leptris 1.9.361.0-ppc64le-linux → 1.9.362.1-ppc64le-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d8e862fd2373fdbb557f098ee97391453e3d99d93059743ac4bc88e24c26865c
-  data.tar.gz: b33652a2a82d7b9cb0470be4b5c5e5d8e63e253cf5c6d55e0ca1f4b2f8d6592e
+  metadata.gz: 9780542c27af094df56b7dbf848569f0006fcb73c60b941430dd04324e5ec49e
+  data.tar.gz: 23fb2d1e896b432b6b19719bd5f4c7ba2684c527029abc41eb8b1795f3079bfc
 SHA512:
-  metadata.gz: cd17ceb87f3da41ef960e8a8096f9cfa8751d26490f27d9a3a71b2775bb2fddfde8e3036b581239b4941abe42c85eac27844970405c245d69322d21664d92667
-  data.tar.gz: 603ad2eb391d23de4eab6b4fa0b7ae19698822ab1ab688b3613469a4e96e1a1db4dc0d54365a631fd2efec844f1df34ff9bd2f8e7e2309b07e3e7cd61d57f341
+  metadata.gz: '034691190cf53120d6ac25a1508baf4884cabbcbfb610eaecd4d77e8df8030f603f144a70c9cc646dc0584280de9f3baeb96e6a81325ec0a70e6103fb9f25198'
+  data.tar.gz: 2fc3de4b4ace30d69581f8025737b2f3208a759b7d5218af3e311e4490cc0721aece5cc106e24c403a51860aeb264ea4f345054f42f6ec33f993e80a014fbf05

data/README.adoc

@@ -17,6 +17,27 @@ The C DOM is the single source of truth — Ruby objects are thin FFI
 handles over the C pointers, so every Ruby method maps to one FFI call.
 No tree hydration, no parallel Ruby-side model.
 
+== Versioning: {engine-semver}.{binding-patch}
+
+Gem versions are **`{libleptris-semver}.{binding-patch}`** — the lockstep
+scheme. The first three components name the EXACT libleptris engine
+release the gem vendors; the fourth is the binding's own patch number
+for that engine.
+
+* engine `v1.9.361` + first binding release → `1.9.361.0`
+* binding-only fix on the same engine → `1.9.361.1`
+* engine `v1.9.362` ride → `1.9.362.0`
+
+The triple is a contract: `~> 1.9.361` pins both the engine behavior
+and the binding surface. **Never** publish a version whose first three
+components are not an existing engine release, never let the binding
+line run ahead of the engine line, and every engine release must get
+its binding ride (`.0`, or `.1` when the ride itself carries binding
+fixes). Releases go through the release workflow with an explicit
+`next_version` — the workflow owns the bump; version numbers are
+computed from the engine tag being ridden, never from
+"previous gem + 1".
+
 == Installation
 
 Add to your Gemfile:

