Skip to content

Commit 34d694c

Browse files
Sunrisepeakspeak-agent
Sunrisepeak
and
speak-agent
authored
Two boards, and three packages whose released versions were broken (#339)
THE PUBLISHED 1.8.12.1 AND 0.2.3 CARRIED A DEPENDENCY PATH THAT ESCAPES THE PACKAGE, AND NEITHER WOULD RESOLVE FOR A CONSUMER. llvm.compiler-rt-builtins = { version = "22.1.8", path = "../compiler-rt-builtins" } picolibc.picolibc = { version = "1.8.12", path = "../picolibc" } That is how each package is developed against an unreleased sibling, and it is invisible to every test that runs from the publishing checkout, because the sibling IS there: the build succeeds and CI is green. It fails only after the version is published and mirrored, for whoever installs it, as error: path dependency 'llvm.compiler-rt-builtins' has no mcpp.toml The three superseded versions are withdrawn from the table rather than left beside their replacements. Two of them do not work, and the third (22.1.8.1) makes every consumer build print two warnings about keys it uses that `[build]` does not have. picolibc.picolibc 1.8.12.1 -> 1.8.12.2 llvm.compiler-rt-builtins 22.1.8.1 -> 22.1.8.2 mcpplibs.cortex-m-rt 0.2.3 -> 0.2.4 Both publishing repositories now refuse an escaping path in CI, which is the part that lasts: a grep of the manifest for a dependency path beginning with `../` or `/`. An internal path stays legal — openarch names its own backends that way — and only one that leaves the package is refused. `language` and `import_std` are replaced by `c_standard`, the key `[build]` actually has. mcpp reported both as unsupported and carried on, so the two C packages compiled at the default standard rather than the one they asked for. The default is already c11, so only the warnings change. Also in this batch, the two boards that adopted the named-runner form: mcpplibs.riscv-virt-rt 0.7.0 mcpplibs.aarch64-virt-rt 0.2.0 AUDITED MECHANICALLY BEFORE SUBMISSION, AND THE AUDIT NOW LOOKS FOR THIS. Across the seven entries this batch touches — 34 versions, 68 URLs — every GLOBAL and CN URL was fetched, hashed and compared with the index; every tarball's own `mcpp.toml` was read and checked to declare the same namespace, name and version the entry claims; and every published manifest was checked for a dependency path that escapes its package. The last of those is new, because the first audit passed a release that was broken in exactly that way. Co-authored-by: speak-agent <248744407+speak-agent@users.noreply.github.com>
1 parent af7fd16 commit 34d694c

5 files changed

Lines changed: 78 additions & 36 deletions

File tree

‎pkgs/a/aarch64-virt-rt.lua‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,13 @@ package = {
5656
xpm = {
5757
linux = {
5858
deps = { "xim:qemu-arm@9.2.4-1" },
59+
["0.2.0"] = {
60+
url = {
61+
GLOBAL = "https://github.com/mcpplibs/aarch64-virt-rt/archive/refs/tags/0.2.0.tar.gz",
62+
CN = "https://gitcode.com/mcpp-res/aarch64-virt-rt/releases/download/0.2.0/aarch64-virt-rt-0.2.0.tar.gz",
63+
},
64+
sha256 = "4a828424e82a3c97f6d45456fdfa557c7ab361929ef54bb3055037867a4e1978",
65+
},
5966
["0.1.1"] = {
6067
url = {
6168
GLOBAL = "https://github.com/mcpplibs/aarch64-virt-rt/archive/refs/tags/0.1.1.tar.gz",
@@ -73,6 +80,13 @@ package = {
7380
},
7481
macosx = {
7582
deps = { "xim:qemu-arm@9.2.4-1" },
83+
["0.2.0"] = {
84+
url = {
85+
GLOBAL = "https://github.com/mcpplibs/aarch64-virt-rt/archive/refs/tags/0.2.0.tar.gz",
86+
CN = "https://gitcode.com/mcpp-res/aarch64-virt-rt/releases/download/0.2.0/aarch64-virt-rt-0.2.0.tar.gz",
87+
},
88+
sha256 = "4a828424e82a3c97f6d45456fdfa557c7ab361929ef54bb3055037867a4e1978",
89+
},
7690
["0.1.1"] = {
7791
url = {
7892
GLOBAL = "https://github.com/mcpplibs/aarch64-virt-rt/archive/refs/tags/0.1.1.tar.gz",
@@ -90,6 +104,13 @@ package = {
90104
},
91105
windows = {
92106
deps = { "xim:qemu-arm@9.2.4-1" },
107+
["0.2.0"] = {
108+
url = {
109+
GLOBAL = "https://github.com/mcpplibs/aarch64-virt-rt/archive/refs/tags/0.2.0.tar.gz",
110+
CN = "https://gitcode.com/mcpp-res/aarch64-virt-rt/releases/download/0.2.0/aarch64-virt-rt-0.2.0.tar.gz",
111+
},
112+
sha256 = "4a828424e82a3c97f6d45456fdfa557c7ab361929ef54bb3055037867a4e1978",
113+
},
93114
["0.1.1"] = {
94115
url = {
95116
GLOBAL = "https://github.com/mcpplibs/aarch64-virt-rt/archive/refs/tags/0.1.1.tar.gz",

