The repo_builder binary had a guard at line 79-81:
if std::env::var("COOKBOOK_CROSS_TARGET").is_ok_and(|x| !x.is_empty()) {
return Ok(());
}
This silently returned early when COOKBOOK_CROSS_TARGET was set —
which is ALWAYS the case during a Red Bear build (we cross-compile
for x86_64-unknown-redox from the host).
Net effect: pkgar files were NEVER published to repo/<target>/ during
the canonical build path, leaving the binary store effectively empty
across builds. With no cache, every recipe was forced to re-cook on
every build, even when its source and inputs had not changed.
Removed the guard so repo_builder always publishes. The per-target
subdirectory layout (repo/<target>/<pkg>.pkgar) is correct because
repo_builder uses redoxer::target() which resolves to the TARGET env
var, matching the lookup path used by cook_build.rs::restore_from_repo().
Patches moved to legacy-superseded-2026-07-12/ because:
kernel/P4-s3-suspend-resume.patch
ALREADY APPLIED in kernel commit 51fdae08. This patch only added
Cargo.toml's acpi_ext dep, which is now in the fork.
kernel/redbear-consolidated.patch
APPLIED via 51fdae08. The cargo dep, build.rs, Makefile, and new
src/asm/x86_64/s3_wakeup.asm + src/arch/x86_shared/sleep.rs files
all made it in. Patch is now redundant.
userutils/P5-redbear-branding.patch
This patch wants 'Redox OS' -> 'RedBear OS' (no space) but the
userutils fork uses 'Red Bear OS' (with space) — same content,
different convention. The fork IS branded; this patch is a no-op.
relibc/P3-dns-resolver-hardening.patch
Source file structure has changed too far for patch(1) to apply.
Fork rebase (upgrade-forks.sh relibc) needed. Marked Phase 2.4 work.
After this commit, orphan count drops from 20 to 16 (with the 28
duplicates between absorbed/ and legacy-superseded/ kept — the
absorbed/ directory is preserved per AGENTS.md 'NEVER DELETE' rule).
Implements 7 of 8 improvements from local/docs/BUILD-SYSTEM-IMPROVEMENT-PROPOSAL.md:
Improvement 1+5: trap-based stash-and-restore for ALL 9 fork sources
- Replaces single-relibc stash with a loop over the canonical fork
inventory (relibc, kernel, base, bootloader, installer, redoxfs,
libredox, syscall, userutils)
- Records each stash SHA in a label-keyed map for safe round-tripping
- Pop stashes in LIFO order matching user-visible stash pop convention
- Idempotent: re-entry during the same build does not double-stash
- Reports (does not silently swallow) real git errors during stash push
- Restored on EXIT regardless of success/failure/signal
Improvement 3: cookbook binary freshness check
- Replaces existence-only check with BLAKE3-of-src/.rs fingerprint
- Hash written to target/release/.cookbook-src-fingerprint
- Rebuild triggers on any source file content change, not just mtime
- Survives git operations that change content without touching mtime
Improvement 4: strict-by-default uncommitted-edit gate
- Refuses to build with uncommitted edits in any fork source
- Catches the 'works on my machine' bug class where pkgar fingerprints
silently mismatch the committed HEAD
- Escape hatch: REDBEAR_ALLOW_DIRTY=1 for emergency CI use
- apply-durable-source-edits.py auto-enables strict mode when
REDBEAR_BUILD_PHASE is set (set by build-redbear.sh)
Improvement 6: failure-cleanup trap with diagnostics
- EXIT trap captures last 30 lines of each cookbook log
- Lists orphaned cook/cargo processes (often root cause of follow-on
build failures via held locks)
- Reports per-recipe build state (complete vs incomplete)
- Preserves diagnostics in REDBEAR_BUILD_STATE_DIR (mktemp -d)
- REDBEAR_KEEP_BUILD_STATE=1 retains the state dir after exit
Improvement 7: pre-cook offline/upstream consistency
- Pre-cook now follows the same offline policy as the main build phase
- REDBEAR_ALLOW_UPSTREAM=1 → offline=false
- default / REDBEAR_RELEASE → offline=true
- Pre-cook logs captured into REDBEAR_BUILD_LOGS_DIR for diagnostics
- Sets REDBEAR_BUILD_PHASE=pre-cook so downstream code can distinguish
Improvement 8: cookbook protection against out-of-band invocations
- src/bin/repo.rs emits a warning when invoked without
REDBEAR_CANONICAL_BUILD=1 in the environment
- The warning lists what is bypassed (cache invalidation, prefix
rebuild, fingerprint tracking, dirty gate)
- Non-fatal: CI scripts that manage their own checks are unaffected
Smoke-tested: ./local/scripts/build-redbear.sh redbear-mini now exits 1
when relibc/kernel have uncommitted edits, and proceeds when
REDBEAR_ALLOW_DIRTY=1 is set.
