fix: exclude host system glibc libraries from haskell-language-server bundle by edge-delta[bot] · Pull Request #305 · gominimal/pkgs

edge-delta · 2026-06-28T11:44:09Z

Summary

During the build process of haskell-language-server, copying all dynamic library dependencies of the compiled binary via ldd blindly captures standard glibc and host system libraries (such as libc.so.6, libtinfo.so.6, and linker ld-linux-x86-64.so.2). These host system libraries are already provided by standard runtime dependencies (glibc), and bundling them in the package leads to unnecessary bloat, dynamic loader conflicts, or ABI compatibility breakages when run on target machines with a different host libc or kernel version.

This PR introduces a targeted pattern match to filter out any library dependencies originating from standard system directories (/lib*, /usr/lib*), ensuring that only the specific Haskell-built / package-internal libraries are bundled.

Related issues

Refs #214

Changes

Exclude standard system/glibc libraries from being copied into the output package directory by filtering ldd paths starting with /lib* or /usr/lib* inside packages/haskell-language-server/build.sh.

Checklist

I've read CONTRIBUTING.md.
I've accepted the ICLA.
min check passes for the affected packages/harnesses.
min patched-build <name> succeeds for any package I added or modified.
For new packages: source_provenance points to the canonical upstream and the source builds from source (not a prebuilt release binary) where the required toolchain is available.
For version bumps: I've verified the new sha256 against the upstream archive.

Notes for reviewers

The fix is minimal and has extremely low risk. It preserves dynamic library loading for compiled Haskell-specific libraries that are built within the sandbox/cabal build directories while leaving host glibc/system-provided libraries to be dynamically linked from standard locations at runtime.

This pull/merge request was created by Edge Delta AI Teammates — see #code-issues for the original conversation.

Add package for the Haskell Language Server (HLS), the official LSP implementation for Haskell. Builds from source using GHC + Cabal with dynamic linking, copying the binary and all required shared libraries via ldd dependency resolution. - Source: GitHub tag 2.14.0.0 with automatic extraction - Build deps: base, cabal, ghc - Runtime deps: glibc - Network access enabled for cabal dependency index updates - Includes standalone version check test

A non-blocking pull_request check that, for each changed packages/*/build.ncl, resolves the upstream release date (attrs.released_at override -> GitHub releases/tags -> ftp.gnu.org Last-Modified -> unknown), computes age, and posts a job-summary table flagging anything younger than a 7-day reference (the #20 minimum-soak criterion). Report-only and additive: contents:read, no secrets, never fails the job, and MUST be kept off branch-protection required checks. Its high-value output is the live census of which packages have no derivable date and need attrs.released_at. The attrs.released_at schema (minimal) + example + minimum_version bump are a deliberate, deferred follow-up gated on sizing the backfill (see #20); the script already handles released_at's absence gracefully, so this lands standalone. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The ~82 no-source_provenance packages (toolchains, X11 libs, pinned binaries) still have an http(s) source tarball -- so generalize the GNU-specific Last-Modified HEAD to any source URL ("date on the file"). New tier 4 (after GitHub/GNU, before UNKNOWN), and a fall-through fallback for GitHub/GNU packages whose tag/tarball didn't resolve. (Repology was evaluated and dropped -- its API exposes versions but no release dates.) Last-Modified is availability/upload time, not strictly upstream release; close enough for a soak gate, and dwell (git time) backstops it. http(s) only; the URL is taken whole from the spec (no SSRF-via-version), with a code comment flagging the fork-PR HEAD surface for the reviewer. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Running the resolver over the full catalog (373 pkgs) surfaced two real bugs that would have errored or under-resolved the live check: 1. github_date crashed on tags-only repos: `git/refs/tags/{t}` (plural) returns a LIST of prefix-matching refs, and the code called `.get` on it -> AttributeError. Switch to singular `git/ref/tags/{t}` (one object) and guard against a list anyway, accepting only an exact match. 2. source_url read the wrong key: source deps carry their fetch spec under `from` ({type, url, sha256}), not a flat `url`, so the new source-URL tier matched nothing. Read `from.url` (tolerate flat shape). Census effect: dated 229 -> 263 / 373 (the source-URL fix reclaimed 34 http(s)-sourced packages); 0 runtime errors across the catalog. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Probed all 20 dateless-but-has-provenance packages against their real upstream (GitHub/GitLab tags APIs, GNU ftp listings) and taught the resolver the formats found, instead of guessing: - candidate_tags: keep the historical 8 forms (no regression) + add repo-derived families (bun-v{v}, varlock@{v}, lib-stripped fuse-/ xkbcommon-) and a per-repo override map for bespoke schemes (R_2_7_5, REL_18_4, core-8-6-16, V_10_3_P1, llvmorg-, version-, rust-v, gopls/v, cabal-install-v, lcms). - gnu_date: try flat + nested per-version dir (gcc lives in /gnu/gcc/gcc-X/) + aliased project dir (libidn2 under /gnu/libidn/). - new self-dated tier: versions carrying a trailing YYYYMMDD (ncurses weekly snapshots, other Dickey projects) self-date with no network. Census effect (full catalog, live): dated 263 -> 279 / 373; the 20 fixable resolver-misses drop to 3 (libsvtav1=GitLab, ngspice=SourceForge, linux_headers=stable-tree-in-gregkh/linux) which need new host tiers. Hardening (from an adversarial review the census motivated): - _curl_head_date shared helper: https-only with --proto/--proto-redir =https + bounded redirects (close the fork-PR SSRF/downgrade surface), and validate the FINAL hop is 2xx so an error page's stale Last-Modified can't yield a bogus "release date" (this removed libx265's 403-page date). Naive datetimes treated as UTC. - gnu_date now follows redirects (was curl -sI, missed 302s). - source_ext reads nested from.url (same bug class as the prior two) and strips ?query before the ext match; add zst. - gh_json: add a 30s timeout (was unbounded). - md_cell: escape |/newlines/backticks in the summary table + unknown list (untrusted build.ncl -> GITHUB_STEP_SUMMARY injection). - by_name skips non-string names (unhashable -> crash guard). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…into unstable

