3343049

docs: Offer the system's theme beside light and dark in the theme switch

The site follows the system's color scheme until a reader picks one, but its switch only toggled between light and dark, so nothing took a reader back to the system's. It now offers all three, the system's selected until one is picked.

0.3.5

proot-next 0.3.5

Fixes

• A child process that reports its first stop before its parent's fork event
  waits for the event before it runs. Started at once, it could exec before it
  had a record of its own: the exec was planned in no view, and the event,
  arriving after, gave it the parent's record, so /proc/self/exe read as the
  parent's program. In a nested view, which every Steam container and
  proot-apps installer is, about one exec in a thousand did so. Only the
  ptrace tier was affected.
• install-steam.sh names proot-next once in its closing line.

0.3.4

proot-next 0.3.4

Steam, installed in one step

proot-next takes over from proot-bwrap, whose Python stand-in ran Steam's
containers through fakechroot and a PRoot build of its own.

• install-steam.sh installs Steam into a Debian-based amd64 image or system
  that has no user namespaces: Steam from Valve's repository with its keys
  checked against their fingerprints, the 32-bit libraries the client and
  games need, this release's binary checked against its published SHA-256 in
  /usr/local/lib/proot-next with the bwrap name beside it, and Steam's
  launcher diverted so that every way of starting Steam exports BWRAP to it.
  The bwrap name stays off PATH. Run again, it rewires an earlier install,
  proot-bwrap's included.

  curl -fsSL https://raw.githubusercontent.com/selkies-project/proot-next/main/install-steam.sh | sudo sh

• tests/steam/check.sh runs bwrap mode the way Steam does: the soldier,
  sniper and scout-on-soldier containers, OpenGL and Vulkan for both
  architectures against the host's own renderers, an X11 client, a native
  benchmark, a Windows OpenGL program through GE-Proton, and the client's
  sign-in window.

Fixes

• bwrap mode exports PWD as the directory the command starts in, and starts
  where bubblewrap does: --chdir's directory, else the caller's where the
  container has it, else $HOME, else /. It passed the caller's PWD
  through and started in / without --chdir, so GE-Proton's protonfixes,
  which finds the game's library through PWD, stopped with
  KeyError: 'PWD' under pressure-vessel before Wine started.
• A program named through a directory that does not exist fails to execute
  with ENOENT again, as under the kernel's own exec. 0.3.3's walk on pinned
  descriptors refuses such a lookup itself, and the ptrace tier skipped the
  syscall without setting its result, so the program saw ENOSYS: a shell
  said "Function not implemented" and returned 126 rather than "not found"
  and 127. Any syscall the ptrace tier refuses now fails with its own errno.

0.3.3

proot-next 0.3.3

Guest paths are walked on pinned descriptors

A guest could reach host files outside its view. Each guest path was
canonicalized by checking its components' host counterparts by name, and the
syscall was then made on the host path string built from them, which the
kernel resolved again. A guest thread that renamed an already-walked directory
away and moved a symlink to a host path into its place between the two steps
had the kernel follow that link out of the rootfs and out of every binding: an
independent reproduction read a host file outside the view in 7.8% of its
opens, and created files there.

• The rootfs and every binding are held open as O_PATH descriptors, and a
  lookup walks from them one component at a time with openat2 and
  RESOLVE_NO_SYMLINKS, so a symlink reports itself and is resolved inside
  the guest as before, and a renamed parent on the host cannot redirect the
  walk either.
• Every handler acts on the directory the walk pinned and the final name, in
  the *at form with symlinks not followed at that point; a symlink found
  there was swapped in since, so open, stat and the calls that open the
  object walk again, three times at most, then fail with ELOOP. Calls with
  no *at form act on the object's own descriptor.
• A mount point of the view is busy to unlink, rmdir and rename, as a
  mount point is.
• A missing intermediate component fails a lookup with ENOENT, as the
  kernel's own walk would.

Fixes

• The bench builds its tree under the canonical path of TMPDIR, so a
  TMPDIR reached through a symlink names the same files on every run.
• The test rootfs is checked against its digests, and the rootfs fetch
  retries the registry's errors.

f888f14

build: Version 0.3.3, with its release notes

The release run for 0.3.3 stopped at its version check, Cargo.toml still naming 0.3.2. The notes lead with the guest path walk on pinned descriptors, which closes a rename race that reached host files outside the view.

df2d085

build: Version 0.3.4, with its release notes

The release proot-bwrap's replacement installs: install-steam.sh and the Steam check, the PWD bubblewrap exports, and the exec errno 0.3.3 lost under ptrace. The bwrap page's example of a pinned release names it.

d86df77

build: Version 0.3.5, with its release notes

The tracer holds a child seen before its creator's fork event until the event registers it, which every nested view (Steam's containers among them) relies on; and the Steam installer's closing line.

d226339

docs: Show the DeepWiki badge through shields.io, beside the badges the other repositories carry

deepwiki.com/badge.svg answers the proxies GitHub and PyPI fetch README images through with a 429 and Vercel's security checkpoint page, so the badge showed as a broken image wherever the README is read. The organization's repositories now carry one row where each badge applies: CI, release, PyPI, license, docs, Discord and DeepWiki.

9e481a8

test: Check the test rootfs against its digests and the lint tools against their SHA-256

fetch-rootfs.sh takes the image's tag as it floats and extracted the
layer as it streamed in. The platform's manifest and its layer are
content-addressed, so each is now saved and checked against the digest
it is fetched by before the layer is extracted; a tag naming a single
manifest takes its layer directly, where the old path first requested
that layer as a manifest. The workflow lint checks actionlint and
shellcheck against their SHA-256. debian-trixie fetched and extracted;
a changed layer is refused with nothing extracted.

6b83133

fix(steam): Name proot-next once in the installer's closing line

proot --version names the program itself.