ocran 1.4.3 → 1.4.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23bee04c3290671dc55673fcb757a222e04af6977bd015a0791bab76ef492f1c
-  data.tar.gz: a4d437bda8e4bd00ea4a66c9c75c2aaa85b6904b8c7619e4f04a5e2b931688d5
+  metadata.gz: 85cce39e5b93c48ccd16ecc3ad73f214a2349c2b203ff242fb1d478a78fbd5b9
+  data.tar.gz: f6ac990c20617164a68d70cd91e38e42afd12889c247f82204684d1843bb26ae
 SHA512:
-  metadata.gz: 0bd96938ab10206fe5009d93d9356034cbb9913159507b51f0df1fa4d46f428fbf7ae0c75ce1e8359079af70094ab8b68d64671064a59ec8bda313baf863dc79
-  data.tar.gz: 199615b364954980946418e4c850e9153cf2a2aabf4a5475143e08ff8bbeeda4dcb784a2fb578ef07b9559b8ae37b24103b36f99e4f86c96357674a115c371a6
+  metadata.gz: 598cfd6fa803707a732ec8c10687f221b2a0618570377655a7414bcb94d9744d59364ade26ddc5b379fd72daf40adf8d001eccdac3d7af0ab20a69dfbafe1500
+  data.tar.gz: 83311e9e259a7c91f99ab6860529bd3ede2d706b3737451707f7488291679ae0ceb49bddb110128b6413f7d99b38f4b06bdd0a2362acf56a0afb9269bb41ae82

data/CHANGELOG.txt

@@ -1,3 +1,40 @@
+=== 1.4.5
+- Windows: detected DLLs are now also bundled into bin, next to ruby.exe, whenever they are not already resolvable from where they get packed. The Windows loader resolves a native extension's imports from the extension's own directory, ruby.exe's application directory (bin) plus its ruby_builtin_dlls SxS assembly, and the system directories - PATH is not consulted on hardened systems, and the AddDllDirectory route gems take through ruby_installer/runtime does not exist in a packed app. A DLL loaded from a gem's own tree (e.g. FreeTDS, which tiny_tds ships under ports/), from a devkit's msys64 tree inside the Ruby prefix, or from outside the prefix entirely was packed only at that original location, which the loader never searches, so the packaged application died at require time with a misleading LoadError on machines where a rich PATH did not mask the gap - the out-of-prefix case was skipped entirely by a guard that made its copy_to_bin branch unreachable. DLLs from the Windows directory keep coming from the target system and are never bundled. Companion DLLs found next to native extensions (e.g. libssl-3-x64.dll beside openssl.so in archdir) go into bin as well: a copy in archdir only helps extensions in archdir itself, while the same extension packed at a gem path (openssl and psych are gems since Ruby 3.x) resolves its imports from bin.
+- `--cosmo-ruby`: a native gem now also counts as provided by the payload when the payload can resolve the gem's primary feature, not only when the payload has a gemspec of that name. A gemspec is not what makes a library requirable - an extension linked into the APE, or a library in the interpreter's embedded stdlib, answers `require` with nothing under /zip/lib/ruby/gems/*/specifications - so gems such as cgi and pathname (both compiled into CosmoRuby, and both ordinary native gems on Ruby 3.4+) were reported incompatible and refused builds that work. The probe runs the payload once using $LOAD_PATH.resolve_feature_path, which searches exactly as require does, built-in extensions included, but executes none of the code it finds.
+- A Rails application with SQLite now packages into a single Actually Portable Executable with `--cosmo-ruby` alone (no compiler at all), given an interpreter with sqlite3, nokogiri, puma, nio4r, bigdecimal and racc linked in: 39.0 MB, serving its first request 1.8s after launch, against 50.4 MB and 1.5s for the same application as a native OCRAN executable, and with nothing unpacked at run time. test/test_rails.rb drives the same HTTP assertions - scaffold CRUD through SQLite with CSRF token and session cookie, dynamically added controllers, persistence across a restart - through both builds. The one remaining limitation is cryptographic and belongs to the interpreter: its openssl is an MbedTLS shim with no cipher, HMAC or PBKDF2 surface, and Rails names those at load time, so the application must fill the gap itself, set SECRET_KEY_BASE, ship no config/credentials.yml.enc, and keep the session out of the (encrypted) cookie. See the Rails section of README.md.