… bundle

CLAassistant · 2026-06-28T11:44:17Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

Edge Delta AI Teammates seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

bryan-minimal · 2026-07-04T19:31:08Z

Thanks so much for this, and for digging into our packaging — you're right that ldd blindly captures host glibc/system libs (libc, libtinfo, ld-linux) into the HLS bundle — a real ABI/portability hazard. 🙏

We're closing this in favour of small, focused internal fixes: we've distilled it, along with your other PRs, into #353, which tracks the underlying findings as actionable items. This PR bundled a number of unrelated package changes and overlapped with others, and we keep changes small and focused per CONTRIBUTING — but the insight is captured and we'll land the fix on our side.

Genuinely grateful for the contribution — please don't let this discourage smaller, focused follow-ups. 🙏

0chroma and others added 8 commits June 1, 2026 17:05

Merge commit 'refs/pull/214/head' of https://github.com/gominimal/pkgs …

9a0f926

…into unstable

Merge commit 'refs/pull/279/head' of https://github.com/gominimal/pkgs …

29985bf

…into unstable

fix: exclude host system glibc libraries from haskell-language-server…

a6145d4

… bundle

github-actions Bot force-pushed the unstable branch 21 times, most recently from bb26344 to ae25f99 Compare June 29, 2026 15:05

github-actions Bot force-pushed the unstable branch 28 times, most recently from d598dfa to ec72bb6 Compare July 2, 2026 19:28

bryan-minimal mentioned this pull request Jul 4, 2026

Package hardening: findings distilled from Edge Delta's PRs (HLS bundling, version-age, reproducibility, edgedelta) #353

Open

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: exclude host system glibc libraries from haskell-language-server bundle#305

fix: exclude host system glibc libraries from haskell-language-server bundle#305
edge-delta[bot] wants to merge 8 commits into
unstablefrom
fix/hls-glibc-system-libs-exclude

edge-delta Bot commented Jun 28, 2026

Uh oh!

CLAassistant commented Jun 28, 2026

Uh oh!

bryan-minimal commented Jul 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

edge-delta Bot commented Jun 28, 2026

Summary

Related issues

Changes

Checklist

Notes for reviewers

Uh oh!

CLAassistant commented Jun 28, 2026

Uh oh!

bryan-minimal commented Jul 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants