From 7892d508426d3586c8dbaf2424facd0e66610dad Mon Sep 17 00:00:00 2001 From: Sergio Date: Tue, 8 Sep 2026 19:26:12 +0000 Subject: [PATCH] =?UTF-8?q?json-glib:=20--prefer-static=20=E2=80=94=20decl?= =?UTF-8?q?araba=20static=20y=20sus=20binarios=20no=20corr=C3=ADan=20fuera?= =?UTF-8?q?=20del=20sandbox?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit '-Ddefault_library=static' gobierna cómo se construye la librería PROPIA, y eso funcionaba: el artefacto trae libjson-glib-1.0.a. Pero no dice nada de con qué se enlazan los EJECUTABLES, así que json-glib-format y json-glib-validate salían dinámicos contra libffi.so.8, libz.so.1 y libc.so — y ese libc.so es la musl de zig, 255 bytes de linker script en el host. O sea binarios que NO CORREN fuera del sandbox, en una receta que declara link=static. Mismo remedio que appstream, que ya llevaba --prefer-static. Medido antes y después: json-glib-format dinámico, 3 NEEDED → ESTÁTICO, 0 NEEDED json-glib-validate dinámico, 3 NEEDED → ESTÁTICO, 0 NEEDED libjson-glib-1.0.a igual (los consumidores no cambian de forma) Y la prueba del consumidor, que es la que vale: json-glib-format sobre un JSON real corre EN EL HOST y devuelve {"a":1}. (El ruido de libgvfsdbus.so en stderr es glib intentando dlopen módulos GIO desde un binario estático: inocuo, la salida sale bien.) Cascada reconstruida en orden de onda, con el cierre transitivo sacado de yupana y no de un grep —que no veía a zathura ni a zathura-pdf-poppler por tener el array de deps multilínea, y la regla del repo es justamente ésa—: zathura, incoming-cosmic/xdg-desktop-portal, zathura-pdf-poppler. Verificado después, no antes: static-audit MIENTEN 0 de 690 ✅ toda receta que declara link=static lo cumple los 5 grafos deuda 0 repro REPRODUCEN 3 · DERIVA 0 · NO-DETERMINISMO 0 ⚠ incoming-gnome/json-glib NO se toca: declara link="dynamic" a propósito porque el shell de GNOME dlopea .so reales para introspección. No miente — es honesta, y su radio de 10 no se paga. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_014QPJteswQvP1L7zSBrQQe2 --- docs/state/build-state-cosmic.json | 8 ++++---- docs/state/build-state-gnome.json | 4 ++-- docs/state/build-state-kde.json | 6 +++--- docs/state/build-state-wlr.json | 6 +++--- docs/state/build-state.json | 6 +++--- docs/state/static-audit.txt | 7 ++----- recipes/json-glib.toml | 9 ++++++++- 7 files changed, 25 insertions(+), 21 deletions(-) diff --git a/docs/state/build-state-cosmic.json b/docs/state/build-state-cosmic.json index d1a93418..64ff7364 100644 --- a/docs/state/build-state-cosmic.json +++ b/docs/state/build-state-cosmic.json @@ -8321,7 +8321,7 @@ "cls": "gui", "queue": "corpus", "foreign": false, - "hash": "b3:62011e81feaa393ded214a5d5ee1533a72093e1d833acb4debf3c9fe305e5335", + "hash": "b3:e346cb599d070d407a853725cec97e6cd1b0a0a647b6767612093120050a5fa7", "state": "sealed", "blocked_by": [], "unblocks": 0, @@ -17324,7 +17324,7 @@ "cls": "c", "queue": "incoming-cosmic", "foreign": false, - "hash": "b3:749fbffe05d974c4b78f6f06d0ef6eaf5f58c52f88be352966912e910dbcb09f", + "hash": "b3:ecbe13f68eca66e5f20cd15ce37f05054d357b5fafb9dbb1753f4fe6e11572b8", "state": "sealed", "blocked_by": [], "unblocks": 0, @@ -17709,7 +17709,7 @@ "cls": "c", "queue": "corpus", "foreign": false, - "hash": "b3:9c5eac9263563cbf359ba7c0e6bb6346747a46a6172baa3de8842df6f6ada829", + "hash": "b3:685efcac30d6821ac9ac0a0f492815b2a469c3360bb3a3c1a6637b3258193dd5", "state": "sealed", "blocked_by": [], "unblocks": 