Phase 1 — Hash-based cache invalidation:
- DepHashes struct: BLAKE3 hash of each build dep stored in dep_hashes.toml
- collect_current_dep_hashes(): reads blake3 from dep .toml metadata
- dep_hashes_changed(): compares stored vs current hashes
- Replaces mtime comparison as primary cache invalidation check
- Mtime fallback preserved for backward compatibility (no dep_hashes.toml)
- --force-rebuild CLI flag bypasses cache entirely
Phase 2 — Binary store cache lookup:
- repo_builder publishes dep_hashes.toml alongside .pkgar/.toml in repo/
- When target/ is missing but repo/ has the package, restores stage
artifacts by extracting pkgar, copying toml + dep_hashes.toml
- Auto-generates auto_deps.toml from repo depends field
- Only applies to non-remote, non-force-rebuild builds
See local/docs/BUILD-CACHE-PLAN.md for full architecture.
Internal Red Bear subprojects (tlc, redbear-*, redbear-greeter, etc.) live
under local/recipes/* and have no upstream source — they are committed to
our own gitea only. If lost, they cannot be recovered from any public
source.
The previous guard used is_local_overlay() && !redbear_allow_local_unfetch()
which could be bypassed by setting REDBEAR_ALLOW_LOCAL_UNFETCH=1. This was
triggered inadvertently (exact trigger unknown) and destroyed the source
tree of local/recipes/tui/tlc/source/.
This commit makes the protection UNCONDITIONAL:
- is_local_overlay() already correctly identifies any path under
local/recipes/ as internal.
- The handle_clean unfetch path now refuses ALL local/recipes/* sources
with a clear error message. No env var can override this.
- The fetch() path's git-reset/git-clean-ffdx and source-wipe guards now
also refuse local overlays unconditionally.
- The dead redbear_allow_local_unfetch() function is removed.
- Makefile distclean-nuclear target is documented as a no-op for local/.
distclean still works for non-local recipes (upstream sources from
sources/redbear-0.1.0/ or git mirrors can be safely re-fetched).
Build system (src/cook/fetch.rs):
- Atomic patch application: applies patches to staging directory (cp -al),
atomically swaps on success, discards on failure — source tree is never
left in a partially-patched state
- normalize_patch(): strips diff --git/index/new-file-mode headers that the
build system's patch command does not recognize
- cleanup_workspace_pollution(): removes orphaned recipes/Cargo.toml and
recipes/Cargo.lock to prevent workspace conflicts
- Added --allow-protected CLI flag to repo binary
Input stack (local/patches/base/P3-*.patch):
- P3-ps2d-led-feedback: PS/2 LED state handling + InputProducer migration
- P3-inputd-keymap-bridge: InputProducer enum, keymap bridge query
- P3-usbhidd-hardening: HID descriptor validation, static lookup table,
8-button mouse support, transfer retry with exponential backoff
- P3-init-colored-output: ANSI-color coded init daemon output (green OK,
red FAILED, yellow SKIP/WARN)
XKB bridge (local/recipes/system/redbear-keymapd/source/src/xkb.rs):
- Parses X11 xkb/symbols/* format, maps XKB keycodes to PS/2 scancodes,
80+ X11 keysym names to Unicode, 4-level key support
Patch governance (local/patches/base/absorbed/README.md):
- Documents consolidation of P0-P3 patches into redox.patch
- apply-patches.sh: add signature-marker checks for build-system patches
to handle cases where reverse-check fails but patch is already applied
- test-baremetal.sh: auto-disable TUI when stdout is not a terminal;
pass CI=1 to make
- test-live-iso-qemu.sh: pass CI=1 via env to prevent repo cook panic
- scripts/run.sh: auto-disable TUI when stdout is not a terminal;
pass CI=1 to qemu launch
- repo.rs: improve TUI initialization error messages (raw mode + alternate
screen) and rustfmt cleanups
- config.rs: auto-detect TTY presence for TUI enablement; use is_terminal()
instead of relying solely on CI env var
Add is_local_overlay() path guard in repo.rs that detects recipes symlinked into local/recipes/ and refuses to delete their source/ during unfetch unless REDBEAR_ALLOW_LOCAL_UNFETCH=1 is set. Add the same guard in fetch.rs to block source-dir wipe and git reset --hard for local overlays unless REDBEAR_ALLOW_PROTECTED_FETCH=1 is set. Expand redbear_protected_recipe() from 8 core recipes to all 95+ local overlay recipe names.
Derivative of Redox OS (https://www.redox-os.org) adding:
- AMD GPU driver (amdgpu) via LinuxKPI compat layer
- ext4 filesystem support (ext4d scheme daemon)
- ACPI fixes for AMD bare metal (x2APIC, DMAR, IVRS, MCFG)
- Custom branding (hostname, os-release, boot identity)
Build system is full upstream Redox with RBOS overlay in local/.
Patches for kernel, base, and relibc are symlinked from local/patches/
and protected from make clean/distclean. Custom recipes live in
local/recipes/ with symlinks into the recipes/ search path.
Build: make all CONFIG_NAME=redbear-full
Sync: ./local/scripts/sync-upstream.sh
vasilito