ocran 1.4.2 → 1.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ff520e4a8036bbcec4c8a1e56c96c89297cf43a88dd868d77ae5f4aadac7865c
-  data.tar.gz: 7735500efac55f60da13cf8c854bb6f80967b091b8baad310889073c7b8093eb
+  metadata.gz: 79aa33b2625758b6cce7b1175d45d73c5c60209b996a6d5ab03a4df55acbae28
+  data.tar.gz: 3d53ff8c8b7a31448080f105f33af4968dea8f9a8fd559aa92a9e87db31db0dd
 SHA512:
-  metadata.gz: 7f360b8ea6dd7f87887a9afaa31e1053d0208588f91e24f6ccb224e6e17afe5ca4f2c7558b99907caaea540097b62c14aa3e2fd0cd89ada4615b54da316c883f
-  data.tar.gz: 5586f5255f2d966c12a23bbe934d1743b0b2f12158307dee2c94dbaa7b3731a08c31f019a378740280da2895d6a216c750da47b84f5fe30143bfc3d5d755bafe
+  metadata.gz: e9975e649595c77397e49649544fad56b209917a55f7ea6d7ff7acf748a14608165013fbe1e43908946b0cba1badbae22da7b73aac4ba2661fb092162d333386
+  data.tar.gz: 67007f4112f91a8bb6a01564a8b5b4b54edd2b852a629f78d1bc12bd9062e3a71771fe0a802bc9f3133560cd0aa7da18fa912f0eb0f2f8337288ea226be308b2

