build: ship build-system hardening arc (5 of 10 improvements)
The v6.0 build-system hardening arc lands 5 of the 10 improvements
proposed in local/docs/BUILD-SYSTEM-IMPROVEMENTS.md. All scripts
have unit tests (62 -> 86, all pass in <1s) and the new 'lint-recipe'
Gitea Actions job runs on every PR.
Per-recipe audit & lint scripts (catch R1/R2 violations BEFORE cook):
* audit-patch-idempotency.py — verifies external patches in
local/patches/ still apply against the upstream pinned rev.
Caught 1 real bug on first run: libdrm/02-redox-dispatch.patch
hunk at xf86drm.c:321 no longer matches libdrm-2.4.125.
* audit-kf6-deps.py — fetches upstream, scans for
find_package(KF6Xxx REQUIRED), compares to recipe deps. Catches
missing + dead dependencies in every kf6-* and qt* recipe.
* classify-cook-failure.py — 17-rule cook-failure classifier.
10-30s diagnosis vs 5-10min manual. exit code is intentionally
inverted (0=novel failure, 1=known fix) for CI signal.
* lint-recipe.py — 7-rule recipe lint: R1-NO-PATCH-FILE,
R1-PATH-SOURCE, R2-INLINE-SED, R2-PATCHES-DIR-UNUSED,
NO-LEGACY-MAKE, R1-LEGACY-APPLY-PATCHES, DEP-NOT-FOUND.
1.1s for 171 recipes (down from 60s+ in v1 via recipe-index
precomputation). Strict mode promotes warnings to errors.
Build-system convenience:
* repair-cook.sh — incremental-build optimizer.
Equivalent to 'repo cook <pkg>' but with a fast-path that
skips configure when CMakeCache.txt is newer than source AND
external patches haven't changed. 30-60s vs 5-10min on KF6
recipes. make repair.<pkg> / make clean-repair.<pkg> targets.
* migrate-kf6-seds-to-patches.sh — migration skeleton for
converting 56 inline 'sed -i' chains across the KF6 recipes
to durable external patches in local/patches/<name>/.
Gitea Actions (host-execution, no Docker):
* .gitea/workflows/build-system.yml — 8-job pipeline:
unit-tests, lint-offline, lint-network (nightly),
lint-recipe (NEW), lint-docs, build-mini, build-full,
smoke (QEMU boot).
* .gitea/RUNNER-SETUP.md — one-time Manjaro/Arch host setup.
Build script hardening:
* build-redbear.sh — when a low-level source (relibc,
kernel, base, bootloader, installer) is newer than its pkgar,
clean build/ and sysroot/ across all recipes too. Low-level
package changes leave autotools packages (pcre2, gettext,
libiconv, ...) with stale configure/libtool scripts referencing
the old runtime, causing 'libtool version mismatch' and
'not a valid libtool object' errors. Cleaning forces
re-configuration; stage/ and source/ are preserved so the
cookbook skips unchanged packages that don't use autotools.
* Makefile — wire lint-cook-failure,
lint-cook-failure-explain, lint-recipe, lint-recipe.%,
lint-recipe.strict, lint-recipe.%.strict, repair.%,
clean-repair.%, test-lint-scripts[-quiet]. Replace the
legacy 'validate-patches' target with a deprecation notice
pointing at validate-sources.
Documentation:
* BUILD-SYSTEM-IMPROVEMENTS.md — mark #2 and #5 DONE; full
implementation notes; updated Make-targets table.
* BUILD-SYSTEM-V6-HARDENING-POSTMORTEM.md (NEW) — 226-line durable
record of the 8-session arc: 32 findings categorized, 5 P0
audit-script bugs fixed, 6 over-broad multi-pattern rules
discovered + fixed, test coverage 86/86 in <1s, 7/10
improvements DONE.
* SCRIPT-BEHAVIOR-MATRIX.md — apply-patches.sh row marked
LEGACY/ARCHIVED; build-redbear.sh row no longer claims to
call it.
* boot-logs/README.md (NEW) — frozen-evidence policy:
'do not edit' rule for REDBEAR-FULL-BOOT-*-RESULTS.md files.
* libdrm/02-redox-dispatch.patch.README (NEW) — 8-step regen
procedure for the broken hunk.
Cleanup:
* local/cache/README.md deleted (1-line placeholder).
* legacy 'make validate-patches' target removed.
Per build-system improvement #5: lint-recipe.py's first run on
the live tree surfaced 1 broken-patch reference (redbear-sessiond),
1 dangling cookbook_apply_patches call (tc), 19 sed -i calls in
sddm (warning — cookbook_apply_patches present, drop-x11.py
migration in progress), 4 sed -i calls in qt6-wayland-smoke
(uncovers the same bug class the libwayland fix prevented).
