Commit9878d838Recorded24 Aug 2026Repositorycore-channel
Act on the adversarial review: six assertions that could not go red
Message
An adversarial reviewer with a named hunt list asked, of every gate in the change, what edit to the PRODUCT would turn it red. Six could not be made to fail:
pkg-config --variable=pkgdatadirexits 0 and prints an empty line for an UNDEFINED variable, so deleting thepkgdatadir=line it was written to protect left it green -- while foot's get_variable() fails three packages later. Now captures the value, requires it non-empty, and requires the staged directory to exist.pkg-config --modversion fcftprints a version and never compares one, while the comment claimed foot's >=3.3.1 <4.0.0 pin was asserted. Now --atleast-version and --max-version, which do compare.- gperf and samurai asserted nothing at all. gperf is the sharp one: this module argues at length that an ABSENT gperf makes fontconfig conclude FC_GPERF_SIZE_T from a substitution that tested nothing, with configure still exiting 0 -- and then did not check the tool was present. Now
test -xplus actually running it. - Three more were subsumed by the command immediately above them.
The meson launcher -- the most fragile artifact here, on the critical path of five packages -- was never executed by the package that writes it, and structurally could not be: meson declared no build-inputs, so no python3 was on PATH during its own build. It now declares python and ends by running the launcher, checking the version, and asserting zero pycache directories, which turns the -B finding from a comment into a standing check.
The date-macro gate could not distinguish its own stated mechanism. It compiled with a bare $CC -- no response file, therefore no -O2, which is the stated trigger -- and the builder sets SOURCE_DATE_EPOCH=0, which renders as exactly the literal it compares against. So its green was equally consistent with "the toolchain pins these unconditionally" and "clang honoured the builder's epoch". Now compiles with $CC $CFLAGS and recompiles under SOURCE_DATE_EPOCH=1000000000 requiring the output to be unchanged. Both arms pass, so the claim is now warranted rather than merely true.
Also: wayland links an executable and lacked -Dprefer_static, working only because expat.pc happens to have no Requires.private; three cp calls became install -m because busybox cp masks mode by the ambient umask and this builder treats mode as identity-relevant; a comment had a paragraph pasted into the middle of a sentence; trailing whitespace.
And one explanation is withdrawn. The samurai comment claimed the realloc(NULL, 0) behaviour was "a property of the zig-bundled libc rather than of musl generally" -- but zig bundles musl SOURCE and compiles it, so there is no separate implementation for the property to belong to. The measurement stands; the mechanism is now marked open instead of dressed as a finding.
Changed
src/core/packages/build-tools.sgl | 140 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---------------------------
src/core/packages/datastructures.sgl | 7 +++++--
src/core/packages/fonts.sgl | 10 +++++++++-
src/core/packages/python.sgl | 36 ++++++++++++++++++++++++++++++++++--
src/core/packages/wayland.sgl | 47 +++++++++++++++++++++++++++++++++++++++++++++--
5 files changed, 206 insertions(+), 34 deletions(-)Diff
