52 lines
14 KiB
Markdown
52 lines
14 KiB
Markdown
# Portable packaging implementation — 2026-09-10
|
|
|
|
Codex-9e8r6t `/root/release_audit`, separate host from Codex-956atf's behavior/forms work. Root authorized only the packaging/helper/notice/Docker/platform-guide files and this report; root keeps README, server guide, built-in guide and shared ledgers. No commits or pushes by this agent. Existing runtime acceptance is not transferred to new artifacts.
|
|
|
|
## Implemented contract
|
|
|
|
* `scripts/package-linux.ps1` packages prebuilt x86-64 glibc desktop/server binaries or exports a server-only notice directory. No build, download, installation, server or GUI launch occurs. It retains explicit target, fresh-output claims, exact copies/hashes and strict notice preflight. ELF imports are inspected without execution; unknown dependencies, wrong architecture/loader and RPATH/RUNPATH require explicit resolution.
|
|
* `scripts/package-common.ps1` shares documentation collection, notice writing, checksum staging and optional caller-supplied build evidence. Evidence must name source/profile/compiler/target and actual binary hashes; the packager checks target/hashes and labels the remaining statements as assertions, not inferred build provenance.
|
|
* `scripts/package-artifacts.py` uses Python 3.11+ standard library for local document closure/link verification, bounded ELF table inspection, deterministic tar/gzip creation with Linux executable modes, archive readback, and container notice verification. Archive claims refuse overwriting. Direct imports and observed GLIBC strings are explicitly distinct from dynamically loaded graphics/portal dependencies and native compatibility.
|
|
* Windows retains its original PE/runtime-DLL allowlist, exact libunwind provenance and recursive import checks. It now shares the package-specific README and a bounded reachable documentation closure; no wholesale harness copying. Both platforms include all 37 teaching/evidence files and complete tracked examples. License texts remain verbatim; their internal upstream source-tree hyperlinks are outside the product-document link check.
|
|
* `Get-ArcadiaNotices` is the existing reviewed collector with selectable root packages and shared compiler-input hashes; the old Windows entry point remains a compatibility wrapper. The exact locked normal/build graph, registry archives, real source hashes, Rust target libraries, embedded font mapping and checksum-bound notice supplements retain their existing refusal behavior. Server-only output excludes the desktop root.
|
|
* Docker's ordinary repository context is an allowlist. A separate BuildKit named `server_notices` context contains only the explicitly prepared notice directory. Builder verification checks exact Linux target/server root, Cargo.lock, Rust release/commit and target-library hashes, common build inputs, exact local crate source file sets, notice manifest and inventory references. The final image retains the bundle under `/usr/share/doc/arcadia-server`. Missing/stale notices fail before application compilation. No actual Docker build/runtime was possible on this host.
|
|
|
|
Platform guides describe package prerequisites, extraction/runtime acceptance, provenance limits, the container notice preparation/build command, and runner-independent validation commands. Root owns the coordinating Docker-command update in `docs/server.md`.
|
|
|
|
## Independent criticism addressed
|
|
|
|
The independent packaging reviewer reproduced acceptance of changed root Cargo.toml, shared build script, embedded OpenAPI and newly added crate files against an old notice inventory. Fixed at the collector/verifier boundary by recording shared build inputs and reconciling exact local file sets. The reviewer also demonstrated that whitespace/case in HTML href syntax bypassed the regular expression; replaced that parsing with stdlib HTMLParser and added positive/negative coverage. An HTML base URL now fails explicitly because changing relative-link resolution needs a deliberate contract. Two further findings were corrected and independently reverified: ancestor Windows junctions could escape documentation roots, and a file added during tar readback escaped the final stage comparison. Python and PowerShell now reject reparse ancestors, and readback compares the final file set as well as hashes. See `harness/release-packaging-independent-review-20260910.md` and Gitea issue 1 comment 49.
|
|
|
|
A real Linux desktop graph subsequently exposed an existing scanner false positive: ab_glyph's Rustdoc font examples reference development fonts outside its distributed crate. The collector now excludes full-line Rust `//` comments before scanning literal font macros; production macros still require an in-crate file and exact notice mapping. Containment is checked before relative-path slicing, with platform-appropriate path comparison. Synthetic comment/production regressions pass and the independent reviewer found no actionable defect in this narrow follow-up.