0, @@ -17751,7 +17751,7 @@ "cls": "c", "queue": "corpus", "foreign": false, - "hash": "b3:ef4062c5a1a5f9b2c8190b4d7d5576afa2a7485f3c7329366dd73d3360d88231", + "hash": "b3:04c8b7bac22a303d7e4edaebcf91833277e52a2fdcf0a741d165176c9b49afd8", "state": "sealed", "blocked_by": [], "unblocks": 0, diff --git a/docs/state/build-state-gnome.json b/docs/state/build-state-gnome.json index 7f750b30..a86cb042 100644 --- a/docs/state/build-state-gnome.json +++ b/docs/state/build-state-gnome.json @@ -18764,7 +18764,7 @@ "cls": "c", "queue": "corpus", "foreign": false, - "hash": "b3:9c5eac9263563cbf359ba7c0e6bb6346747a46a6172baa3de8842df6f6ada829", + "hash": "b3:685efcac30d6821ac9ac0a0f492815b2a469c3360bb3a3c1a6637b3258193dd5", "state": "sealed", "blocked_by": [], "unblocks": 0, @@ -18806,7 +18806,7 @@ "cls": "c", "queue": "corpus", "foreign": false, - "hash": "b3:ef4062c5a1a5f9b2c8190b4d7d5576afa2a7485f3c7329366dd73d3360d88231", + "hash": "b3:04c8b7bac22a303d7e4edaebcf91833277e52a2fdcf0a741d165176c9b49afd8", "state": "sealed", "blocked_by": [], "unblocks": 0, diff --git a/docs/state/build-state-kde.json b/docs/state/build-state-kde.json index 661d8c4f..ff2e07d4 100644 --- a/docs/state/build-state-kde.json +++ b/docs/state/build-state-kde.json @@ -8477,7 +8477,7 @@ "cls": "gui", "queue": "corpus", "foreign": false, - "hash": "b3:62011e81feaa393ded214a5d5ee1533a72093e1d833acb4debf3c9fe305e5335", + "hash": "b3:e346cb599d070d407a853725cec97e6cd1b0a0a647b6767612093120050a5fa7", "state": "sealed", "blocked_by": [], "unblocks": 0, @@ -24548,7 +24548,7 @@ "cls": "c", "queue": "corpus", "foreign": false, - "hash": "b3:9c5eac9263563cbf359ba7c0e6bb6346747a46a6172baa3de8842df6f6ada829", + "hash": "b3:685efcac30d6821ac9ac0a0f492815b2a469c3360bb3a3c1a6637b3258193dd5", "state": "sealed", "blocked_by": [], "unblocks": 0, @@ -24590,7 +24590,7 @@ "cls": "c", "queue": "corpus", "foreign": false, - "hash": "b3:ef4062c5a1a5f9b2c8190b4d7d5576afa2a7485f3c7329366dd73d3360d88231", + "hash": "b3:04c8b7bac22a303d7e4edaebcf91833277e52a2fdcf0a741d165176c9b49afd8", "state": "sealed", "blocked_by": [], "unblocks": 0, diff --git a/docs/state/build-state-wlr.json b/docs/state/build-state-wlr.json index 3b2365da..51f3aad7 100644 --- a/docs/state/build-state-wlr.json +++ b/docs/state/build-state-wlr.json @@ -7950,7 +7950,7 @@ "cls": "gui", "queue": "corpus", "foreign": false, - "hash": "b3:62011e81feaa393ded214a5d5ee1533a72093e1d833acb4debf3c9fe305e5335", + "hash": "b3:e346cb599d070d407a853725cec97e6cd1b0a0a647b6767612093120050a5fa7", "state": "sealed", "blocked_by": [], "unblocks": 0, @@ -17452,7 +17452,7 @@ "cls": "c", "queue": "corpus", "foreign": false, - "hash": "b3:9c5eac9263563cbf359ba7c0e6bb6346747a46a6172baa3de8842df6f6ada829", + "hash": "b3:685efcac30d6821ac9ac0a0f492815b2a469c3360bb3a3c1a6637b3258193dd5", "state": "sealed", "blocked_by": [], "unblocks": 0, @@ -17494,7 +17494,7 @@ "cls": "c", "queue": "corpus", "foreign": false, - "hash": "b3:ef4062c5a1a5f9b2c8190b4d7d5576afa2a7485f3c7329366dd73d3360d88231", + "hash": "b3:04c8b7bac22a303d7e4edaebcf91833277e52a2fdcf0a741d165176c9b49afd8", "state": "sealed", "blocked_by": [], "unblocks": 0, diff --git a/docs/state/build-state.json b/docs/state/build-state.json index 