ocran 1.4.6 → 1.5.1

data/lib/ocran/direction.rb

@@ -6,6 +6,7 @@ require_relative "refine_pathname"
 require_relative "host_config_helper"
 require_relative "command_output"
 require_relative "build_constants"
+require_relative "env_hook"
 
 module Ocran
   class Direction
@@ -16,7 +17,9 @@ module Ocran
     # - /ruby/3.0.0/
     # - /ruby/site_ruby/3.0.0/
     # - /ruby/vendor_ruby/3.0.0/
-    RUBY_LIBRARY_PATH_REGEX = %r{/(ruby/(?:site_ruby/|vendor_ruby/)?\d+\.\d+\.\d+)/?$}i
+    # The version directory is RbConfig's ruby_version, which development
+    # builds suffix with their ABI version (e.g. "4.1.0+5").
+    RUBY_LIBRARY_PATH_REGEX = %r{/(ruby/(?:site_ruby/|vendor_ruby/)?\d+\.\d+\.\d+(?:\+\d+)?)/?$}i
 
     # Core libraries provided by glibc and the dynamic loader. These must
     # never be bundled: they are tightly coupled to the target system's
@@ -35,6 +38,9 @@ module Ocran
     # payload, which is statically linked and has no dlopen.
     NATIVE_BINARY_EXTENSIONS = %w[.so .bundle .dll].freeze
 
+    # Visual C++ 2015-2022 runtime DLLs (Microsoft.VC14x.CRT redistributables)
+    VC_RUNTIME_DLL_RE = /\A(?:vcruntime140(?:_\d+)?|msvcp140(?:_\w+)?|concrt140|vccorlib140|vcomp140)\.dll\z/i
+
     # Native binaries a gem ships or has had built for it, i.e. the files
     # that make it unusable under the cosmopolitan Ruby payload.
     #
@@ -176,7 +182,48 @@ module Ocran
       else
         require_relative "library_detector_posix"
       end
-      LibraryDetector.loaded_dlls.map { |path| Pathname.new(path).cleanpath }
+      dlls = LibraryDetector.loaded_dlls.map { |path| Pathname.new(path).cleanpath }
+      # A Ruby reached through a junction (the "current" link of rb or
+      # scoop) loads its DLLs by the junction path, while RbConfig reports
+      # the real prefix. Resolve them, or no DLL is recognised as part of
+      # the Ruby installation.
+      dlls.map! { |dll| dll.realpath rescue dll } if Gem.win_platform?
+      dlls
+    end
+
+    # The DLLs that the packed ruby.exe (or rubyw.exe), the Ruby DLL and
+    # the native extensions among +features+ import, directly or through
+    # each other, that are found in the Ruby bin directory, and the Visual
+    # C++ runtime DLLs among them (from the system directory). System DLLs,
+    # and DLLs elsewhere that only the dependency run can find, are not
+    # included.
+    def windows_imported_dlls(features)
+      require_relative "pe_imports"
+
+      bin_dlls = bindir.children.select { |path| path.extname?(".dll") && path.file? }
+                       .to_h { |path| [path.basename.to_s.downcase, path] }
+      system_dir = Pathname((ENV["SystemRoot"] || "C:/Windows").tr("\\", "/")) / "System32"
+      seen = Set.new
+      seen << libruby_so.to_s.downcase if libruby_so
+      found = []
+      queue = [bindir / ruby_executable]
+      queue << bindir / libruby_so if libruby_so
+      queue += features.select { |f| f.extname?(".so") }
+      while (image = queue.shift)
+        next unless image.file?
+
+        PEImports.dll_names(image).each do |name|
+          next unless seen.add?(name.downcase)
+
+          dll = bin_dlls[name.downcase]
+          dll ||= system_dir / name if name.match?(VC_RUNTIME_DLL_RE) && (system_dir / name).file?
+          next unless dll
+
+          found << dll
+          queue << dll
+        end
+      end
+      found
     end
 