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.359"
+LIBLEPTRIS_VERSION = "1.9.362"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the
@@ -292,13 +292,14 @@ task :compile do
     Dir.chdir(ext_dir) do
       sh "ruby extconf.rb"
       if RUBY_PLATFORM =~ /darwin/
-        # Link the bundle ourselves: setup-ruby's custom rubies
-        # make mkmf link libruby by absolute runner path no matter
-        # which RbConfig entries are cleared, and any libruby
-        # LC_LOAD_DYLIB is unresolvable on user machines. Compile
-        # via the Makefile, link with pure -undefined
-        # dynamic_lookup (Ruby symbols resolve from the loading
-        # interpreter) and a conservative deployment target.
+        # Link the bundle ourselves: mkmf snapshots LIBRUBYARG from
+        # RbConfig at require time, so setup-ruby's shared-libruby
+        # rubies record their absolute hostedtoolcache path in the
+        # bundle (shipped broken through 1.9.36x, #1739) and no
+        # post-require clearing can stop it. Compile via the
+        # Makefile, link with pure -undefined dynamic_lookup (Ruby
+        # symbols resolve from the loading interpreter) and a
+        # conservative deployment target.
         sh "make native.o"
         sh "cc -dynamic -bundle -undefined dynamic_lookup " \
            "-mmacosx-version-min=#{ENV['MACOSX_DEPLOYMENT_TARGET'] || '11.0'} " \
@@ -312,10 +313,11 @@ task :compile do
         # their symbols via -rdynamic, like any extension .so).
         sh "make native.o"
         sh "#{RbConfig::CONFIG['CC']} -shared -fPIC -o native.so native.o"
-        # Guard the contract in the build log.
-        sh "if strings native.so | grep -q libruby; then " \
-           "echo 'ERROR: native.so links libruby (#207)'; exit 1; fi"
       end
+      # Guard the linkage contract at the build chokepoint (#1739):
+      # no libruby reference, allowlisted load commands on darwin.
+      sh "#{RbConfig.ruby} ../../check_bundle_linkage.rb " \
+         "#{RUBY_PLATFORM =~ /darwin/ ? 'native.bundle' : 'native.so'}"
     end
     bundle = Dir.glob("#{ext_dir}/native.{bundle,so,dll}").first
     if bundle.nil?
@@ -337,6 +339,18 @@ task :compile do
       cp(bundle, "#{dest}.new")
       mv("#{dest}.new", dest)
       sign_darwin_binaries(dest)
+      # Per-minor twin (ruby#476): the loader prefers
+      # native_<minor>.{bundle,so}; dev builds run same-minor, so
+      # the copy is byte-identical and keeps `rake compile` +
+      # `rake spec` working without a full release matrix.
+      unless Gem.win_platform?
+        minor = RUBY_VERSION[/\A\d+\.\d+/].tr('.', '_')
+        ext = RUBY_PLATFORM.include?('darwin') ? '.bundle' : '.so'
+        twin = "lib/leptris/xml/native_#{minor}#{ext}"
+        cp(dest, "#{twin}.new")
+        mv("#{twin}.new", twin)
+        sign_darwin_binaries(twin)
+      end
       puts "Vendored native layer (#{File.basename(bundle)}) into lib/leptris/xml/"
     end
   end
@@ -412,11 +426,19 @@ namespace :audit do
   # leptris_version() equals the gem's engine pin (a half-bumped
   # lockstep state can no longer package). Negative proof lives
   # in spec/audit_codesign_spec.rb.
-  desc "Fail on unsigned/tampered macOS artifacts or engine-version drift"
+  desc "Fail on unsigned/tampered macOS artifacts, engine-version drift, or libruby-linked native layers"
   task :artifacts do
+    # Linkage contract over EVERY shipped native layer, per-minor
+    # twins included (#1739) — every platform: the 1.9.36x trains
+    # packaged runner-absolute libruby loads in native_3_2/3_4
+    # artifacts that audit:symbols/audit:artifacts never opened.
+    bundles = Dir.glob("lib/leptris/xml/native*.{bundle,so}")
+    bundles.each do |b|
+      sh "#{RbConfig.ruby} ext/check_bundle_linkage.rb #{b}"
+    end
     unless RUBY_PLATFORM =~ /darwin/
-      puts "audit:artifacts: skipped off-darwin (codesign gates " \
-           "the macOS packaging legs)"
+      puts "audit:artifacts: #{bundles.size} native layers linkage-clean; " \
+           "codesign gates skip off-darwin"
       next
     end
     abort "audit:artifacts: codesign unavailable" \
@@ -439,8 +461,8 @@ namespace :audit do
       abort "audit:artifacts: engine-version drift — vendored " \
             "#{vendored.inspect} != pin #{pinned.inspect}"
     end
-    puts "audit:artifacts: #{libs.size} macOS artifacts verify " \
-         "strictly and engine-synced (#{pinned})"
+    puts "audit:artifacts: #{libs.size} macOS artifacts + #{bundles.size} native " \
+         "layers verify strictly, linkage-clean and engine-synced (#{pinned})"
   end
 
   # Packaging doctrine (#271): every BUILT gem carries the engine
@@ -563,14 +585,18 @@ platforms.each do |platform|
     spec.files += Dir.glob("vendor-src/**/*")
     spec.files += %w[ext/leptris/native/extconf.rb
                      ext/leptris/native/native.c]
-    if platform.include?("mingw")
-      # #207/#227: per-Ruby-minor DLLs (PE must bind its Ruby).
-      # DOT-FREE names — MRI derives the init symbol from the
-      # basename cut at the first dot (native_3_3.so ->
-      # Init_native_3_3; the dotted form made Ruby look for
-      # "Init_native-3", which cannot exist).
-      spec.files += Dir.glob("lib/leptris/xml/native_*.so")
-    else
+    # #207/#227 + ruby#476: per-Ruby-minor bundles on EVERY
+    # platform (the ext's compiled-in RString layout changed in
+    # 3.2 — one CI-built bundle segfaults 3.1). DOT-FREE names —
+    # MRI derives the init symbol from the basename cut at the
+    # first dot (native_3_3.so -> Init_native_3_3; the dotted form
+    # made Ruby look for "Init_native-3", which cannot exist).
+    spec.files += Dir.glob("lib/leptris/xml/native_*.so")
+    spec.files += Dir.glob("lib/leptris/xml/native_*.bundle")
+    if !platform.include?("mingw")
+      # The unversioned bundle rides for toolchains that only run
+      # rake compile's single build (native_layer prefers the
+      # per-minor variant and never loads a wrong-ABI file).
       spec.files += Dir.glob("lib/leptris/xml/native.{bundle,so,dll}")
     end
     task = Gem::PackageTask.new(spec)

