Fix managed runtime header build - #6
Conversation
|
Warning Review limit reached
Next review available in: 25 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe profile pipeline now isolates Linux API header host tools, uses a shared pinned builder for managed-runtime components, supports multiple AArch64 compilers, canonicalizes paths, validates payload metadata and symlinks, and compares complete runtime inventories. ChangesProfile runtime hardening
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant ProfileBuilder
participant ManagedRuntimeBuilder
participant PinnedBuilder
participant ProfilePayload
participant RuntimeValidator
ProfileBuilder->>ManagedRuntimeBuilder: build runtime and helper DSOs
ManagedRuntimeBuilder->>PinnedBuilder: run patched glibc and DSO builds
PinnedBuilder-->>ManagedRuntimeBuilder: return runtime artifacts
ManagedRuntimeBuilder-->>ProfilePayload: create canonical payload
ProfilePayload->>RuntimeValidator: provide manifest and inventory
RuntimeValidator-->>ProfileBuilder: validate files, modes, hashes, and symlinks
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
ci/profile_builder_test.sh (1)
54-57: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winExercise the GCC fallback.
Line 55 only confirms that the fallback command exists in source text. It does not prove that either builder invokes GCC when
clangis unavailable. Add a test that hidesclang, exposesaarch64-linux-gnu-gcc, runs both builders, and checks that each output is an AArch64 ELF file.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci/profile_builder_test.sh` around lines 54 - 57, Extend the test around the dso_builder loop to exercise the compiler fallback: create a controlled PATH where clang is unavailable but aarch64-linux-gnu-gcc is available, run both profiles/build-proc-exe-shim.sh and profiles/build-loader-audit.sh, and verify each generated output is identified as an AArch64 ELF file. Keep the existing source-text check, and isolate temporary files and PATH changes so the test environment is restored afterward.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@ci/profile_builder_test.sh`:
- Around line 54-57: Extend the test around the dso_builder loop to exercise the
compiler fallback: create a controlled PATH where clang is unavailable but
aarch64-linux-gnu-gcc is available, run both profiles/build-proc-exe-shim.sh and
profiles/build-loader-audit.sh, and verify each generated output is identified
as an AArch64 ELF file. Keep the existing source-text check, and isolate
temporary files and PATH changes so the test environment is restored afterward.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6a446812-cf9c-40a7-973c-709a76d1ab49
📒 Files selected for processing (4)
ci/profile_builder_test.shprofiles/build-loader-audit.shprofiles/build-managed-runtime.shprofiles/build-proc-exe-shim.sh
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
profiles/prepare-profile.sh (1)
96-97: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winNormalize directory modes too.
The bulk chmod covers regular files only. Directory modes come from the prepared tree through
cp -a, and the manifest records onlyfileandsymlinkentries. A source directory with a non-standard mode (for example group- or world-writable) therefore reaches the payload, and_runtime_inventory_verifydoes not detect it. Add a directory pass to keep payload modes reproducible.♻️ Proposed directory mode normalization
+find "$PAYLOAD_DIR" -type d -exec chmod 755 {} + find "$PAYLOAD_DIR" -type f -perm /111 -exec chmod 755 {} + find "$PAYLOAD_DIR" -type f ! -perm /111 -exec chmod 644 {} +🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@profiles/prepare-profile.sh` around lines 96 - 97, Update the mode-normalization logic in profiles/prepare-profile.sh to include directories under PAYLOAD_DIR, applying the intended reproducible directory mode while preserving the existing executable/non-executable file handling. Ensure this pass runs after the cp -a preparation so inherited non-standard directory permissions are normalized.ci/profile_builder_test.sh (1)
4-4: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDerive
REPO_ROOTfrom the script location.
REPO_ROOT=$(pwd)requires the caller to start the test from the repository root. Compute the path fromBASH_SOURCEso the test works from any working directory.♻️ Proposed change
-REPO_ROOT=$(pwd) +REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)The relative greps at lines 53-74 then also need
${REPO_ROOT}/prefixes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci/profile_builder_test.sh` at line 4, Update REPO_ROOT initialization in profile_builder_test.sh to derive the repository path from the script’s BASH_SOURCE location rather than the caller’s current directory, and prefix the relative grep paths in the affected test commands with ${REPO_ROOT}/.src/runtime.sh (1)
452-461: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win
_runtime_apply_inventory_modestrusts manifest paths. The function chmods${profile_root}/${relative_path}after only-fand! -Lchecks. It runs before_runtime_inventory_verify, so a manifest path with..components would chmod a file outside the profile root if a caller skips_runtime_profile_manifest_validate._runtime_safe_relative_pathalready exists and rejects such paths.
