From 29c12d47133a523079bc63327af4e0cbf21ccc47 Mon Sep 17 00:00:00 2001 From: speak-agent <248744407+speak-agent@users.noreply.github.com> Date: Fri, 4 Sep 2026 16:22:49 +0800 Subject: [PATCH] The two upstream-derived packages take upstream's version MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A PACKAGE THAT VENDORS SOMEONE ELSE'S SOURCES TAKES THEIR NUMBER AS WELL AS THEIR NAMESPACE. `picolibc.picolibc` and `llvm.compiler-rt-builtins` were published with an independent version (0.1.x), on the argument that a version must move when the packaging changes and upstream's has not. The fourth segment answers that without a second numbering scheme: it orders strictly above the bare upstream number, because mcpp compares an arbitrary-length dot list with absent segments as zero, and it satisfies every requirement the bare number satisfies, because a bare requirement is a caret. A consumer therefore writes the number upstream released: picolibc.picolibc = "1.8.12" llvm.compiler-rt-builtins = "22.1.8" Both entries publish `.1` rather than the bare number, which is the scheme in use rather than an exception to it: tags named `1.8.12` and `22.1.8` had already been published carrying different bytes, and a published version must not come to mean something else. VERIFIED AGAINST UPSTREAM RATHER THAN ASSERTED. Every one of picolibc's 2109 vendored files is byte-identical to the 1.8.12 release tarball, whose `meson.build` declares that version; every one of the 347 vendored builtins is byte-identical to `compiler-rt/lib/builtins` at the tag `llvmorg-22.1.8`. picolibc's licence field was wrong and is now counted rather than guessed. The tree descends from newlib and carries five identifiers over the files actually shipped: BSD-3-Clause (902), BSD-3-Clause-Clear (31), MIT (8), BSD-2-Clause-FreeBSD (5), BSD-2-Clause (4). The entry declared BSD-3-Clause and BSD-2-Clause. `mcpp sbom` emits this field into a document a legal review reads, where one wrong identifier reads as examined and is worse than silence. `mcpplibs.cortex-m-rt` moves to 0.2.3, in which a `main` that returns terminates instead of hanging for ever: C defines returning from `main` as `exit(status)`, and the startup file called `board_main` for effect and then spun. With a C library in the graph that discarded buffered output; with none, the program ran until something killed it. The template writes an explicit `board::exit(0)`, so every test of the package took the one path that worked. The superseded versions are withdrawn from the table rather than left beside their replacements: they are hours old, nothing consumes them, and leaving them would make the same bytes installable under two identities, one of which contradicts the convention. AUDITED MECHANICALLY BEFORE SUBMISSION. Across the seven entries this batch touches — 32 versions, 64 URLs — every GLOBAL and CN URL was fetched, hashed and compared with the index, and every tarball's own `mcpp.toml` was read and checked to declare the same namespace, name and version the entry claims. No disagreement was found. --- pkgs/c/cortex-m-rt.lua | 32 ++++++++--------- pkgs/l/llvm.compiler-rt-builtins.lua | 44 ++++++++++++++--------- pkgs/p/picolibc.picolibc.lua | 52 ++++++++++++++++++---------- 3 files changed, 76 insertions(+), 52 deletions(-) diff --git a/pkgs/c/cortex-m-rt.lua b/pkgs/c/cortex-m-rt.lua index f10ba54..1efa393 100644 --- a/pkgs/c/cortex-m-rt.lua +++ b/pkgs/c/cortex-m-rt.lua @@ -1,7 +1,7 @@ -- Board support for Cortex-M: startup, memory layout, a semihosting console, -- and the runners that reach an emulator or a debug probe. -- --- ⭐⭐ ONE PACKAGE, TWO ENVIRONMENTS — AND SINCE 0.2.1, THREE FEATURES. +-- ONE PACKAGE, TWO ENVIRONMENTS — AND SINCE 0.2.1, THREE FEATURES. -- -- A board reached through an emulator and the same board reached through a -- debug probe differ in the argv of their runners and in NOTHING else: the @@ -14,20 +14,20 @@ -- mcpp run --features hardware # the board, over a debug probe -- mcpp run --features libc # with a C library -- --- ⭐ `mcpp run` IS THE WHOLE OF THE COMMON CASE, ON EITHER. On