- check-fork-drift.sh: compares each submodule HEAD against upstream/master,
reports behind/ahead counts, exits 1 if any fork exceeds threshold
- upgrade-forks.sh: fetches latest upstream, saves RB commits, resets to
upstream, cherry-picks RB patches with conflict handling and backups
- build-preflight.sh: wired drift check into preflight (threshold=50,
suppressible via REDBEAR_SKIP_DRIFT_CHECK=1)
- bootloader submodule pointer updated to latest upstream rebase
Bootloader fork rebase:
- Base changed from 0.1.0 pre-patched archive to upstream 1.0.0 tag (c7eeb9f)
- Applied 0001-redbear-local-forks.patch (Cargo.toml crate path redirects)
- Applied fix-uefi-alloc-panic.patch equivalents (4 panic!() -> graceful
error handling in src/main.rs)
- Applied P5-live-preload-cap-1gib.patch (1 GiB cap on live image preload)
- Skipped: P0 GPT partition scan (requires new module + integration),
P1 timeout/default-resolution, P2 live preload guard (subsumed by
panic fixes + cap), P3 live image safe read, P4 large ISO boot,
redox.patch — to be applied in dedicated rebase session.
firmware-loader/Cargo.toml: version 0.1.0 -> 0.3.0 (sync with other
Red Bear custom crates which are at 0.3.0).
fork-upstream-map.toml: bootloader back from PENDING_REBASE to 1.0.0
since the partial rebase matches upstream 1.0.0 content.
fork-upstream-map.toml: base restored to 'main' tracked (was correctly
tracked by build-redbear.sh).
Live upstream versions verified 2026-07-11:
- gnu-grep 3.12 (2025-04-10) -- https://ftp.gnu.org/gnu/grep/
- libsodium 1.0.22-stable (2026-07-08) -- https://download.libsodium.org/libsodium/releases/
- autoconf 2.73 (2026-03-20) -- https://ftp.gnu.org/gnu/autoconf/
Each recipe updated with new tar URL + BLAKE3 hash. Build-tool upgrades are
isolated from the fork content-verification system, so these are SAFE to
upgrade without the relibc-style risk.
diffutils was already at 3.12 (previously committed).
Also: fork-upstream-map.toml — bootloader flagged PENDING_REBASE
(2026-07-11 detection: 1.0.0 tag mismatch, fork based on 0.1.0 archive
not a true rebase — documented inline).
Context: A relibc fork check via cargo compare exposed that the fork
labeled 0.6.0 (matching a 2020-12-23 upstream tag) was on a
completely different codebase from upstream master. The fork was
imported as a snapshot. The verify-fork-versions.sh tool allowed
this because 'snapshot' mode skipped byte-for-byte content comparison.
Changes:
1. Remove 'snapshot = skip content check' behavior. All Cat 2 forks must
pass actual content comparison against their claimed upstream tag.
2. Add base to local/fork-upstream-map.toml so it's checked too (was missing).
Effect: Future 'fake version label' divergences (Cargo.toml says
version X but source content does not match upstream X) will be
caught by the preflight check instead of slipping through build.
Cherry-picked from Qt upstream (commit e488f852fa18c2afc2842a88eff8f66ad4105a45).
Original patch source:
https://download.qt.io/official_releases/qt/6.11/CVE-2026-6210-qtsvg-6.11.diff
Fix: Test types of nodes before downcasting them. A bad cast in
QSvgMarker::drawHelper led to endless recursion resulting in a heap
overflow. While fixing that, another similar case was also fixed.
The diffutils recipe only ran cookbook_configure but never actually
compiled or installed anything, leaving stage.tmp empty (4K). This
caused redbear-mini to fail with a 4.0K INCOMPLETE stage and no
diff/diff3 binaries in the final image.
Add the missing make and make install steps, matching the pattern
used by other autotools recipes (bison, findutils, etc.).
Implements Improvement 2 from local/docs/BUILD-SYSTEM-IMPROVEMENT-PROPOSAL.md.
Replaces the mtime-only source invalidation with a BLAKE3 content hash
of every file in the source tree (plus recipe.toml and patches). The hash
catches content modifications that preserve mtime (git checkout, git
bisect, cp -a, rsync -a) and silently leave the cache stale.
Design choices:
- Hash written to target/<arch>/source_hash.txt after each successful
build, atomically (tmp + rename) to survive concurrent builds.
- Two-tier check: mtime fast-path (skip hash compute when mtime says
'changed'); hash verification (when mtime says 'unchanged', still
compute hash to catch mtime-preserving edits). The hash compute cost
is one pass over the source tree per build — acceptable for the
correctness gain.