data/CHANGELOG.txt

@@ -1,3 +1,29 @@
+=== 1.4.4
+- Fix crash on distro-packaged and Homebrew Ruby when a default gem (e.g. fiddle, singleton) has a gemspec but no materialized gem directory: file collection now treats the missing directory as an empty set instead of raising Errno::ENOENT from Find.find (issue #44). The gem's files, which live in the stdlib, are still packed via the load path.
+- Pack the real Ruby interpreter when bindir/ruby is a dispatcher script (e.g. Fedora's rubypick): the running interpreter binary (/proc/self/exe) is packed under the expected name instead, so the packed executable no longer requires Ruby on the target system.
+- Build runtime RUBYLIB from the build Ruby's actual default load path in addition to the RbConfig directories, covering distro-specific compiled-in entries such as Fedora's /usr/share/rubygems where rubygems.rb lives outside rubylibdir.
+- Include every Gem.path entry under the Ruby prefix in the runtime GEM_PATH (not just Gem.default_dir), so RubyGems can activate gems from split layouts like Fedora's /usr/share/gems + /usr/local/share/gems.
+- Make default gems activatable at runtime: their gemspecs (from specifications/default/, which RubyGems only scans under the compiled-in Gem.default_dir) are also copied into the regular specifications directory of the same packed base directory.
+- Handle distros that expose gem files under additional symlinked paths (e.g. Fedora symlinks /usr/share/ruby/psych.rb into the psych gem directory): loaded features are resolved by realpath so they are packed inside the gem directory, and duplicate stdlib-level copies that would shadow the packed gem at runtime are no longer packed.
+- Pack native extension files that distros build outside the gem's base_dir (e.g. Fedora's /usr/lib64/gems/ruby) into the extension directory RubyGems computes at runtime, and recreate the gem.build_complete marker there so the gem activates instead of being ignored ("its extensions are not built").
+- Linux: bundle detected non-glibc shared libraries (libyaml, libssl, libcrypt, libgmp, libz, ...) next to libruby, with soname symlink aliases, so packed executables also run on other distros where these are missing or have different sonames. Core glibc libraries, the loader, and libnss_* plugins are never bundled; the target's glibc must be at least as new as the build host's. Disable with --no-autodll.
+- CI: new isolated workflow test-aspera-cli.yml that packages the aspera-cli gem with distro Ruby on Fedora and verifies the executable runs on clean Fedora and Ubuntu containers without Ruby. Kept separate from the release pipeline with a read-only token; the third-party gem only ever runs inside throwaway containers.
+- Restore the OCRA-compatible wrapper executable for Inno Setup builds: `--innosetup` now additionally builds a small stub executable named after `--output` and installs it into `{app}` alongside the application files. The wrapper runs the installed application directly from its own directory (new RUN_IN_EXE_DIR stub mode) — no extraction, no cleanup of the application directory. This behavior existed in OCRA and ocran <= 1.3.x but was lost in the 1.4.0 rewrite, breaking user ISS scripts that reference the executable, e.g. in [Run]/[UninstallRun] entries or for Windows service registration (`myapp.exe --register-service`). The launcher.bat is still generated and installed as before.
+- Add `run_in_exe_dir` option to StubBuilder and a RUN_IN_EXE_DIR (0x20) stub header flag. In this mode the stub never deletes its directory (double-guarded in the stub itself, since the directory is the real application directory).
+- Allow `--innosetup` on POSIX hosts when an ISCC command is available in PATH (e.g. a Wine wrapper); previously it was rejected on non-Windows unconditionally. Fix the ISCC presence check to use `command -v` instead of the Windows-only `where`/`>NUL` on POSIX.
+- Inno Setup builds from POSIX hosts no longer crash on symlink entries (symlinks cannot be expressed in an installer script and are skipped; they are only generated for POSIX shared-library aliases).
+- `--output-dir` and `--output-zip` now also include the wrapper executable (named after `--output`) next to the launch script, so the unpacked output has a doubleclickable, pinnable, signable entry point that can even be registered as a Windows service. The launch script (`.bat`/`.sh`) is still generated.
+- New `--no-wrapper-exe` option: omit the wrapper executable from installer, directory and zip output.
+- Always create the packed prefix gem directories (e.g. lib/ruby/gems/<api>) even when empty: RubyGems probes the default gem dir for writability at startup and printed "Can't determine writability of default gem path" on stderr for every packed executable on newer RubyGems.
+- Stub: normalize the extraction/application directory to its long path form on Windows (GetLongPathName). With an 8.3 short TEMP path (e.g. C:\Users\RUNNER~1) the same file could be loaded under two spellings, defeating $LOADED_FEATURES deduplication and causing "already initialized constant" warnings.
+
+=== 1.4.3
+- Migrate edicon from C to Ruby: replace edicon.exe with a pure-Ruby implementation (ed_icon.rb), fixing incorrect BeginUpdateResource error checking and wrong GroupIconSize calculation. Shortens build times and removes the C binary from the build.
+- Include Gem.default_dir in GEM_PATH on all platforms: previously the exec_prefix gem directory was excluded on Windows, causing native-extension gems (e.g. fxruby/fox16) to fail at runtime with a LoadError even though they were bundled correctly.
+- Add FXRuby (fox16) test: verify that native extension DLLs are bundled correctly so the packaged executable does not raise a LoadError at runtime.
+- CI: start a virtual display (xpra + Xorg dummy driver with GLX) on Linux before running tests so FXRuby's X11 requirement is satisfied.
+- CI: install XQuartz on macOS runners and add it to the portability test job so FXRuby can connect to a display on both test and portability jobs.
+
 === 1.4.2
 - Auto-bundle OpenSSL and all its transitive dependencies (openssl.rb, digest.so, etc.) when net/http is loaded but no HTTPS request was made during the dependency scan. OpenSSL is now required inside the OCRAN build process so every file it pulls in appears in the bundled executable.
 - Add companion DLL scan on windows: when a native extension (.so) within the Ruby installation is loaded, all DLLs in the same directory are proactively included. This ensures libssl-3-x64.dll, libcrypto-3-x64.dll, libwinpthread-1.dll, and libyaml-0-2.dll are bundled even when no HTTPS connection is made during the build scan.

data/README.md

@@ -1,12 +1,6 @@
-# ocran
+# OCRAN
 
-home   :: https://github.com/largo/ocran/
-
-issues :: http://github.com/largo/ocran/issues
-
-## Description
-
-OCRAN (One-Click Ruby Application Next) packages Ruby applications for
+[OCRAN (One-Click Ruby Application Next)](https://github.com/largo/ocran) packages Ruby applications for
 distribution. It bundles your script, the Ruby interpreter, gems, and native
 libraries into a single self-contained artifact that runs without requiring
 Ruby to be installed on the target machine.
@@ -21,20 +15,24 @@ OCRAN supports four output formats, all cross-platform:
 OCRAN is a fork of [OCRA](https://github.com/larsch/ocra) maintained for
 Ruby 3.2+ compatibility.
 
