René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"start-proxy selects an AMD64 binary on Linux ARM64","articleBody":"## Problem\n\nThe CodeQL CLI now has native Linux ARM64 support in beta, but the managed private-registry proxy still selects and downloads an AMD64 executable on Linux ARM64. This prevents the proxy from running natively even when CodeQL analysis itself can run.\n\nThis report concerns the proxy artifact and architecture selection, not generic CodeQL CLI ARM64 support, registry credentials, custom CA certificates, or outbound network access.\n\n## Source and public release evidence\n\nSource inspected on September 25, 2026: [`fa8392b7e54a5d74a53270a4aa7defa307aa415c`](https://github.com/github/codeql-action/commit/fa8392b7e54a5d74a53270a4aa7defa307aa415c).\n\n- [`getProxyPackage()`](https://github.com/github/codeql-action/blob/fa8392b7e54a5d74a53270a4aa7defa307aa415c/src/start-proxy.ts#L371-L382) selects by `process.platform` only. Every Linux host receives `update-job-proxy-linux64.tar.gz`; `process.arch` is not checked.\n- [`getDownloadUrl()`](https://github.com/github/codeql-action/blob/fa8392b7e54a5d74a53270a4aa7defa307aa415c/src/start-proxy.ts#L424-L475) looks for that filename in the CodeQL bundle release, then falls back to the [hard-coded v2.22.0 release](https://github.com/github/codeql-action/blob/fa8392b7e54a5d74a53270a4aa7defa307aa415c/src/start-proxy.ts#L172-L175).\n- The [v2.27.0 release](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0) contains a native `codeql-bundle-linux-arm64` CLI bundle, but the proxy assets are only `linux64`, `osx64`, and `win64`.\n- Fresh inspection of both Linux proxy archives below found ELF `e_machine=62` (`EM_X86_64`), not `183` (`EM_AARCH64`). Downloaded archive hashes match the digests returned by the GitHub Releases API.\n\n| Proxy release | ELF architecture | Archive SHA-256 |\n| --- | --- | --- |\n| v2.27.0 | AMD64 / `e_machine=62` | `77197411d8fe7c6d157f694e2e4edd6b94bf7d9d10c667864cd6a113c31f97b2` |\n| v2.22.0 fallback | AMD64 / `e_machine=62` | `caed6d4ad41849570f6c62f784f20f9414a82738b120f464d7fcad1640f7900b` |\n\n## Public-only reproduction\n\nThis inspects public artifacts without executing them, extracting them to disk, accessing a private registry, or requiring credentials. It can run on any host with curl and Python 3; the affected execution platform is native Linux ARM64 without x86 emulation.\n\n```bash\nfor version in 2.27.0 2.22.0; do\n  curl --fail --silent --show-error --location \\\n    \"https://github.com/github/codeql-action/releases/download/codeql-bundle-v${version}/update-job-proxy-linux64.tar.gz\" \\\n    -o \"proxy-v${version}.tar.gz\" || exit 1\ndone\n\npython3 - \u003c\u003c'PY'\nimport tarfile\nfrom pathlib import Path\n\nfor version in (\"2.27.0\", \"2.22.0\"):\n    with tarfile.open(f\"proxy-v{version}.tar.gz\", \"r:gz\") as archive:\n        members = [\n            member for member in archive.getmembers()\n            if member.isfile() and Path(member.name).name == \"update-job-proxy\"\n        ]\n        assert len(members) == 1\n        header = archive.extractfile(members[0]).read(64)\n        assert header[:4] == b\"\\x7fELF\"\n        assert header[5] in (1, 2)\n        byteorder = \"little\" if header[5] == 1 else \"big\"\n        machine = int.from_bytes(header[18:20], byteorder)\n        print(f\"{version}: ELF e_machine={machine} (62=AMD64, 183=AArch64)\")\nPY\n```\n\nActual output:\n\n```text\n2.27.0: ELF e_machine=62 (62=AMD64, 183=AArch64)\n2.22.0: ELF e_machine=62 (62=AMD64, 183=AArch64)\n```\n\n## Native-run observation and impact\n\nA September 21, 2026 managed CodeQL run on native Linux ARM64, Ubuntu 26.04.1, with CLI 2.27.0 uploaded analyses successfully, but its local registry-proxy connection tests failed with `ECONNREFUSED`; proxy cleanup reported `ESRCH`. This earlier runtime observation is separate from the fresh public-artifact inspection above; no new managed scan was triggered for this report.\n\nSuccessful analysis upload therefore did not establish successful private-dependency resolution. The architecture mismatch can be verified independently of that runner OS version and of any particular private registry. An x64 runner remains the workaround for this proxy path.\n\n## Expected behavior\n\nSelect a native Linux ARM64 proxy artifact when `process.arch === \"arm64\"`, including an architecture-compatible fallback. Until such an artifact is available, fail early with an explicit unsupported-architecture diagnostic rather than attempting to start the AMD64 executable. Tests should cover Linux `x64` and `arm64` selection and fallback behavior.\n\nCould the maintainers confirm whether private-registry proxy support is intended to be part of [Linux ARM64 CodeQL support](https://codeql.github.com/docs/codeql-overview/system-requirements/), or whether this remains an unsupported combination that should be documented explicitly?\n\n## Related, but distinct\n\n#3530 and #3531 address proxy startup retries and false-success/readiness reporting. They may explain why a dead proxy is not surfaced clearly, but they do not add an ARM64 proxy artifact or change architecture selection. This report tracks that architecture gap separately.\n","author":{"url":"https://github.com/debanjanbasu","@type":"Person","name":"debanjanbasu"},"datePublished":"2026-09-25T01:56:10Z","url":"https://github.com/github/codeql-action/issues/4173"}