src/core/packages/build-tools.sglmodified
@@ -14,6 +14,7 @@
14
(define-library (core packages build-tools) 15
(import (sigil core) 16
(core build-environments)+17
(core packages python) 18
(sigil env package) 19
(sigil build external)) 20
(export byacc file gperf meson samurai)@@ -115,7 +116,11 @@
116
"set -eu\n" 117
"d=\"$(dirname \"$PWD\")/install-root\"\n" 118
"test -x \"$d${out}/bin/yacc\"\n"−118
"cp \"$d${out}/bin/yacc\" \"$d${out}/bin/byacc\"\n"+119
;; `install -m` rather than `cp`: busybox `cp` masks the+120
;; source mode by the ambient UMASK, which would+121
;; make the installed permissions a function of the+122
;; environment rather than of the derivation.+123
"install -m 755 \"$d${out}/bin/yacc\" \"$d${out}/bin/byacc\"\n" 124
"test -x \"$d${out}/bin/byacc\"\n" 125
"echo BYACC-DUAL-NAME-INSTALLED\n")))))) 126
@@ -203,12 +208,25 @@
208
;; reads like a missing file. 209
;; 210
;; THIS TOOLCHAIN'S LIBC RETURNS NULL FROM realloc(NULL, 0) WHILE RETURNING−206
;; NON-NULL FROM malloc(0). Upstream musl's realloc begins−207
;; `if (!p) return malloc(n);` and would return non-null, so this is a−208
;; property of the zig-bundled libc rather than of musl generally, and−209
;; anything in this channel calling `realloc(p, 0)` inherits it. Measured−210
;; through a volatile function pointer, because the optimizer rewrites a−211
;; visible `realloc(NULL, n)` into `malloc(n)` and hides the real answer.+211
;; NON-NULL FROM malloc(0). Measured through a volatile function pointer,+212
;; at -O0 and -O2, with `realloc(NULL, 32)` as a passing positive control --+213
;; the indirection is necessary because the optimizer rewrites a VISIBLE+214
;; `realloc(NULL, n)` into `malloc(n)` and hides the real answer.+215
;;+216
;; THE MEASUREMENT IS WHAT THIS PACKAGE RELIES ON; THE EXPLANATION IS NOT+217
;; SETTLED, and an earlier version of this comment overstated it. It said+218
;; the behaviour was "a property of the zig-bundled libc rather than of musl+219
;; generally", on the grounds that upstream musl's realloc opens+220
;; `if (!p) return malloc(n);`. That reasoning does not hold up: zig+221
;; bundles musl SOURCE and compiles it, so there is no separate+222
;; implementation for the property to belong to. Either the musl version+223
;; here differs from the one that reasoning describes, or the reasoning is+224
;; simply wrong. Nothing in this channel depends on which -- the patch is+225
;; defensive and correct under either -- so it is left as an open question+226
;; rather than dressed up as a finding.+227
;;+228
;; What IS established and does matter: anything in this channel calling+229
;; `realloc(p, 0)` and treating NULL as failure will break the same way. 230
;; 231
;; REVISIT ON EVERY VERSION BUMP. Upstream master still has the same line, 232
;; so the patch is expected to keep applying -- but if it stops, the right@@ -249,7 +267,19 @@
267
path: "patches/samurai-realloc-zero-length.patch" 268
sha256: "f160b3d9265a68b88cbcc5e7b04ec5e65f1ef89289dac14919e3702c80e025b3"))) 269
(external-phase kind: 'make)−252
(external-phase kind: 'install args: (list "PREFIX=${out}")))))+270
(external-phase kind: 'install args: (list "PREFIX=${out}"))+271
;; ASSERT THE BINARY. Every other package in this change+272
;; checks what its consumers will look for; samurai and gperf+273
;; were the two that did not, and gperf is the sharp one --+274