     def find_gemspecs(features)
@@ -350,19 +397,30 @@ module Ocran
       # Convert all relative paths to absolute paths before building.
       # NOTE: In the future, different strategies may be needed before and after script execution.
       features.filter_map do |feature|
-        if feature.absolute?
-          feature
-        elsif (load_path = @post_env.find_load_path(feature))
-          feature.expand_path(@post_env.expand_path(load_path))
-        else
-          # This message occurs when paths for core library files (e.g., enumerator.so,
-          # rational.so, complex.so, fiber.so, thread.rb, ruby2_keywords.rb) are not
-          # found. These are integral to Ruby's standard libraries or extensions and
-          # may not be located via normal load path searches, especially in RubyInstaller
-          # environments.
-          verbose "Load path not found for #{feature}, skip this feature"
-          nil
+        path =
+          if feature.absolute?
+            feature
+          elsif (load_path = @post_env.find_load_path(feature))
+            feature.expand_path(@post_env.expand_path(load_path))
+          else
+            # This message occurs when paths for core library files (e.g., enumerator.so,
+            # rational.so, complex.so, fiber.so, thread.rb, ruby2_keywords.rb) are not
+            # found. These are integral to Ruby's standard libraries or extensions and
+            # may not be located via normal load path searches, especially in RubyInstaller
+            # environments.
+            verbose "Load path not found for #{feature}, skip this feature"
+            next
+          end
+        # An entry can be in $LOADED_FEATURES without a file behind it: a
+        # racc parser generated with its runtime embedded marks
+        # <dir>/racc/parser.rb and racc/info.rb as loaded so that racc is not
+        # loaded twice (rdoc's RD parsers in Ruby 3.4 do). Copying it failed
+        # the whole build with ENOENT; there is nothing to pack.
+        unless path.file?
+          verbose "#{path} is marked as loaded but is not a file, skip this feature"
+          next
         end
+        path
       end
     end
 
@@ -425,6 +483,19 @@ module Ocran
         end
       end
 
+      # String#unicode_normalize (and unicode_normalized?, unicode_normalize!)
+      # is core, but core requires its implementation from the standard
+      # library (unicode_normalize/normalize.rb, which loads tables.rb) on
+      # first use. An app that does not call it during the dependency run
+      # fails with a LoadError once packed, so always pack these files.
+      # Not with --cosmo-ruby: the payload has its own standard library.
+      unless @option.cosmo_ruby
+        known = features.to_set { |f| f.path_key }
+        (Pathname(RbConfig::CONFIG["rubylibdir"]) / "unicode_normalize").glob("*.rb").sort.each do |path|
+          features << path unless known.include?(path.path_key)
+        end
+      end
+
       say "Building #{@option.output_executable}"
       require_relative "build_helper"
       builder.extend(BuildHelper)
@@ -484,8 +555,17 @@ module Ocran
         end
       end
 
+      # Windows-only: DLLs bundled into bin, next to ruby.exe, by basename
+      dlls_in_bin = Set.new
+      add_dll_to_bin = proc do |dll|
+        next if dll.subpath?(bindir) || !dlls_in_bin.add?(dll.basename.to_s.downcase)
+
+        say "Adding detected DLL #{dll} to bin"
+        builder.copy_to_bin(dll, dll.basename)
+      end
+
       # Windows-only: Add detected DLLs
-      if Gem.win_platform? && @option.auto_detect_dlls?
+      if Gem.win_platform? && @option.auto_detect_dlls? && !@option.static_runtime?
         # The Windows loader resolves the imports of a native extension from
         # the extension's own directory, the application directory of the
         # packed ruby.exe (bin) plus its SxS assembly (ruby_builtin_dlls),
@@ -502,16 +582,17 @@ module Ocran
         # LD_LIBRARY_PATH. DLLs from the Windows directory always come from
         # the target system and are never bundled.
         windows_dir = Pathname(ENV["SystemRoot"] || "C:/Windows")
-        dlls_in_bin = Set.new
-        add_dll_to_bin = proc do |dll|
-          next if dll.subpath?(bindir) || !dlls_in_bin.add?(dll.basename.to_s.downcase)
-
-          say "Adding detected DLL #{dll} to bin"
-          builder.copy_to_bin(dll, dll.basename)
-        end
 