+- New `--chdir-exe-dir` option (issue #32): the packaged executable starts the script with its working directory set to the directory containing the executable itself, so relative file access (e.g. reading data files placed next to the .exe) works regardless of how the executable is invoked. Implemented as a new CHDIR_TO_EXE_DIR (0x40) stub header flag; the stub passes `-C <exe dir>` to the packed Ruby interpreter. Mutually exclusive with `--chdir-first`.
+- README: document that `__FILE__`/`__dir__`/`$0` point into the temporary extraction directory at runtime (the cause of issue #32) and show the supported `ENV["OCRAN_EXECUTABLE"]` pattern for locating files next to the executable.
+- `--gemfile <path>` now governs the dependency run too, not just the Gemfile scan that follows it. The script is loaded inside the OCRAN process, so whatever BUNDLE_GEMFILE the environment carried used to win: running OCRAN from inside another project's `bundle exec` made the script's own `require "bundler/setup"` activate that project's bundle, and gems only the application's Gemfile provides went missing. Local development gems declared with `path:` or `gemspec` always did, since they exist nowhere but that Gemfile, so packaging them (issue #34) failed with a LoadError before anything could be packed. OCRAN now points BUNDLE_GEMFILE at the given Gemfile before loading the script, and when a different bundle has already been set up through RUBYOPT it drops Bundler's memoized state so the application's Gemfile is the one that takes effect.
+- Test suite: build and run steps assert through a new assert_system helper that captures the child's stdout and stderr and puts them in the failure message. A failing build used to report nothing but "Expected false to be truthy" while its diagnostics scrolled past in the runner's output.
+- `--cosmo-ruby <ruby.com>` now packages without any compiler when the given cosmopolitan Ruby runs an embedded /zip/main.rb (issue #26). Instead of compiling an APE launcher stub, OCRAN copies the interpreter and injects the application into the interpreter's own ZIP store, so the executable IS the interpreter: no cosmocc, no make, and nothing is unpacked at run time. Startup drops from 0.79s to 0.23s on Linux and from 1.52s to 0.49s on Windows for a 4-gem CLI, no temporary directory is created at all (so none can be leaked when the process is killed), and the executable is about twice as large because it cannot be LZMA-compressed. The mode is selected automatically - `--cosmo-ruby <ruby.com>` alone remains the whole command line - by detecting the capability in the binary; interpreters without it still get the launcher stub, and an explicit `--cosmo <toolchain>` (or --output-dir/--output-zip/--innosetup/--macosx-bundle) forces it. No new command line option.
+- Behavior differences of the ZIP packaging mode, documented in README: the application runs from inside the executable, so $0, __FILE__ and __dir__ point into /zip/ocran/src instead of a temporary directory (files shipping next to the executable are still found via OCRAN_EXECUTABLE, which is unchanged); --chdir-first changes into the executable's directory; of RUBYOPT only -I and -r can be replayed; --icon and --debug-extract have no effect.
+- ZIP packaging now passes the whole command line to the application and reports exact exit codes, including on Windows, given a cosmopolitan Ruby with the 2026-08 interpreter fixes. Previously the interpreter parsed leading option-shaped arguments as its own ("app.com --verbose" failed with "invalid option --verbose", only "app.com -- --verbose" worked) and multiplied Windows exit codes by 256 ("exit 3" arrived as 768). Both were interpreter bugs that also affected plain "ruby.com script.rb"; "--" is now an ordinary argument and interpreter options are reachable through RUBYOPT.
+- The APE launcher stub sets COSMORUBY_WAIT_STATUS_EXIT=1 for the packaged interpreter. The stub is itself a cosmopolitan program: it fork/execs the interpreter and reads the result with WEXITSTATUS(), so with the interpreter's Windows exit-code fix in place an unmarked child's "exit 3" came back as 131 (128 + signal 3). The variable asks the interpreter to keep cosmopolitan's wait-status encoding for this one caller; the stub still reports the plain status to its own native parent.