;; see the note there.+275
(external-phase+276
kind: 'run+277
args: (list "sh" "-c"+278
(string-append+279
"set -eu\n"+280
"d=\"$(dirname \"$PWD\")/install-root\"\n"+281
"test -x \"$d${out}/bin/samu\"\n"+282
"echo SAMURAI-INSTALLED\n")))))) 283
284
;; gperf, a perfect-hash generator. Nothing in this channel wants one; it 285
;; is here because fontconfig's configure RUNS it, at configure time:@@ -289,10 +319,33 @@
319
phases: (list 320
(external-phase kind: 'configure args: (list "--prefix=${out}")) 321
(external-phase kind: 'make)−292
(external-phase kind: 'install))))+322
(external-phase kind: 'install)+323
;; ASSERT THE BINARY, AND THIS ONE IS LOAD-BEARING RATHER+324
;; THAN TIDY. The entire argument for packaging gperf is+325
;; that an ABSENT gperf makes fontconfig's configure.ac:216+326
;; probe conclude `FC_GPERF_SIZE_T=size_t` from a command+327
;; substitution that tested nothing -- with configure still+328
;; exiting 0. Packaging gperf closes that only if+329
;; `bin/gperf` actually exists. Without this line, a gperf+330
;; whose `make install` put the binary somewhere else would+331
;; ship green and hand fontconfig straight back into the+332
;; silent-wrong-answer state this package was written to+333
;; prevent, with every gate downstream still passing.+334
(external-phase+335
kind: 'run+336
args: (list "sh" "-c"+337
(string-append+338
"set -eu\n"+339
"d=\"$(dirname \"$PWD\")/install-root\"\n"+340
"test -x \"$d${out}/bin/gperf\"\n"+341
;; And prove it RUNS, because the thing+342
;; fontconfig does is run it.+343
"\"$d${out}/bin/gperf\" --version | head -1\n"+344
"echo GPERF-INSTALLED\n")))))) 345
346
;; meson. Pure Python, so there is nothing to compile and the whole−295
;; package is one `run` phase that copies a tree and writes a launcher.+347
;; package is one `run` phase that copies a tree, writes a launcher, and+348
;; then RUNS that launcher. 349
;; 350
;; WHY THE LAUNCHER EXECS `python3` FROM PATH RATHER THAN AN ABSOLUTE PATH. 351
;; The honest way to write this would be `${python}/bin/python3`, but@@ -316,6 +369,15 @@
369
location: "https://github.com/mesonbuild/meson/releases/download/1.8.2/meson-1.8.2.tar.gz" 370
sha256: "c105816d8158c76b72adcb9ff60297719096da7d07f6b1f000fd8c013cd387af") 371
buildenv: core-buildenv+372
;; PYTHON IS A BUILD INPUT SO THAT THIS PACKAGE CAN RUN ITS OWN+373
;; LAUNCHER. meson compiles nothing, so strictly it needs no inputs at+374
;; all -- and that was the earlier definition. The cost was that the+375
;; single most fragile artifact here, a hand-written shell wrapper on+376
;; the critical path of five packages, was never executed by the+377
;; package that produces it: the first thing to run it was the next+378
;; package's `meson setup`, one build later. Declaring python buys the+379
;; `--version` call at the end of the phase, which is a real gate.+380
build-inputs: (list python) 381
phases: (list 382
(external-phase 383
kind: 'run@@ -325,25 +387,35 @@
387
"d=\"$(dirname \"$PWD\")/install-root\"\n" 388
"mkdir -p \"$d${out}/lib/meson\" \"$d${out}/bin\"\n" 389
"cp -a mesonbuild \"$d${out}/lib/meson/\"\n"−328
"cp meson.py \"$d${out}/lib/meson/\"\n"−329
;; THE LAUNCHER LOCATES ITSELF rather than−330
;; baking `${out}`. `${out}` expands to the−331
;; SANDBOX view -- /sigil/store/<item> -- which−332
;; exists inside any build that binds meson and−333