         detect_dlls.each do |dll|
           next unless dll.extname?(".dll") && dll.basename != libruby_so
+          # The Visual C++ runtime is not part of Windows: an mswin Ruby
+          # (and any MSVC-built DLL a gem loads) fails to start with
+          # 0xC0000135 where the VC++ Redistributable is not installed.
+          # Microsoft permits deploying it app-locally, next to ruby.exe.
+          if dll.basename.to_s.match?(VC_RUNTIME_DLL_RE)
+            add_dll_to_bin.call(dll)
+            next
+          end
           next if dll.subpath?(windows_dir)
 
           if dll.subpath?(exec_prefix)
@@ -531,7 +612,7 @@ module Ocran
         # the same extension packed at a gem path (openssl and psych are
         # gems since Ruby 3.x) resolves its imports from bin.
         features.select { |f| f.extname?(".so") && f.subpath?(exec_prefix) }
-                .map(&:dirname).uniq
+                .map(&:dirname).uniq { |dir| dir.path_key }
                 .each do |dir|
           dir.each_child do |path|
             next unless path.file? && path.extname?(".dll")
@@ -542,6 +623,25 @@ module Ocran
         end
       end
 
+      # Windows-only: DLLs that ruby.exe, the Ruby DLL and the packed native
+      # extensions import from the Ruby bin directory, plus the Visual C++
+      # runtime. RubyInstaller keeps such DLLs in ruby_builtin_dlls, which is
+      # packed whole below; an mswin Ruby keeps them (gmp, libffi, OpenSSL,
+      # libyaml, zlib from vcpkg) next to ruby.exe, and its interpreter does
+      # not even start without gmp and vcruntime140. They are read from the
+      # PE import tables, so they are packed with --no-autodll too, and for
+      # extensions the dependency run did not exercise.
+      if Gem.win_platform?
+        windows_imported_dlls(features).each do |dll|
+          if dll.subpath?(bindir)
+            verbose "Adding imported DLL #{dll}"
+            builder.duplicate_to_exec_prefix(dll)
+          else
+            add_dll_to_bin.call(dll)
+          end
+        end
+      end
+
       # Linux: bundle detected shared libraries (e.g. libyaml, libssl,
       # libcrypt) next to libruby so the executable also runs on systems
       # where they are missing or have different sonames (the stub already
@@ -549,7 +649,7 @@ module Ocran
       # libraries and the loader are never bundled - they must come from the
       # target system. Ruby native extensions are packed as features, not
       # here. Not needed with --cosmo-ruby: the APE payload is static.
-      if RUBY_PLATFORM.include?("linux") && @option.auto_detect_dlls? && !@option.cosmo_ruby
+      if RUBY_PLATFORM.include?("linux") && @option.auto_detect_dlls? && !@option.cosmo_ruby && !@option.static_runtime?
         feature_set = features.to_set
         feature_realpaths = features.filter_map { |f| f.realpath rescue nil }.to_set
         # Ruby native extensions live in these directories and are packed as
@@ -851,7 +951,9 @@ module Ocran
 
         actual_files
       end
-      gem_files.uniq!
+      # Keyed on Pathname#path_key here and below: Array#uniq and Set do not
+      # see the refined, case-insensitive Pathname#eql? on Windows.
+      gem_files.uniq! { |file| file.path_key }
 
