From b07f5a7883d3a94fddd37b94dd0e6331731147c8 Mon Sep 17 00:00:00 2001
From: Rocky DeStefano <rocky@apeiris.ai>
Date: Wed, 26 Aug 2026 19:04:17 -0600
Subject: [PATCH] toolchain: add linux_arm64 builds for gitleaks, trivy and
 osv-scanner

MANAGED lists all three tools, but each downloads map carried only darwin_arm64,
darwin_amd64 and linux_amd64. _platform_key() maps aarch64 -> arm64, so on Linux
ARM64 describe() returns None for every managed tool.

The engine then takes the 'not in the pinned catalog' branch and never emits
TOOL_REQUESTED, so the install card is unreachable and request_tool always reports
the tool as unavailable -- which is the silent-gap failure OPE-85 exists to
prevent, on a platform where all three tools are in fact available.

It also fails three tests on that platform:
  tests/test_tool_request.py::test_emits_tool_requested_and_reports_install
  tests/test_tool_request.py::test_declining_tells_the_agent_to_fall_back_openly
  tests/test_tool_request.py::test_decline_recheck_finds_a_copy_the_user_installed_themselves

All three projects publish linux_arm64 assets. Each was downloaded, checksummed
and executed on aarch64 before being pinned here:

  gitleaks 8.30.1    ELF 64-bit LSB executable, ARM aarch64
  trivy 0.74.0       ELF 64-bit LSB executable, ARM aarch64
  osv-scanner 2.5.0  ELF 64-bit LSB executable, ARM aarch64

Asset naming differs per project and is preserved as each publishes it; osv-scanner
ships a bare binary, so its entry has no member=, matching its existing entries.

Backend suite on aarch64: 4189 passed, 0 failed (was 3 failed).
---
 coworker/toolchain.py | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/coworker/toolchain.py b/coworker/toolchain.py
index 0a10866be..1c6b61671 100644
--- a/coworker/toolchain.py
+++ b/coworker/toolchain.py
@@ -117,6 +117,11 @@ class ManagedTool:
                 sha256="551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb",
                 member="gitleaks",
             ),
+            "linux_arm64": Download(
+                url="https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_arm64.tar.gz",
+                sha256="e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080",
+                member="gitleaks",
+            ),
         },
     ),
     "trivy": ManagedTool(
@@ -139,6 +144,11 @@ class ManagedTool:
                 sha256="2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a",
                 member="trivy",
             ),
+            "linux_arm64": Download(
+                url="https://github.com/aquasecurity/trivy/releases/download/v0.74.0/trivy_0.74.0_Linux-ARM64.tar.gz",
+                sha256="b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5",
+                member="trivy",
+            ),
         },
     ),
     "osv-scanner": ManagedTool(
@@ -158,6 +168,10 @@ class ManagedTool:
                 url="https://github.com/google/osv-scanner/releases/download/v2.5.0/osv-scanner_linux_amd64",
                 sha256="edcfc41d257db36148f065055655fe3fcfc434b0b423ea67468a84c207524e0c",
             ),
+            "linux_arm64": Download(
+                url="https://github.com/google/osv-scanner/releases/download/v2.5.0/osv-scanner_linux_arm64",
+                sha256="fe152e1a546af223e6c557cc3111a8bb3e5dc02fcbf7dbe95d26567c0f0041f2",
+            ),
         },
     ),
 }