data/ext/build_native_per_minor.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+# Builds the native read layer bundle for the CURRENT Ruby and
+# installs it under its minor-versioned name
+# (lib/leptris/xml/native_<major>_<minor>.bundle on darwin, .so on
+# Linux).
+#
+# ruby#476: the ext's compiled-in RString layout changed in Ruby
+# 3.2 — a bundle built by a newer minor reads garbage pointers and
+# lengths under 3.1 (the parse segfaulted inside the engine's
+# correctly-bounded NEON text counter). One bundle per supported
+# minor therefore ships in the darwin/Linux platform gems — the
+# same contract the Windows gems have had since #207/#227 — and
+# native_layer picks by RUBY_VERSION at require, falling back to
+# the FFI surface when the variant for the running minor is
+# absent. A WRONG-ABI load is never attempted.
+#
+# The name is DOT-FREE: MRI derives a C extension's init symbol
+# from the require feature's basename cut at the first dot, so
+# native_3_1.bundle resolves Init_native_3_1 (exported by
+# native.c).
+
+require "rbconfig"
+require "fileutils"
+
+root = File.expand_path("..", __dir__)
+ext_dir = File.join(root, "ext", "leptris", "native")
+minor = RUBY_VERSION[/\A\d+\.\d+/]
+minor_us = minor.tr(".", "_")
+ext = RUBY_PLATFORM.include?("darwin") ? ".bundle" : ".so"
+
+Dir.chdir(ext_dir) do
+  # Force a clean compile on every invocation (stale objects from
+  # a failed earlier attempt ship silent wrong-ABI builds).
+  FileUtils.rm_f(Dir.glob("#{ext_dir}/native.{o,so,bundle}"))
+  system(RbConfig.ruby, "extconf.rb") or abort "extconf failed under #{RUBY_VERSION}"
+  # Link WITHOUT libruby (#1739): mkmf's Makefile rule records the
+  # building ruby's libruby — for setup-ruby builds by absolute
+  # hostedtoolcache path — in every LC_LOAD_DYLIB / DT_NEEDED, which
+  # dlopen-fails on any other machine. Compile via the Makefile,
+  # link exactly like rake compile's native branch: pure
+  # dynamic_lookup, rb_* resolve from the loading interpreter.
+  system("make native.o") or abort "make native.o failed under #{RUBY_VERSION}"
+  cc = RbConfig::CONFIG["CC"]
+  link =
+    if ext == ".bundle"
+      "#{cc} -dynamic -bundle -undefined dynamic_lookup " \
+        "-mmacosx-version-min=#{ENV['MACOSX_DEPLOYMENT_TARGET'] || '11.0'} " \
+        "-o native.bundle native.o"
+    else
+      "#{cc} -shared -fPIC -o native.so native.o"
+    end
+  system(link) or abort "native link failed under #{RUBY_VERSION}: #{link}"
+  built = Dir.glob("native.{so,bundle}").first
+  abort "native bundle not produced under #{RUBY_VERSION}" unless built
+
+  # Linkage gate: no libruby reference, and (darwin) only
+  # allowlisted load commands — enforced HERE so a violated bundle
+  # never reaches packaging (the 1.9.36x trains shipped exactly
+  # this shape, #1739).
+  system(RbConfig.ruby, File.join(root, "ext", "check_bundle_linkage.rb"),
+         File.expand_path(built)) or
+    abort "linkage gate failed under #{RUBY_VERSION}"
+
+  # Functional gate: dlopen the built bundle and resolve the
+  # MINOR-SUFFIXED init symbol — only a real lookup proves
+  # require "leptris/xml/native_<minor>" will resolve.
+  begin
+    require "fiddle"
+    Fiddle.dlopen(File.expand_path(built))["Init_native_#{minor_us}"]
+  rescue LoadError => e
+    warn "fiddle unavailable under #{RUBY_VERSION} (#{e.message}) — skipping"
+  rescue Fiddle::DLError => e
+    abort "#{built} does not export Init_native_#{minor_us} — refusing to " \
+          "install a bundle that would fail at require (#{e.message})"
+  end
+
+  dest = File.join(root, "lib", "leptris", "xml", "native_#{minor_us}#{ext}")
+  FileUtils.cp(built, dest)
+  puts "Installed native layer for Ruby #{minor} -> #{dest}"
+end