       # On some distros parts of a gem are reachable through symlinks at other
       # locations (e.g. Fedora symlinks /usr/share/ruby/psych.rb into the
@@ -859,16 +961,17 @@ module Ocran
       # the same file under different paths. Compare realpaths when removing
       # gem files from the feature list; otherwise a stdlib-level duplicate
       # would be packed as well and shadow the packed gem at runtime.
-      gem_file_set = (gem_files + gem_files.filter_map { |file| file.realpath rescue nil }).to_set
+      gem_file_set = (gem_files + gem_files.filter_map { |file| file.realpath rescue nil })
+                       .to_set { |file| file.path_key }
       features = features.reject do |feature|
-        next true if gem_file_set.include?(feature)
+        next true if gem_file_set.include?(feature.path_key)
 
         real = begin
           feature.realpath
         rescue SystemCallError
           nil
         end
-        real && gem_file_set.include?(real)
+        real && gem_file_set.include?(real.path_key)
       end
 
       # If requested, add all ruby standard libraries
@@ -877,15 +980,23 @@ module Ocran
       elsif @option.add_all_core?
         say "Will include all ruby core libraries"
         all_core_dir.each do |path|
+          # A configured directory that was never created (Debian's
+          # sitelibdir, /usr/local/lib/site_ruby/<ver>) holds nothing.
+          next unless path.directory?
+
           # Match the load path against standard library, site_ruby, and vendor_ruby paths
           unless (subdir = path.to_posix.match(RUBY_LIBRARY_PATH_REGEX)&.[](1))
             raise "Unexpected library path format (does not match core dirs): #{path}"
           end
-          path.find.each do |src|
-            next if src.directory?
-            a = Pathname(subdir) / src.relative_path_from(path)
+          files, skipped = self.class.core_library_files(path)
+          files.each do |src|
             builder.copy_to_lib(src, Pathname(subdir) / src.relative_path_from(path))
           end
+          next if skipped.empty?
+
+          warning "Not packed: #{skipped.size} entr#{skipped.size == 1 ? "y" : "ies"} of #{path} that " \
+                  "#{skipped.size == 1 ? "is" : "are"} not a readable file (#{skipped.first(3).join(", ")}" \
+                  "#{skipped.size > 3 ? ", ..." : ""})"
         end
       end
 
@@ -912,7 +1023,8 @@ module Ocran
       end
 
       # Windows-only: Workaround for RubyInstaller MSYS folder detection
-      if Gem.win_platform?
+      # (mswin Ruby, built with Visual C++, has no MSYS2 devkit)
+      if Gem.win_platform? && !RUBY_PLATFORM.include?("mswin")
         # RubyInstaller cannot find the msys folder if ../msys64/usr/bin/msys-2.0.dll is not present
         # (since RubyInstaller-2.4.1 rubyinstaller 2 issue 23)
         builder.touch('msys64/usr/bin/msys-2.0.dll')
@@ -1082,7 +1194,7 @@ module Ocran
       neutralize_bundler_env(builder)
       # Add the load path that are required with the correct path after
       # src_prefix was adjusted.
-      load_path = src_load_path.map { |path| SRCDIR / path.relative_path_from(inst_src_prefix) }.uniq
+      load_path = src_load_path.map { |path| SRCDIR / path.relative_path_from(inst_src_prefix) }.uniq { |path| path.path_key }
 
       # On POSIX systems, also add the packed Ruby standard library directories
       # to RUBYLIB. The Ruby binary has a compiled-in prefix pointing to the build
@@ -1121,7 +1233,7 @@ module Ocran
       prefix_gem_dirs = (Gem.path.map { |dir| Pathname(dir) } + [Pathname(Gem.default_dir)])
         .select { |dir| dir.subpath?(exec_prefix) }
         .map { |dir| dir.relative_path_from(exec_prefix) }
-        .uniq
+        .uniq { |dir| dir.path_key }
       gem_paths += prefix_gem_dirs
       # RubyGems probes the default gem dir for writability at startup and
       # prints "Can't determine writability of default gem path" on stderr
@@ -1137,6 +1249,8 @@ module Ocran
       end
       builder.set_env_path("GEM_PATH", *gem_paths)
 
