Package hardening: findings distilled from Edge Delta's PRs (HLS bundling, version-age, reproducibility, edgedelta)

[bryan-minimal]

Context

Edge Delta opened a batch of packaging PRs (#294, #296, #300, #303, #304, #305, #306) — thank you! 🙏 They contained some genuinely valuable diagnoses, but each bundled a number of unrelated package changes and several overlapped, so rather than merge them we've distilled the underlying findings here and will land focused fixes on our side. Closing the PRs with a pointer to this issue.

This is a checklist of the real, actionable findings.

1. haskell-language-server bundles host glibc / system libraries

Problem: packages/haskell-language-server/build.sh copies every ldd-discovered shared library into $OUTPUT_DIR/usr/lib/, which indiscriminately captures core system libraries — libc.so, libpthread.so, libdl.so, libgcc_s.so, libstdc++, and the dynamic loader ld-linux-x86-64.so.2. Bundling host glibc/loader leads to dynamic-linker conflicts, ABI mismatches, and segfaults when the package runs on a host with a different glibc — a real hermeticity/portability bug.

Fix: constrain the copy loop to package-internal libraries only — exclude standard system paths (/lib*, /usr/lib*) and/or match Haskell libs (libHS*); let glibc etc. resolve via the normal runtime deps.

Flagged by #294, #303, #304, #305.

• Filter ldd bundling in haskell-language-server/build.sh to exclude system/glibc libraries

2. version_age_report.py crashes on a null attrs

Problem: .github/scripts/version_age_report.py uses pkg.get("attrs", {}), which returns None (not {}) when the attrs key exists but its value is literally null — then .get(...) on None raises AttributeError. A null attrs in a catalog dump crashes the version-age check.

Fix: pkg.get("attrs") or {} (fall back to {} on a null value). Worth an eye given the in-flight attrs provenance-backfill PRs.

Flagged by #306, #304 (#304 also hardens the HTTP Last-Modified fallback).

• Null-safe attrs handling in version_age_report.py

3. HLS / stack cabal builds aren't reproducible (unpinned Hackage index)

Problem: cabal update without a pinned index-state fetches the latest Hackage index at build time, so the resolved transitive dependency tree drifts over time → non-deterministic builds / spurious breakages. Same class for stack.

Fix: pin index-state for the cabal-based packages (haskell-language-server, stack). Aligns with our hermetic-Haskell direction and the earlier Haskell fetch-retry work (pkgs#332).

Flagged by #300.

• Pin cabal index-state for haskell-language-server and stack

4. edgedelta Makeself extraction is fragile

Problem: packages/edgedelta/build.sh carves the Makeself archive payload with hand-rolled grep/head/tail byte-offset math — brittle against any upstream installer change.

Fix: use the installer's native extraction: sh "$installer" --target payload --noexec.

Flagged by #296 (Edge Delta's own product package).

• Switch edgedelta/build.sh to native --target payload --noexec extraction

---

Distilled from Edge Delta's PRs; closing those in favor of small, focused internal fixes tracked here. Thanks again to Edge Delta for the careful diagnoses.