a device, +-- `mcpp run` IS THE WHOLE OF THE COMMON CASE, ON EITHER. On a device, -- running a program means writing it, resetting, attaching to its output and -- reading its exit status — ONE command, not several. So that is the DEFAULT -- runner in both environments, and the command a developer types does not -- change when the board arrives. `flash` and `serve` are named exceptions, and -- the engine knows neither name. -- --- ⚠️ EACH ENVIRONMENT BRINGS ITS OWN TOOL, ON THE `run` TIER. `qemu-arm` under +-- EACH ENVIRONMENT BRINGS ITS OWN TOOL, ON THE `run` TIER. `qemu-arm` under -- `[feature-xlings.emulator]`, `probe-rs` under `[feature-xlings.hardware]`, -- both `when = "run"` — so a consumer downloads exactly what the feature they -- selected needs, and a CI job that compiles firmware and never flashes it -- downloads nothing at all. Requires mcpp 2026.9.4.2. -- --- ⚠️ AND THE BOARD SETS THE THREAD POINTER, which is what makes `libc` work. +-- AND THE BOARD SETS THE THREAD POINTER, which is what makes `libc` work. -- picolibc reaches `stdout` through thread-local storage, and a freestanding -- image has none until the startup file sets one. Measured without it: a -- `printf` program linked cleanly, ran, printed NOTHING and hung. There is no @@ -43,30 +43,30 @@ package = { xpm = { linux = { - ["0.2.1"] = { + ["0.2.3"] = { url = { - GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.1/cortex-m-rt-0.2.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.3.tar.gz", + CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.3/cortex-m-rt-0.2.3.tar.gz", }, - sha256 = "d4983148c80cd5366a3374f3bc5a379f9688657c516868e459eefd31b97cfd60", + sha256 = "2b926b10df89ad35d9eff7d1c318b334317d106525cb24eea00a0c623e448ce7", }, }, macosx = { - ["0.2.1"] = { + ["0.2.3"] = { url = { - GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.1/cortex-m-rt-0.2.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.3.tar.gz", + CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.3/cortex-m-rt-0.2.3.tar.gz", }, - sha256 = "d4983148c80cd5366a3374f3bc5a379f9688657c516868e459eefd31b97cfd60", + sha256 = "2b926b10df89ad35d9eff7d1c318b334317d106525cb24eea00a0c623e448ce7", }, }, windows = { - ["0.2.1"] = { + ["0.2.3"] = { url = { - GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.1/cortex-m-rt-0.2.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.3.tar.gz", + CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.3/cortex-m-rt-0.2.3.tar.gz", }, - sha256 = "d4983148c80cd5366a3374f3bc5a379f9688657c516868e459eefd31b97cfd60", + sha256 = "2b926b10df89ad35d9eff7d1c318b334317d106525cb24eea00a0c623e448ce7", }, }, }, diff --git a/pkgs/l/llvm.compiler-rt-builtins.lua b/pkgs/l/llvm.compiler-rt-builtins.lua index 8db14ff..de66ada 100644 --- a/pkgs/l/llvm.compiler-rt-builtins.lua +++ b/pkgs/l/llvm.compiler-rt-builtins.lua @@ -1,59 +1,69 @@ -- The compiler-rt builtins as a SOURCE package. -- --- ⭐ TWO PACKAGES RATHER THAN ONE, AND THE EDGE IS THE REASON. picolibc's +-- TWO PACKAGES RATHER THAN ONE, AND THE EDGE IS THE REASON. picolibc's -- `printf` formats floats through ryu, which calls routines no C library -- defines — and on rv64 a 128-bit shift the instruction set has none for. A C -- library carrying its own copy would be wrong for anyone supplying their own -- builtins; the dependency edge says the same thing and can be overridden. -- --- ⚠️ AND compiler-rt DOES NOT RECOGNISE A `thumb*` TRIPLE. Configuring its own +-- AND compiler-rt DOES NOT RECOGNISE A `thumb*` TRIPLE. Configuring its own -- CMake with `thumbv6m-none-eabi` produces a build tree with NO builtins target -- at all: cmake succeeds, ninja reports "no work to do", and the failure -- surfaces later as a missing file. A source package has no archive to name and -- no triple to translate. -- --- ⚠️ THE NAMESPACE IS UPSTREAM'S, NOT `mcpplibs`. This package vendors someone +-- THE NAMESPACE IS UPSTREAM'S, NOT `mcpplibs`. This package vendors someone -- else's sources and adds a manifest; the code is theirs and the identity says -- so. `mcpplibs` is for packages whose CONTENT this organisation