- Symlinks are NOT followed in collect_files_recursive (avoids cycles
and surprises across the sysroot).
- Unreadable files are hashed as <unreadable> sentinel so a permission
fix later changes the hash and triggers a rebuild (correct
behavior).
- Patch filenames are hashed alongside contents so reordering or
renaming patches invalidates the cache (order matters for atomic apply).
- Devices, sockets, .git/, target/, *.swp, *.tmp are excluded.
Smoke-tested: hash is deterministic and different source dirs produce
different hashes. Cookbook compiles cleanly. Integration with the
existing source_changed decision is via OR (mtime OR hash triggers
rebuild).
Implements 7 of 8 improvements from local/docs/BUILD-SYSTEM-IMPROVEMENT-PROPOSAL.md:
Improvement 1+5: trap-based stash-and-restore for ALL 9 fork sources
- Replaces single-relibc stash with a loop over the canonical fork
inventory (relibc, kernel, base, bootloader, installer, redoxfs,
libredox, syscall, userutils)
- Records each stash SHA in a label-keyed map for safe round-tripping
- Pop stashes in LIFO order matching user-visible stash pop convention
- Idempotent: re-entry during the same build does not double-stash
- Reports (does not silently swallow) real git errors during stash push
- Restored on EXIT regardless of success/failure/signal
Improvement 3: cookbook binary freshness check
- Replaces existence-only check with BLAKE3-of-src/.rs fingerprint
- Hash written to target/release/.cookbook-src-fingerprint
- Rebuild triggers on any source file content change, not just mtime
- Survives git operations that change content without touching mtime
Improvement 4: strict-by-default uncommitted-edit gate
- Refuses to build with uncommitted edits in any fork source
- Catches the 'works on my machine' bug class where pkgar fingerprints
silently mismatch the committed HEAD
- Escape hatch: REDBEAR_ALLOW_DIRTY=1 for emergency CI use
- apply-durable-source-edits.py auto-enables strict mode when
REDBEAR_BUILD_PHASE is set (set by build-redbear.sh)
Improvement 6: failure-cleanup trap with diagnostics
- EXIT trap captures last 30 lines of each cookbook log
- Lists orphaned cook/cargo processes (often root cause of follow-on
build failures via held locks)
- Reports per-recipe build state (complete vs incomplete)
- Preserves diagnostics in REDBEAR_BUILD_STATE_DIR (mktemp -d)
- REDBEAR_KEEP_BUILD_STATE=1 retains the state dir after exit
Improvement 7: pre-cook offline/upstream consistency
- Pre-cook now follows the same offline policy as the main build phase
- REDBEAR_ALLOW_UPSTREAM=1 → offline=false
- default / REDBEAR_RELEASE → offline=true
- Pre-cook logs captured into REDBEAR_BUILD_LOGS_DIR for diagnostics
- Sets REDBEAR_BUILD_PHASE=pre-cook so downstream code can distinguish
Improvement 8: cookbook protection against out-of-band invocations
- src/bin/repo.rs emits a warning when invoked without
REDBEAR_CANONICAL_BUILD=1 in the environment
- The warning lists what is bypassed (cache invalidation, prefix
rebuild, fingerprint tracking, dirty gate)
- Non-fatal: CI scripts that manage their own checks are unaffected
Smoke-tested: ./local/scripts/build-redbear.sh redbear-mini now exits 1
when relibc/kernel have uncommitted edits, and proceeds when
REDBEAR_ALLOW_DIRTY=1 is set.
Documents 8 concrete improvements to build-redbear.sh and the cookbook
tool, derived from the redbear-mini boot crash debug session:
1. Trap-based stash-and-restore for ALL fork sources (eliminates the
'where did my edits go?' pain)
2. Source content-hashing to replace mtime-only cache invalidation
3. Cookbook binary freshness check (currently existence-only)
4. Strict-by-default uncommitted-edit gate
5. Stash-all-forks consistency
6. Failure-cleanup trap with diagnostics
7. Pre-cook offline/upstream consistency
8. Cookbook protection against out-of-band invocations
Each improvement has a file:line location, implementation sketch,
and impact/complexity rating. Implementation order suggested.
Problem motivation: the user has repeatedly hit silent stash-loss,
stale cookbook binaries, and mtime-based cache staleness while
debugging kernel/relibc/base forks. The build pipeline should
make these mistakes impossible, not require users to remember
workarounds.
