From 3357637a3e787d91648351b409ab936277e52b7f Mon Sep 17 00:00:00 2001 From: speak-agent <248744407+speak-agent@users.noreply.github.com> Date: Fri, 4 Sep 2026 16:32:50 +0800 Subject: [PATCH] Two boards, and three packages whose released versions were broken MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit THE PUBLISHED 1.8.12.1 AND 0.2.3 CARRIED A DEPENDENCY PATH THAT ESCAPES THE PACKAGE, AND NEITHER WOULD RESOLVE FOR A CONSUMER. llvm.compiler-rt-builtins = { version = "22.1.8", path = "../compiler-rt-builtins" } picolibc.picolibc = { version = "1.8.12", path = "../picolibc" } That is how each package is developed against an unreleased sibling, and it is invisible to every test that runs from the publishing checkout, because the sibling IS there: the build succeeds and CI is green. It fails only after the version is published and mirrored, for whoever installs it, as error: path dependency 'llvm.compiler-rt-builtins' has no mcpp.toml The three superseded versions are withdrawn from the table rather than left beside their replacements. Two of them do not work, and the third (22.1.8.1) makes every consumer build print two warnings about keys it uses that `[build]` does not have. picolibc.picolibc 1.8.12.1 -> 1.8.12.2 llvm.compiler-rt-builtins 22.1.8.1 -> 22.1.8.2 mcpplibs.cortex-m-rt 0.2.3 -> 0.2.4 Both publishing repositories now refuse an escaping path in CI, which is the part that lasts: a grep of the manifest for a dependency path beginning with `../` or `/`. An internal path stays legal — openarch names its own backends that way — and only one that leaves the package is refused. `language` and `import_std` are replaced by `c_standard`, the key `[build]` actually has. mcpp reported both as unsupported and carried on, so the two C packages compiled at the default standard rather than the one they asked for. The default is already c11, so only the warnings change. Also in this batch, the two boards that adopted the named-runner form: mcpplibs.riscv-virt-rt 0.7.0 mcpplibs.aarch64-virt-rt 0.2.0 AUDITED MECHANICALLY BEFORE SUBMISSION, AND THE AUDIT NOW LOOKS FOR THIS. Across the seven entries this batch touches — 34 versions, 68 URLs — every GLOBAL and CN URL was fetched, hashed and compared with the index; every tarball's own `mcpp.toml` was read and checked to declare the same namespace, name and version the entry claims; and every published manifest was checked for a dependency path that escapes its package. The last of those is new, because the first audit passed a release that was broken in exactly that way. --- pkgs/a/aarch64-virt-rt.lua | 21 +++++++++++++++++++++ pkgs/c/cortex-m-rt.lua | 24 ++++++++++++------------ pkgs/l/llvm.compiler-rt-builtins.lua | 24 ++++++++++++------------ pkgs/p/picolibc.picolibc.lua | 24 ++++++++++++------------ pkgs/r/riscv-virt-rt.lua | 21 +++++++++++++++++++++ 5 files changed, 78 insertions(+), 36 deletions(-) diff --git a/pkgs/a/aarch64-virt-rt.lua b/pkgs/a/aarch64-virt-rt.lua index 5ae017f..41b2a10 100644 --- a/pkgs/a/aarch64-virt-rt.lua +++ b/pkgs/a/aarch64-virt-rt.lua @@ -56,6 +56,13 @@ package = { xpm = { linux = { deps = { "xim:qemu-arm@9.2.4-1" }, + ["0.2.0"] = { + url = { + GLOBAL = "https://github.com/mcpplibs/aarch64-virt-rt/archive/refs/tags/0.2.0.tar.gz", + CN = "https://gitcode.com/mcpp-res/aarch64-virt-rt/releases/download/0.2.0/aarch64-virt-rt-0.2.0.tar.gz", + }, + sha256 = "4a828424e82a3c97f6d45456fdfa557c7ab361929ef54bb3055037867a4e1978", + }, ["0.1.1"] = { url = { GLOBAL = "https://github.com/mcpplibs/aarch64-virt-rt/archive/refs/tags/0.1.1.tar.gz", @@ -73,6 +80,13 @@ package = { }, macosx = { deps = { "xim:qemu-arm@9.2.4-1" }, + ["0.2.0"] = { + url = { + GLOBAL = "https://github.com/mcpplibs/aarch64-virt-rt/archive/refs/tags/0.2.0.tar.gz", + CN = "https://gitcode.com/mcpp-res/aarch64-virt-rt/releases/download/0.2.0/aarch64-virt-rt-0.2.0.tar.gz", + }, + sha256 = "4a828424e82a3c97f6d45456fdfa557c7ab361929ef54bb3055037867a4e1978", + }, ["0.1.1"] = { url = { GLOBAL = "https://github.com/mcpplibs/aarch64-virt-rt/archive/refs/tags/0.1.1.tar.gz", @@ -90,6 +104,13 @@ package = { }, windows = { deps = { "xim:qemu-arm@9.2.4-1" }, + ["0.2.0"] = { + url = { + GLOBAL = "https://github.com/mcpplibs/aarch64-virt-rt/archive/refs/tags/0.2.0.tar.gz", + CN = "https://gitcode.com/mcpp-res/aarch64-virt-rt/releases/download/0.2.0/aarch64-virt-rt-0.2.0.tar.gz", + }, + sha256 = "4a828424e82a3c97f6d45456fdfa557c7ab361929ef54bb3055037867a4e1978", + }, ["0.1.1"] = { url = { GLOBAL = "https://github.com/mcpplibs/aarch64-virt-rt/archive/refs/tags/0.1.1.tar.gz", diff --git a/pkgs/c/cortex-m-rt.lua b/pkgs/c/cortex-m-rt.lua index 1efa393..6df20e0 100644 --- a/pkgs/c/cortex-m-rt.lua +++ b/pkgs/c/cortex-m-rt.lua @@ -43,30 +43,30 @@ package = { xpm = { linux = { - ["0.2.3"] = { + ["0.2.4"] = { url = { - GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.3.tar.gz", - CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.3/cortex-m-rt-0.2.3.tar.gz", + GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.4.tar.gz", + CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.4/cortex-m-rt-0.2.4.tar.gz", }, - sha256 = "2b926b10df89ad35d9eff7d1c318b334317d106525cb24eea00a0c623e448ce7", + sha256 = "6709be9d6795e377b9b82a7dde805aee1bb8b99bde4ab720bf4ea8055190e12e", }, }, macosx = { - ["0.2.3"] = { + ["0.2.4"] = { url = { - GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.3.tar.gz", - CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.3/cortex-m-rt-0.2.3.tar.gz", + GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.4.tar.gz", + CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.4/cortex-m-rt-0.2.4.tar.gz", }, - sha256 = "2b926b10df89ad35d9eff7d1c318b334317d106525cb24eea00a0c623e448ce7", + sha256 = "6709be9d6795e377b9b82a7dde805aee1bb8b99bde4ab720bf4ea8055190e12e", }, }, windows = { - ["0.2.3"] = { + ["0.2.4"] = { url = { - GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.3.tar.gz", - CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.3/cortex-m-rt-0.2.3.tar.gz", + GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.4.tar.gz", + CN = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.4/cortex-m-rt-0.2.4.tar.gz", }, - sha256 = "2b926b10df89ad35d9eff7d1c318b334317d106525cb24eea00a0c623e448ce7", + sha256 = "6709be9d6795e377b9b82a7dde805aee1bb8b99bde4ab720bf4ea8055190e12e", }, }, }, diff --git a/pkgs/l/llvm.compiler-rt-builtins.lua b/pkgs/l/llvm.compiler-rt-builtins.lua index de66ada..8a918c1 100644 --- a/pkgs/l/llvm.compiler-rt-builtins.lua +++ b/pkgs/l/llvm.compiler-rt-builtins.lua @@ -40,30 +40,30 @@ package = { xpm = { linux = { - ["22.1.8.1"] = { + ["22.1.8.2"] = { url = { - GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.1/compiler-rt-builtins-22.1.8.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.2.tar.gz", + CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.2/compiler-rt-builtins-22.1.8.2.tar.gz", }, - sha256 = "799797e79e927d28b949e8723d9642e2b8a9d8e997b8c56ecc84ee8220228da3", + sha256 = "c6070e0b878aef1d526ce764b9ad3d6e5396b230d059262ed5615c2e0bf78dfd", }, }, macosx = { - ["22.1.8.1"] = { + ["22.1.8.2"] = { url = { - GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.1/compiler-rt-builtins-22.1.8.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.2.tar.gz", + CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.2/compiler-rt-builtins-22.1.8.2.tar.gz", }, - sha256 = "799797e79e927d28b949e8723d9642e2b8a9d8e997b8c56ecc84ee8220228da3", + sha256 = "c6070e0b878aef1d526ce764b9ad3d6e5396b230d059262ed5615c2e0bf78dfd", }, }, windows = { - ["22.1.8.1"] = { + ["22.1.8.2"] = { url = { - GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.1/compiler-rt-builtins-22.1.8.