From 82a2f11d7a2a54c96320ea76fb2a65f176414f53 Mon Sep 17 00:00:00 2001 From: sami Date: Thu, 10 Sep 2026 14:58:10 +0400 Subject: [PATCH] pkg: make bootstrap --check validate apt names, and run it on 26.04 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --check verified outcomes — binaries on PATH, pkg-config modules — on a box that already installed everything. It never looked at the APT_* names, which is the only part that breaks on a clean machine of the wrong release, as R1 just showed. Add a loop over the assembled PKGS array that fails on any name with no installable candidate (apt-cache policy; no root, no network). All-missing is treated as stale lists (warn), not 36 bad names. The bootstrap-script job runs on a 24.04 runner, where the bad name still resolves, so name validation there checks the wrong archive. Add bootstrap-script-2604: a real --with-clang install in an ubuntu:26.04 container — the release the project ships on, and the first time the fuzz-toolchain half of bootstrap is exercised anywhere (CORE had been running clang++-21 directly). Also pass --with-clang/--packaging to the 24.04 --check so the optional and M6 names can't rot unnoticed. BRANCH_PROTECTION.md gains the 2604 row and the stale "when X merges" rows are corrected to "now". gui/docs/pkg-qa-requests-m1.md R2 + the --with-clang note. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_0143aKiohmDiyefJBwHDJJqw --- .github/BRANCH_PROTECTION.md | 9 +++++---- .github/workflows/ci.yml | 30 ++++++++++++++++++++++++++++-- tools/bootstrap.sh | 30 ++++++++++++++++++++++++++++++ 3 files changed, 63 insertions(+), 6 deletions(-) diff --git a/.github/BRANCH_PROTECTION.md b/.github/BRANCH_PROTECTION.md index 705c011..77891ae 100644 --- a/.github/BRANCH_PROTECTION.md +++ b/.github/BRANCH_PROTECTION.md @@ -14,11 +14,12 @@ policy so it can be re-applied or audited. |---|---| | `clang-format` | now | | `testserver` | now | - | `bootstrap-script` | now | - | `build (gcc)` / `build (clang)` | when the first C++ lane merges | - | `sanitizers (dev)` / `sanitizers (tsan)` | when the first C++ lane merges | + | `bootstrap-script` | now (validates package names against the 24.04 runner archive) | + | `bootstrap-script-2604` | now — real `--with-clang` install in a 26.04 container; the release the project ships on | + | `build (gcc)` / `build (clang)` | now — core, daemon and gui have merged | + | `sanitizers (dev)` / `sanitizers (tsan)` | now — core, daemon and gui have merged | | `conformance` | **now — `tests/conformance/` has landed; this is the M0 exit gate** | - | `extension-lint` | when `extension/` lands | + | `extension-lint` | now — `extension/` has merged (MV3 manifest + esbuild build) | `clang-tidy` is intentionally **not** required through M1 (`continue-on-error: true`, `.clang-tidy` has `WarningsAsErrors: ''`). Make it required at M2. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8479275..6451a3d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,12 +41,38 @@ jobs: run: python3 tools/testserver/selftest.py bootstrap-script: - # Keeps tools/bootstrap.sh honest: it must run clean and its --check must pass. + # Keeps tools/bootstrap.sh honest on the runner image: it must run clean and its + # --check must pass. ubuntu-latest is 24.04; the project ships on 26.04, so this + # exercises the 24.04 archive only. bootstrap-script-2604 below is what validates + # the package names against the release the project actually targets. runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: sudo ./tools/bootstrap.sh --with-clang - - run: ./tools/bootstrap.sh --check + - run: ./tools/bootstrap.sh --check --with-clang + # Cheap: apt-cache only. Validates the M6 packaging names now so they can't rot + # unnoticed until M6. + - run: ./tools/bootstrap.sh --check --with-clang --packaging + + bootstrap-script-2604: + # The project targets 26.04 and GitHub has no 26.04 runner image yet, so the one + # automated place bootstrap.sh runs is on the wrong release to catch a name that is + # valid on 24.04 and gone on 26.04 — which is exactly how libqt6svg6-dev reached a + # contributor's VM (gui/docs/pkg-qa-requests-m1.md R1/R2). Run the real install in a + # 26.04 container, with --with-clang: the fuzz toolchain had never been exercised + # anywhere (CORE ran clang++-21 directly because it can't sudo). + runs-on: ubuntu-latest + container: ubuntu:26.04 + steps: + - name: Base tools for checkout + run: | + apt-get update -qq + apt-get install -y --no-install-recommends ca-certificates git sudo + - uses: actions/checkout@v4 + - name: Full bootstrap on 26.04 (--with-clang) + run: ./tools/bootstrap.sh --with-clang + - name: Re-verify + run: ./tools/bootstrap.sh --check --with-clang extension-lint: runs-on: ubuntu-latest diff --git a/tools/bootstrap.sh b/tools/bootstrap.sh index 45d6e7d..49fc17d 100755 --- a/tools/bootstrap.sh +++ b/tools/bootstrap.sh @@ -146,6 +146,36 @@ need_cmd() { fi } +# Every apt name this script would install must resolve to an installable candidate on +# THIS release. The checks below verify outcomes — binaries on $PATH, pkg-config modules — +# on a box that already installed everything; none of them look at the APT_* names, which +# is the one part of the script that breaks on a clean machine of the wrong release +# (libqt6svg6-dev did exactly this on 26.04). See gui/docs/pkg-qa-requests-m1.md R2. +# `apt-cache policy` needs no root and no network; it reads the lists apt already has. +log "validating apt package names (${#PKGS[@]})" +missing_pkgs=() +for pkg in "${PKGS[@]}"; do + # `apt-cache policy` exits 0 whether or not the name resolves; a name with no + # installable version prints "Candidate: (none)". Grep the line, don't trust $?. + cand="$(apt-cache policy "$pkg" 2>/dev/null | sed -n 's/^ Candidate: //p')" + if [[ -z "$cand" || "$cand" == "(none)" ]]; then + missing_pkgs+=("$pkg") + fi +done +if (( ${#missing_pkgs[@]} == 0 )); then + printf ' \033[32m✓\033[0m %-16s all %d resolve on %s\n' \ + "apt names" "${#PKGS[@]}" "${VERSION_ID:-this release}" +elif (( ${#missing_pkgs[@]} == ${#PKGS[@]} )); then + warn "no apt candidate for ANY of the ${#PKGS[@]} packages — the apt lists are almost" + warn "certainly stale, not the package set. Run 'apt-get update' and re-run --check." +else + for pkg in "${missing_pkgs[@]}"; do + printf ' \033[31m✗\033[0m %-16s no installable candidate on %s\n' \ + "$pkg" "${VERSION_ID:-this release}" + done + fail=1 +fi + need_cmd git git --version need_cmd cmake cmake --version need_cmd ninja ninja --version