Skip to content

fix: constrain haskell-language-server library bundling#294

Closed
edge-delta[bot] wants to merge 20 commits into
unstablefrom
fix/hls-shared-lib-bundling
Closed

fix: constrain haskell-language-server library bundling#294
edge-delta[bot] wants to merge 20 commits into
unstablefrom
fix/hls-shared-lib-bundling

Conversation

@edge-delta

@edge-delta edge-delta Bot commented Jun 25, 2026

Copy link
Copy Markdown

Summary

This PR addresses a critical package bundling issue in the haskell-language-server package build script (packages/haskell-language-server/build.sh).

The build script previously used ldd to extract and copy all shared library dependencies of haskell-language-server into $OUTPUT_DIR/usr/lib/. While this was intended to bundle Haskell shared libraries, it indiscriminately copied core system libraries (like libc.so, libpthread.so, libdl.so, and the dynamic loader /lib64/ld-linux-x86-64.so.2). Bundling glibc libraries leads to severe dynamic linker conflicts and segmentation faults at runtime on host systems.

This fix constrains copying to Haskell-specific dynamic libraries (matching prefix libHS*), ensuring standard glibc/system libraries are not bundled and instead resolved correctly via standard runtime dependencies (e.g., glibc).

Related issues

Resolves risk identified in commit 9759eb40dab20721da79436324e10064b013ea6e (where the indiscriminate bundling was introduced).

Changes

  • Updated packages/haskell-language-server/build.sh to extract the basename of each shared library and check if it starts with libHS before copying it.

Checklist

  • I've read CONTRIBUTING.md.
  • I've accepted the ICLA (and CCLA if contributing on my employer's time). CLA Assistant will prompt me on this PR if I haven't already.
  • min check passes for the affected packages/harnesses.
  • min patched-build <name> succeeds for any package I added or modified.

Notes for reviewers

The dynamic library names for Haskell standard libraries and compiler-generated package dependencies strictly follow the libHS<name>-<version>-ghc<ghc_version>.so naming convention. This pattern-matching is extremely precise, low-risk, and preserves all Haskell-specific libraries while ignoring system libraries like libc, libm, libpthread, librt, libdl, libffi, and libgmp which should be resolved from the runtime environment.


This pull/merge request was created by Edge Delta AI Teammates — see #code-issues for the original conversation.

0chroma and others added 20 commits June 1, 2026 17:05
Add package for the Haskell Language Server (HLS), the official LSP
implementation for Haskell. Builds from source using GHC + Cabal with
dynamic linking, copying the binary and all required shared libraries
via ldd dependency resolution.

- Source: GitHub tag 2.14.0.0 with automatic extraction
- Build deps: base, cabal, ghc
- Runtime deps: glibc
- Network access enabled for cabal dependency index updates
- Includes standalone version check test
A non-blocking pull_request check that, for each changed packages/*/build.ncl,
resolves the upstream release date (attrs.released_at override -> GitHub
releases/tags -> ftp.gnu.org Last-Modified -> unknown), computes age, and posts
a job-summary table flagging anything younger than a 7-day reference (the #20
minimum-soak criterion).

Report-only and additive: contents:read, no secrets, never fails the job, and
MUST be kept off branch-protection required checks. Its high-value output is the
live census of which packages have no derivable date and need attrs.released_at.

The attrs.released_at schema (minimal) + example + minimum_version bump are a
deliberate, deferred follow-up gated on sizing the backfill (see #20); the
script already handles released_at's absence gracefully, so this lands standalone.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The ~82 no-source_provenance packages (toolchains, X11 libs, pinned binaries)
still have an http(s) source tarball -- so generalize the GNU-specific
Last-Modified HEAD to any source URL ("date on the file"). New tier 4 (after
GitHub/GNU, before UNKNOWN), and a fall-through fallback for GitHub/GNU packages
whose tag/tarball didn't resolve. (Repology was evaluated and dropped -- its API
exposes versions but no release dates.)

Last-Modified is availability/upload time, not strictly upstream release; close
enough for a soak gate, and dwell (git time) backstops it. http(s) only; the URL
is taken whole from the spec (no SSRF-via-version), with a code comment flagging
the fork-PR HEAD surface for the reviewer.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Running the resolver over the full catalog (373 pkgs) surfaced two real
bugs that would have errored or under-resolved the live check:

1. github_date crashed on tags-only repos: `git/refs/tags/{t}` (plural)
   returns a LIST of prefix-matching refs, and the code called `.get` on
   it -> AttributeError. Switch to singular `git/ref/tags/{t}` (one
   object) and guard against a list anyway, accepting only an exact match.

2. source_url read the wrong key: source deps carry their fetch spec
   under `from` ({type, url, sha256}), not a flat `url`, so the new
   source-URL tier matched nothing. Read `from.url` (tolerate flat shape).