|
|
|
|
The subsequent full Linux preflight correctly refused an unmapped actual `sctk-adwaita 0.10.1/src/title/Cantarell-Regular.ttf`. Added an exact asset mapping, unchanged historical OFL text and readable name-table attribution. The 31,236 font bytes have SHA256 `d15f25bcdaba2e25f54c32d4e29e68fedeb1b7a1d8fbc83f7c4475916e93b55f`; cached crate and [pinned crate-upstream font](https://raw.githubusercontent.com/PolyMeilex/sctk-adwaita/d5f343c45c04d4a026db57f76760819b7325db00/src/title/Cantarell-Regular.ttf) match exactly. The embedded Mac/Windows name records explicitly identify OFL 1.1, Version 0.05 and Understanding Limited/Jakub Steiner copyright years matching the [historical GNOME COPYING](https://raw.githubusercontent.com/GNOME/cantarell-fonts/61362600e104b96c88a2fdc068e1e2c68aef4f16/COPYING). The latter is 4,534 bytes, SHA256 `7bb92a19f8f5485713f6e96a8331289b3aae49e8e44e7cad58b567e03be16d76`, from peeled GNOME tag 0.0.5. Attribution notice SHA256: `2936eaab48b3b4ac2fa216a02f1bb0ccbbd8fe2227e9b930e526056f639def80`. This does not infer which GNOME source built sctk's font. Exact mapping success and changed-font-byte refusal were added to the synthetic contract. `/root/palette_finish` independently reviewed the upstream bytes/embedded records/historical notice in `harness/release-cantarell-notice-review-20260910.md`.
|
|
|
|
That review found Git newline normalization would corrupt the new upstream notice's checksum. A read-only audit of all 25 supplement references also found the existing Fira OFL and extracted Fira notice had the same problem. Added three exact `-text` attributes. An isolated alternate Git index staged and checked out every referenced notice: all **25 raw/staged/restored SHA256 hashes equal their manifest values**. The root index was untouched. Existing Fira HEAD blobs are normalized (`5e4608f24a4b050232daa61b2d0d13cfe10317b6`, `0988a708ca1ce6534e1e94628bb47b3f7466d5ba`), while the manifest-matching raw files have Git hashes `b82722716de236b6d2c771e89a1c907006a677d5`, `0ab1f7af399b149c9d273f094ac84ec640cf3c24`. **Root must stage those two exact raw files with `git add --renormalize -- scripts/windows-notices/Fira-OFL.txt scripts/windows-notices/FiraSans-Regular-NOTICE.txt`**, alongside attributes; Git's existing stat cache can otherwise make them appear unchanged. This is a byte-preservation correction, not license text rewriting.
|
|
|
|
## Verification and exact scopes
|
|
|
|
* Python synthetic suite passes **11/11** (final rerun 0.365 seconds): deterministic bytes/modes/path ordering, overwrite refusal, late stage additions, ancestor reparse refusal, local-link completeness/traversal/fenced examples, HTML attribute variants, ELF acceptance/rejection/table bounds and container notice/compiler/library/source mismatch checks.
|
|
* Existing PowerShell notice tests pass, including normal/build graph selection and prior archive/font/source/traversal/supplement refusals; added Linux server-only selection, target-specific runtime refusal and shared build-input inventory checks. All five changed/new PowerShell script parser checks passed.
|
|
* Actual independent documentation closure: Windows **63 files / 15 local links**, Linux **62 files / 13 local links**, both **49 examples** including all **37** water-pressure teaching files, **0** harness files or sources escaping the checkout. Final package-local link checks run after copying actual inputs.
|
|
* Preserved real Linux GUI package (38 files: old GUI plus its 37 teaching files) was archived without mutation or execution. Archive `.local/packaging-20260910/preserved-gui-archive-a.tar.gz`, **18,842,613 bytes**, SHA256 **`63170eea59c485430fd23f9eb19f8a161f40787f16df6c97db162354c2062187`**. Every entry was read back, content/mode/timestamp/uid/gid checked, and input stage hashes retained. Attempting to reuse that path failed; original archive hash stayed unchanged. This is an archive-helper/environment-fixture check, not a complete Linux distribution: no extracted real Linux server binary exists here outside preserved guest storage.
|
|
* Linux command with a missing ELF directory refused before creating its output directory/claim. This exercised the actual PowerShell→Python error propagation.
|
|
* Real frozen Windows source7 inputs were packaged twice in fresh ignored outputs. Final post-review package: `.local/packaging-20260910/windows-b/ArcadiaStudio-packaging-check-20260910-b-x86_64-pc-windows-gnullvm.zip`, **557 files**, SHA256 **`bc27e398d7268a4ee6e6c52ccc89f32bb0a4a970020ca198963501c49146e8c8`**. The strict current target graph contained 266 packages. It records `NativeAcceptance: Pending`; current docs/notices do not establish the old binaries' build source or compiler. The later comment-scanner-only adjustment is covered by its targeted regressions and does not transfer acceptance.