data/ext/build_windows_native.rb

@@ -29,14 +29,17 @@ Dir.chdir(ext_dir) do
   # because make reused a stale native.obj from a failed earlier
   # attempt (the log shows "creating Makefile -> linking" with no
   # compile). Force a clean compile on every invocation.
-  FileUtils.rm_f(Dir.glob("#{ext_dir}/native.{o,obj,so,dll}"))
-  FileUtils.rm_f("#{ext_dir}/leptris/xml/native.so")
+  # The globs cover both spellings of the mkmf target: the
+  # unversioned name and the per-minor name extconf now creates
+  # the Makefile for (#476 source-install parity).
+  FileUtils.rm_f(Dir.glob("#{ext_dir}/native*.{o,obj,so,dll}"))
+  FileUtils.rm_f(Dir.glob("#{ext_dir}/leptris/xml/native*.so"))
   system(RbConfig.ruby, "extconf.rb") or abort "extconf failed under #{RUBY_VERSION}"
   # mkmf's link binds the CURRENT Ruby's runtime DLL — exactly
   # what the versioned naming is for.
   success = system("make")
   abort "make failed under #{RUBY_VERSION}" unless success
-  so = Dir.glob("native.{so,dll}").first
+  so = Dir.glob("native*.so").first
   abort "native bundle not produced under #{RUBY_VERSION}" unless so
   # Functional export gate: dlopen the built DLL and resolve the
   # MINOR-SUFFIXED init symbol. A PE DLL can carry the symbol in its

data/ext/check_bundle_linkage.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+# Linkage contract for shipped native layers (#1739 / ruby#481): a
+# Ruby extension resolves rb_* symbols from the LOADING interpreter,
+# so the artifact must never link libruby — mkmf records the
+# building ruby's absolute path (setup-ruby's hostedtoolcache
+# location), which dlopen-fails on every other machine and silently
+# degrades the whole install to FFI. On darwin the check is
+# stricter: every load command must stay inside the loader
+# allowlist. Windows PE DLLs are exempt — binding the build
+# runtime is the documented contract there (#227).
+#
+# Runnable as a script over any number of artifacts (exit 1 on the
+# first violated contract batch) or required for the pure checks in
+# spec/check_bundle_linkage_spec.rb.
+module CheckBundleLinkage
+  ALLOWED_PREFIXES = %w[@rpath/ @loader_path/ @executable_path/ /usr/lib/ /System/].freeze
+
+  # The LC_LOAD_DYLIB paths otool -L lists that fall outside the
+  # allowlist. +otool_output+ is the raw stdout of `otool -L <file>`;
+  # entries are the tab-indented "<install name> (compatibility
+  # version X, current version Y)" lines.
+  def self.load_command_violations(otool_output)
+    otool_output.lines.grep(/^\t.*\(compatibility version/)
+                .filter_map { |l| l.split.first }
+                .reject { |path| ALLOWED_PREFIXES.any? { |p| path.start_with?(p) } }
+  end
+
+  # The libruby sonames a strings(1) dump reveals — the ELF-side
+  # tripwire for DT_NEEDED entries and RUNPATH spellings alike.
+  def self.libruby_references(strings_output)
+    strings_output.scan(/libruby[\w.]*/).uniq
+  end
+end
+
+if $PROGRAM_NAME == __FILE__
+  require "shellwords"
+
+  status = 0
+  ARGV.each do |path|
+    next if path.end_with?(".dll")
+
+    bad = CheckBundleLinkage.libruby_references(`strings #{Shellwords.escape(path)} 2>/dev/null`)
+    unless bad.empty?
+      warn "ERROR: #{path} references #{bad.join(', ')} — Ruby symbols must " \
+           "resolve from the loading interpreter, never a linked libruby " \
+           "(#1739); link with -undefined dynamic_lookup / plain -shared"
+      status = 1
+    end
+    next unless RUBY_PLATFORM.include?("darwin")
+
+    viol = CheckBundleLinkage.load_command_violations(`otool -L #{Shellwords.escape(path)} 2>/dev/null`)
+    next if viol.empty?
+
+    warn "ERROR: #{path} carries load commands outside the loader " \
+         "allowlist (#{CheckBundleLinkage::ALLOWED_PREFIXES.join(' ')}): " \
+         "#{viol.join(', ')} (#1739)"
+    status = 1
+  end
+  exit status
+end

