The v6.0 build-system hardening arc lands 5 of the 10 improvements
proposed in local/docs/BUILD-SYSTEM-IMPROVEMENTS.md. All scripts
have unit tests (62 -> 86, all pass in <1s) and the new 'lint-recipe'
Gitea Actions job runs on every PR.
Per-recipe audit & lint scripts (catch R1/R2 violations BEFORE cook):
* audit-patch-idempotency.py — verifies external patches in
local/patches/ still apply against the upstream pinned rev.
Caught 1 real bug on first run: libdrm/02-redox-dispatch.patch
hunk at xf86drm.c:321 no longer matches libdrm-2.4.125.
* audit-kf6-deps.py — fetches upstream, scans for
find_package(KF6Xxx REQUIRED), compares to recipe deps. Catches
missing + dead dependencies in every kf6-* and qt* recipe.
* classify-cook-failure.py — 17-rule cook-failure classifier.
10-30s diagnosis vs 5-10min manual. exit code is intentionally
inverted (0=novel failure, 1=known fix) for CI signal.
* lint-recipe.py — 7-rule recipe lint: R1-NO-PATCH-FILE,
R1-PATH-SOURCE, R2-INLINE-SED, R2-PATCHES-DIR-UNUSED,
NO-LEGACY-MAKE, R1-LEGACY-APPLY-PATCHES, DEP-NOT-FOUND.
1.1s for 171 recipes (down from 60s+ in v1 via recipe-index
precomputation). Strict mode promotes warnings to errors.
Build-system convenience:
* repair-cook.sh — incremental-build optimizer.
Equivalent to 'repo cook <pkg>' but with a fast-path that
skips configure when CMakeCache.txt is newer than source AND
external patches haven't changed. 30-60s vs 5-10min on KF6
recipes. make repair.<pkg> / make clean-repair.<pkg> targets.
* migrate-kf6-seds-to-patches.sh — migration skeleton for
converting 56 inline 'sed -i' chains across the KF6 recipes
to durable external patches in local/patches/<name>/.
Gitea Actions (host-execution, no Docker):
* .gitea/workflows/build-system.yml — 8-job pipeline:
unit-tests, lint-offline, lint-network (nightly),
lint-recipe (NEW), lint-docs, build-mini, build-full,
smoke (QEMU boot).
* .gitea/RUNNER-SETUP.md — one-time Manjaro/Arch host setup.
Build script hardening:
* build-redbear.sh — when a low-level source (relibc,
kernel, base, bootloader, installer) is newer than its pkgar,
clean build/ and sysroot/ across all recipes too. Low-level
package changes leave autotools packages (pcre2, gettext,
libiconv, ...) with stale configure/libtool scripts referencing
the old runtime, causing 'libtool version mismatch' and
'not a valid libtool object' errors. Cleaning forces
re-configuration; stage/ and source/ are preserved so the
cookbook skips unchanged packages that don't use autotools.
* Makefile — wire lint-cook-failure,
lint-cook-failure-explain, lint-recipe, lint-recipe.%,
lint-recipe.strict, lint-recipe.%.strict, repair.%,
clean-repair.%, test-lint-scripts[-quiet]. Replace the
legacy 'validate-patches' target with a deprecation notice
pointing at validate-sources.
Documentation:
* BUILD-SYSTEM-IMPROVEMENTS.md — mark #2 and #5 DONE; full
implementation notes; updated Make-targets table.
* BUILD-SYSTEM-V6-HARDENING-POSTMORTEM.md (NEW) — 226-line durable
record of the 8-session arc: 32 findings categorized, 5 P0
audit-script bugs fixed, 6 over-broad multi-pattern rules
discovered + fixed, test coverage 86/86 in <1s, 7/10
improvements DONE.
* SCRIPT-BEHAVIOR-MATRIX.md — apply-patches.sh row marked
LEGACY/ARCHIVED; build-redbear.sh row no longer claims to
call it.
* boot-logs/README.md (NEW) — frozen-evidence policy:
'do not edit' rule for REDBEAR-FULL-BOOT-*-RESULTS.md files.
* libdrm/02-redox-dispatch.patch.README (NEW) — 8-step regen
procedure for the broken hunk.
Cleanup:
* local/cache/README.md deleted (1-line placeholder).
* legacy 'make validate-patches' target removed.
Per build-system improvement #5: lint-recipe.py's first run on
the live tree surfaced 1 broken-patch reference (redbear-sessiond),
1 dangling cookbook_apply_patches call (tc), 19 sed -i calls in
sddm (warning — cookbook_apply_patches present, drop-x11.py
migration in progress), 4 sed -i calls in qt6-wayland-smoke
(uncovers the same bug class the libwayland fix prevented).
Captures the QEMU boot of the redbear-full target after the
VIRTIO_BLK_F_RO read-only fix landed in local/sources/base (commit
cffacf591 virtio-blkd: handle read-only drives gracefully). The
boot now proceeds past the previously-fatal virtio-blkd
assert_eq!(*status, 0) abort and continues through the rest of
the desktop init path, validating the fix end-to-end on the
desktop target.
The pre-fix pair is committed in the previous commit; keeping
pre/post pairs adjacent in main-repo history makes the regression
test reproducible from git alone without having to look up
when each log was captured.
Captured log: 16 893 bytes, 204 lines, same scope as the
pre-fix capture (q35 + OVMF, KVM, virtio-blk readonly ISO).
Marked-up analysis: REDBEAR-FULL-BOOT-POST-VIRTIO-BLKD-FIX-RESULTS.md
documents which init stages now reach the login prompt, which
drivers register, and what the next blocking stage is.
Captures the 300s extended QEMU boot of the redbear-full target
that exposed the virtio-blkd read-only assert. Boot progressed
through:
* PCI enumeration, pcid-spawner bring-up
* nvmed multi-queue registration
* virtio-blkd bring-up (READONLY boot ISO attached)
* ahcid probe
then panicked inside virtio-blkd during a write to the boot
drive. The ISO is attached with readonly=on (per the launcher
contract to protect the build artifact), and the driver received
VIRTIO_BLK_S_IOERR (status = 1) on what it expected to be a
writable block device; the assert_eq!(*status, 0) on line 70 of
drivers/storage/virtio-blkd/src/scheme.rs aborted the daemon.
The kernel caught the user-space invalid-opcode fault from the
aborted daemon and reported UNHANDLED EXCEPTION, CPU #0, PID 19
on the virtio-blkd scheme. Captured log is 16 893 bytes / 204
lines; the marked-up analysis (REDBEAR-FULL-BOOT-EXTENDED-RESULTS.md)
identifies the root cause and the missing VIRTIO_BLK_F_RO feature
negotiation that the follow-up commit in local/sources/base adds.
These two files are the only stable record of the pre-fix
behaviour; without them the regression test for the read-only
fix has no baseline. Both files are markdown + plain serial
console capture (no binary artifacts) and are safe to commit.
The post-fix pair (REDBEAR-FULL-BOOT-POST-VIRTIO-BLKD-FIX-RESULTS.md
+ redbear-full-boot-post-virtio-blkd-fix-20260609-181340.log)
are intentionally split into a separate commit so the pre- and
post-fix captures stay paired to their corresponding source
changes.
Add the QEMU boot test results captured on 2026-06-09 from
test-redbear-full-qemu.sh. Two terminal captures (75 s and a longer
~2-min run) accompany the analysis document. The captures and the
analysis document the boot chain for the redbear-full target on
QEMU virtio-gpu, including the relationship to the redbear-mini
reference log.
kellito
vasilito