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.2.tar.gz", + CN = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.2/compiler-rt-builtins-22.1.8.2.tar.gz", }, - sha256 = "799797e79e927d28b949e8723d9642e2b8a9d8e997b8c56ecc84ee8220228da3", + sha256 = "c6070e0b878aef1d526ce764b9ad3d6e5396b230d059262ed5615c2e0bf78dfd", }, }, }, diff --git a/pkgs/p/picolibc.picolibc.lua b/pkgs/p/picolibc.picolibc.lua index b16e255..821e2eb 100644 --- a/pkgs/p/picolibc.picolibc.lua +++ b/pkgs/p/picolibc.picolibc.lua @@ -57,30 +57,30 @@ package = { xpm = { linux = { - ["1.8.12.1"] = { + ["1.8.12.2"] = { url = { - GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.1/picolibc-1.8.12.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.2.tar.gz", + CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.2/picolibc-1.8.12.2.tar.gz", }, - sha256 = "8c148d5cce7857caeeeacacc95c28e1bbdf13cc06408876ae2fdaece2caaefa8", + sha256 = "29045a2eed39a421353dec6f7763f3d78eda88d0957f9eec6833143d92b2e2fd", }, }, macosx = { - ["1.8.12.1"] = { + ["1.8.12.2"] = { url = { - GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.1/picolibc-1.8.12.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.2.tar.gz", + CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.2/picolibc-1.8.12.2.tar.gz", }, - sha256 = "8c148d5cce7857caeeeacacc95c28e1bbdf13cc06408876ae2fdaece2caaefa8", + sha256 = "29045a2eed39a421353dec6f7763f3d78eda88d0957f9eec6833143d92b2e2fd", }, }, windows = { - ["1.8.12.1"] = { + ["1.8.12.2"] = { url = { - GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.1.tar.gz", - CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.1/picolibc-1.8.12.1.tar.gz", + GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.2.tar.gz", + CN = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.2/picolibc-1.8.12.2.tar.gz", }, - sha256 = "8c148d5cce7857caeeeacacc95c28e1bbdf13cc06408876ae2fdaece2caaefa8", + sha256 = "29045a2eed39a421353dec6f7763f3d78eda88d0957f9eec6833143d92b2e2fd", }, }, }, diff --git a/pkgs/r/riscv-virt-rt.lua b/pkgs/r/riscv-virt-rt.lua index 3be7f0a..e0d6d1d 100644 --- a/pkgs/r/riscv-virt-rt.lua +++ b/pkgs/r/riscv-virt-rt.lua @@ -62,6 +62,13 @@ package = { -- published is a version someone may have pinned. xpm = { linux = { + ["0.7.0"] = { + url = { + GLOBAL = "https://github.com/mcpplibs/riscv-virt-rt/archive/refs/tags/0.7.0.tar.gz", + CN = "https://gitcode.com/mcpp-res/riscv-virt-rt/releases/download/0.7.0/riscv-virt-rt-0.7.0.tar.gz", + }, + sha256 = "f97ba771783d8f5fa56bb5bfc7ed9626f448db2605b9fe95ff1cef4137aceb74", + }, ["0.6.1"] = { url = { GLOBAL = "https://github.com/mcpplibs/riscv-virt-rt/archive/refs/tags/0.6.1.tar.gz", @@ -128,6 +135,13 @@ package = { }, }, macosx = { + ["0.7.0"] = { + url = { + GLOBAL = "https://github.com/mcpplibs/riscv-virt-rt/archive/refs/tags/0.7.0.tar.gz", + CN = "https://gitcode.com/mcpp-res/riscv-virt-rt/releases/download/0.7.0/riscv-virt-rt-0.7.0.tar.gz", + }, + sha256 = "f97ba771783d8f5fa56bb5bfc7ed9626f448db2605b9fe95ff1cef4137aceb74", + }, ["0.6.1"] = { url = { GLOBAL = "https://github.com/mcpplibs/riscv-virt-rt/archive/refs/tags/0.6.1.tar.gz", @@ -194,6 +208,13 @@ package = { }, }, windows = { + ["0.7.0"] = { + url = { + GLOBAL = "https://github.com/mcpplibs/riscv-virt-rt/archive/refs/tags/0.7.0.tar.gz", + CN = "https://gitcode.com/mcpp-res/riscv-virt-rt/releases/download/0.7.0/riscv-virt-rt-0.7.0.tar.gz", + }, + sha256 = "f97ba771783d8f5fa56bb5bfc7ed9626f448db2605b9fe95ff1cef4137aceb74", + }, ["0.6.1"] = { url = { GLOBAL = "https://github.com/mcpplibs/riscv-virt-rt/archive/refs/tags/0.6.1.tar.gz",