+      pack_env_hook(builder)
+
       # Add the opcode to launch the script
       installed_ruby_exe = BINDIR / ruby_executable
       target_script = builder.resolve_source_path(@option.script, inst_src_prefix)
@@ -1146,6 +1260,58 @@ module Ocran
       builder.exec(installed_ruby_exe, target_script, *@option.argv)
     end
 
+    # Packs the RubyGems startup hook that sets the exported variables for a
+    # bare bin/ruby of the package (see EnvHook), e.g. a Windows service
+    # registered as `bin\ruby.exe src\service.rb`. It goes into the packed
+    # sitelibdir, the first default load path entry, in every output that
+    # carries the host Ruby: the stub and the launch scripts set the
+    # variables themselves, so there it only loads the original file.
+    # Not with --cosmo-ruby and --static-runtime, which bring their own
+    # Ruby and set up their environment themselves.
+    def pack_env_hook(builder)
+      return if @option.cosmo_ruby || @option.static_runtime?
+
+      site = Pathname(sitelibdir)
+      unless site.subpath?(exec_prefix)
+        verbose "Not packing #{EnvHook::FEATURE}: sitelibdir #{site} is outside #{exec_prefix}"
+        return
+      end
+      if (site / EnvHook::FEATURE).exist?
+        warning "Not packing ocran's #{EnvHook::FEATURE}: #{site} has one already, so a bare " \
+                "#{BINDIR / ruby_executable} of the package will not get the launch script's environment"
+        return
+      end
+
+      target = site.relative_path_from(exec_prefix) / EnvHook::FEATURE
+      say "Adding #{target} (sets the launch environment for a bare #{BINDIR / ruby_executable})"
+      require "tempfile"
+      hook_file = Tempfile.new(["ocran-operating_system", ".rb"])
+      hook_file.write(EnvHook.source(builder.exported_env, target.dirname.each_filename.count))
+      hook_file.close
+      verbose File.read(hook_file.path)
+      # Kept until the build finishes, like the RUBYOPT launcher.
+      @env_hook_file = hook_file
+      builder.cp(hook_file.path, target)
+    end
+    private :pack_env_hook
+
+    # The files below +dir+ that --add-all-core packs, and the entries it
+    # cannot: a Ruby installation can list what is not there - Debian's
+    # rdoc links its fonts into a fonts-lato package that may not be
+    # installed, and a stdlib entry that vanished or cannot be read used to
+    # abort the whole build (ENOENT) over a file no application needs.
+    # Returns [files, skipped], both lists of Pathname.
+    def self.core_library_files(dir)
+      files = []
+      skipped = []
+      dir.find do |src|
+        next if src.directory?
+
+        (src.file? && src.readable? ? files : skipped) << src
+      end
+      [files, skipped]
+    end
+
     # Maps an absolute build-machine path to its location (relative to the
     # extraction root) inside the packed application, mirroring where
     # #construct places files. Returns nil when the path is not packed.
@@ -1295,6 +1461,20 @@ module Ocran
       end
     end
 
+    # The PE resource options (version info, string table, manifest), for
+    # every Windows executable the user launches: the self-extracting exe and
+    # the wrapper that installer, directory and zip output start from.
+    def pe_resource_options
+      {
+        version_strings: @option.version_strings,
+        file_version: @option.file_version,
+        product_version: @option.product_version,
+        resource_strings: @option.resource_strings,
+        execution_level: @option.execution_level,
+        application_manifest: @option.application_manifest&.to_s,
+      }
+    end
+
     # Builds the small RUN_IN_EXE_DIR wrapper stub that starts the deployed
     # application directly from the directory the wrapper resides in.
     def build_wrapper_exe(wrapper_path)
@@ -1307,7 +1487,8 @@ module Ocran
                       gui_mode: @option.windowed?,
                       icon_path: @option.icon_filename,
                       run_in_exe_dir: true,
-                      stub_path: cosmo_stub_path) do |stub|
+                      stub_path: cosmo_stub_path,
+                      **pe_resource_options) do |stub|
         yield(stub)
       end
     end
@@ -1317,7 +1498,11 @@ module Ocran
 