src/runtime.sh#L452-L461: call_runtime_safe_relative_path "$relative_path"and return 1 before thechmod.glibcx#L1659-L1668: regenerate this bundled copy after thesrc/runtime.shchange.🛡️ Proposed guard
while IFS= read -r -d '' relative_path \ && IFS= read -r -d '' mode; do + if ! _runtime_safe_relative_path "$relative_path"; then + echo "[glibcx] Error: unsafe managed-profile file path '$relative_path'." >&2 + return 1 + fi if [[ ! -f "${profile_root}/${relative_path}" \ || -L "${profile_root}/${relative_path}" ]]; then🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/runtime.sh` around lines 452 - 461, Update _runtime_apply_inventory_modes in src/runtime.sh#L452-L461 to call _runtime_safe_relative_path "$relative_path" and return 1 before chmod when validation fails; then regenerate the bundled copy in glibcx#L1659-L1668 from the updated source, with no separate logic change required there.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/runtime-profile.yml:
- Around line 116-118: Update the manifest validation flow around
_runtime_profile_manifest_validate so expected_prefix comes from the build
contract path /data/data/com.termux/files/usr/opt/glibcx/runtimes/${PROFILE_ID}
or independently recorded build metadata, rather than reading .prefix from
profile.json. Preserve validation of the manifest against PROFILE_ID and the
externally established prefix.
In `@ci/profile_builder_test.sh`:
- Around line 200-206: Update the escaping fixture around build_payload to use a
three-level parent-relative symlink target so it resolves outside the payload
root and exercises containment rejection rather than the dangling-link path.
Capture the build error output instead of discarding stderr, and assert that it
contains the expected escape-rejection message while preserving the failure
expectation.
In `@src/runtime.sh`:
- Around line 431-436: Add cmp, diff, and xargs to the command preflight
validation in init_env, alongside the existing jq and flock checks, so inventory
verification cannot run with missing dependencies. Then regenerate glibcx from
src/runtime.sh; update src/runtime.sh lines 431-436 and the corresponding
generated glibcx lines 1638-1643, with no separate logic change required in the
generated copy beyond regeneration.
---
Nitpick comments:
In `@ci/profile_builder_test.sh`:
- Line 4: Update REPO_ROOT initialization in profile_builder_test.sh to derive
the repository path from the script’s BASH_SOURCE location rather than the
caller’s current directory, and prefix the relative grep paths in the affected
test commands with ${REPO_ROOT}/.
In `@profiles/prepare-profile.sh`:
- Around line 96-97: Update the mode-normalization logic in
profiles/prepare-profile.sh to include directories under PAYLOAD_DIR, applying
the intended reproducible directory mode while preserving the existing
executable/non-executable file handling. Ensure this pass runs after the cp -a
preparation so inherited non-standard directory permissions are normalized.
In `@src/runtime.sh`:
- Around line 452-461: Update _runtime_apply_inventory_modes in
src/runtime.sh#L452-L461 to call _runtime_safe_relative_path "$relative_path"
and return 1 before chmod when validation fails; then regenerate the bundled
copy in glibcx#L1659-L1668 from the updated source, with no separate logic
change required there.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6f25bc2f-9f4d-4d37-91e6-b45b7a37f6e9
📒 Files selected for processing (8)
.github/workflows/runtime-profile.ymlci/profile_builder_test.shglibcxprofiles/build-managed-runtime.shprofiles/package-release.shprofiles/patches/linux-api-headers-host-tools.patchprofiles/prepare-profile.shsrc/runtime.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- profiles/patches/linux-api-headers-host-tools.patch
| expected_prefix=$(jq -r '.prefix' "$profile_file") | ||
| _runtime_profile_manifest_validate \ | ||
| "$profile_file" "$PROFILE_ID" "$expected_prefix" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Find where the final prefix is produced and recorded during the build.