+If you run into errors while using OCRAN, please check the [OCRAN issues](https://github.com/largo/ocran/issues) first.
+
 ## Recommended usage
 
-The most common use-case is shipping a program to Windows servers or users
-who do not have Ruby installed. By default, each time the `.exe` is opened it
+The most common use-case is shipping a program to users running Windows / Linux / macOS
+who do not have Ruby installed. By default, each time the `.exe` / executable is opened it
 extracts the Ruby interpreter and your code to a temporary directory and runs
 them from there.
 
-Because extraction takes time on each launch, consider using the Inno Setup
+Because extraction takes time on each launch, use `--output-dir` or
+`--output-zip` to produce a portable directory/archive that runs with the
+bundled Ruby on Linux, macOS, or Windows.
+If using Windows you can use  the Inno Setup
 option (`--innosetup`) to produce a proper installer that extracts once to a
 permanent directory.
 
-For cross-platform packaging or CI artifacts, use `--output-dir` or
-`--output-zip` to produce a portable directory/archive that runs with the
-bundled Ruby on Linux, macOS, or Windows.
+You can easily generate binaries for the supported Operating Systems with GitHub
+Actions — see [Building for multiple platforms with GitHub Actions](#building-for-multiple-platforms-with-github-actions).
 
 ## Features
 
@@ -74,12 +72,12 @@ https://github.com/largo/ocran/releases/.
 
 ## Synopsis
 
-### Building a Windows executable:
+### Building an executable:
 
     ocran script.rb
 
 Packages `script.rb`, the Ruby interpreter, and all dependencies (gems and
-DLLs) into `script.exe`.
+DLLs) into `script.exe` or `script` on Linux or macOS.
 
 ### Building a portable directory (Linux / macOS / Windows):
 
@@ -238,12 +236,98 @@ OCRAN on the same platform (and architecture) as the intended target**:
 There is no support for building a Windows `.exe` from a Linux or macOS host,
 or vice versa. If you need builds for multiple platforms, run OCRAN in CI on
 each target platform separately (e.g., a Windows runner for `.exe` builds and
-a Linux runner for Linux builds).
+a Linux runner for Linux builds). See
+[Building for multiple platforms with GitHub Actions](#building-for-multiple-platforms-with-github-actions)
+for a ready-made setup.
+
+### Linux binary portability (glibc)
+
+On Linux, OCRAN bundles the shared libraries your application loaded during
+the build (libyaml, libssl, libcrypt, libgmp, libz, ...) next to the bundled
+Ruby, so the executable also runs on distributions where those libraries are
+missing or have different sonames. It works with distro-packaged Ruby too
+(e.g. `dnf install ruby` on Fedora), including its split gem layout and
+`rubypick` wrapper.
+
+One thing can never be bundled: **glibc itself** (and its dynamic loader).
+Those always come from the target system, and glibc is only
+backward-compatible. In practice:
+
+* A Linux binary runs on any distribution whose glibc is **at least as new**
+  as the build machine's.
+* Build on the **oldest** distribution you want to support. For example, a
+  binary built on the oldest available `ubuntu-*` GitHub runner runs on that
+  Ubuntu version and everything newer, while a binary built on a
+  cutting-edge distribution (e.g. `fedora:latest`) will not run on older
+  Debian/Ubuntu releases (`` version `GLIBC_2.4x' not found ``).
+
+Use `--no-autodll` to disable shared library bundling.
+
+## Building for multiple platforms with GitHub Actions
+
+Since OCRAN is not a cross-compiler, the recommended way to ship your app for
+Windows, Linux, and macOS is a GitHub Actions matrix that runs OCRAN natively
+on each platform. A minimal workflow:
+
+```yaml
+name: Build binaries
+
+on:
+  push:
+    tags: ['v*']      # build releases from version tags
+  workflow_dispatch:   # allow manual runs
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: windows-latest   # x86-64 Windows .exe
+          - os: ubuntu-22.04     # x86-64 Linux; oldest runner = widest glibc compatibility
+          - os: macos-14         # Apple Silicon macOS
+          - os: macos-15-intel   # Intel macOS
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.4'
+          bundler-cache: true    # if your app has a Gemfile
+
+      - run: gem install ocran
+
+      # Run OCRAN on your entry script. Add "-- <args>" if your script needs
+      # arguments to exit cleanly during the dependency-detection run.
+      - run: ocran myapp.rb --output myapp
+        # produces myapp.exe on Windows, myapp on Linux/macOS
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: myapp-${{ matrix.os }}
+          path: myapp*
+```
+
+Notes:
+
+* Pick the **oldest** `ubuntu-*` runner GitHub offers for the Linux build so
+  the binary runs on as many distributions as possible (see
+  [Linux binary portability](#linux-binary-portability-glibc)).
+* On macOS, each architecture needs its own build: `macos-14` (and newer
+  numbered ARM runners) produce Apple Silicon binaries, `macos-15-intel`
+  produces Intel binaries.
+* Swap the `ocran` invocation for `--output-dir`, `--output-zip`,
+  `--macosx-bundle`, or `--innosetup` depending on how you want to ship
+  (see [Recommended usage](#recommended-usage)).
+* For tag pushes you can attach the artifacts to a GitHub release with a
+  follow-up job (e.g. `softprops/action-gh-release`).
 