- Implement krealloc in linux-kpi memory.rs with GFP-aware tracker lookup,
copying, and zeroing of grown regions; add krealloc declaration to slab.h
- Align __GFP_ZERO/__GFP_NOWARN and GFP_* values between linux-kpi/slab.h
and redox_glue.h; make __GFP_ZERO a meaningful flag bit
- Add missing POSIX/errno base constants (EFBIG, EISDIR, ESPIPE, etc.) to
linux-kpi linux/errno.h so firmware-size checks and other drivers compile
- Harden linux-kpi bug.h: BUG()/BUG_ON() abort, WARN_ON_ONCE only warns once,
BUILD_BUG_ON uses _Static_assert
- Harden redox_glue.h: add PCI_COMMAND_* flags, CONFIG_HZ/HZ, jiffies
conversion macros, once-only WARN_ON_ONCE, _Static_assert BUILD_BUG_ON
- Implement redox_pci_enable_device/redox_pci_set_master with real local state
and command-bit updates; document pcid-spawner pre-enable
- Remove realloc-only krealloc from redox_stubs.c; it now links from linux-kpi
- Fix wait_for_completion_timeout to interpret timeout as jiffies and convert
to milliseconds, and update msecs/usecs_to_jiffies to use HZ
- Stage previously completed firmware-loader path deps and constructor fix
- Stage base and relibc submodule pointer updates from prior work
The tracked source tree was stuck at KF6 6.10.0 with QML/Quick/kcmshell
stripped out and kcmoduleloader/kcmultidialog gutted by sed/python hacks.
Replace the local source with the upstream 6.27.0 tarball content, keeping
only the .clang-format and docs/ extras. This restores:
- add_subdirectory(qml) / (quick) / (kcmshell)
- kcmoduleqml.cpp/h, KF6KCMUtilsQuick, Qt6::Qml/Quick/QuickWidgets links
- kcmoduleloader.cpp and kcmultidialog.cpp QML code paths
- ECMQmlModule and KF6KIO find_package in top-level CMakeLists.txt
- Qt6Qml find_dependency in KF6KCMUtilsConfig.cmake.in
Shrink the recipe build script to use cookbook_apply_patches of the
external 01-initial-migration.patch and remove all sed/python hacks.
Shrink the migration patch to only disable ki18n_install(po) (translations
remain deferred until lupdate/lrelease is built for target).
Replace version-string deps on redox_syscall, redox-scheme, and
libredox with path dependencies pointing to local/sources/ forks.
This aligns with local/AGENTS.md local-fork-dependency rule and
eliminates the crates.io vs local fork ambiguity that causes
mismatched-type link errors.
Pushes latest Red Bear commits on each submodule branch:
- base: acpid EC, inputd, block driver, ipcd UDS, loopback, ptyd, ramfs, randd
- kernel: SYS_MKNS/SYS_SETNS namespace syscalls, offset normalization fixes
- relibc: byteswap.h, sys/statfs, ioccom.h, MAP*/MSG*/TIOCM/CRTSCTS, statfs/cbindgen cleanup
- syscall: SYS_SETNS syscall number
These commits were already on local submodule working trees; this
updates the parent repo pointers to match.
relibc now provides the real <byteswap.h> header and Linux mmap
extension flags (MAP_LOCKED, MAP_HUGETLB, etc.) in <sys/mman.h>.
Drop the redox_compat/ shim files from the WirePlumber patch, update
README-redbear.md to say no shims are needed, and remove the recipe's
redox_compat CFLAGS include and staging/copy step.
relibc now provides the real <byteswap.h> header and Linux mmap
extension flags (MAP_LOCKED, MAP_HUGETLB, etc.) in <sys/mman.h>.
Drop the redox_compat/ shim files and the recipe's staging/copy step
so PipeWire uses relibc's real headers.
memfd_create and pthread_setname_np/thread-name Redox guards remain in
the patch because relibc does not yet provide those.
Documents the project-wide rule that Red Bear OS local forks are the
complete, authoritative source of truth for every component they cover.
Key points:
- A fork that delegates to upstream/crates.io is not a fork — it's a wrapper.
- Missing fork functionality is implemented in the fork, not papered over.
- Path deps + [patch.crates-io] everywhere; no version strings for forks.
- Adapt to upstream at the same pace — never pin back.
Adds a cross-reference from local/AGENTS.md DESIGN PRINCIPLE section.
Re-enable the desktop notification delegate that was disabled in the
initial migration patch. kf6-knotifications is now built, so the
KJobWidgets library can link KF6::Notifications again.