This commit is contained in:
kellito
@@ -6,6 +6,22 @@ external projects use the cookbook's `cookbook_apply_patches` helper
|
||||
which checks `git apply --reverse --check` to skip already-applied
|
||||
patches. If a patch's reverse check fails (because the upstream
|
||||
source drifted from the patch's expected state), the helper tries to
|
||||
|
||||
JSON SCHEMA (with --json):
|
||||
Top-level:
|
||||
patches: [PatchEntry, ...] one per patch in local/patches/
|
||||
total: int len(patches)
|
||||
errors: int count of all_errors across all entries
|
||||
skipped: int count of entries that were --no-fetch
|
||||
Per-entry:
|
||||
component: str e.g. "mesa", "libdrm"
|
||||
patch: str filename, e.g. "01-foo.patch"
|
||||
status: "ok" | "fail" | "skipped"
|
||||
errors: [str, ...] empty unless status == "fail"
|
||||
Exit code: 0 if errors == 0, else 1. With --no-fetch, all entries are
|
||||
"skipped" and the exit code is still 0, so the make lint-patches
|
||||
target chains should treat skipped_count == total as a soft failure.
|
||||
|
||||
apply the patch forward, which fails too because some hunks no
|
||||
longer apply. The result is a confusing cook failure.
|
||||
|
||||
@@ -284,30 +300,68 @@ def main():
|
||||
"--no-fetch", action="store_true",
|
||||
help="Skip fetching upstream (useful when network is unavailable)",
|
||||
)
|
||||
parser.add_argument(
|
||||
"--json", action="store_true",
|
||||
help="Emit a machine-readable JSON summary on stdout "
|
||||
"(use for CI hooks or `make lint` integration).",
|
||||
)
|
||||
args = parser.parse_args()
|
||||
|
||||
patches = list(collect_patches(args.component))
|
||||
if not patches:
|
||||
print(f"No patches found{' for component ' + args.component if args.component else ''}.",
|
||||
file=sys.stderr)
|
||||
if args.json:
|
||||
import json
|
||||
print(json.dumps({"patches": [], "errors": 0, "skipped": 0}))
|
||||
else:
|
||||
print(f"No patches found{' for component ' + args.component if args.component else ''}.",
|
||||
file=sys.stderr)
|
||||
return 0
|
||||
|
||||
print(f"Auditing {len(patches)} patch(es)...")
|
||||
if not args.json:
|
||||
print(f"Auditing {len(patches)} patch(es)...")
|
||||
|
||||
all_errors = []
|
||||
skipped = 0
|
||||
json_results = []
|
||||
for component, patch_path in patches:
|
||||
if args.verbose:
|
||||
entry = {
|
||||
"component": component,
|
||||
"patch": patch_path.name,
|
||||
"status": "ok",
|
||||
"errors": [],
|
||||
}
|
||||
if args.verbose and not args.json:
|
||||
print(f"[{component}/{patch_path.name}]")
|
||||
if args.no_fetch:
|
||||
print(f" {component}/{patch_path.name}: SKIPPED (--no-fetch)")
|
||||
entry["status"] = "skipped"
|
||||
if not args.json:
|
||||
print(f" {component}/{patch_path.name}: SKIPPED (--no-fetch)")
|
||||
skipped += 1
|
||||
json_results.append(entry)
|
||||
continue
|
||||
errors = audit_one(component, patch_path, verbose=args.verbose)
|
||||
errors = audit_one(component, patch_path, verbose=args.verbose and not args.json)
|
||||
if errors:
|
||||
entry["status"] = "fail"
|
||||
entry["errors"] = list(errors)
|
||||
for e in errors:
|
||||
print(f" FAIL: {e}")
|
||||
if not args.json:
|
||||
print(f" FAIL: {e}")
|
||||
all_errors.extend(errors)
|
||||
elif args.verbose:
|
||||
elif args.verbose and not args.json:
|
||||
print(f" OK")
|
||||
json_results.append(entry)
|
||||
|
||||
if args.json:
|
||||
import json
|
||||
print(json.dumps({
|
||||
"patches": json_results,
|
||||
"total": len(patches),
|
||||
"errors": len(all_errors),
|
||||
"skipped": skipped,
|
||||
}, indent=2))
|
||||
if skipped == len(patches):
|
||||
return 2
|
||||
return 0 if not all_errors else 1
|
||||
|
||||
if all_errors:
|
||||
print()
|
||||
@@ -323,6 +377,12 @@ def main():
|
||||
print(" 3. Patch has whitespace conflicts with the upstream source.")
|
||||
print(" Try regenerating with `git diff --ignore-all-space`.")
|
||||
return 1
|
||||
if skipped == len(patches):
|
||||
print()
|
||||
print(f"All {len(patches)} patch(es) SKIPPED (--no-fetch). "
|
||||
"No audit was performed; the count of 0 errors is not a "
|
||||
"pass, just an absence of network-dependent checks.")
|
||||
return 2
|
||||
print(f"All {len(patches)} patch(es) are idempotent and reproducible.")
|
||||
return 0
|
||||
|
||||
|
||||
Reference in New Issue
Block a user