+- New Ocran::ZipWriter: a minimal, dependency-free ZIP appender (Zlib only) used to inject the application into the APE without shelling out to the zip command, which Windows build hosts do not have. It rewrites the central directory in place, refuses ZIP64 and archives with trailing data, rejects entries that would shadow an existing member, and writes UNIX file-type bits in the external attributes - without S_IFREG/S_IFDIR the members are readable but Ruby's load refuses to open them and directory listings come back empty.
+- New experimental `--cosmo <path>` option (alias `--cosmo-toolchain`): build the launcher stub from its C sources with a Cosmopolitan Libc toolchain (cosmocc) at packaging time and package the application with the resulting Actually Portable Executable (APE) stub instead of the pre-built stub (issue #26). `<path>` is the cosmocc executable or the toolchain directory (containing bin/cosmocc). Console applications only (`--windows` is rejected); requires make and a Linux/macOS build host. The default output name uses the `.com` extension (APE convention); an explicit `--output` is used verbatim. Compiled stubs are cached in ~/.cache/ocran keyed on the toolchain and stub sources; compile errors surface the compiler output.
+- Ship the stub C sources (src/) in the binary platform gems so `--cosmo` can rebuild the stub from an installed gem, not only from a source checkout.
+- `--cosmo-ruby <ruby.com>` is a complete command line on its own: the cosmocc toolchain that builds the APE launcher stub is now discovered on the build host instead of having to be named with `--cosmo` (issue #26). Search order: the COSMOCC environment variable (the cosmocc executable or its install directory; a value that does not resolve is an error, not a silent fallback), cosmocc in PATH, then the conventional install locations ~/.cosmocc/*/bin/cosmocc, ~/cosmocc/*/bin/cosmocc, /opt/cosmocc/*/bin/cosmocc, /opt/cosmo/bin/cosmocc and /usr/local/cosmocc/bin/cosmocc (newest version first). `--cosmo <path>` remains an explicit override that always wins and still works on its own. When no toolchain is found, option parsing fails - before the dependency run - with a message naming the environment variable, PATH, the conventional locations, the download URL and the `--cosmo` flag.
+- New experimental `--cosmo-ruby <ruby.com>` option: package a cosmopolitan-built Ruby APE as the bundled interpreter instead of the host Ruby, so the produced `.com` contains both an APE stub and an APE Ruby and runs with no host-native code (issue #26). The payload's embedded stdlib (in its /zip store) is used at runtime instead of the host's, its embedded gem directory is appended to GEM_PATH, pure-Ruby gems are packed as usual, and native-extension gems are skipped when the payload provides them (json, psych, ...) or abort the build otherwise. The payload is validated by running it once on the build host; a warning is printed when host and payload Ruby versions differ. Verified end-to-end on Linux; console-only, POSIX build hosts only.
+
+=== 1.4.4
+- Fix crash on distro-packaged and Homebrew Ruby when a default gem (e.g. fiddle, singleton) has a gemspec but no materialized gem directory: file collection now treats the missing directory as an empty set instead of raising Errno::ENOENT from Find.find (issue #44). The gem's files, which live in the stdlib, are still packed via the load path.
+- Pack the real Ruby interpreter when bindir/ruby is a dispatcher script (e.g. Fedora's rubypick): the running interpreter binary (/proc/self/exe) is packed under the expected name instead, so the packed executable no longer requires Ruby on the target system.
+- Build runtime RUBYLIB from the build Ruby's actual default load path in addition to the RbConfig directories, covering distro-specific compiled-in entries such as Fedora's /usr/share/rubygems where rubygems.rb lives outside rubylibdir.
+- Include every Gem.path entry under the Ruby prefix in the runtime GEM_PATH (not just Gem.default_dir), so RubyGems can activate gems from split layouts like Fedora's /usr/share/gems + /usr/local/share/gems.
