47 lines
8.0 KiB
Markdown
47 lines
8.0 KiB
Markdown
# September LLVM-MinGW runtime notice proposal
|
||
|
||
Prepared 2026-09-13 for independent parent review. **Recommend one additional runtime mapping**, preserving the existing August mapping and all license bytes. No root tracked file, compiler, package, UI, Gitea or release was changed or executed. Python performed HTTPS reads, ZIP member comparisons and isolated proposal generation only.
|
||
|
||
## Verified identities
|
||
|
||
| Object | Identity / SHA256 |
|
||
| --- | --- |
|
||
| Official release | [LLVM-MinGW20260908, LLVM23.1.1](https://github.com/mstorsjo/llvm-mingw/releases/tag/20260908) |
|
||
| Official x86_64 UCRT ZIP asset | asset551256712, 190,677,197 bytes |
|
||
| Local `.local/toolchain/llvm-mingw.zip` | `1bcf74d06b724aeecaa6412ca85f5b26fb1da770e7cdcefa9263c9c5c3ad34b6` |
|
||
| Installed and archived x86_64 `libunwind.dll` | 190,464 bytes; `aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a` |
|
||
| Archived/installed distribution LICENSE.TXT | 15,141 bytes; `8d85c1057d742e597985c7d4e6320b015a9139385cff4cbae06ffc0ebe89afee` |
|
||
| Distribution tag object | `bdd1c28943bc0aaa4e33ebf7a42408a81d69380c` |
|
||
| Distribution source commit | `030097eeee87fcfd0f3bfe536b21cbd6e5d3b324` |
|
||
| LLVM tag | `llvmorg-23.1.1`, tag object `e7ce3600b55034ddf819638f395e3c475fad5be2` |
|
||
| LLVM source commit | `6dfe1677ab8dffbc6ec13d53a1e0215d75147689` |
|
||
| Exact libunwind LICENSE.TXT from this LLVM commit | 16,706 bytes; `b5efebcaca80879234098e52d1725e6d9eb8fb96a19fce625d39184b705f7b6d` |
|
||
|
||
The official GitHub release API's asset `digest` and `size` exactly match the local ZIP hash and size. ZIP decompression/CRC checks succeeded for both `bin/libunwind.dll` and `x86_64-w64-mingw32/bin/libunwind.dll`, and both member bytes exactly match their installed paths. The latter is the strict packager's selected runtime path. Distribution LICENSE.TXT also exactly matches the archive. This binds the DLL to the official published distribution, rather than merely accepting the installed directory name. Full archive CRC inspection was not performed; the full ZIP SHA256 and selected member CRC/bytes were checked.
|
||
|
||
`initial-evidence.json` retains the local/archive/member identities and complete official asset metadata, URLs and response hashes. `official-release.json`, tag responses and `source-evidence.json` preserve primary retrievals; no authenticated access or credentials were used.
|
||
|
||
## Source/license chain and limits
|
||
|
||
The distribution tag resolves to030097. Its [build-llvm.sh](https://github.com/mstorsjo/llvm-mingw/blob/030097eeee87fcfd0f3bfe536b21cbd6e5d3b324/build-llvm.sh) selects `llvmorg-23.1.1` by default at line19, resolves/fetches that ref at lines125–150, and checks out LLVM. The [build-libcxx.sh](https://github.com/mstorsjo/llvm-mingw/blob/030097eeee87fcfd0f3bfe536b21cbd6e5d3b324/build-libcxx.sh) uses that checkout, enables `libunwind;libcxxabi;libcxx`, builds shared libunwind, and installs into the architecture-specific prefix (lines53–59,104–139). Build-all invokes that runtime recipe; the Windows cross-tools script subsequently copies architecture DLLs into its host bin through prepare-cross-toolchain.sh. Sources are retained byte-exact here.
|
||
|
||
The pinned build workflow distinguishes nightly scheduled/manual builds (which override LLVM_VERSION with main) from push builds (which use the release script default). Release workflow selects a successful **push** build artifact. The official actions API identifies [successful push build34222735188](https://github.com/mstorsjo/llvm-mingw/actions/runs/34222735188) at exactly030097, created September8 11:49:39 UTC and completed19:34:58 UTC, before the release upload20:30:59–20:31:07 UTC. Build-chain receipts preserve that corroboration. The x86_64 UCRT Windows matrix uses the Linux stage1 runtime, builds cross tools, then ZIPs the selected distribution. This is a reviewed source/distribution chain, not independently replayed compilation or a cryptographic source-to-binary attestation.
