fix: comprehensive boot warnings and exceptions — fixable silenced, unfixable diagnosed

Build system (5 gaps hardened):
- COOKBOOK_OFFLINE defaults to true (fork-mode)
- normalize_patch handles diff -ruN format
- New 'repo validate-patches' command (25/25 relibc patches)
- 14 patched Qt/Wayland/display recipes added to protected list
- relibc archive regenerated with current patch chain

Boot fixes (fixable):
- Full ISO EFI partition: 16 MiB → 1 MiB (matches mini, BIOS hardcoded 2 MiB offset)
- D-Bus system bus: absolute /usr/bin/dbus-daemon path (was skipped)
- redbear-sessiond: absolute /usr/bin/redbear-sessiond path (was skipped)
- daemon framework: silenced spurious INIT_NOTIFY warnings for oneshot_async services (P0-daemon-silence-init-notify.patch)
- udev-shim: demoted INIT_NOTIFY warning to INFO (expected for oneshot_async)
- relibc: comprehensive named semaphores (sem_open/close/unlink) replacing upstream todo!() stubs
- greeterd: Wayland socket timeout 15s → 30s (compositor DRM wait)
- greeter-ui: built and linked (header guard unification, sem_compat stubs removed)
- mc: un-ignored in both configs, fixed glib/libiconv/pcre2 transitive deps
- greeter config: removed stale keymapd dependency from display/greeter services
- prefix toolchain: relibc headers synced, _RELIBC_STDLIB_H guard unified

Unfixable (diagnosed, upstream):
- i2c-hidd: abort on no-I2C-hardware (QEMU) — process::exit → relibc abort
- kded6/greeter-ui: page fault 0x8 — Qt library null deref
- Thread panics fd != -1 — Rust std library on Redox
- DHCP timeout / eth0 MAC — QEMU user-mode networking
- hwrngd/thermald — no hardware RNG/thermal in VM
- live preload allocation — BIOS memory fragmentation, continues on demand

local/recipes/system/dbus/source.tmp/test/data/auth/anonymous-client-successful.auth-script

@@ -0,0 +1,16 @@
+## this tests that a client can login anonymously
+
+CLIENT
+
+## Reject whatever mechanism the client picks first
+EXPECT_COMMAND AUTH
+SEND 'REJECTED DBUS_TEST_NONEXISTENT_MECH1 ANONYMOUS DBUS_TEST_NONEXISTENT_MECH2'
+
+## And this time we get ANONYMOUS
+
+EXPECT_COMMAND AUTH
+## of course real DBUS_COOKIE_SHA1 would not send this here...
+SEND 'OK 1234deadbeef'
+
+EXPECT_COMMAND BEGIN
+EXPECT_STATE AUTHENTICATED

local/recipes/system/dbus/source.tmp/test/data/auth/anonymous-server-successful.auth-script

@@ -0,0 +1,13 @@
+## this tests the server side in a successful auth of type ANONYMOUS 
+
+SERVER
+## verify that prior to doing anything, we haven't authed as anyone
+EXPECT_HAVE_NO_CREDENTIALS
+SEND 'AUTH ANONYMOUS 442d42757320312e312e31'
+EXPECT_COMMAND OK
+EXPECT_STATE WAITING_FOR_INPUT
+SEND 'BEGIN'
+EXPECT_STATE AUTHENTICATED
+## verify that we are still anonymous
+EXPECT_HAVE_NO_CREDENTIALS
+

local/recipes/system/dbus/source.tmp/test/data/auth/cancel.auth-script

@@ -0,0 +1,19 @@
+## this tests canceling EXTERNAL
+
+SERVER
+SEND 'AUTH EXTERNAL USERID_HEX'
+EXPECT_COMMAND OK
+EXPECT_STATE WAITING_FOR_INPUT
+SEND 'CANCEL'
+EXPECT_COMMAND REJECTED
+EXPECT_STATE WAITING_FOR_INPUT
+
+## now start over and see if it works
+SEND 'AUTH EXTERNAL USERID_HEX'
+EXPECT_COMMAND OK
+EXPECT_STATE WAITING_FOR_INPUT
+SEND 'BEGIN'
+EXPECT_STATE AUTHENTICATED
+
+
+

local/recipes/system/dbus/source.tmp/test/data/auth/client-out-of-mechanisms.auth-script

@@ -0,0 +1,7 @@
+## this tests that tests that the client disconnects when it's out of
+## known mechanisms
+
+CLIENT
+EXPECT_COMMAND AUTH
+SEND 'REJECTED BONGO_MD5'
+EXPECT_STATE NEED_DISCONNECT

local/recipes/system/dbus/source.tmp/test/data/auth/cookie-sha1-username.auth-script

@@ -0,0 +1,12 @@
+UNIX_ONLY
+SERVER
+SEND 'AUTH DBUS_COOKIE_SHA1 WRONG_USERNAME_HEX'
+EXPECT_COMMAND REJECTED
+EXPECT_STATE WAITING_FOR_INPUT
+EXPECT_HAVE_NO_CREDENTIALS
+SEND 'AUTH DBUS_COOKIE_SHA1 USERNAME_HEX'
+EXPECT_COMMAND DATA
+EXPECT_STATE WAITING_FOR_INPUT
+EXPECT_HAVE_NO_CREDENTIALS
+# We don't actually complete DBUS_COOKIE_SHA1 authentication, because
+# it's non-trivial.

