The two upstream-derived packages take upstream's version - #338
Merged
Conversation
A PACKAGE THAT VENDORS SOMEONE ELSE'S SOURCES TAKES THEIR NUMBER AS WELL AS
THEIR NAMESPACE.
`picolibc.picolibc` and `llvm.compiler-rt-builtins` were published with an
independent version (0.1.x), on the argument that a version must move when the
packaging changes and upstream's has not. The fourth segment answers that
without a second numbering scheme: it orders strictly above the bare upstream
number, because mcpp compares an arbitrary-length dot list with absent segments
as zero, and it satisfies every requirement the bare number satisfies, because a
bare requirement is a caret. A consumer therefore writes the number upstream
released:
picolibc.picolibc = "1.8.12"
llvm.compiler-rt-builtins = "22.1.8"
Both entries publish `.1` rather than the bare number, which is the scheme in
use rather than an exception to it: tags named `1.8.12` and `22.1.8` had already
been published carrying different bytes, and a published version must not come
to mean something else.
VERIFIED AGAINST UPSTREAM RATHER THAN ASSERTED. Every one of picolibc's 2109
vendored files is byte-identical to the 1.8.12 release tarball, whose
`meson.build` declares that version; every one of the 347 vendored builtins is
byte-identical to `compiler-rt/lib/builtins` at the tag `llvmorg-22.1.8`.
picolibc's licence field was wrong and is now counted rather than guessed. The
tree descends from newlib and carries five identifiers over the files actually
shipped: BSD-3-Clause (902), BSD-3-Clause-Clear (31), MIT (8),
BSD-2-Clause-FreeBSD (5), BSD-2-Clause (4). The entry declared BSD-3-Clause and
BSD-2-Clause. `mcpp sbom` emits this field into a document a legal review reads,
where one wrong identifier reads as examined and is worse than silence.
`mcpplibs.cortex-m-rt` moves to 0.2.3, in which a `main` that returns terminates
instead of hanging for ever: C defines returning from `main` as `exit(status)`,
and the startup file called `board_main` for effect and then spun. With a C
library in the graph that discarded buffered output; with none, the program ran
until something killed it. The template writes an explicit `board::exit(0)`, so
every test of the package took the one path that worked.
The superseded versions are withdrawn from the table rather than left beside
their replacements: they are hours old, nothing consumes them, and leaving them
would make the same bytes installable under two identities, one of which
contradicts the convention.
AUDITED MECHANICALLY BEFORE SUBMISSION. Across the seven entries this batch
touches — 32 versions, 64 URLs — every GLOBAL and CN URL was fetched, hashed and
compared with the index, and every tarball's own `mcpp.toml` was read and
checked to declare the same namespace, name and version the entry claims. No
disagreement was found.
Sunrisepeak
force-pushed
the
upstream-aligned-versions
branch
from
September 4, 2026 08:22
dfd555f to
29c12d4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
picolibc.picolibcandllvm.compiler-rt-builtinsvendor someone else's sources, so they take upstream's number as well as upstream's namespace. The fourth segment carries the packaging revision: it orders above the bare number and satisfies the same caret requirement, so a consumer writes"1.8.12"and"22.1.8".Verified against upstream rather than asserted — picolibc's 2109 vendored files and compiler-rt's 347 are each byte-identical to the upstream release they name.
picolibc's licence field is now counted over the files actually shipped (five identifiers, from its newlib ancestry) rather than the two it declared.
mcpplibs.cortex-m-rt0.2.3 fixes amainthat returns hanging for ever.Audited before submission: 32 versions, 64 URLs fetched and hashed against the index, every tarball's own manifest checked to agree on namespace, name and version.