 ## Requirements
 
 * Ruby 3.2+
-* For building Windows `.exe`: Windows with RubyInstaller DevKit (mingw-w64), or Wine on Linux/macOS
+* For building Windows `.exe`: Windows with [RubyInstaller DevKit](https://rubyinstaller.org/downloads/) (mingw-w64), or Wine on Linux/macOS
+* For building Linux and MacOS binaries: the respective build tools
 * For `--output-dir` / `--output-zip`: any platform with Ruby 3.2+
 * For `--output-zip` on Linux/macOS: the `zip` command must be available
 * For `--output-zip` on Windows: PowerShell (included in Windows 8+)
@@ -319,8 +403,12 @@ If your script uses `Kernel#autoload`, OCRAN will attempt to load those
 constants so they are included in the output. Missing modules are ignored
 with a warning.
 
-Dynamic link libraries (.dll files, for example WxWidgets, or other
-source files) will be detected and included by OCRAN.
+Dynamic link libraries are detected and included by OCRAN: `.dll` files on
+Windows (for example WxWidgets), and on Linux the non-glibc shared libraries
+the process loaded (libyaml, libssl, libcrypt, ...), which are placed next to
+the bundled Ruby with appropriate soname symlinks (see
+[Linux binary portability](#linux-binary-portability-glibc)). Disable with
+`--no-autodll`.
 
 ### Including libraries non-automatically
 
@@ -526,12 +614,19 @@ file:
       end
     end
 
+## See elsewhere
+
+- [State of Ruby Packagers](https://gist.github.com/YOU54F/3775e66e6090e0371c11601e6b75c305)
+- [Traveling Ruby](https://github.com/trubygems/traveling-ruby)
+
 ## Credits
 
-Lars Christensen and contributors for the OCRA project which this is forked from.
+[Andi Idogawa](https://github.com/largo), [Shinokaro](https://github.com/shinokaro)
+[Lars Christensen](https://github.com/larsch) and contributors for the OCRA project which this is forked from.
+
+Special thanks to Ruby on Windows maintainers such as [Nobuyoshi Nakada](https://github.com/nobu), [Lars Kanis](https://github.com/larskanis), and [MSP-Greg](https://github.com/MSP-Greg)
 
-Kevin Walzer of codebykevin, Maxim Samsonov for ocra2, John Mair for
-codesigning support.
+[Kevin Walzer](https://github.com/codebykevin) of codebykevin, [Maxim Samsonov](https://github.com/maxirmx), and [John Mair](https://github.com/banister) for codesigning support.
 
 Igor Pavlov for the LZMA compressor and decompressor (Public Domain).
 
@@ -545,7 +640,7 @@ http://ruby.morphball.net/vit-ruby-ico_en.html).
 (The MIT License)
 
 Copyright (c) 2009-2020 Lars Christensen
-Copyright (c) 2020-2025 The OCRAN Committers Team
+Copyright (c) 2020-2026 The OCRAN Committers Team
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/lib/ocran/build_facade.rb

@@ -10,6 +10,8 @@ module Ocran
 
     def cp(...) = @filer.__send__(__method__, ...)
 