       path = Pathname(path)
       say "Building directory #{path}"
-      builder = DirBuilder.new(path, &to_proc)
+      builder = DirBuilder.new(path,
+                               script_name: @option.script.basename.sub_ext("").to_s,
+                               chdir_before: @option.chdir_before?,
+                               chdir_exe_dir: @option.chdir_exe_dir?,
+                               &to_proc)
 
       if @option.wrapper_exe?
         # Same wrapper as in Inno Setup builds: a doubleclickable executable
@@ -1381,30 +1566,41 @@ module Ocran
       end
 
       bundle_id  = @option.bundle_identifier || "com.example.#{app_name}"
-      icon_entry = @option.icon_filename ? "    <key>CFBundleIconFile</key>\n    <string>AppIcon</string>\n" : ""
+      File.write(contents_dir / "Info.plist",
+                 self.class.info_plist(app_name, bundle_id, icon: !!@option.icon_filename))
+
+      say "Finished building #{bundle_path} (#{builder.data_size} bytes decompressed)"
+    end
 
-      File.write(contents_dir / "Info.plist", <<~PLIST)
+    XML_ESCAPES = { "&" => "&amp;", "<" => "&lt;", ">" => "&gt;", '"' => "&quot;", "'" => "&apos;" }.freeze
+
+    # The Info.plist of a macOS app bundle. The values are XML-escaped: an
+    # app named "R&D" must not produce a property list macOS cannot parse.
+    def self.info_plist(app_name, bundle_id, icon: false)
+      name = app_name.to_s.gsub(/[&<>"']/, XML_ESCAPES)
+      id = bundle_id.to_s.gsub(/[&<>"']/, XML_ESCAPES)
+      icon_entry = icon ? "    <key>CFBundleIconFile</key>\n    <string>AppIcon</string>\n" : ""
+
+      <<~PLIST
         <?xml version="1.0" encoding="UTF-8"?>
         <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
         <plist version="1.0">
         <dict>
           <key>CFBundleName</key>
-          <string>#{app_name}</string>
+          <string>#{name}</string>
           <key>CFBundleDisplayName</key>
-          <string>#{app_name}</string>
+          <string>#{name}</string>
           <key>CFBundleIdentifier</key>
-          <string>#{bundle_id}</string>
+          <string>#{id}</string>
           <key>CFBundleVersion</key>
           <string>1.0</string>
           <key>CFBundlePackageType</key>
           <string>APPL</string>
           <key>CFBundleExecutable</key>
-          <string>#{app_name}</string>
+          <string>#{name}</string>
         #{icon_entry}</dict>
         </plist>
       PLIST
-
-      say "Finished building #{bundle_path} (#{builder.data_size} bytes decompressed)"
     end
 
     # Builds the executable by copying the cosmopolitan Ruby and injecting
@@ -1419,6 +1615,7 @@ module Ocran
       ZipPayloadBuilder.new(output,
                             cosmo_ruby: @option.cosmo_ruby,
                             chdir_before: @option.chdir_before?,
+                            chdir_exe_dir: @option.chdir_exe_dir?,
                             debug_mode: @option.enable_debug_mode?,
                             &to_proc) => builder
 
@@ -1441,6 +1638,56 @@ module Ocran
       say "Finished building #{output} (#{output.size} bytes, #{builder.data_size} bytes of application data)"
     end
 