rg -n 'TERMUX_INSTALL_PREFIX|final_prefix|FINAL_PREFIX|prefix' profiles/build-managed-runtime.sh profiles/prepare-profile.sh | head -40
fd -t f 'build-metadata' | headRepository: dsecurity49/glibcx
Length of output: 2429
🏁 Script executed:
#!/bin/bash
printf '%s\n' '--- workflow ---'
sed -n '80,135p' .github/workflows/runtime-profile.yml
printf '%s\n' '--- build prefix and handoff ---'
sed -n '85,105p;195,212p' profiles/build-managed-runtime.sh
printf '%s\n' '--- prepare manifest generation ---'
sed -n '200,255p' profiles/prepare-profile.sh
printf '%s\n' '--- validator definition and call sites ---'
rg -n -C 8 '_runtime_profile_manifest_validate|expected_prefix|under_prefix' .github profilesRepository: dsecurity49/glibcx
Length of output: 7762
🏁 Script executed:
#!/bin/bash
printf '%s\n' '--- validator implementation ---'
rg -n -C 12 'runtime_profile_manifest_validate|\.prefix.*\$prefix|under_prefix' src profiles .github
printf '%s\n' '--- independent prefix definitions and workflow inputs ---'
rg -n -C 3 'PROFILE_ID|final_prefix|TERMUX_INSTALL_PREFIX|opt/glibcx/runtimes' .github profiles srcRepository: dsecurity49/glibcx
Length of output: 24018
🏁 Script executed:
#!/bin/bash
python3 - <<'PY'
from pathlib import Path
import re
workflow = Path(".github/workflows/runtime-profile.yml").read_text()
build = Path("profiles/build-managed-runtime.sh").read_text()
prepare = Path("profiles/prepare-profile.sh").read_text()
runtime = Path("src/runtime.sh").read_text()
assignment = re.search(
r'expected_prefix=\$\(jq -r \'\.prefix\' "\$profile_file"\)', workflow
)
call = re.search(
r'_runtime_profile_manifest_validate\s+\\\s*'
r'\s+"\$profile_file" "\$PROFILE_ID" "\$expected_prefix"',
workflow,
re.MULTILINE,
)
predicate = ".prefix == $prefix" in runtime
under_prefix = "startswith($prefix + \"/\")" in runtime
build_prefix = re.search(
r'final_prefix="(/data/data/com\.termux/files/usr/opt/glibcx/runtimes/\$\{PROFILE_ID\})"',
build,
)
handoff = re.search(
r'bash profiles/prepare-profile\.sh\s+\\\s*'
r'\s+"\$PROFILE_ID" "\$prepared_tree" "\$final_prefix" "\$payload_root"',
build,
re.MULTILINE,
)
manifest_source = '--arg prefix "$FINAL_PREFIX"' in prepare
print(f"workflow_reads_manifest_prefix={bool(assignment)}")
print(f"workflow_passes_manifest_prefix={bool(call)}")
print(f"validator_compares_manifest_prefix={predicate}")
print(f"validator_anchors_under_prefix_checks={under_prefix}")
print(f"build_derives_prefix_from_profile_id={bool(build_prefix)}")
print(f"build_passes_prefix_to_prepare_profile={bool(handoff)}")
print(f"prepare_profile_writes_passed_prefix={manifest_source}")
assert assignment and call and predicate and under_prefix
assert build_prefix and handoff and manifest_source
PY
printf '%s\n' '--- inventory verifier context ---'
rg -n -C 10 '_runtime_inventory_verify|profile\.json|\.path' src/runtime.sh | head -100Repository: dsecurity49/glibcx
Length of output: 5620
Validate the manifest against the build prefix.
Set expected_prefix from the build contract, /data/data/com.termux/files/usr/opt/glibcx/runtimes/${PROFILE_ID}, or from independently recorded build metadata. Do not read it from profile.json; otherwise .prefix == $prefix and all under_prefix checks remain self-referential.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/runtime-profile.yml around lines 116 - 118, Update the
manifest validation flow around _runtime_profile_manifest_validate so
expected_prefix comes from the build contract path
/data/data/com.termux/files/usr/opt/glibcx/runtimes/${PROFILE_ID} or
independently recorded build metadata, rather than reading .prefix from
profile.json. Preserve validation of the manifest against PROFILE_ID and the
externally established prefix.
| escaping_tree="${TEST_TMP_DIR}/escaping" | ||
| cp -a "$prepared_tree" "$escaping_tree" | ||
| ln -s ../../outside "${escaping_tree}/lib/nested/escape.so" | ||
| if build_payload "${TEST_TMP_DIR}/escaping-output" "$escaping_tree" 2>/dev/null; then | ||
| fail "parent-relative escaping symlink was accepted" | ||
| fi | ||
| pass "parent-relative symlink escape rejection" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
The escape fixture does not escape the payload.