data/ext/leptris/native/extconf.rb

@@ -28,6 +28,19 @@ unless %w[ruby truffleruby].include?(RUBY_ENGINE)
        "installing without the compiled native layer"
   exit 0
 end
+# Never link libruby: a Ruby extension resolves rb_* symbols from
+# the LOADING interpreter, and mkmf records the building ruby's
+# libruby (for setup-ruby, an absolute hostedtoolcache path) into
+# the bundle otherwise — dlopen-failing on every other machine
+# (#1739). mkmf snapshots $LIBRUBYARG* from RbConfig at require
+# time, so this MUST precede `require "mkmf"`; a later clearing is
+# a silent no-op (exactly how the 1.9.36x trains shipped broken).
+if RUBY_PLATFORM =~ /darwin/
+  %w[LIBRUBYARG LIBRUBYARG_SHARED LIBRUBYARG_STATIC].each do |key|
+    RbConfig::CONFIG[key] = ""
+    RbConfig::MAKEFILE_CONFIG[key] = ""
+  end
+end
 require "mkmf"
 
 # A prebuilt libleptris in lib/ (dev checkout after rake compile,
@@ -106,18 +119,25 @@ if RUBY_PLATFORM =~ /darwin/
   [$LDFLAGS, $DLDFLAGS].each do |var|
     var << lookup unless var.include?("dynamic_lookup")
   end
-  # setup-ruby builds carry the RUNNER's absolute libruby path in
-  # LIBRUBYARG_SHARED — recorded as an LC_LOAD_DYLIB in the
-  # bundle, unresolvable on user machines. A Ruby extension
-  # resolves Ruby symbols from the loading interpreter; never
-  # link libruby.
-  # BOTH maps: mkmf's Makefile interpolates from MAKEFILE_CONFIG,
-  # not CONFIG — clearing only CONFIG is a silent no-op (caught via
-  # the build-log otool on the runner).
-  RbConfig::CONFIG["LIBRUBYARG_SHARED"] = ""
-  RbConfig::CONFIG["LIBRUBYARG_STATIC"] = ""
-  RbConfig::MAKEFILE_CONFIG["LIBRUBYARG_SHARED"] = ""
-  RbConfig::MAKEFILE_CONFIG["LIBRUBYARG_STATIC"] = ""
+  # ruby#476: newer ld64 defaults BUNDLES to two-level namespace —
+  # with -undefined dynamic_lookup a two-level bind records the
+  # symbol as expected from the MAIN EXECUTABLE ("main-executable"),
+  # and interpreters that don't re-export every ruby symbol from
+  # their binary abort at first call ("dyld missing symbol called",
+  # hit at Init_native's first import). -flat_namespace is the
+  # classic C-extension pattern: dynamic_lookup symbols search all
+  # loaded images at call time and resolve from libruby.
+  flat = " -Wl,-flat_namespace"
+  [$LDFLAGS, $DLDFLAGS].each do |var|
+    var << flat unless var.include?("flat_namespace")
+  end
+  # Belt for the require-time snapshot: RbConfig was cleared BEFORE
+  # `require "mkmf"` (top of file), and the module globals mkmf
+  # captured then are zeroed here too — a Ruby extension resolves
+  # Ruby symbols from the loading interpreter; never link libruby.
+  $LIBRUBYARG = ""
+  $LIBRUBYARG_SHARED = ""
+  $LIBRUBYARG_STATIC = ""
 end
 if Gem.win_platform?
   # Windows names the artifact per Ruby minor, DOT-FREE (#227
@@ -137,4 +157,12 @@ if Gem.win_platform?
   win_def = " #{def_path.tr('/', '\\\\')}"
   $DLDFLAGS << win_def unless $DLDFLAGS.include?("native_exports.def")
 end
-create_makefile("leptris/xml/native")
+# Name the artifact per Ruby minor EVERYWHERE (#476): the loader
+# requires native_<minor> and deliberately has NO unversioned
+# fallback (loading a bundle built by another minor is the 3.1
+# wrong-ABI segfault class), so a source install must produce the
+# per-minor name itself. mkmf derives Init_native_<minor> from the
+# same basename — exported by native.c and pinned in the Windows
+# .def above.
+minor_us = RUBY_VERSION[/\A\d+\.\d+/].tr(".", "_")
+create_makefile("leptris/xml/native_#{minor_us}")