;; nowhere else. A launcher carrying that path−334
;; works where meson is actually used and dies−335
;; under `sigil env shell`, which is a real−336
;; failure mode this package hit on its first−337
;; build and which the same shape gives ncurses'+390
;; `install -m` rather than `cp`: busybox `cp`+391
;; creates the destination with the source's mode+392
;; masked by the ambient UMASK, so the installed+393
;; permissions would be a function of the+394
;; environment rather than of the derivation.+395
;; Every autotools `make install` in this channel+396
;; uses `install -m` for exactly that reason.+397
"install -m 644 meson.py \"$d${out}/lib/meson/meson.py\"\n"+398
;; THE LAUNCHER LOCATES ITSELF rather than baking+399
;; `${out}`. `${out}` expands to the SANDBOX+400
;; view -- /sigil/store/<item> -- which exists+401
;; inside any build that binds meson and nowhere+402
;; else. A launcher carrying that path works+403
;; where meson is actually used and dies under+404
;; `sigil env shell`, which is a real failure+405
;; mode this package hit on its first build, and+406
;; which the same shape gives ncurses' 407
;; compiled-in terminfo root. Deriving the 408
;; prefix from `$0` costs one line, works in both 409
;; places, and leaves no absolute path in the 410
;; artifact at all. 411
;; 412
;; A quoted heredoc delimiter keeps the shell out+413
;; of `$0` and `$@`; neither uses braces, so+414
;; sigil's own `${...}` interpolation does not see+415
;; them either. 416
;;−345
;; `-B` IS LOAD-BEARING AND THIS PACKAGE PROVED−346
;; IT THE EXPENSIVE WAY. Without it, the FIRST+417
;; `-B` IS LOAD-BEARING AND THIS PACKAGE PROVED IT+418
;; THE EXPENSIVE WAY. Without it, the FIRST 419
;; `meson --version` wrote 99 `.pyc` files into 420
;; `__pycache__` directories INSIDE meson's own 421
;; store item. The item then failed content@@ -363,11 +435,8 @@
435
;; stopped from writing beside its own sources at 436
;; run time. Python is merely the first one here. 437
;; The failure is also delayed by one invocation,−366
;; so it does not look like a packaging bug --−367
;; the run that breaks the item succeeds.−368
;; of `$0` and `$@`; neither uses braces, so−369
;; sigil's own `${...}` interpolation does not−370
;; see them either.+438
;; so it does not look like a packaging bug -- the+439
;; run that breaks the item succeeds. 440
"cat > \"$d${out}/bin/meson\" <<'WRAP'\n" 441
"#!/bin/sh\n" 442
"here=$(CDPATH= cd -- \"$(dirname -- \"$0\")\" && pwd)\n"@@ -375,4 +444,21 @@
444
"WRAP\n" 445
"chmod 755 \"$d${out}/bin/meson\"\n" 446
"test -d \"$d${out}/lib/meson/mesonbuild\"\n"+447
;; RUN THE LAUNCHER. This is the gate the earlier+448
;; definition lacked: it exercises the shebang,+449
;; the `$0`-relative prefix derivation, the `-B`+450
;; flag, python3 resolving from PATH, and+451
;; mesonbuild importing -- none of which the+452
;; preceding `test -d` touches, because that is+453
;; subsumed by the `cp -a` above it.+454
"v=\"$(\"$d${out}/bin/meson\" --version)\"\n"+455
"echo \"MESON-LAUNCHER-VERSION=[$v]\"\n"+456
"test \"$v\" = \"1.8.2\"\n"+457
;; And prove `-B` did its job: running the+458
;; launcher must NOT have written bytecode beside+459
;; the sources, or the store item corrupts itself+460
;; on first use.+461
"n=$(find \"$d${out}/lib/meson\" -name '__pycache__' -type d | wc -l)\n"+462
"echo \"MESON-PYCACHE-DIRS=$n\"\n"+463
"test \"$n\" -eq 0\n" 464
"echo MESON-INSTALLED\n"))))))))src/core/packages/datastructures.sglmodified
@@ -66,7 +66,10 @@
66
"set -eu\n" 67
"d=\"$(dirname \"$PWD\")/install-root\"\n" 68
"mkdir -p \"$d${out}/include\" \"$d${out}/lib/pkgconfig\"\n"−69
"cp tllist.h \"$d${out}/include/\"\n"+69
;; `install -m` rather than `cp`, so the installed mode is a+70
;; function of the derivation and not of the+71
;; ambient umask.+72
"install -m 644 tllist.h \"$d${out}/include/tllist.h\"\n" 73
"cat > \"$d${out}/lib/pkgconfig/tllist.pc\" <<'PC'\n" 74
"Name: tllist\n" 75
"Description: A C header file only implementation of a typed linked list\n"@@ -80,4 +83,4 @@
83
"test -f \"$d${out}/include/tllist.h\"\n" 84
"PKG_CONFIG_PATH=\"$d${out}/lib/pkgconfig\" pkg-config --exists tllist\n" 85
"PKG_CONFIG_PATH=\"$d${out}/lib/pkgconfig\" pkg-config --modversion tllist\n"−83
"echo TLLIST-INSTALLED\n")))))))) +86
"echo TLLIST-INSTALLED\n"))))))))src/core/packages/fonts.sglmodified
@@ -262,5 +262,13 @@
262
;; foot pins fcft to >=3.3.1 <4.0.0, so the 263
;; version pkg-config reports is load-bearing and 264
;; is asserted rather than assumed.−265
"PKG_CONFIG_PATH=\"$d${out}/lib/pkgconfig\" pkg-config --modversion fcft\n"+265
;; `--modversion` PRINTS a version; it does not+266
;; CHECK one, and it exits 0 for any value. foot+267
;; pins fcft to `>=3.3.1 <4.0.0`, so assert that+268
;; range with the options that actually compare.+269
;; Printing it as well keeps the value in the log.+270
"v=$(PKG_CONFIG_PATH=\"$d${out}/lib/pkgconfig\" pkg-config --modversion fcft)\n"+271
"echo \"FCFT-VERSION=[$v]\"\n"+272
"PKG_CONFIG_PATH=\"$d${out}/lib/pkgconfig\" pkg-config --atleast-version=3.3.1 fcft\n"+273
"PKG_CONFIG_PATH=\"$d${out}/lib/pkgconfig\" pkg-config --max-version=3.99.99 fcft\n" 274
"echo FCFT-INSTALLED\n"))))))))src/core/packages/python.sglmodified
@@ -101,11 +101,43 @@
101
"set -eu\n" 102
"echo '#include <stdio.h>' > dtcheck.c\n" 103
"echo 'int main(void){ printf(\"%s|%s\", __DATE__, __TIME__); return 0; }' >> dtcheck.c\n"−104
"$CC -Wno-error=date-time dtcheck.c -o dtcheck\n"+104
;; ARM 1 -- COMPILED WITH $CFLAGS, which is the+105
;; whole point. An earlier version of this gate+106
;; ran a bare `$CC`, so it carried no+107
;; `@compiler.flags` response file and therefore+108
;; no `-O2` -- it vouched for a configuration+109
;; CPython is not built in, while the comment+110
;; above names `-O2` as the trigger. A gate that+111
;; compiles under different flags than the code it+112
;; certifies is asserting its author's+113
;; expectations rather than the product.+114
"$CC $CFLAGS -Wno-error=date-time dtcheck.c -o dtcheck\n" 115
"v=$(./dtcheck)\n" 116
"echo \"TOOLCHAIN-DATE-MACROS=[$v]\"\n" 117
"test \"$v\" = \"Jan 1 1970|00:00:00\"\n"−108
"rm -f dtcheck dtcheck.c\n"+118
;; ARM 2 -- THE ARM THAT SEPARATES THE TWO+119
;; EXPLANATIONS. The builder sets+120
;; SOURCE_DATE_EPOCH=0, and epoch 0 renders as+121
;; exactly "Jan 1 1970" / "00:00:00" -- the+122
;; literal arm 1 compares against. So arm 1 alone+123
;; is green under BOTH hypotheses: "the toolchain+124
;; pins these macros unconditionally" (which is+125
;; what licenses the -Wno-error above) and "clang+126
;; is honouring the builder's epoch" (which would+127
;; not license it, because the guarantee would+128
;; then belong to a variable a future builder+129
;; could stop setting).+130
;;+131