The link is created at lib/nested/escape.so with target ../../outside. In the payload the link directory is <payload>/lib/nested, so the target resolves to <payload>/outside, which stays inside the payload. prepare-profile.sh rejects it at the existence check, not at the containment check, so this test duplicates the dangling-symlink case at lines 208-213 and never exercises the escape rejection. Use three levels to leave the payload root, and assert the error message.
💚 Proposed fix
escaping_tree="${TEST_TMP_DIR}/escaping"
cp -a "$prepared_tree" "$escaping_tree"
-ln -s ../../outside "${escaping_tree}/lib/nested/escape.so"
-if build_payload "${TEST_TMP_DIR}/escaping-output" "$escaping_tree" 2>/dev/null; then
+ln -s ../../../outside "${escaping_tree}/lib/nested/escape.so"
+escape_error=$(build_payload "${TEST_TMP_DIR}/escaping-output" "$escaping_tree" 2>&1) && \
fail "parent-relative escaping symlink was accepted"
-fi
+grep -Fq 'symlink escapes payload' <<<"$escape_error" \
+ || fail "escaping symlink was rejected for the wrong reason"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| escaping_tree="${TEST_TMP_DIR}/escaping" | |
| cp -a "$prepared_tree" "$escaping_tree" | |
| ln -s ../../outside "${escaping_tree}/lib/nested/escape.so" | |
| if build_payload "${TEST_TMP_DIR}/escaping-output" "$escaping_tree" 2>/dev/null; then | |
| fail "parent-relative escaping symlink was accepted" | |
| fi | |
| pass "parent-relative symlink escape rejection" | |
| escaping_tree="${TEST_TMP_DIR}/escaping" | |
| cp -a "$prepared_tree" "$escaping_tree" | |
| ln -s ../../../outside "${escaping_tree}/lib/nested/escape.so" | |
| escape_error=$(build_payload "${TEST_TMP_DIR}/escaping-output" "$escaping_tree" 2>&1) && \ | |
| fail "parent-relative escaping symlink was accepted" | |
| grep -Fq 'symlink escapes payload' <<<"$escape_error" \ | |
| || fail "escaping symlink was rejected for the wrong reason" | |
| pass "parent-relative symlink escape rejection" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci/profile_builder_test.sh` around lines 200 - 206, Update the escaping
fixture around build_payload to use a three-level parent-relative symlink target
so it resolves outside the payload root and exercises containment rejection
rather than the dangling-link path. Capture the build error output instead of
discarding stderr, and assert that it contains the expected escape-rejection
message while preserving the failure expectation.
| if ! cmp -s "$expected_records" "$actual_records"; then | ||
| echo "[glibcx] Error: managed-profile inventory is missing, unlisted, or drifted." >&2 | ||
| diff -u "$expected_records" "$actual_records" >&2 || true | ||
| rm -f "$expected_records" "$actual_records" "$actual_hashes" | ||
| return 1 | ||
| fi |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Locate required-command preflight checks and confirm cmp/diff/xargs coverage.
rg -n -C3 'command -v' src glibcx | head -80
rg -n '\b(cmp|diff|xargs)\b' src glibcx -g '!**/*.md' | head -60Repository: dsecurity49/glibcx
Length of output: 5778
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- src/runtime.sh relevant functions ---'
sed -n '360,445p' src/runtime.sh
printf '%s\n' '--- glibcx corresponding region ---'
sed -n '1580,1650p' glibcx
printf '%s\n' '--- command preflight definitions and callers ---'
rg -n -C5 '_require_command|_runtime_inventory_verify|runtime_inventory|command -v' src/runtime.sh glibcx | head -240
printf '%s\n' '--- source/bundle relationship ---'
rg -n 'runtime\.sh|generated|bundle|glibcx' README.md CONTRIBUTING.md Makefile package.json scripts .github 2>/dev/null | head -160Repository: dsecurity49/glibcx
Length of output: 25620
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- init_env and runtime command dispatch ---'
rg -n -C8 '^(init_env|runtime_|_runtime_.*verify|case .*runtime|runtime verify|runtime_verify)' src glibcx | head -320
printf '%s\n' '--- source module order ---'
sed -n '1,90p' build.sh 2>/dev/null || true
sed -n '1,90p' src/runtime.sh
printf '%s\n' '--- dependency documentation ---'
rg -n -C4 'jq|flock|find|coreutils|cmp|diff|xargs|sha256sum|Termux' README.md docs profiles ci .github src glibcx | head -260
printf '%s\n' '--- shell status probe ---'
PATH="$(mktemp -d)"
set +e
if ! cmp -s /dev/null /dev/null; then
cmp_status=$?
else
cmp_status=0
fi
diff -u /dev/null /dev/null >/dev/null 2>&1 || diff_status=$?