+    def symlink(...) = @filer.__send__(__method__, ...)
+
     def export(...) = @launcher.__send__(__method__, ...)
 
     def exec(...) = @launcher.__send__(__method__, ...)

data/lib/ocran/dir_builder.rb

@@ -13,6 +13,9 @@ module Ocran
     WINDOWS = Gem.win_platform?
 
     attr_reader :data_size
+    # Recorded launch data (environment variables and exec arguments), used
+    # by Direction to build the optional wrapper executable.
+    attr_reader :env, :exec_args
 
     def initialize(path)
       @path = Pathname(path)

data/lib/ocran/direction.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 require "rbconfig"
 require "pathname"
+require "set"
 require_relative "refine_pathname"
 require_relative "host_config_helper"
 require_relative "command_output"
@@ -17,6 +18,12 @@ module Ocran
     # - /ruby/vendor_ruby/3.0.0/
     RUBY_LIBRARY_PATH_REGEX = %r{/(ruby/(?:site_ruby/|vendor_ruby/)?\d+\.\d+\.\d+)/?$}i
 
+    # Core libraries provided by glibc and the dynamic loader. These must
+    # never be bundled: they are tightly coupled to the target system's
+    # ld.so, and shipping a foreign copy breaks the dynamic linker. The
+    # libnss_* plugins are dlopened by the target's glibc and must match it.
+    LINUX_SYSTEM_LIBRARY_RE = /\A(?:ld-linux|ld64|libc\.so|libm\.so|libdl\.so|libpthread\.so|librt\.so|libutil\.so|libnsl\.so|libresolv\.so|libmvec\.so|libanl\.so|libBrokenLocale\.so|libnss_)/
+
     include BuildConstants, CommandOutput, HostConfigHelper
 
     attr_reader :ruby_executable, :rubyopt
@@ -168,7 +175,20 @@ module Ocran
 
       # Add the ruby executable and DLL
       say "Adding ruby executable #{ruby_executable}"
-      builder.copy_to_bin(bindir / ruby_executable, ruby_executable)
+      ruby_source = bindir / ruby_executable
+      if !Gem.win_platform? && File.binread(ruby_source, 2) == "#!"
+        # On some distros (e.g. Fedora), bindir/ruby is a dispatcher shell
+        # script ("rubypick") rather than the interpreter itself, which
+        # cannot run on a system without Ruby. Pack the currently running
+        # interpreter binary under the expected name instead.
+        real_ruby = Pathname("/proc/self/exe")
+        raise "#{ruby_source} is a wrapper script and the real interpreter could not be determined" unless real_ruby.exist?
+
+        say "#{ruby_source} is a wrapper script; packing #{real_ruby.realpath} instead"
+        builder.copy_to_bin(real_ruby.realpath, ruby_executable)
+      else
+        builder.copy_to_bin(ruby_source, ruby_executable)
+      end
       if libruby_so
         # On POSIX systems, libruby.so is in libdir; on Windows, it's in bindir
         libruby_src = Gem.win_platform? ? bindir / libruby_so : libdir / libruby_so
@@ -221,6 +241,44 @@ module Ocran
         end
       end
 
+      # Linux: bundle detected shared libraries (e.g. libyaml, libssl,
+      # libcrypt) next to libruby so the executable also runs on systems
+      # where they are missing or have different sonames (the stub already
+      # points LD_LIBRARY_PATH at the packed bin directory). Core glibc
+      # libraries and the loader are never bundled - they must come from the
+      # target system. Ruby native extensions are packed as features, not
+      # here.
+      if RUBY_PLATFORM.include?("linux") && @option.auto_detect_dlls?
+        feature_set = features.to_set
+        feature_realpaths = features.filter_map { |f| f.realpath rescue nil }.to_set
+        # Ruby native extensions live in these directories and are packed as
+        # features; they must not be duplicated into bin.
+        ruby_arch_dirs = RbConfig::CONFIG.values_at("archdir", "sitearchdir", "vendorarchdir")
+          .compact.map { |dir| Pathname(dir) }
+        detect_dlls.each do |dll|
+          basename = dll.basename.to_s
+          next unless basename.match?(/\.so(\.|\z)/)
+          next if basename.match?(LINUX_SYSTEM_LIBRARY_RE)
+          # libruby is packed with its aliases already
+          next if basename.start_with?("libruby")
+          next if feature_set.include?(dll) || feature_realpaths.include?(dll)
+          next if ruby_arch_dirs.any? { |dir| dll.subpath?(dir) } || dll.to_posix.match?(%r{/gems/})
+          next unless dll.file?
+
+          say "Adding detected shared library #{dll}"
+          builder.copy_to_bin(dll, basename)
+          # The loader may request a library by a less specific soname than
+          # the fully versioned file name recorded in the memory map (e.g.
+          # libssl.so.3 for libssl.so.3.2.4). Provide symlink aliases for
+          # each shorter version suffix.
+          alias_name = basename
+          while (shorter = alias_name.sub(/\.\d+[^.]*\z/, "")) != alias_name && shorter.include?(".so")
+            builder.symlink_in_bin(basename, shorter)
+            alias_name = shorter
+          end
+        end
+      end
+
       # Windows-only: Add external manifest and builtin DLLs
       if Gem.win_platform?
         if (manifest = ruby_builtin_manifest)
@@ -284,6 +342,45 @@ module Ocran
           raise "Gem spec #{spec_file} does not exist in the Ruby installation. Don't know where to put it."
         end
 