Census effect: dated 229 -> 263 / 373 (the source-URL fix reclaimed 34
http(s)-sourced packages); 0 runtime errors across the catalog.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Probed all 20 dateless-but-has-provenance packages against their real
upstream (GitHub/GitLab tags APIs, GNU ftp listings) and taught the
resolver the formats found, instead of guessing:

- candidate_tags: keep the historical 8 forms (no regression) + add
  repo-derived families (bun-v{v}, varlock@{v}, lib-stripped fuse-/
  xkbcommon-) and a per-repo override map for bespoke schemes
  (R_2_7_5, REL_18_4, core-8-6-16, V_10_3_P1, llvmorg-, version-,
  rust-v, gopls/v, cabal-install-v, lcms).
- gnu_date: try flat + nested per-version dir (gcc lives in
  /gnu/gcc/gcc-X/) + aliased project dir (libidn2 under /gnu/libidn/).
- new self-dated tier: versions carrying a trailing YYYYMMDD (ncurses
  weekly snapshots, other Dickey projects) self-date with no network.

Census effect (full catalog, live): dated 263 -> 279 / 373; the 20
fixable resolver-misses drop to 3 (libsvtav1=GitLab, ngspice=SourceForge,
linux_headers=stable-tree-in-gregkh/linux) which need new host tiers.

Hardening (from an adversarial review the census motivated):
- _curl_head_date shared helper: https-only with --proto/--proto-redir
  =https + bounded redirects (close the fork-PR SSRF/downgrade surface),
  and validate the FINAL hop is 2xx so an error page's stale
  Last-Modified can't yield a bogus "release date" (this removed
  libx265's 403-page date). Naive datetimes treated as UTC.
- gnu_date now follows redirects (was curl -sI, missed 302s).
- source_ext reads nested from.url (same bug class as the prior two)
  and strips ?query before the ext match; add zst.
- gh_json: add a 30s timeout (was unbounded).
- md_cell: escape |/newlines/backticks in the summary table + unknown
  list (untrusted build.ncl -> GITHUB_STEP_SUMMARY injection).
- by_name skips non-string names (unhashable -> crash guard).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
#249 passed `-D cf_time`, but perl's Configure recomputes cf_time from `date`
UNCONDITIONALLY, so the override never stuck — the build wall-clock and the
sandbox's per-build `minimal-<pid>` hostname still leaked into Config_heavy.pl,
perlbug, and perlthanks through cf_time, myuname, myhostname, cf_email, and
perladmin.

Pin them all via config.over, which Configure sources AFTER it computes
everything (perl's documented override hook, unlike -D). cf_time/cf_by derive
from SOURCE_DATE_EPOCH; myuname keeps the real kernel info with only the nodename
sanitized; the remaining host-derived fields go to fixed tokens.

Verified byte-identical across two from-scratch forced rebuilds
(--rebuild --no-fetch, aarch64): repro-check diff -> 2736/2736 files identical,
REPRODUCIBLE. (Before: DIFFERS on the 3 Config files.) Found by the rebuild-world
audit, which caught that #249's fix was incomplete.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…tropy)

The rebuild-world audit caught that #254's recipe (codegen-units=1 +
CONST_RANDOM_SEED) left `nu` non-reproducible. Root-caused in three layers:

1. ThinLTO (Cargo.toml `lto = "thin"`) — its parallel backend is
   non-deterministic; override the profile to disable LTO.
2. Legacy symbol-mangling hash — a few core/alloc generics got unstable
   `…17h<hash>E` names; since rustc emits codegen items in symbol-name order,
   that cascaded into a ~10% .text/.rela.dyn reorder. Fix: -C symbol-mangling-version=v0.
3. Proc-macro HashMap (the last 0.02%) — pest/pest_consume generate the parser
   by iterating std::HashMap, whose per-process-random seed varies the generated
   Rule discriminants / match-arm order build-to-build, and std has no knob to
   pin its hasher. Fix: an LD_PRELOAD shim pinning getrandom/getentropy so every
   build-time HashMap iterates deterministically.

Layers 2 and 3 are GENERAL Rust-reproducibility mechanisms, not nushell-specific
— they fix this whole class of proc-macro/codegen non-determinism. Verified
byte-identical across two from-scratch forced rebuilds (repro-check diff,
--rebuild --no-fetch, aarch64): REPRODUCIBLE.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.


Edge Delta AI Teammates seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

@github-actions github-actions Bot force-pushed the unstable branch 9 times, most recently from e907de0 to 23bf910 Compare June 25, 2026 13:39
@bryan-minimal

Copy link
Copy Markdown
Member

Thanks so much for this, and for digging into our packaging — you're right that our haskell-language-server build.sh bundles host glibc/system libraries via ldd, which is a genuine hermeticity/portability bug. 🙏

We're closing this in favour of small, focused internal fixes: we've distilled it, along with your other PRs, into #353, which tracks the underlying findings as actionable items. This PR bundled a number of unrelated package changes and overlapped with others, and we keep changes small and focused per CONTRIBUTING — but the insight is captured and we'll land the fix on our side.

Genuinely grateful for the contribution — please don't let this discourage smaller, focused follow-ups. 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants