yaqinda dasturchilar orasida BootProof nomli yangi CLI vositasi katta eʼtibor qozondi. Bu vosita kod omborlarini “run” qilishda faqat “vibe” emas, balki aniq dalillar asosida tasdiqlashni taklif etadi. BootProof kodni tahlil qiladi, ishga tushirish rejasini tuzadi, faqat ishonchli qadamlarni bajaradi va natijani imzolangan attestasiyaga yozadi.

BootProof qanday ishlaydi?

Vositani npx bootproof up . buyrugʻi bilan ishga tushirsangiz, u quyidagi bosqichlarni bajaradi:

 bootproof up https://github.com/dubinc/dub

Remote source: https://github.com/dubinc/dub.git
Clone retained at: .bootproof/remotes/github.com/dubinc/dub-*/repo

Inference (evidence-based)
  application: yes
  package manager: pnpm.15.9
  selected command: pnpm dev

✗ NOT VERIFIED — remote_code_execution_blocked
Why BootProof refused: remote repositories are untrusted code and require explicit consent.

 bootproof up . --provider local --unsafe-local --install

✓ install: dependencies installed
✓ start-app: app process started and was supervised
✓ health: observed HTTP 200 at http://localhost:3333

✓ BOOTED — HTTP 200 at http://localhost:3333
Evidence: .bootproof/attestation.json

No proof, no green check.

• Infratsatsiya (evidence‑based inference) – repozitoriyda Node, Python, Go kabi texnologiyalarni aniqlaydi.
• Talablarni o'rnatish – paket menejeri (masalan, pnpm) versiyasi mos kelmasa, dependency_install_skipped xatosi bilan to'xtaydi.
• Ilovani ishga tushirish – aniq start‑buyruq (masalan, pnpm dev) bajariladi.
• Health tekshiruvi – localhostda HTTP 200 javobini kutadi, bu muvaffaqiyatli ishga tushirilganligini tasdiqlaydi.
• Attestatsiya yaratish – natija .bootproof/attestation.json faylida imzolanadi.

Har bir bosqichda BootProof “no proof – no green check” tamoyilini saqlaydi, yaʼni ishonchli dalil bo'lmasa, yashil belgini ko'rsatmaydi.

bootproof up .

Masofaviy repozitoriyalar bilan ishlash

Masofaviy GitHub repozitoriyalarini bootproof up https://github.com/user/repo buyrugʻi bilan klonlaydi, lekin kodni bajarish uchun --unsafe-local yoki --provider local parametrlarini qo'shish talab etiladi. Bu foydalanuvchiga kodni ko'rib chiqish va ruxsat berish imkonini beradi.

bootproof up . --ci --json

CI/CD muhitida BootProof

CI rejimida (--ci --json) vosita rangli chiqishni o'chiradi, natijani JSON formatida beradi va chiqish kodi orqali muvaffaqiyat (0) yoki xato (1) holatini aniq ko'rsatadi. Bu CI pipeline’larda avtomatik tasdiqlash va audit qilish uchun qulay.

NOT VERIFIED — package_manager_version_mismatch
What happened: The repository requires pnpm 10.24.0, but this environment has pnpm 9.15.4.
Why BootProof refused: The dependency install cannot be trusted with the wrong package manager version.
Safe next step: Run corepack enable && corepack prepare pnpm@10.24.0 --activate, then rerun BootProof.
Evidence: .bootproof/attestation.json

Asosiy xususiyatlari

• Node, pnpm, Python/Flask, Go/Node gibridlarini aniqlash.
• Monorepo’larni baholash va aniq workspace tanlashni talab qilish.
• Docker service dependency aniqlash va docker-compose.bootproof.yml faylini yaratish.
• Ed25519 imzoli attestasiyalar – mahalliy yoki kelajakda CI/OIDC imzolari.
• Hech qanday sirli faylga ( .env ) yozilmaydi, maxfiy ma'lumotlar himoyalanadi.

Nega BootProofni tanlash kerak?

Bu vosita “run” tugmasini bosganingizda, inson diagnostikasi va mashina isboti birga keladi. Dasturchi xato yoki versiya mos kelmasligini ko‘rganida, aniq tavsiyalar (masalan, corepack enable && corepack prepare pnpm@10.24.0 --activate) beradi. Shuningdek, muvaffaqiyatsiz urinishlar ham foydali – ular “dependency_install_skipped” yoki “package_manager_version_mismatch” kabi sinflarga bo‘linadi, bu esa kelgusida muammoni tez aniqlashga yordam beradi.

{
  "schema": "bootproof/result/v1",
  "booted": false,
  "healthVerified": false,
  "failureClass": "dependency_install_skipped",
  "attestationPath": ".bootproof/attestation.json",
  "inference": {},
  "plan": {},
  "observed": []
}

BootProof hali alfa bosqichida, ammo kelajakda quyidagilarni qo‘shish rejalashtirilgan: ko‘proq remote provayderlar, kuchli multi‑service orkestratsiya, kengaytirilgan Python va Go qo‘llab‑quvvatlash, CI/OIDC imzoli tasdiqlar va “verified badge” tizimi.

cd /path/to/repository
npx bootproof up .

Umuman olganda, BootProof - “honest run button” bo‘lib, kodni ishga tushurishda xavfsizlik, shaffoflik va ishonchlilikni birlashtiradi.

npx bootproof up . --provider local --unsafe-local