+        spec_dir = spec_file.dirname
+        default_spec = spec_dir.basename.to_s == "default"
+        # The gem's base directory: specs live in <base_dir>/specifications[/default]
+        base_dir = default_spec ? spec_dir.dirname.dirname : spec_dir.dirname
+        # Relative packed location of base_dir; nil when the gem lives outside
+        # the Ruby prefix, in which case its files are packed under GEMDIR
+        # with the same layout.
+        packed_base = base_dir.subpath?(exec_prefix) ? base_dir.relative_path_from(exec_prefix) : GEMDIR
+
+        # Default gemspecs live in a "specifications/default" directory, which
+        # RubyGems only scans under Gem.default_dir. On rubies with a
+        # compiled-in absolute prefix (e.g. distro Ruby on Fedora), that path
+        # points to the build host and does not exist on the target system, so
+        # activating such a gem (e.g. via a binstub) fails. Also place a copy
+        # in the regular specifications directory of the same packed base
+        # directory, where GEM_PATH makes it discoverable and its require
+        # paths resolve to the packed gem files.
+        if !Gem.win_platform? && default_spec
+          builder.cp(spec_file, packed_base / "specifications" / spec_file.basename)
+        end
+
+        # Native-extension gems record successful builds in a gem.build_complete
+        # marker under <base_dir>/extensions/...; without it RubyGems refuses to
+        # activate the gem ("Ignoring x because its extensions are not built").
+        # The marker can be absent from the packed tree either because the
+        # distro relocates it (e.g. Fedora keeps it under /usr/lib64/gems/ruby
+        # via a default_ext_dir_for override) or because the gem is a default
+        # gem, which is exempt from the check on the host while its packed
+        # regular-spec copy is not. Recreate the marker where RubyGems expects
+        # it at runtime.
+        if !Gem.win_platform? && spec.extensions.any?
+          api_version = Gem.respond_to?(:extension_api_version) ? Gem.extension_api_version : Gem.ruby_api_version
+          packed_ext_dir = Pathname("extensions") / Gem::Platform.local.to_s / api_version / spec.full_name
+          host_marker = Pathname(spec.gem_build_complete_path)
+          if default_spec || (File.exist?(host_marker) && !host_marker.subpath?(base_dir))
+            builder.touch(packed_base / packed_ext_dir / "gem.build_complete")
+          end
+        end
+
         # Determine which set of files to include for this particular gem
         include = GemSpecQueryable.gem_inclusion_set(spec.name, @option.gem_options)
         say "Detected gem #{spec.full_name} (#{include.join(", ")})"
@@ -292,6 +389,9 @@ module Ocran
 
         verbose "\tgem_dir: #{spec.gem_dir}"
         verbose "\tgem_dir exists: #{File.directory?(spec.gem_dir)}"
+        unless File.directory?(spec.gem_dir)
+          verbose "\tGem directory does not exist (default gem?); packing loaded files via load path instead"
+        end
         loaded_matches = include.include?(:loaded) ? features.select { |f| f.subpath?(spec.gem_dir) } : []
         verbose "\t:loaded candidates in features: #{loaded_matches.size}"
         loaded_matches.each { |f| verbose "\t  loaded: #{f}" }
@@ -313,11 +413,72 @@ module Ocran
           end
         end
 