: "${diff_status:=0}"
printf 'cmp_status_after_not=%s diff_status=%s\n' "$cmp_status" "$diff_status"
rm -rf "$PATH"Repository: dsecurity49/glibcx
Length of output: 35530
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '--- top-level dispatch and initialization ---'
rg -n -C12 'init_env|runtime_profile_verify|runtime verify|case "\$1"|case "\${1' src/main.sh glibcx | tail -260
printf '%s\n' '--- command usage in the inventory verifier ---'
sed -n '366,445p' src/runtime.sh
printf '%s\n' '--- exact missing-command statuses ---'
old_path=$PATH
PATH=/nonexistent
set +e
cmp -s /dev/null /dev/null >/dev/null 2>&1
cmp_direct=$?
diff -u /dev/null /dev/null >/dev/null 2>&1
diff_direct=$?
command -v cmp >/dev/null 2>&1
cmp_lookup=$?
command -v diff >/dev/null 2>&1
diff_lookup=$?
printf 'cmp_direct=%s diff_direct=%s cmp_lookup=%s diff_lookup=%s\n' \
"$cmp_direct" "$diff_direct" "$cmp_lookup" "$diff_lookup"
set -e
PATH=$old_path
printf '%s\n' '--- matching conditional result ---'
PATH=/nonexistent
set +e
if ! cmp -s /dev/null /dev/null; then
printf 'cmp conditional: drift branch\n'
branch_status=$?
else
printf 'cmp conditional: equal branch\n'
branch_status=$?
fi
printf 'branch_status=%s\n' "$branch_status"
PATH=$old_pathRepository: dsecurity49/glibcx
Length of output: 4543
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- initialization call sites ---'
rg -n -C10 'init_env' src/main.sh src/common.sh glibcx
printf '%s\n' '--- runtime command call sites ---'
rg -n -C12 'runtime_profile_verify|runtime_profile_list|runtime_profile_import|runtime verify|runtime list' src/main.sh src/runtime.sh glibcx | tail -260
printf '%s\n' '--- verifier external commands ---'
python3 - <<'PY'
from pathlib import Path
text = Path("src/runtime.sh").read_text()
start = text.index("_runtime_inventory_verify()")
end = text.index("_runtime_apply_inventory_modes()", start)
commands = ["realpath", "mktemp", "jq", "sort", "find", "xargs", "sha256sum",
"readlink", "dirname", "cmp", "diff", "wc", "rm", "printf"]
for command in commands:
print(f"{command}: {'present' if command in text[start:end] else 'absent'}")
PY
printf '%s\n' '--- preflight package instructions ---'
sed -n '35,58p' src/common.sh
sed -n '203,220p' README.mdRepository: dsecurity49/glibcx
Length of output: 38497
Preflight inventory-verification commands. init_env checks only jq and flock, but this path invokes cmp, diff, and xargs. A missing cmp enters the drift branch with status 127, and a missing diff is hidden by || true. Add these commands to the preflight checks, then regenerate glibcx from src/runtime.sh.
📍 Affects 2 files
src/runtime.sh#L431-L436(this comment)glibcx#L1638-L1643
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/runtime.sh` around lines 431 - 436, Add cmp, diff, and xargs to the
command preflight validation in init_env, alongside the existing jq and flock
checks, so inventory verification cannot run with missing dependencies. Then
regenerate glibcx from src/runtime.sh; update src/runtime.sh lines 431-436 and
the corresponding generated glibcx lines 1638-1643, with no separate logic
change required in the generated copy beyond regeneration.
1 participant
The v0.3.0 runtime candidate exposed a release-build failure while compiling Linux headers at the managed prefix. The headers_install phase inherited the AArch64 target compiler and produced a host helper that the x86_64 builder could not run.\n\nThis carries a small patch against the pinned upstream recipe so both Linux-header phases use native host tools. The corresponding-source bundle includes the patched recipe and the patch itself. A regression test verifies that the patch applies to the pinned recipe shape.\n\nNo client, installer, wrapper, resolver, or runtime execution code changes.
Summary by CodeRabbit
Bug Fixes
Build Improvements