;; Overriding the epoch to a DIFFERENT instant+132
;; discriminates: if the output moves, the macros+133
;; track SOURCE_DATE_EPOCH and this package's+134
;; justification is wrong.+135
"w=$(SOURCE_DATE_EPOCH=1000000000 ./dtcheck)\n"+136
"printf 'DATE-MACROS-UNDER-EPOCH-1000000000=[%s]\\n' \"$w\"\n"+137
"e=$(SOURCE_DATE_EPOCH=1000000000 $CC $CFLAGS -Wno-error=date-time dtcheck.c -o dtcheck2 && ./dtcheck2)\n"+138
"echo \"DATE-MACROS-RECOMPILED-UNDER-EPOCH=[$e]\"\n"+139
"test \"$e\" = \"Jan 1 1970|00:00:00\"\n"+140
"rm -f dtcheck dtcheck2 dtcheck.c\n" 141
"echo DATE-MACRO-PINNING-CONFIRMED\n"))) 142
(external-phase 143
kind: 'configuresrc/core/packages/wayland.sglmodified
@@ -77,6 +77,19 @@
77
" --prefix=${out}" 78
" --buildtype=plain" 79
" --default-library=static"+80
;; `-Dprefer_static=true` HERE TOO, although+81
;; nothing needs it TODAY. wayland builds+82
;; `wayland-scanner`, an executable that links+83
;; expat, and it links only because `expat.pc`+84
;; happens to carry no `Requires.private:` -- so+85
;; the default, non-static pkg-config query is+86
;; sufficient by coincidence rather than by+87
;; construction. The moment expat grows one, or+88
;; the scanner gains a dependency that has one,+89
;; this package reproduces the `undefined symbol`+90
;; link failure that fontconfig's+91
;; `Requires.private: expat` produced in foot.+92
" -Dprefer_static=true" 93
;; documentation wants doxygen, xmlto and 94
;; xsltproc; dtd_validation wants libxml2. Both 95
;; are probes on what happens to be visible, and@@ -172,5 +185,35 @@
185
;; And prove the variable foot reads back is 186
;; actually readable, by the tool that will read 187
;; it.−175
"PKG_CONFIG_PATH=\"$d${out}/lib/pkgconfig\" pkg-config --variable=pkgdatadir wayland-protocols\n"−176
"echo WAYLAND-PROTOCOLS-INSTALLED\n")))))))) +188
;; A BARE `pkg-config --variable=` CALL IS NOT A+189
;; GATE. pkg-config exits 0 and prints an empty+190
;; line when the requested variable is UNDEFINED,+191
;; so deleting the `pkgdatadir=` line from the+192
;; heredoc above would leave this green -- and+193
;; foot's `get_variable('pkgdatadir')` would then+194
;; fail three packages later, inside+195
;; wayland-scanner, which is exactly the distance+196
;; these assertions exist to close. Require the+197
;; value to be non-empty AND to name a real+198
;; directory.+199
"v=$(PKG_CONFIG_PATH=\"$d${out}/lib/pkgconfig\" pkg-config --variable=pkgdatadir wayland-protocols)\n"+200
"echo \"WAYLAND-PROTOCOLS-PKGDATADIR=[$v]\"\n"+201
"test -n \"$v\"\n"+202
;; AND THE VALUE MUST NAME A REAL DIRECTORY --+203
;; but the STAGED one. `$v` is an absolute+204
;; `/sigil/store/<item>/...` path, which is where+205
;; the directory will live once this output is in+206
;; the store and bound into a consumer's sandbox.+207
;; It does not exist yet DURING this build; the+208
;; files are under `$d` until the realizer moves+209
;; them. So the staged equivalent is `$d$v`.+210
;;+211
;; The first version of this check tested `$v`+212
;; directly and failed the build immediately --+213
;; which is the right direction for a new gate to+214
;; be wrong in, and worth leaving a note about:+215
;; a path emitted by pkg-config is a CONSUMER-time+216
;; path, and a build-time assertion about it has+217
;; to add the staging offset.+218
"test -d \"$d$v\"\n"+219
"echo WAYLAND-PROTOCOLS-INSTALLED\n"))))))))