+        # When a distro builds native extensions outside the gem's base_dir
+        # and loads them from there (e.g. Fedora's /usr/lib64/gems/ruby), the
+        # loaded .so would be packed at a mirror path that is never on the
+        # runtime load path. Pack such loaded extension files ONLY into the
+        # extension directory RubyGems computes at runtime, which gem
+        # activation puts on the load path. Appended to actual_files after
+        # the generic copy above so they are claimed as gem files (and thus
+        # excluded from the plain feature packing, where a bare .so on
+        # RUBYLIB would shadow the gem) without also being mirrored at their
+        # host location. The extension dir and the load location may be
+        # aliased via symlinks in either direction, so match features against
+        # the extension dir by realpath both ways.
+        if !Gem.win_platform? && spec.extensions.any?
+          host_ext_dir = Pathname(spec.extension_dir)
+          if host_ext_dir.directory? && !host_ext_dir.subpath?(base_dir)
+            alias_map = {}
+            host_ext_dir.find.select(&:file?).each do |entry|
+              real = begin
+                entry.realpath
+              rescue SystemCallError
+                next
+              end
+              alias_map[real] = entry
+            end
+            features.each do |feature|
+              real = begin
+                feature.realpath
+              rescue SystemCallError
+                feature
+              end
+              entry = if feature.subpath?(host_ext_dir)
+                        feature
+                      elsif real.subpath?(host_ext_dir)
+                        real
+                      else
+                        alias_map[feature] || alias_map[real]
+                      end
+              next unless entry
+
+              builder.cp(feature, packed_base / packed_ext_dir / entry.relative_path_from(host_ext_dir))
+              actual_files << feature
+            end
+          end
+        end
+
         actual_files
       end
       gem_files.uniq!
 
-      features -= gem_files
+      # On some distros parts of a gem are reachable through symlinks at other
+      # locations (e.g. Fedora symlinks /usr/share/ruby/psych.rb into the
+      # psych gem directory), so a feature and a packed gem file can denote
+      # the same file under different paths. Compare realpaths when removing
+      # gem files from the feature list; otherwise a stdlib-level duplicate
+      # would be packed as well and shadow the packed gem at runtime.
+      gem_file_set = (gem_files + gem_files.filter_map { |file| file.realpath rescue nil }).to_set
+      features = features.reject do |feature|
+        next true if gem_file_set.include?(feature)
+
+        real = begin
+          feature.realpath
+        rescue SystemCallError
+          nil
+        end
+        real && gem_file_set.include?(real)
+      end
 
       # If requested, add all ruby standard libraries
       if @option.add_all_core?
@@ -500,13 +661,16 @@ module Ocran
       # By adding the extract-dir equivalents of rubylibdir, sitelibdir, etc. to
       # RUBYLIB, Ruby can find rubygems and the standard library in the packed tree.
       unless Gem.win_platform?
-        core_lib_paths = all_core_dir
+        # Use the build Ruby's actual default load path in addition to the
+        # RbConfig directories: some distros compile in extra entries that
+        # RbConfig does not expose (e.g. Fedora's /usr/share/rubygems, where
+        # rubygems.rb lives outside rubylibdir).
+        default_load_paths = @pre_env.load_path.map { |dir| Pathname(@pre_env.expand_path(dir)) }
+        archdir = Pathname(RbConfig::CONFIG["archdir"])
+        core_lib_paths = (default_load_paths + all_core_dir + [archdir])
           .select { |dir| dir.subpath?(exec_prefix) }
           .map { |dir| dir.relative_path_from(exec_prefix) }
-        archdir = Pathname(RbConfig::CONFIG["archdir"])
-        if archdir.subpath?(exec_prefix)
-          core_lib_paths << archdir.relative_path_from(exec_prefix)
-        end
+          .uniq
         load_path = core_lib_paths + load_path
       end
 
@@ -514,15 +678,25 @@ module Ocran
       builder.set_env_path("GEM_HOME", GEMDIR)
 
       gem_paths = [GEMDIR]
-      # On POSIX, default gems (e.g. error_highlight) are stored under the Ruby
-      # installation's gem dir (Gem.default_dir), not in GEMDIR. Include it in
-      # GEM_PATH so RubyGems can find and activate them in the extracted tree.
-      unless Gem.win_platform?
-        default_gem_dir = Pathname(Gem.default_dir)
-        if default_gem_dir.subpath?(exec_prefix)
-          gem_paths << default_gem_dir.relative_path_from(exec_prefix)
-        end
-      end
+      # Gems installed under the Ruby prefix (exec_prefix) have their specs and
+      # extension dirs placed there via duplicate_to_exec_prefix. Include every
+      # Gem.path entry located under exec_prefix (relative to it) in GEM_PATH so
+      # RubyGems can find and activate them at runtime. This is required on both
+      # Windows (e.g. fxruby/fox16 whose fox16_c.so lives in extension_dir under
+      # the Ruby prefix) and POSIX (e.g. error_highlight default gems). Distros
+      # can split gems over several such directories - e.g. Fedora uses
+      # /usr/share/gems for RPM-packaged (default) gems and /usr/local/share/gems
+      # for user-installed ones - so Gem.default_dir alone is not enough.
+      prefix_gem_dirs = (Gem.path.map { |dir| Pathname(dir) } + [Pathname(Gem.default_dir)])
+        .select { |dir| dir.subpath?(exec_prefix) }
+        .map { |dir| dir.relative_path_from(exec_prefix) }
+        .uniq
+      gem_paths += prefix_gem_dirs
+      # RubyGems probes the default gem dir for writability at startup and
+      # prints "Can't determine writability of default gem path" on stderr
+      # when the directory does not exist in the packed layout - so always
+      # create the packed prefix gem dirs, even when no specs landed there.
+      prefix_gem_dirs.each { |dir| builder.mkdir(dir) }
       builder.set_env_path("GEM_PATH", *gem_paths)
 