+    # --static-runtime: the application appended as a ZIP archive to a statically
+    # linked Windows Ruby (see StaticRuntimeBuilder).
+    def build_static_runtime_exe
+      require_relative "static_runtime_builder"
+
+      runtime = StaticRuntime.load(@option.static_runtime)
+      runtime.verify!
+      host_api = RbConfig::CONFIG["ruby_version"]
+      # Gems, default gem specs and the host files the runtime does not
+      # replace were resolved for the build host's Ruby; they only fit a
+      # runtime with the same API version.
+      unless host_api == runtime.ruby_api_version
+        raise "The static runtime in #{runtime.dir} is Ruby #{runtime.ruby_version} (API #{runtime.ruby_api_version}), " \
+              "but this is Ruby #{RUBY_VERSION} (API #{host_api}): package with a Ruby #{runtime.ruby_api_version.sub(/\.0\z/, "")}"
+      end
+      if RUBY_VERSION != runtime.ruby_version
+        warning "Dependency detection ran under Ruby #{RUBY_VERSION}; the static runtime is Ruby #{runtime.ruby_version}"
+      end
+      say "Packaging for the static runtime #{runtime.executable} (Ruby #{runtime.ruby_version} #{runtime.arch})"
+      if @option.extra_dlls.any?
+        warning "--dll has no effect with --static-runtime: a DLL cannot be loaded from inside the executable"
+      end
+
+      output = @option.output_executable
+      StaticRuntimeBuilder.new(output,
+                           runtime: runtime,
+                           host_ruby_api_version: host_api,
+                           host_arch: RbConfig::CONFIG["arch"],
+                           chdir_before: @option.chdir_before?,
+                           chdir_exe_dir: @option.chdir_exe_dir?,
+                           windowed: @option.windowed?,
+                           debug_mode: @option.enable_debug_mode?,
+                           dlls: @option.runtime_dlls,
+                           resources: { icon_path: @option.icon_filename&.to_s, **pe_resource_options },
+                           &to_proc) => builder
+
+      builder.skipped.each do |reason, names|
+        verbose "Not packed (#{reason.to_s.tr("_", " ")}): #{names.size} file(s)"
+        names.each { |name| verbose "\t#{name}" }
+      end
+      unless builder.skipped[:not_in_runtime_stdlib].empty?
+        say "#{builder.skipped[:not_in_runtime_stdlib].size} file(s) of this Ruby's standard library are not " \
+            "in the runtime's and were left out (--verbose lists them)"
+      end
+      say "Finished building #{output} (#{output.size} bytes, #{builder.data_size} bytes of application data)"
+      unless builder.shipped_dlls.empty?
+        say "Ship these DLLs next to #{output.basename}: #{builder.shipped_dlls.map { |d| d.basename.to_s }.join(", ")}"
+      end
+    end
+
     def build_stab_exe
       require_relative "stub_builder"
 
@@ -1457,6 +1704,7 @@ module Ocran
                       gui_mode: @option.windowed?,
                       icon_path: @option.icon_filename,
                       stub_path: cosmo_stub_path,
+                      **pe_resource_options,
                       &to_proc) => builder
       say "Finished building #{@option.output_executable} (#{@option.output_executable.size} bytes)"
       say "After decompression, the data will expand to #{builder.data_size} bytes."