69d79da5..e9e6fb1d 100644 --- a/docs/state/build-state.json +++ b/docs/state/build-state.json @@ -7813,7 +7813,7 @@ "cls": "gui", "queue": "corpus", "foreign": false, - "hash": "b3:62011e81feaa393ded214a5d5ee1533a72093e1d833acb4debf3c9fe305e5335", + "hash": "b3:e346cb599d070d407a853725cec97e6cd1b0a0a647b6767612093120050a5fa7", "state": "sealed", "blocked_by": [], "unblocks": 0, @@ -16975,7 +16975,7 @@ "cls": "c", "queue": "corpus", "foreign": false, - "hash": "b3:9c5eac9263563cbf359ba7c0e6bb6346747a46a6172baa3de8842df6f6ada829", + "hash": "b3:685efcac30d6821ac9ac0a0f492815b2a469c3360bb3a3c1a6637b3258193dd5", "state": "sealed", "blocked_by": [], "unblocks": 0, @@ -17017,7 +17017,7 @@ "cls": "c", "queue": "corpus", "foreign": false, - "hash": "b3:ef4062c5a1a5f9b2c8190b4d7d5576afa2a7485f3c7329366dd73d3360d88231", + "hash": "b3:04c8b7bac22a303d7e4edaebcf91833277e52a2fdcf0a741d165176c9b49afd8", "state": "sealed", "blocked_by": [], "unblocks": 0, diff --git a/docs/state/static-audit.txt b/docs/state/static-audit.txt index 8d55ff8a..4bb30a60 100644 --- a/docs/state/static-audit.txt +++ b/docs/state/static-audit.txt @@ -1,6 +1,3 @@ -audit de enlace estático · medido 2026-09-07T19:33:36Z · rc=1 - ✗ json-glib dice static, 2 de 2 ejecutables DINÁMICOS (p.ej. usr/bin/json-glib-format) → libffi.so.8 libz.so.1 libc.so - ↑ `libc.so` es la musl de zig: en el host son 255B de linker script ⇒ NO CORRE fuera del sandbox -══ estáticos de verdad: 689 | MIENTEN: 1 | sin artefacto o sin ELF: 69 - fix: LDFLAGS="-all-static -no-pie" en compile Y en install (libtool relinkea al instalar) +══ estáticos de verdad: 690 | MIENTEN: 0 | sin artefacto o sin ELF: 69 + ✅ toda receta que declara link=static lo cumple diff --git a/recipes/json-glib.toml b/recipes/json-glib.toml index 215a6d5d..7a0bba7f 100644 --- a/recipes/json-glib.toml +++ b/recipes/json-glib.toml @@ -51,8 +51,15 @@ compiler = "zig-cc" target = "x86_64-linux-musl" link = "static" +# ⚠ `--prefer-static` NO es redundante con `-Ddefault_library=static` (2026-09-08). El segundo +# gobierna cómo se construye la librería PROPIA —y funcionaba: el artefacto trae `libjson-glib-1.0.a`— +# pero no dice nada de con qué se enlazan los EJECUTABLES. Sin `--prefer-static`, `json-glib-format` y +# `json-glib-validate` salían dinámicos contra `libffi.so.8`, `libz.so.1` y `libc.so`; ese `libc.so` +# es la musl de zig, que en el host son 255 bytes de linker script ⇒ **binarios que no corren fuera +# del sandbox**, en una receta que declara `link = "static"`. Lo cazó `scripts/static-audit.sh`, que +# existe justamente para que la declaración y el binario no se separen. Mismo remedio que `appstream`. [build.phases] -configure = "PKG_CONFIG_PATH=/usr/lib/pkgconfig meson setup output --prefix=/usr --buildtype=release --wrap-mode=nodownload -Ddefault_library=static -Dintrospection=disabled -Ddocumentation=disabled -Dman=false -Dtests=false -Dconformance=false -Dnls=disabled -Dinstalled_tests=false" +configure = "PKG_CONFIG_PATH=/usr/lib/pkgconfig meson setup output --prefix=/usr --buildtype=release --wrap-mode=nodownload --prefer-static -Ddefault_library=static -Dintrospection=disabled -Ddocumentation=disabled -Dman=false -Dtests=false -Dconformance=false -Dnls=disabled -Dinstalled_tests=false" compile = "ninja -C output" install = "DESTDIR=/out meson install -C output --no-rebuild"