‎pkgs/c/cortex-m-rt.lua‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -43,30 +43,30 @@ package = {
4343

4444
xpm = {
4545
linux = {
46-
["0.2.3"] = {
46+
["0.2.4"] = {
4747
url = {
48-
GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.3.tar.gz",
49-
CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.3/cortex-m-rt-0.2.3.tar.gz",
48+
GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.4.tar.gz",
49+
CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.4/cortex-m-rt-0.2.4.tar.gz",
5050
},
51-
sha256 = "2b926b10df89ad35d9eff7d1c318b334317d106525cb24eea00a0c623e448ce7",
51+
sha256 = "6709be9d6795e377b9b82a7dde805aee1bb8b99bde4ab720bf4ea8055190e12e",
5252
},
5353
},
5454
macosx = {
55-
["0.2.3"] = {
55+
["0.2.4"] = {
5656
url = {
57-
GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.3.tar.gz",
58-
CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.3/cortex-m-rt-0.2.3.tar.gz",
57+
GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.4.tar.gz",
58+
CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.4/cortex-m-rt-0.2.4.tar.gz",
5959
},
60-
sha256 = "2b926b10df89ad35d9eff7d1c318b334317d106525cb24eea00a0c623e448ce7",
60+
sha256 = "6709be9d6795e377b9b82a7dde805aee1bb8b99bde4ab720bf4ea8055190e12e",
6161
},
6262
},
6363
windows = {
64-
["0.2.3"] = {
64+
["0.2.4"] = {
6565
url = {
66-
GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.3.tar.gz",
67-
CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.3/cortex-m-rt-0.2.3.tar.gz",
66+
GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.4.tar.gz",
67+
CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.4/cortex-m-rt-0.2.4.tar.gz",
6868
},
69-
sha256 = "2b926b10df89ad35d9eff7d1c318b334317d106525cb24eea00a0c623e448ce7",
69+
sha256 = "6709be9d6795e377b9b82a7dde805aee1bb8b99bde4ab720bf4ea8055190e12e",
7070
},
7171
},
7272
},

‎pkgs/l/llvm.compiler-rt-builtins.lua‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -40,30 +40,30 @@ package = {
4040

4141
xpm = {
4242
linux = {
43-
["22.1.8.1"] = {
43+
["22.1.8.2"] = {
4444
url = {
45-
GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.1.tar.gz",
46-
CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.1/compiler-rt-builtins-22.1.8.1.tar.gz",
45+
GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.2.tar.gz",
46+
CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.2/compiler-rt-builtins-22.1.8.2.tar.gz",
4747
},
48-
sha256 = "799797e79e927d28b949e8723d9642e2b8a9d8e997b8c56ecc84ee8220228da3",
48+
sha256 = "c6070e0b878aef1d526ce764b9ad3d6e5396b230d059262ed5615c2e0bf78dfd",
4949
},
5050
},
5151
macosx = {
52-
["22.1.8.1"] = {
52+
["22.1.8.2"] = {
5353
url = {
54-
GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.1.tar.gz",
55-
CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.1/compiler-rt-builtins-22.1.8.1.tar.gz",
54+
GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.2.tar.gz",
55+
CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.2/compiler-rt-builtins-22.1.8.2.tar.gz",
5656
},
57-
sha256 = "799797e79e927d28b949e8723d9642e2b8a9d8e997b8c56ecc84ee8220228da3",
57+
sha256 = "c6070e0b878aef1d526ce764b9ad3d6e5396b230d059262ed5615c2e0bf78dfd",
5858
},
5959
},
6060
windows = {
61-
["22.1.8.1"] = {
61+
["22.1.8.2"] = {
6262
url = {
63-
GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.1.tar.gz",
64-
CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.1/compiler-rt-builtins-22.1.8.1.tar.gz",
63+
GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.2.tar.gz",
64+
CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.2/compiler-rt-builtins-22.1.8.2.tar.gz",
6565
},
66-
sha256 = "799797e79e927d28b949e8723d9642e2b8a9d8e997b8c56ecc84ee8220228da3",
66+
sha256 = "c6070e0b878aef1d526ce764b9ad3d6e5396b230d059262ed5615c2e0bf78dfd",
6767
},
6868
},
6969
},