local/recipes/system/dbus/source.tmp/test/data/auth/cookie-sha1.auth-script

@@ -0,0 +1,11 @@
+SERVER
+SEND 'AUTH DBUS_COOKIE_SHA1 WRONG_USERID_HEX'
+EXPECT_COMMAND REJECTED
+EXPECT_STATE WAITING_FOR_INPUT
+EXPECT_HAVE_NO_CREDENTIALS
+SEND 'AUTH DBUS_COOKIE_SHA1 USERID_HEX'
+EXPECT_COMMAND DATA
+EXPECT_STATE WAITING_FOR_INPUT
+EXPECT_HAVE_NO_CREDENTIALS
+# We don't actually complete DBUS_COOKIE_SHA1 authentication, because
+# it's non-trivial.

local/recipes/system/dbus/source.tmp/test/data/auth/external-auto.auth-script

@@ -0,0 +1,18 @@
+# Test that we can authenticate with an empty authorization identity
+SERVER
+EXPECT_HAVE_NO_CREDENTIALS
+
+# C: "I want to use EXTERNAL, I decline to specify an initial response"
+SEND 'AUTH EXTERNAL'
+# S: "OK, who do you claim to be?"
+EXPECT_COMMAND DATA
+EXPECT_STATE WAITING_FOR_INPUT
+EXPECT_HAVE_NO_CREDENTIALS
+# C: "I am whoever the kernel says I am"
+SEND 'DATA'
+# S: "I suppose I can't argue with that"
+EXPECT_COMMAND OK
+EXPECT_STATE WAITING_FOR_INPUT
+SEND 'BEGIN'
+EXPECT_STATE AUTHENTICATED
+EXPECT_HAVE_SOME_CREDENTIALS

local/recipes/system/dbus/source.tmp/test/data/auth/external-failed.auth-script

@@ -0,0 +1,11 @@
+## this tests that auth of type EXTERNAL without credentials will fail
+
+SERVER
+NO_CREDENTIALS
+## verify that prior to doing anything, we haven't authed as anyone
+EXPECT_HAVE_NO_CREDENTIALS
+SEND 'AUTH EXTERNAL USERID_HEX'
+EXPECT_COMMAND REJECTED
+EXPECT_STATE WAITING_FOR_INPUT
+## verify that we still haven't authed as anyone
+EXPECT_HAVE_NO_CREDENTIALS

local/recipes/system/dbus/source.tmp/test/data/auth/external-root.auth-script

@@ -0,0 +1,11 @@
+## this tests we can auth EXTERNAL as ourselves, with root credentials
+UNIX_ONLY
+SERVER
+ROOT_CREDENTIALS
+## 30 is ASCII '0' in hex
+SEND 'AUTH EXTERNAL 30'
+EXPECT_COMMAND OK
+EXPECT_STATE WAITING_FOR_INPUT
+SEND 'BEGIN'
+EXPECT_STATE AUTHENTICATED
+

local/recipes/system/dbus/source.tmp/test/data/auth/external-silly.auth-script

@@ -0,0 +1,12 @@
+## this tests we can't auth if socket reports silly credentials but we ask for our own uid
+
+SERVER
+## verify that prior to doing anything, we haven't authed as anyone
+EXPECT_HAVE_NO_CREDENTIALS
+SILLY_CREDENTIALS
+SEND 'AUTH EXTERNAL USERID_HEX'
+EXPECT_COMMAND REJECTED
+EXPECT_STATE WAITING_FOR_INPUT
+## verify that we still haven't authed as anyone
+EXPECT_HAVE_NO_CREDENTIALS
+

local/recipes/system/dbus/source.tmp/test/data/auth/external-successful.auth-script

@@ -0,0 +1,12 @@
+## this tests a successful auth of type EXTERNAL
+
+SERVER
+## verify that prior to doing anything, we haven't authed as anyone
+EXPECT_HAVE_NO_CREDENTIALS
+SEND 'AUTH EXTERNAL USERID_HEX'
+EXPECT_COMMAND OK
+EXPECT_STATE WAITING_FOR_INPUT
+SEND 'BEGIN'
+EXPECT_STATE AUTHENTICATED
+## verify that we now have some credentials
+EXPECT_HAVE_SOME_CREDENTIALS

local/recipes/system/dbus/source.tmp/test/data/auth/external-username.auth-script