data/lib/ocran/ed_resource.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+require "fiddle/import"
+require "fiddle/types"
+# The language/codepage constants and the pure-Ruby blob builder live in a
+# separate, dlload-free file so they can be unit-tested on any platform.
+require_relative "ed_resource_builder"
+
+module Ocran
+  # Edits PE resources in an executable, in the style of rcedit:
+  #   * RT_VERSION  - version info (VS_VERSIONINFO / VS_FIXEDFILEINFO / StringFileInfo)
+  #   * RT_MANIFEST - application manifest / requested execution level
+  #   * RT_STRING   - string table entries by numeric ID
+  #
+  # This is a sibling of EdIcon and uses the same Windows resource-update API
+  # (BeginUpdateResourceW / UpdateResourceW / EndUpdateResourceW) via Fiddle.
+  module EdResource
+    extend Fiddle::Importer
+    dlload "kernel32.dll"
+
+    include Fiddle::Win32Types
+    typealias "LPVOID", "void*"
+    typealias "LPCWSTR", "char*"
+
+    MAKEINTRESOURCE = -> (i) { Fiddle::Pointer.new(i) }
+    RT_VERSION = MAKEINTRESOURCE.(16)
+    RT_STRING = MAKEINTRESOURCE.(6)
+    # CREATEPROCESS_MANIFEST_RESOURCE_ID == 1; the manifest is stored under
+    # resource type RT_MANIFEST (24), name id 1.
+    RT_MANIFEST = MAKEINTRESOURCE.(24)
+    MANIFEST_RESOURCE_ID = 1
+
+    # Language/codepage constants (MAKELANGID, LANGID, LANGID_US_ENGLISH,
+    # CODEPAGE_UNICODE, STRING_TABLE_KEY), EXECUTION_LEVELS and
+    # MANIFEST_TEMPLATE are defined in ed_resource_builder.rb, required above.
+
+    extern "DWORD GetLastError()"
+    extern "HANDLE BeginUpdateResourceW(LPCWSTR, BOOL)"
+    extern "BOOL EndUpdateResourceW(HANDLE, BOOL)"
+    extern "BOOL UpdateResourceW(HANDLE, LPCWSTR, LPCWSTR, WORD, LPVOID, DWORD)"
+
+    class << self
+      # Perform every requested resource edit under a single
+      # BeginUpdateResource/EndUpdateResource cycle (one PE rewrite).
+      def update(executable_filename, version_strings: nil, file_version: nil,
+                 product_version: nil, resource_strings: nil, manifest_xml: nil,
+                 execution_level: nil)
+        wants_version = !blank?(version_strings) || file_version || product_version
+        wants_manifest = manifest_xml || execution_level
+        wants_strings = !blank?(resource_strings)
+        return unless wants_version || wants_manifest || wants_strings
+
+        update_resource(executable_filename) do |handle|
+          write_version_info(handle, version_strings || {}, file_version, product_version) if wants_version
+          write_manifest(handle, manifest_xml, execution_level) if wants_manifest
+          write_resource_strings(handle, resource_strings) if wants_strings
+        end
+      end
+
+      private
+
+      def blank?(value)
+        value.nil? || (value.respond_to?(:empty?) && value.empty?)
+      end
+
+      def write_version_info(handle, strings, file_version, product_version)
+        merged = {}
+        strings.each { |k, v| merged[k.to_s] = v }
+        merged["FileVersion"] = file_version if file_version
+        merged["ProductVersion"] = product_version if product_version
+
+        blob = Build.version_info(
+          strings: merged,
+          file_version: file_version || merged["FileVersion"] || "0.0.0.0",
+          product_version: product_version || merged["ProductVersion"] || "0.0.0.0"
+        )
+        put(handle, RT_VERSION, 1, blob)
+      end
+
+      def write_manifest(handle, manifest_xml, execution_level)
+        xml = Build.manifest(manifest_xml, execution_level)
+        put(handle, RT_MANIFEST, MANIFEST_RESOURCE_ID, xml.b)
+      end
+
+      def write_resource_strings(handle, id_to_value)
+        id_to_value.group_by { |id, _| id.to_i / 16 }.each do |bundle_index, pairs|
+          bundle = Build.string_bundle(pairs.to_h)
+          put(handle, RT_STRING, bundle_index + 1, bundle)
+        end
+      end
+
+      def put(handle, type, name, data)
+        name_arg = name.is_a?(Integer) ? MAKEINTRESOURCE.(name) : name
+        if UpdateResourceW(handle, type, name_arg, LANGID, data, data.bytesize) == 0
+          raise "Failed to UpdateResourceW(#{GetLastError()})"
+        end
+      end
+
+      def update_resource(executable_filename)
+        path = File.expand_path(executable_filename).encode("UTF-16LE").b + "\x00\x00".b
+        handle = BeginUpdateResourceW(path, 0)
+        if handle == Fiddle::NULL
+          raise "Failed to BeginUpdateResourceW(#{GetLastError()})"
+        end
+
+        yield(handle)
+
+        if EndUpdateResourceW(handle, 0) == 0
+          raise "Failed to EndUpdateResourceW(#{GetLastError()})"
+        end
+      end
+    end
+  end
+end