|
||
|
||
The official LLVM annotated tag resolves to6dfe1677. The complete [component license at that immutable commit](https://raw.githubusercontent.com/llvm/llvm-project/6dfe1677ab8dffbc6ec13d53a1e0215d75147689/libunwind/LICENSE.TXT) was fetched and hashed. It includes Apache2.0 with LLVM exceptions and the retained legacy University of Illinois/MIT notice material. It is **exactly equal** to the repository's existing `llvm-ea7d852a70e8-libunwind-LICENSE.TXT`; equality was asserted against full bytes, not inferred from SPDX or version. Its old filename reflects the original download commit, but the new runtime row records the new verified source URL. No need to duplicate an identical license merely to rename it.
|
||
|
||
Corroborative binary metadata was deliberately not overstated: archive `clang.exe` and `clang-23.exe` scans did not expose a LLVM source commit/version string useful for this binding. The latter scan found only the generic LLVM bug URL. No compiler executable was invoked. No `versions.txt` member was found in the actual archive; the present workflow source's store-version step is therefore not claimed as an available artifact receipt. These omissions do not change the verified official asset hash or tag/source license comparison, but prevent claiming those additional corroborators. Build logs/attestations were not downloaded and the official build was not reproduced.
|
||
|
||
## Reviewable proposal and smallest integration
|
||
|
||
`runtime-entry.json` is the sole new semantic row. `notice-inputs/manifest.json` is the full proposed manifest, SHA256 `ec0a106d22ab2985712abe44323bbaaebbc61aa37de37d73f7170087896c915d`. It was derived from base manifest SHA256 `b39beaee5d8aeedcb45c7fd9b65c1b88a4fe784ddb9fe3d4126f5750e478c081`, preserving all previous package/asset/runtime rows and appending the exact aa282 runtime entry. Its notice references the existing b5ef license bytes and new immutable LLVM URL. The provenance text explicitly limits the result to official distribution/source evidence.
|
||
|
||
All25 existing supplement files are copied byte-exact into `notice-inputs/`; this makes the proposed manifest directory complete under the packager's relative-file containment rules without changing root inputs. Every referenced notice digest in all manifest groups was checked. `proposal-verification.json` records source/candidate hashes, copied notice identities and the verified semantic change. No full dependency preflight, packager, PE/runtime acceptance or GUI was run.
|
||
|
||
Minimal production integration after parent review: append `runtime-entry.json` to the existing `scripts/windows-notices/manifest.json` runtimes array. Keep the previous runtime mapping; no new supplement or packaging implementation change is necessary because the freshly retrieved license equals the already checked-in file. Preserve byte formatting of unaffected rows if editing manually. Include the primary evidence report/hashes in the relevant durable packaging record. Alternatively pass the isolated complete candidate directory as a temporary reviewed `-NoticeManifest` for a bounded future packaging experiment; do not call that an integrated fix.
|
||
|
||
Then run affected notice contract checks and the actual identified final union's locked offline dependency/notice preflight under the root's serialized lease. Verify selected DLL hash still equals aa282 before packaging, preserve all existing missing-source/notice/import checks, and perform the ordinary fresh-extraction GUI/server acceptance. This mapping resolves only the known runtime-notice input mismatch; it does not accept the application, final package, optimized profile, source union or Linux.
|
||
|
||
## Evidence mechanics
|
||
|
||
`collect.py`, `collect-source.py`, `prepare-proposal.py` and `confirm-build-chain.py` are narrowly scoped, create-new helpers whose actual sources are retained. All finished exit0. They never execute downloaded scripts. Their source URLs, API responses and output identities are retained beside this report. Existing large ZIP/DLL payloads remain external hashed inputs; no190MB duplicate was made. `evidence-inventory.json` inventories this directory's payloads at handoff, excluding itself. Parent owns independent review, any tracked integration and later packaging acceptance.
|