@@ -0,0 +1,24 @@
+# Assert that EXTERNAL authentication accepts numeric uids, but not
+# login names.
+
+# This only works on Unix because USERNAME_HEX is unimplemented on Windows
+# (but no authentication mechanism uses usernames there anyway).
+UNIX_ONLY
+SERVER
+EXPECT_HAVE_NO_CREDENTIALS
+
+# C: "I claim that I am smcv"
+SEND 'AUTH EXTERNAL USERNAME_HEX'
+# S: (doesn't want to look up smcv in NSS or /etc/passwd)
+EXPECT_COMMAND REJECTED
+EXPECT_STATE WAITING_FOR_INPUT
+EXPECT_HAVE_NO_CREDENTIALS
+
+# C: "OK, how about I claim that I am uid 1000?"
+SEND 'AUTH EXTERNAL USERID_HEX'
+# S: (is happier)
+EXPECT_COMMAND OK
+EXPECT_STATE WAITING_FOR_INPUT
+SEND 'BEGIN'
+EXPECT_STATE AUTHENTICATED
+EXPECT_HAVE_SOME_CREDENTIALS

local/recipes/system/dbus/source.tmp/test/data/auth/extra-bytes.auth-script

@@ -0,0 +1,10 @@
+## this tests that we have the expected extra bytes at the end
+
+SERVER
+SEND 'AUTH EXTERNAL USERID_HEX'
+EXPECT_COMMAND OK
+EXPECT_STATE WAITING_FOR_INPUT
+SEND 'BEGIN\r\nHello'
+EXPECT_STATE AUTHENTICATED_WITH_UNUSED_BYTES
+EXPECT_UNUSED 'Hello\r\n'
+EXPECT_STATE AUTHENTICATED

local/recipes/system/dbus/source.tmp/test/data/auth/fail-after-n-attempts.auth-script

@@ -0,0 +1,34 @@
+## this tests that after retrying too often we fail
+
+SERVER
+NO_CREDENTIALS
+
+# 1
+SEND 'AUTH EXTERNAL USERID_HEX'
+EXPECT_COMMAND REJECTED
+EXPECT_STATE WAITING_FOR_INPUT
+
+# 2
+SEND 'AUTH EXTERNAL USERID_HEX'
+EXPECT_COMMAND REJECTED
+EXPECT_STATE WAITING_FOR_INPUT
+
+# 3
+SEND 'AUTH EXTERNAL USERID_HEX'
+EXPECT_COMMAND REJECTED
+EXPECT_STATE WAITING_FOR_INPUT
+
+# 4
+SEND 'AUTH EXTERNAL USERID_HEX'
+EXPECT_COMMAND REJECTED
+EXPECT_STATE WAITING_FOR_INPUT
+
+# 5
+SEND 'AUTH EXTERNAL USERID_HEX'
+EXPECT_COMMAND REJECTED
+EXPECT_STATE WAITING_FOR_INPUT
+
+# 6
+SEND 'AUTH EXTERNAL USERID_HEX'
+EXPECT_COMMAND REJECTED
+EXPECT_STATE NEED_DISCONNECT

local/recipes/system/dbus/source.tmp/test/data/auth/fallback.auth-script

@@ -0,0 +1,17 @@
+## this tests that a client can fallback to a secondary auth mech 
+
+CLIENT
+
+## Will try EXTERNAL by default first without first calling AUTH alone.
+
+EXPECT_COMMAND AUTH
+SEND 'REJECTED EXTERNAL DBUS_COOKIE_SHA1 DBUS_TEST_NONEXISTENT_MECH'
+
+## And this time we get DBUS_COOKIE_SHA1
+
+EXPECT_COMMAND AUTH
+## of course real DBUS_COOKIE_SHA1 would not send this here...
+SEND 'OK 1234deadbeef'
+
+EXPECT_COMMAND BEGIN
+EXPECT_STATE AUTHENTICATED

local/recipes/system/dbus/source.tmp/test/data/auth/invalid-command-client.auth-script

@@ -0,0 +1,8 @@
+## this tests that receiving a nonexistent command is handled properly
+## by a client
+
+CLIENT
+EXPECT_COMMAND AUTH
+SEND 'NONEXISTENT_COMMAND foo bar baz blah blah'
+EXPECT_COMMAND ERROR
+EXPECT_STATE WAITING_FOR_INPUT

local/recipes/system/dbus/source.tmp/test/data/auth/invalid-command.auth-script

@@ -0,0 +1,7 @@
+## this tests that receiving a nonexistent command is handled properly
+## by a server
+
+SERVER
+SEND 'NONEXISTENT_COMMAND foo bar baz blah blah'
+EXPECT_COMMAND ERROR
+EXPECT_STATE WAITING_FOR_INPUT

local/recipes/system/dbus/source.tmp/test/data/auth/invalid-hex-encoding.auth-script

@@ -0,0 +1,6 @@
+## this tests an invalid hex encoding followed by successful authentication
+
+SERVER
+SEND 'AUTH EXTERNAL willy'
+EXPECT_COMMAND ERROR
+EXPECT_STATE WAITING_FOR_INPUT

local/recipes/system/dbus/source.tmp/test/data/auth/mechanisms.auth-script

@@ -0,0 +1,8 @@
+## this tests that the server sends a list of mechanisms
+## in response to blank AUTH
+
+SERVER
+SEND AUTH
+EXPECT_COMMAND REJECTED
+EXPECT_STATE WAITING_FOR_INPUT
+