iPerf3 3.21 is a bug fix release from July 2025.
rsync 3.4.4 is the latest 3.4.x maintenance release.
git 2.55.0 is the latest 2.55.x stable release, fixing 9+ years of CVEs
and bugs since the Red Bear build's 2.13.1 baseline. This is a security
critical upgrade.
All tarballs re-downloaded from upstream mirrors, BLAKE3 hashes
verified against downloaded files. Per user request: walk through ALL
recipes, not just graphics. This is the active build pipeline batch.
KF6 frameworks: 44 packages 6.27.0 → 6.28.0
- Verified live upstream at https://download.kde.org/stable/frameworks/6.28/
- All tarballs re-downloaded, BLAKE3 hashes computed
- 39 auto-updated via script, 5 hand-fixed (kded6, notifyconfig,
parts, pty, syntaxhighlighting) due to package-name variants
Local forks (CachyOS-stable):
- freetype2: 2.13.3 → 2.14.3
- libxkbcommon: 1.11.0 → 1.13.2
- glib: 2.87.0 → 2.89.1
Upstream recipes (gnome.org):
- harfbuzz: 11.0.1 → 14.2.1
- pango: 1.56.3 → 1.56.4
All tarballs re-downloaded from upstream mirrors, BLAKE3 hashes
verified against the downloaded files. Each recipe updated with
new tar URL + BLAKE3 hash.
This is the first batch of the Round-2 comprehensive upgrade.
cstdlib/fstring.h file 'tostring' recipe was already at 1.19.1
(was a 404 from cairographics.org, kept at 1.18.4). cairo recipe
was already at 1.18.4 (latest).
Build verification pending via build-redbear.sh. Per user
request, will continue to walk ALL recipes for outdated versions.
- check-fork-drift.sh: compares each submodule HEAD against upstream/master,
reports behind/ahead counts, exits 1 if any fork exceeds threshold
- upgrade-forks.sh: fetches latest upstream, saves RB commits, resets to
upstream, cherry-picks RB patches with conflict handling and backups
- build-preflight.sh: wired drift check into preflight (threshold=50,
suppressible via REDBEAR_SKIP_DRIFT_CHECK=1)
- bootloader submodule pointer updated to latest upstream rebase
Bootloader fork rebase:
- Base changed from 0.1.0 pre-patched archive to upstream 1.0.0 tag (c7eeb9f)
- Applied 0001-redbear-local-forks.patch (Cargo.toml crate path redirects)
- Applied fix-uefi-alloc-panic.patch equivalents (4 panic!() -> graceful
error handling in src/main.rs)
- Applied P5-live-preload-cap-1gib.patch (1 GiB cap on live image preload)
- Skipped: P0 GPT partition scan (requires new module + integration),
P1 timeout/default-resolution, P2 live preload guard (subsumed by
panic fixes + cap), P3 live image safe read, P4 large ISO boot,
redox.patch — to be applied in dedicated rebase session.
firmware-loader/Cargo.toml: version 0.1.0 -> 0.3.0 (sync with other
Red Bear custom crates which are at 0.3.0).
fork-upstream-map.toml: bootloader back from PENDING_REBASE to 1.0.0
since the partial rebase matches upstream 1.0.0 content.
fork-upstream-map.toml: base restored to 'main' tracked (was correctly
tracked by build-redbear.sh).
Live upstream versions verified 2026-07-11:
- gnu-grep 3.12 (2025-04-10) -- https://ftp.gnu.org/gnu/grep/
- libsodium 1.0.22-stable (2026-07-08) -- https://download.libsodium.org/libsodium/releases/
- autoconf 2.73 (2026-03-20) -- https://ftp.gnu.org/gnu/autoconf/
Each recipe updated with new tar URL + BLAKE3 hash. Build-tool upgrades are
isolated from the fork content-verification system, so these are SAFE to
upgrade without the relibc-style risk.
diffutils was already at 3.12 (previously committed).
Also: fork-upstream-map.toml — bootloader flagged PENDING_REBASE
(2026-07-11 detection: 1.0.0 tag mismatch, fork based on 0.1.0 archive
not a true rebase — documented inline).
Context: A relibc fork check via cargo compare exposed that the fork
labeled 0.6.0 (matching a 2020-12-23 upstream tag) was on a
completely different codebase from upstream master. The fork was
imported as a snapshot. The verify-fork-versions.sh tool allowed
this because 'snapshot' mode skipped byte-for-byte content comparison.
Changes:
1. Remove 'snapshot = skip content check' behavior. All Cat 2 forks must
pass actual content comparison against their claimed upstream tag.
2. Add base to local/fork-upstream-map.toml so it's checked too (was missing).
Effect: Future 'fake version label' divergences (Cargo.toml says
version X but source content does not match upstream X) will be
caught by the preflight check instead of slipping through build.
Cherry-picked from Qt upstream (commit e488f852fa18c2afc2842a88eff8f66ad4105a45).
Original patch source:
https://download.qt.io/official_releases/qt/6.11/CVE-2026-6210-qtsvg-6.11.diff
Fix: Test types of nodes before downcasting them. A bad cast in
QSvgMarker::drawHelper led to endless recursion resulting in a heap
overflow. While fixing that, another similar case was also fixed.
The diffutils recipe only ran cookbook_configure but never actually
compiled or installed anything, leaving stage.tmp empty (4K). This
caused redbear-mini to fail with a 4.0K INCOMPLETE stage and no
diff/diff3 binaries in the final image.
Add the missing make and make install steps, matching the pattern
used by other autotools recipes (bison, findutils, etc.).
Implements Improvement 2 from local/docs/BUILD-SYSTEM-IMPROVEMENT-PROPOSAL.md.
Replaces the mtime-only source invalidation with a BLAKE3 content hash
of every file in the source tree (plus recipe.toml and patches). The hash
catches content modifications that preserve mtime (git checkout, git
bisect, cp -a, rsync -a) and silently leave the cache stale.
Design choices:
- Hash written to target/<arch>/source_hash.txt after each successful
build, atomically (tmp + rename) to survive concurrent builds.
- Two-tier check: mtime fast-path (skip hash compute when mtime says
'changed'); hash verification (when mtime says 'unchanged', still
compute hash to catch mtime-preserving edits). The hash compute cost
is one pass over the source tree per build — acceptable for the
correctness gain.
- Symlinks are NOT followed in collect_files_recursive (avoids cycles
and surprises across the sysroot).
- Unreadable files are hashed as <unreadable> sentinel so a permission
fix later changes the hash and triggers a rebuild (correct
behavior).
- Patch filenames are hashed alongside contents so reordering or
renaming patches invalidates the cache (order matters for atomic apply).
- Devices, sockets, .git/, target/, *.swp, *.tmp are excluded.
Smoke-tested: hash is deterministic and different source dirs produce
different hashes. Cookbook compiles cleanly. Integration with the
existing source_changed decision is via OR (mtime OR hash triggers
rebuild).
Implements 7 of 8 improvements from local/docs/BUILD-SYSTEM-IMPROVEMENT-PROPOSAL.md:
Improvement 1+5: trap-based stash-and-restore for ALL 9 fork sources
- Replaces single-relibc stash with a loop over the canonical fork
inventory (relibc, kernel, base, bootloader, installer, redoxfs,
libredox, syscall, userutils)
- Records each stash SHA in a label-keyed map for safe round-tripping
- Pop stashes in LIFO order matching user-visible stash pop convention
- Idempotent: re-entry during the same build does not double-stash
- Reports (does not silently swallow) real git errors during stash push
- Restored on EXIT regardless of success/failure/signal
Improvement 3: cookbook binary freshness check
- Replaces existence-only check with BLAKE3-of-src/.rs fingerprint
- Hash written to target/release/.cookbook-src-fingerprint
- Rebuild triggers on any source file content change, not just mtime
- Survives git operations that change content without touching mtime
Improvement 4: strict-by-default uncommitted-edit gate
- Refuses to build with uncommitted edits in any fork source
- Catches the 'works on my machine' bug class where pkgar fingerprints
silently mismatch the committed HEAD
- Escape hatch: REDBEAR_ALLOW_DIRTY=1 for emergency CI use
- apply-durable-source-edits.py auto-enables strict mode when
REDBEAR_BUILD_PHASE is set (set by build-redbear.sh)
Improvement 6: failure-cleanup trap with diagnostics
- EXIT trap captures last 30 lines of each cookbook log
- Lists orphaned cook/cargo processes (often root cause of follow-on
build failures via held locks)
- Reports per-recipe build state (complete vs incomplete)
- Preserves diagnostics in REDBEAR_BUILD_STATE_DIR (mktemp -d)
- REDBEAR_KEEP_BUILD_STATE=1 retains the state dir after exit
Improvement 7: pre-cook offline/upstream consistency
- Pre-cook now follows the same offline policy as the main build phase
- REDBEAR_ALLOW_UPSTREAM=1 → offline=false
- default / REDBEAR_RELEASE → offline=true
- Pre-cook logs captured into REDBEAR_BUILD_LOGS_DIR for diagnostics
- Sets REDBEAR_BUILD_PHASE=pre-cook so downstream code can distinguish
Improvement 8: cookbook protection against out-of-band invocations
- src/bin/repo.rs emits a warning when invoked without
REDBEAR_CANONICAL_BUILD=1 in the environment
- The warning lists what is bypassed (cache invalidation, prefix
rebuild, fingerprint tracking, dirty gate)
- Non-fatal: CI scripts that manage their own checks are unaffected
Smoke-tested: ./local/scripts/build-redbear.sh redbear-mini now exits 1
when relibc/kernel have uncommitted edits, and proceeds when
REDBEAR_ALLOW_DIRTY=1 is set.