+- Make default gems activatable at runtime: their gemspecs (from specifications/default/, which RubyGems only scans under the compiled-in Gem.default_dir) are also copied into the regular specifications directory of the same packed base directory.
+- Handle distros that expose gem files under additional symlinked paths (e.g. Fedora symlinks /usr/share/ruby/psych.rb into the psych gem directory): loaded features are resolved by realpath so they are packed inside the gem directory, and duplicate stdlib-level copies that would shadow the packed gem at runtime are no longer packed.
+- Pack native extension files that distros build outside the gem's base_dir (e.g. Fedora's /usr/lib64/gems/ruby) into the extension directory RubyGems computes at runtime, and recreate the gem.build_complete marker there so the gem activates instead of being ignored ("its extensions are not built").
+- Linux: bundle detected non-glibc shared libraries (libyaml, libssl, libcrypt, libgmp, libz, ...) next to libruby, with soname symlink aliases, so packed executables also run on other distros where these are missing or have different sonames. Core glibc libraries, the loader, and libnss_* plugins are never bundled; the target's glibc must be at least as new as the build host's. Disable with --no-autodll.
+- CI: new isolated workflow test-aspera-cli.yml that packages the aspera-cli gem with distro Ruby on Fedora and verifies the executable runs on clean Fedora and Ubuntu containers without Ruby. Kept separate from the release pipeline with a read-only token; the third-party gem only ever runs inside throwaway containers.
+- Restore the OCRA-compatible wrapper executable for Inno Setup builds: `--innosetup` now additionally builds a small stub executable named after `--output` and installs it into `{app}` alongside the application files. The wrapper runs the installed application directly from its own directory (new RUN_IN_EXE_DIR stub mode) — no extraction, no cleanup of the application directory. This behavior existed in OCRA and ocran <= 1.3.x but was lost in the 1.4.0 rewrite, breaking user ISS scripts that reference the executable, e.g. in [Run]/[UninstallRun] entries or for Windows service registration (`myapp.exe --register-service`). The launcher.bat is still generated and installed as before.
+- Add `run_in_exe_dir` option to StubBuilder and a RUN_IN_EXE_DIR (0x20) stub header flag. In this mode the stub never deletes its directory (double-guarded in the stub itself, since the directory is the real application directory).
+- Allow `--innosetup` on POSIX hosts when an ISCC command is available in PATH (e.g. a Wine wrapper); previously it was rejected on non-Windows unconditionally. Fix the ISCC presence check to use `command -v` instead of the Windows-only `where`/`>NUL` on POSIX.
+- Inno Setup builds from POSIX hosts no longer crash on symlink entries (symlinks cannot be expressed in an installer script and are skipped; they are only generated for POSIX shared-library aliases).
+- `--output-dir` and `--output-zip` now also include the wrapper executable (named after `--output`) next to the launch script, so the unpacked output has a doubleclickable, pinnable, signable entry point that can even be registered as a Windows service. The launch script (`.bat`/`.sh`) is still generated.
+- New `--no-wrapper-exe` option: omit the wrapper executable from installer, directory and zip output.
+- Always create the packed prefix gem directories (e.g. lib/ruby/gems/<api>) even when empty: RubyGems probes the default gem dir for writability at startup and printed "Can't determine writability of default gem path" on stderr for every packed executable on newer RubyGems.
+- Stub: normalize the extraction/application directory to its long path form on Windows (GetLongPathName). With an 8.3 short TEMP path (e.g. C:\Users\RUNNER~1) the same file could be loaded under two spellings, defeating $LOADED_FEATURES deduplication and causing "already initialized constant" warnings.
+
 === 1.4.3
 - Migrate edicon from C to Ruby: replace edicon.exe with a pure-Ruby implementation (ed_icon.rb), fixing incorrect BeginUpdateResource error checking and wrong GroupIconSize calculation. Shortens build times and removes the C binary from the build.
 - Include Gem.default_dir in GEM_PATH on all platforms: previously the exec_prefix gem directory was excluded on Windows, causing native-extension gems (e.g. fxruby/fox16) to fail at runtime with a LoadError even though they were bundled correctly.