wrote. -- --- ⭐ The wrapper REPOSITORY can still live under mcpplibs — `ocornut.imgui` is +-- The wrapper REPOSITORY can still live under mcpplibs — `ocornut.imgui` is -- published from `mcpplibs/imgui-m` for exactly this reason. Where the manifest -- lives and whose code it describes are different questions. +-- THE VERSION IS UPSTREAM'S, AND THE FOURTH SEGMENT IS THE PACKAGING REVISION. +-- +-- `22.1.8` is the LLVM release every one of the 347 vendored files was compared +-- against, byte for byte, at the tag `llvmorg-22.1.8`. The number carries +-- information no independent one could: these routines are an ABI contract with +-- a COMPILER, and "the builtins that ship with the clang in this toolchain" is +-- the question a consumer is asking. A change to the PACKAGING moves the fourth +-- segment, which orders above the bare number and satisfies the same +-- requirements. +-- package = { spec = "1", namespace = "llvm", name = "compiler-rt-builtins", - description = "The compiler-rt 22.1.8 builtins as a source package: the routines a compiler emits calls to, compiled with the consuming program's own flags", + description = "The compiler-rt builtins as a source package: LLVM's replacement for libgcc — the routines a compiler emits calls to — compiled with the consuming program's own flags", licenses = {"Apache-2.0 WITH LLVM-exception"}, repo = "https://github.com/mcpplibs/compiler-rt-builtins", type = "package", xpm = { linux = { - ["0.1.1"] = { + ["22.1.8.1"] = { url = { - GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/0.1.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/0.1.1/compiler-rt-builtins-0.1.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.1.tar.gz", + CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.1/compiler-rt-builtins-22.1.8.1.tar.gz", }, - sha256 = "443673d32137ae64896e341cce52f76a2e8c183cad86d5772a457c4cf4daf513", + sha256 = "799797e79e927d28b949e8723d9642e2b8a9d8e997b8c56ecc84ee8220228da3", }, }, macosx = { - ["0.1.1"] = { + ["22.1.8.1"] = { url = { - GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/0.1.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/0.1.1/compiler-rt-builtins-0.1.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.1.tar.gz", + CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.1/compiler-rt-builtins-22.1.8.1.tar.gz", }, - sha256 = "443673d32137ae64896e341cce52f76a2e8c183cad86d5772a457c4cf4daf513", + sha256 = "799797e79e927d28b949e8723d9642e2b8a9d8e997b8c56ecc84ee8220228da3", }, }, windows = { - ["0.1.1"] = { + ["22.1.8.1"] = { url = { - GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/0.1.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/0.1.1/compiler-rt-builtins-0.1.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.1.tar.gz", + CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.1/compiler-rt-builtins-22.1.8.1.tar.gz", }, - sha256 = "443673d32137ae64896e341cce52f76a2e8c183cad86d5772a457c4cf4daf513", + sha256 = "799797e79e927d28b949e8723d9642e2b8a9d8e997b8c56ecc84ee8220228da3", }, }, }, diff --git a/pkgs/p/picolibc.picolibc.lua b/pkgs/p/picolibc.picolibc.lua index 412ea8c..b16e255 100644 --- a/pkgs/p/picolibc.picolibc.lua +++ b/pkgs/p/picolibc.picolibc.lua @@ -1,6 +1,6 @@ -- picolibc as a SOURCE package: compiled with the consuming program's own flags. -- --- ⭐⭐ THERE IS NO MULTILIB HERE, AND THAT IS WHY IT IS A SOURCE PACKAGE. +-- THERE IS NO MULTILIB HERE, AND THAT IS WHY IT IS A SOURCE PACKAGE. -- -- A prebuilt C library ships one build per ABI a target table can name — seven -- for Cortex-M alone — and every consumer then finds the right one through a @@ -14,59 +14,73 @@ -- directories and the soft-float row received a library carrying -- `Tag_ABI_HardFP_use`. Nothing failed at build time. -- --- ⚠️ AND THE HEADERS WERE NEVER PER-PROFILE. Measured across those seven +-- AND THE HEADERS WERE NEVER PER-PROFILE. Measured across those seven -- builds, the whole include tree — `picolibc.h` and `newlib.h`, which meson -- GENERATES, included — is byte-identical. The prebuilt ships seven copies of -- one directory. -- --- ⚠️ `picocrt` IS