- Remove duplicated Qt6GuiPrivate find_package lines from CMakeLists.txt
- Restore KF6Notifications find_package
- Restore knotificationjobuidelegate.cpp/h in src/CMakeLists.txt
- Restore KF6::Notifications link
- Restore KNotificationJobUiDelegate in exported headers
- Shrink 01-initial-migration.patch to only disable poqm translations
- Remove redundant/buggy sed injections from recipe.toml
The recipe.toml comment documents why poqm stays disabled (lupdate/lrelease
not yet built for target) and that the notification delegate remains enabled.
vmalloc now allocates with PROT_NONE guard pages on each side,
matching Linux kernel vmalloc behavior. Buffers overflow into a
guard page and segfault instead of silently corrupting adjacent
heap allocations.
Replaces posix_memalign fallback with proper physically-contiguous
allocation via scheme:memory/scheme-root + zeroed@wb?phys_contiguous.
Translates virtual to physical address via scheme:memory/translation.
Falls back to heap allocation if scheme:memory is unavailable.
Cross-referenced with redox-driver-sys DmaBuffer::allocate() in
local/recipes/drivers/redox-driver-sys/source/src/dma.rs.
Workqueue (redox_stubs.c + redox_glue.h):
- schedule_work: queues work for async execution by background worker thread
- schedule_delayed_work: spawns timer thread, delays before queueing
- cancel_work_sync: removes pending or waits for executing work
- cancel_delayed_work_sync: cancels timer then cancels work
- flush_workqueue/flush_scheduled_work: waits for queue to drain
Completion timeout:
- wait_for_completion_timeout uses pthread_cond_timedwait with deadline
instead of ignoring timeout and blocking indefinitely
DMA mapping:
- dma_map_page returns page address+offset instead of bogus 0
Kconfig:
- IS_ENABLED/IS_REACHABLE return actual config value instead of always 0
Cross-referenced with Linux 7.1 kernel/workqueue.c and
include/uapi/linux/kernel.h.
Replaced 42 fragile per-recipe sed hacks (commenting out
ecm_install_po_files_as_qm and ki18n_install(po) in CMakeLists.txt)
with a single clean cmake flag: -DKF_SKIP_PO_PROCESSING=ON.
Both ECMPoQmTools.cmake and KF6I18nMacros.cmake.in natively check
KF_SKIP_PO_PROCESSING and return early before reaching
find_package(Qt6 COMPONENTS LinguistTools CONFIG REQUIRED).
This eliminates the need for Qt6LinguistTools (lupdate/lrelease)
at build time. When qttools is eventually built and Qt6LinguistTools
becomes available, simply remove the flag to re-enable translations.
These were set to "ignore" to prevent cascade rebuilds during
development, not because they fail to build. Per project policy,
packages must not be ignored without explicit user request.
Updates relibc submodule pointer to include:
- sys/ioccom.h, byteswap.h, sys/statfs.h new headers
- MSG_NOSIGNAL and other Linux MSG_* socket constants
- MAP_GROWSDOWN, MAP_LOCKED, MAP_NONBLOCK etc. mman constants
- ELFMAG/SELFMAG defines in generated elf.h
Gnulib generates lib/sched.h which wraps the system sched.h via
#include_next, but the #if @HAVE_SCHED_H@ guard evaluates to 0 during
cross-compilation, preventing sched_param typedef from being visible.
Adding ac_cv_header_sched_h=yes fixes the guard.
fstools.mk: Use canonical local/sources/ paths for installer and redoxfs
cargo install --path. The recipes/ symlink chain caused cargo to resolve
path dependencies (../libredox, ../redoxfs, ../syscall) relative to the
recipe directory instead of the canonical source location, breaking
the host build.
bison: Add cross-compilation cache variables for POSIX spawn support.
Gnulib's configure couldn't detect the system spawn.h during cross-compile,
causing generated lib/spawn.h to omit #include_next, leaving
POSIX_SPAWN_* constants undefined.
Replace ad-hoc struct literals scattered across the source with
named constructor methods (CacheMetadata::placeholder, CacheMetadata::from_source,
FirmwareFallback::load_defaults, FirmwareFallback::load_from_dir,
FirmwareFallback::builtins). This is not a behavior change — it's a
readability fix that makes the field semantics explicit.
Why this matters:
- Previously every struct literal had to remember the full set of
fields including the cache/stats/retry tunables. Adding a new field
required finding every literal in the source tree.
- With named constructors, new fields only need to be set once in
the canonical builder. Test/placeholder sites stay minimal.
- Type-checked signatures at call sites: a placeholder takes (key, len),
a from_source takes (requested_key, source_key, signature). The
compiler now verifies you pass a SourceSignature when you need one.
Cross-referenced with Linux drivers/base/firmware_loader.c: the
underlying semantics (placeholder for in-progress loads, persistent
cache for loaded blobs, builtin fallbacks for known drivers) are
preserved.
vasilito