Two boards, and three packages whose released versions were broken - #339
Merged
Conversation
THE PUBLISHED 1.8.12.1 AND 0.2.3 CARRIED A DEPENDENCY PATH THAT ESCAPES THE
PACKAGE, AND NEITHER WOULD RESOLVE FOR A CONSUMER.
llvm.compiler-rt-builtins = { version = "22.1.8", path = "../compiler-rt-builtins" }
picolibc.picolibc = { version = "1.8.12", path = "../picolibc" }
That is how each package is developed against an unreleased sibling, and it is
invisible to every test that runs from the publishing checkout, because the
sibling IS there: the build succeeds and CI is green. It fails only after the
version is published and mirrored, for whoever installs it, as
error: path dependency 'llvm.compiler-rt-builtins' has no mcpp.toml
The three superseded versions are withdrawn from the table rather than left
beside their replacements. Two of them do not work, and the third
(22.1.8.1) makes every consumer build print two warnings about keys it uses
that `[build]` does not have.
picolibc.picolibc 1.8.12.1 -> 1.8.12.2
llvm.compiler-rt-builtins 22.1.8.1 -> 22.1.8.2
mcpplibs.cortex-m-rt 0.2.3 -> 0.2.4
Both publishing repositories now refuse an escaping path in CI, which is the
part that lasts: a grep of the manifest for a dependency path beginning with
`../` or `/`. An internal path stays legal — openarch names its own backends
that way — and only one that leaves the package is refused.
`language` and `import_std` are replaced by `c_standard`, the key `[build]`
actually has. mcpp reported both as unsupported and carried on, so the two C
packages compiled at the default standard rather than the one they asked for.
The default is already c11, so only the warnings change.
Also in this batch, the two boards that adopted the named-runner form:
mcpplibs.riscv-virt-rt 0.7.0
mcpplibs.aarch64-virt-rt 0.2.0
AUDITED MECHANICALLY BEFORE SUBMISSION, AND THE AUDIT NOW LOOKS FOR THIS.
Across the seven entries this batch touches — 34 versions, 68 URLs — every
GLOBAL and CN URL was fetched, hashed and compared with the index; every
tarball's own `mcpp.toml` was read and checked to declare the same namespace,
name and version the entry claims; and every published manifest was checked for
a dependency path that escapes its package. The last of those is new, because
the first audit passed a release that was broken in exactly that way.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
picolibc.picolibc@1.8.12.1andmcpplibs.cortex-m-rt@0.2.3shipped apath = "../…"dependency override — how each is developed against an unreleased sibling, invisible to the publishing repository's own CI because the sibling is there, and broken for every consumer.Replaced by 1.8.12.2, 22.1.8.2 and 0.2.4; the superseded versions are withdrawn rather than left beside them.
Both repositories now refuse an escaping path in CI, and the index audit checks published manifests for it too — the previous audit passed a release broken in exactly this way.
Adds
mcpplibs.riscv-virt-rt@0.7.0andmcpplibs.aarch64-virt-rt@0.2.0.Audited: 34 versions, 68 URLs fetched and hashed, manifests checked for identity, version and escaping paths.