‎pkgs/p/picolibc.picolibc.lua‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -57,30 +57,30 @@ package = {
5757

5858
xpm = {
5959
linux = {
60-
["1.8.12.1"] = {
60+
["1.8.12.2"] = {
6161
url = {
62-
GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.1.tar.gz",
63-
CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.1/picolibc-1.8.12.1.tar.gz",
62+
GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.2.tar.gz",
63+
CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.2/picolibc-1.8.12.2.tar.gz",
6464
},
65-
sha256 = "8c148d5cce7857caeeeacacc95c28e1bbdf13cc06408876ae2fdaece2caaefa8",
65+
sha256 = "29045a2eed39a421353dec6f7763f3d78eda88d0957f9eec6833143d92b2e2fd",
6666
},
6767
},
6868
macosx = {
69-
["1.8.12.1"] = {
69+
["1.8.12.2"] = {
7070
url = {
71-
GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.1.tar.gz",
72-
CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.1/picolibc-1.8.12.1.tar.gz",
71+
GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.2.tar.gz",
72+
CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.2/picolibc-1.8.12.2.tar.gz",
7373
},
74-
sha256 = "8c148d5cce7857caeeeacacc95c28e1bbdf13cc06408876ae2fdaece2caaefa8",
74+
sha256 = "29045a2eed39a421353dec6f7763f3d78eda88d0957f9eec6833143d92b2e2fd",
7575
},
7676
},
7777
windows = {
78-
["1.8.12.1"] = {
78+
["1.8.12.2"] = {
7979
url = {
80-
GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.1.tar.gz",
81-
CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.1/picolibc-1.8.12.1.tar.gz",
80+
GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.2.tar.gz",
81+
CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.2/picolibc-1.8.12.2.tar.gz",
8282
},
83-
sha256 = "8c148d5cce7857caeeeacacc95c28e1bbdf13cc06408876ae2fdaece2caaefa8",
83+
sha256 = "29045a2eed39a421353dec6f7763f3d78eda88d0957f9eec6833143d92b2e2fd",
8484
},
8585
},
8686
},

‎pkgs/r/riscv-virt-rt.lua‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,13 @@ package = {
6262
-- published is a version someone may have pinned.
6363
xpm = {
6464
linux = {
65+
["0.7.0"] = {
66+
url = {
67+
GLOBAL = "https://github.com/mcpplibs/riscv-virt-rt/archive/refs/tags/0.7.0.tar.gz",
68+
CN = "https://gitcode.com/mcpp-res/riscv-virt-rt/releases/download/0.7.0/riscv-virt-rt-0.7.0.tar.gz",
69+
},
70+
sha256 = "f97ba771783d8f5fa56bb5bfc7ed9626f448db2605b9fe95ff1cef4137aceb74",
71+
},
6572
["0.6.1"] = {
6673
url = {
6774
GLOBAL = "https://github.com/mcpplibs/riscv-virt-rt/archive/refs/tags/0.6.1.tar.gz",
@@ -128,6 +135,13 @@ package = {
128135
},
129136
},
130137
macosx = {
138+
["0.7.0"] = {
139+
url = {
140+
GLOBAL = "https://github.com/mcpplibs/riscv-virt-rt/archive/refs/tags/0.7.0.tar.gz",
141+
CN = "https://gitcode.com/mcpp-res/riscv-virt-rt/releases/download/0.7.0/riscv-virt-rt-0.7.0.tar.gz",
142+
},
143+
sha256 = "f97ba771783d8f5fa56bb5bfc7ed9626f448db2605b9fe95ff1cef4137aceb74",
144+
},
131145
["0.6.1"] = {
132146
url = {
133147
GLOBAL = "https://github.com/mcpplibs/riscv-virt-rt/archive/refs/tags/0.6.1.tar.gz",
@@ -194,6 +208,13 @@ package = {
194208
},
195209
},
196210
windows = {
211+
["0.7.0"] = {
212+
url = {
213+
GLOBAL = "https://github.com/mcpplibs/riscv-virt-rt/archive/refs/tags/0.7.0.tar.gz",
214+
CN = "https://gitcode.com/mcpp-res/riscv-virt-rt/releases/download/0.7.0/riscv-virt-rt-0.7.0.tar.gz",
215+
},
216+
sha256 = "f97ba771783d8f5fa56bb5bfc7ed9626f448db2605b9fe95ff1cef4137aceb74",
217+
},
197218
["0.6.1"] = {
198219
url = {
199220
GLOBAL = "https://github.com/mcpplibs/riscv-virt-rt/archive/refs/tags/0.6.1.tar.gz",

0 commit comments

Comments
 (0)