|
|
* Actual Rust 1.90.0 Linux server-only notices: `.local/packaging-20260910/linux-server-notices-a/server-notices`, **102 packages / 178 files**, inventory SHA256 **`b196d64cf79b4b5a20c2145bccca4356e7af5f744f70ebb3d45c4d43470b899a`**. Local container-verifier execution passed against the source/compiler snapshot at collection. Subsequent integrated source changes require regeneration, as designed. This checks notices without claiming a server executable or Docker build.
|
|
* **Final full Linux PowerShell adapter passed**, using two explicitly inert 1,024-byte ELF fixtures plus the actual **339-package** locked Linux dependency graph, strict Cantarell notices, documentation closure, caller-evidence validation and full tar readback. Archive `.local/packaging-20260910/linux-synthetic-b/ArcadiaStudio-synthetic-adapter-test-20260910-b-x86_64-unknown-linux-gnu.tar.gz`: **681 files / 1,575,171 bytes**, SHA256 **`b49362c15e740639e6c2890c354ab86db270ec813384db288a3d1b4a5dc8f6ca`**. Its package metadata explicitly identifies the inert fixtures, `compiler: none; constructed ELF headers only`, and `NativeAcceptance: Pending`. Package-local verification checked 13 links. This establishes the complete adapter path, not a runnable Linux desktop/server distribution. Evidence: `linux-synthetic-integration-b.log` and `linux-synthetic-summary.json`; the initial strict Cantarell refusal remains in `linux-synthetic-integration.log`.
|
|
|
|
Logs and subsequent real package results are under `.local/packaging-20260910/`. Real notice runs are serialized after the local palette build's Cargo lease; they invoke only locked offline metadata and Rust identity/sysroot queries. No application compile or Linux provisioning is performed by this work.
|
|
|
|
Retained evidence: `python-contracts.log`, `powershell-parser.log`, `notice-contracts.log`, `windows-package-b.log`, `linux-server-notices-a.log`, `linux-server-notices-verify.log`, `linux-server-notices-summary.json`, `preserved-gui-archive-a.log`, and `preserved-gui-overwrite-refusal.log`. Independent adversarial probes and actual closure manifests are under `.local/packaging-independent-review-20260910/`. Root explicitly authorized adding `__pycache__/` to `.gitignore`; generated helper bytecode is confirmed ignored.
|
|
|
|
## File handoff
|
|
|
|
Owned production changes: `.gitignore` (one bytecode-ignore line); `scripts/package-linux.ps1`, `scripts/package-common.ps1`, `scripts/package-readme.md`, `scripts/package-artifacts.py`, `scripts/test-package-artifacts.py`, `scripts/package-windows.ps1`, `scripts/windows-notices.ps1`, `scripts/test-windows-notices.ps1`; `deployment/Dockerfile`, `deployment/Dockerfile.dockerignore`; `docs/linux-packaging.md`, `docs/windows-packaging.md`. This implementation report is owned here; the separate independent review is owned by `/root/behavior_audit`. Root controls staging/commit and its README/server/guide/common-ledger edits. Final production file hashes are retained in `.local/packaging-20260910/implementation-input-hashes.json`.
|
|
|
|
Root additionally authorized the exact notice-integrity additions: `.gitattributes` (three `-text` paths), `scripts/windows-notices/manifest.json`, `GNOME-Cantarell-61362600e104-COPYING`, `Cantarell-Regular-NOTICE.txt`, and the raw-byte restoration of `Fira-OFL.txt` and `FiraSans-Regular-NOTICE.txt`. The separate Cantarell review is owned by `/root/palette_finish`. New evidence paths: `.local/packaging-20260910/cantarell-name-table.json`, `notice-git-roundtrip-preflight.json`, `notice-roundtrip.log`, `notice-roundtrip/results.json`; retained upstream download and extraction script are in the same ignored task directory.
|
|
|
|
Reproduction commands: `python scripts/test-package-artifacts.py`; `pwsh -NoProfile -File scripts/test-windows-notices.ps1`; the platform packager invocations in the owned guides, with a fresh output root and the exact prebuilt binary directory. The Windows check used preserved `dist/ArcadiaStudio-preview-source7-20260907-x86_64-pc-windows-gnullvm` binaries and `.local/toolchain/llvm-mingw-20260826-ucrt-x86_64`; it never implies a current optimized build. All real metadata queries were serialized under `CARGO_BUILD_JOBS=1`, locked/offline, with the selected installed target compiler. The only runtime provisioning was the earlier separately authorized failed WSL import, recorded in its own report.
|
|
|
|
## Open release gates
|
|
|
|
Current optimized Windows/Linux binaries and their native acceptance, a full Linux archive containing the real matching desktop/server inputs, actual container build/runtime and a usable Linux runner remain separate release gates. An old GUI helper archive or strict notice manifest is never presented as current application acceptance. Windows MSVC runtime/CRT strategy still requires an actual verified build; the import allowlist was not weakened to make an unverified recipe pass.
|