       # Add the opcode to launch the script
@@ -545,8 +719,13 @@ module Ocran
         title: @option.output_executable.basename.sub_ext("")
       )
 
+      # Record the launch events (exports + exec) so they can be replayed
+      # into the wrapper stub executable below.
+      require_relative "launcher_event_recorder"
+      recorder = LauncherEventRecorder.new(launcher_builder)
+
       require_relative "build_facade"
-      builder = BuildFacade.new(iss_builder, launcher_builder)
+      builder = BuildFacade.new(iss_builder, recorder)
 
       if @option.icon_filename
         builder.cp(@option.icon_filename, File.basename(@option.icon_filename))
@@ -559,22 +738,65 @@ module Ocran
       verbose File.read(launcher_path)
       builder.cp(launcher_path, "launcher.bat")
 
-      say "Build inno setup script file"
-      iss_path = iss_builder.build
-      verbose File.read(iss_path)
+      require "tmpdir"
+      Dir.mktmpdir("ocran") do |tmpdir|
+        if @option.wrapper_exe?
+          # Wrapper executable (pre-1.4/OCRA behavior): a small stub without
+          # embedded files that runs the installed application directly from
+          # {app}. It is installed next to the application files so that user
+          # Inno Setup scripts can reference it by the --output name, e.g. in
+          # [Run]/[UninstallRun] entries or for Windows service registration.
+          wrapper_path = Pathname(tmpdir) / @option.output_executable.basename
+          build_wrapper_exe(wrapper_path) { |stub| recorder.replay(stub) }
+          builder.cp(wrapper_path, wrapper_path.basename)
+        end
 
-      say "Running Inno Setup Command-Line compiler (ISCC)"
-      iss_builder.compile(verbose: @option.verbose?)
+        say "Build inno setup script file"
+        iss_path = iss_builder.build
+        verbose File.read(iss_path)
+
+        say "Running Inno Setup Command-Line compiler (ISCC)"
+        iss_builder.compile(verbose: @option.verbose?)
+      end
 
       say "Finished building installer file"
     end
 
+    # Builds the small RUN_IN_EXE_DIR wrapper stub that starts the deployed
+    # application directly from the directory the wrapper resides in.
+    def build_wrapper_exe(wrapper_path)
+      require_relative "stub_builder"
+      say "Build wrapper executable #{wrapper_path.basename}"
+      StubBuilder.new(wrapper_path,
+                      chdir_before: @option.chdir_before?,
+                      debug_mode: @option.enable_debug_mode?,
+                      gui_mode: @option.windowed?,
+                      icon_path: @option.icon_filename,
+                      run_in_exe_dir: true) do |stub|
+        yield(stub)
+      end
+    end
+
     def build_output_dir(path)
       require_relative "dir_builder"
 
       path = Pathname(path)
       say "Building directory #{path}"
-      DirBuilder.new(path, &to_proc)
+      builder = DirBuilder.new(path, &to_proc)
+
+      if @option.wrapper_exe?
+        # Same wrapper as in Inno Setup builds: a doubleclickable executable
+        # next to the launch script, usable e.g. for Windows service
+        # registration from an unpacked zip. Disable with --no-wrapper-exe.
+        build_wrapper_exe(path / @option.output_executable.basename) do |stub|
+          builder.env.each { |name, value| stub.export(name, value) }
+          if builder.exec_args
+            image, script, argv = builder.exec_args
+            stub.exec(image, script, *argv)
+          end
+        end
+      end
+
       say "Finished building directory #{path}"
     end