Documents 8 concrete improvements to build-redbear.sh and the cookbook
tool, derived from the redbear-mini boot crash debug session:
1. Trap-based stash-and-restore for ALL fork sources (eliminates the
'where did my edits go?' pain)
2. Source content-hashing to replace mtime-only cache invalidation
3. Cookbook binary freshness check (currently existence-only)
4. Strict-by-default uncommitted-edit gate
5. Stash-all-forks consistency
6. Failure-cleanup trap with diagnostics
7. Pre-cook offline/upstream consistency
8. Cookbook protection against out-of-band invocations
Each improvement has a file:line location, implementation sketch,
and impact/complexity rating. Implementation order suggested.
Problem motivation: the user has repeatedly hit silent stash-loss,
stale cookbook binaries, and mtime-based cache staleness while
debugging kernel/relibc/base forks. The build pipeline should
make these mistakes impossible, not require users to remember
workarounds.
- Implement krealloc in linux-kpi memory.rs with GFP-aware tracker lookup,
copying, and zeroing of grown regions; add krealloc declaration to slab.h
- Align __GFP_ZERO/__GFP_NOWARN and GFP_* values between linux-kpi/slab.h
and redox_glue.h; make __GFP_ZERO a meaningful flag bit
- Add missing POSIX/errno base constants (EFBIG, EISDIR, ESPIPE, etc.) to
linux-kpi linux/errno.h so firmware-size checks and other drivers compile
- Harden linux-kpi bug.h: BUG()/BUG_ON() abort, WARN_ON_ONCE only warns once,
BUILD_BUG_ON uses _Static_assert
- Harden redox_glue.h: add PCI_COMMAND_* flags, CONFIG_HZ/HZ, jiffies
conversion macros, once-only WARN_ON_ONCE, _Static_assert BUILD_BUG_ON
- Implement redox_pci_enable_device/redox_pci_set_master with real local state
and command-bit updates; document pcid-spawner pre-enable
- Remove realloc-only krealloc from redox_stubs.c; it now links from linux-kpi
- Fix wait_for_completion_timeout to interpret timeout as jiffies and convert
to milliseconds, and update msecs/usecs_to_jiffies to use HZ
- Stage previously completed firmware-loader path deps and constructor fix
- Stage base and relibc submodule pointer updates from prior work
The tracked source tree was stuck at KF6 6.10.0 with QML/Quick/kcmshell
stripped out and kcmoduleloader/kcmultidialog gutted by sed/python hacks.
Replace the local source with the upstream 6.27.0 tarball content, keeping
only the .clang-format and docs/ extras. This restores:
- add_subdirectory(qml) / (quick) / (kcmshell)
- kcmoduleqml.cpp/h, KF6KCMUtilsQuick, Qt6::Qml/Quick/QuickWidgets links
- kcmoduleloader.cpp and kcmultidialog.cpp QML code paths
- ECMQmlModule and KF6KIO find_package in top-level CMakeLists.txt
- Qt6Qml find_dependency in KF6KCMUtilsConfig.cmake.in
Shrink the recipe build script to use cookbook_apply_patches of the
external 01-initial-migration.patch and remove all sed/python hacks.
Shrink the migration patch to only disable ki18n_install(po) (translations
remain deferred until lupdate/lrelease is built for target).
Replace version-string deps on redox_syscall, redox-scheme, and
libredox with path dependencies pointing to local/sources/ forks.
This aligns with local/AGENTS.md local-fork-dependency rule and
eliminates the crates.io vs local fork ambiguity that causes
mismatched-type link errors.
Pushes latest Red Bear commits on each submodule branch:
- base: acpid EC, inputd, block driver, ipcd UDS, loopback, ptyd, ramfs, randd
- kernel: SYS_MKNS/SYS_SETNS namespace syscalls, offset normalization fixes
- relibc: byteswap.h, sys/statfs, ioccom.h, MAP*/MSG*/TIOCM/CRTSCTS, statfs/cbindgen cleanup
- syscall: SYS_SETNS syscall number
These commits were already on local submodule working trees; this
updates the parent repo pointers to match.
relibc now provides the real <byteswap.h> header and Linux mmap
extension flags (MAP_LOCKED, MAP_HUGETLB, etc.) in <sys/mman.h>.
Drop the redox_compat/ shim files from the WirePlumber patch, update
README-redbear.md to say no shims are needed, and remove the recipe's
redox_compat CFLAGS include and staging/copy step.
relibc now provides the real <byteswap.h> header and Linux mmap
extension flags (MAP_LOCKED, MAP_HUGETLB, etc.) in <sys/mman.h>.
Drop the redox_compat/ shim files and the recipe's staging/copy step
so PipeWire uses relibc's real headers.
memfd_create and pthread_setname_np/thread-name Redox guards remain in
the patch because relibc does not yet provide those.
Documents the project-wide rule that Red Bear OS local forks are the
complete, authoritative source of truth for every component they cover.
Key points:
- A fork that delegates to upstream/crates.io is not a fork — it's a wrapper.
- Missing fork functionality is implemented in the fork, not papered over.
- Path deps + [patch.crates-io] everywhere; no version strings for forks.
- Adapt to upstream at the same pace — never pin back.
Adds a cross-reference from local/AGENTS.md DESIGN PRINCIPLE section.
vasilito