DELIBERATELY ABSENT. A startup object decides where execution +-- `picocrt` IS DELIBERATELY ABSENT. A startup object decides where execution -- begins and how it reaches the host — which board is running. Choosing among -- picolibc's nine variants is a board-support package's job; `cortex-m-rt` -- supplies its own, including the thread-pointer initialisation without which a -- `printf` program links cleanly, runs, prints nothing and hangs. -- --- ⚠️ THE NAMESPACE IS UPSTREAM'S, NOT `mcpplibs`. This package vendors someone +-- THE NAMESPACE IS UPSTREAM'S, NOT `mcpplibs`. This package vendors someone -- else's sources and adds a manifest; the code is theirs and the identity says -- so. `mcpplibs` is for packages whose CONTENT this organisation wrote. -- --- ⭐ The wrapper REPOSITORY can still live under mcpplibs — `ocornut.imgui` is +-- The wrapper REPOSITORY can still live under mcpplibs — `ocornut.imgui` is -- published from `mcpplibs/imgui-m` for exactly this reason. Where the manifest -- lives and whose code it describes are different questions. +-- THE VERSION IS UPSTREAM'S, AND THE FOURTH SEGMENT IS THE PACKAGING REVISION. +-- +-- `1.8.12` is what upstream released and what every one of the 2109 vendored +-- files was compared against, byte for byte. A change to the PACKAGING moves +-- the fourth segment: `1.8.12.1` orders strictly above `1.8.12`, because mcpp +-- compares an arbitrary-length dot list with absent segments as zero, and +-- satisfies every requirement `1.8.12` satisfies, because a bare requirement is +-- a caret. A consumer therefore writes the number upstream released. +-- package = { spec = "1", namespace = "picolibc", name = "picolibc", - description = "picolibc 1.8.12 as a source package: a freestanding C library compiled with the consuming program's own flags, so there is no multilib and no ABI convention to match", - licenses = {"BSD-3-Clause", "BSD-2-Clause"}, + description = "picolibc as a source package: a freestanding C library compiled with the consuming program's own flags, so there is no multilib and no ABI convention to match", + -- Counted over the files actually shipped, not guessed. picolibc descends + -- from newlib and the vendored tree carries five identifiers: BSD-3-Clause + -- (902 files), BSD-3-Clause-Clear (31), MIT (8), BSD-2-Clause-FreeBSD (5), + -- BSD-2-Clause (4). `LICENSE.picolibc` is upstream's per-file mapping. + licenses = {"BSD-3-Clause", "BSD-3-Clause-Clear", "MIT", + "BSD-2-Clause-FreeBSD", "BSD-2-Clause"}, repo = "https://github.com/mcpplibs/picolibc", type = "package", xpm = { linux = { - ["0.1.1"] = { + ["1.8.12.1"] = { url = { - GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/0.1.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/0.1.1/picolibc-0.1.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.1.tar.gz", + CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.1/picolibc-1.8.12.1.tar.gz", }, - sha256 = "2265a49e58ed02b2166a4cbef40595a2250c7a0821156f96d4e04ae2086ccf89", + sha256 = "8c148d5cce7857caeeeacacc95c28e1bbdf13cc06408876ae2fdaece2caaefa8", }, }, macosx = { - ["0.1.1"] = { + ["1.8.12.1"] = { url = { - GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/0.1.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/0.1.1/picolibc-0.1.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.1.tar.gz", + CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.1/picolibc-1.8.12.1.tar.gz", }, - sha256 = "2265a49e58ed02b2166a4cbef40595a2250c7a0821156f96d4e04ae2086ccf89", + sha256 = "8c148d5cce7857caeeeacacc95c28e1bbdf13cc06408876ae2fdaece2caaefa8", }, }, windows = { - ["0.1.1"] = { + ["1.8.12.1"] = { url = { - GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/0.1.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/0.1.1/picolibc-0.1.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.1.tar.gz", + CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.1/picolibc-1.8.12.1.tar.gz", }, - sha256 = "2265a49e58ed02b2166a4cbef40595a2250c7a0821156f96d4e04ae2086ccf89", + sha256 = "8c148d5cce7857caeeeacacc95c28e1bbdf13cc06408876ae2fdaece2caaefa8", }, }, },