tebako 0.14.0 → 0.15.0

data/lib/tebako/runtime_manager.rb

@@ -0,0 +1,347 @@
+# frozen_string_literal: true
+
+# Copyright (c) 2026 [Ribose Inc](https://www.ribose.com).
+# All rights reserved.
+# This file is a part of the Tebako project.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+require "digest"
+require "fileutils"
+require "json"
+require "net/http"
+require "uri"
+
+require_relative "error"
+require_relative "version"
+
+# Tebako - an executable packager
+module Tebako
+  # Resolution, download, verification and machine-wide caching of prebuilt
+  # tebako runtime packages published by tamatebako/tebako-runtime-ruby.
+  #
+  # Cache layout (rooted at $TEBAKO_HOME or ~/.tebako):
+  #   runtimes/ruby-<ruby-version>-<tebakoabi>-<platform>/
+  #     tebako-runtime-<tebakoabi>-<ruby-version>-<platform>[.exe]
+  #     sha256    -- digest the installed file was verified against
+  #     origin    -- URL the package was downloaded from
+  #
+  # Installs are serialized per entry with a flock'd lockfile; packages are
+  # downloaded to tmp/, SHA256-verified against the release index and moved
+  # into place with an atomic rename, so partial downloads never poison the
+  # cache.
+  class RuntimeManager # rubocop:disable Metrics/ClassLength
+    DEFAULT_MIRROR = "https://github.com/tamatebako/tebako-runtime-ruby/releases/download"
+    RUNTIMES_DIR = "runtimes"
+    TMP_DIR = "tmp"
+    LOCK_FILE = ".install.lock"
+    SHA256_FILE = "sha256"
+    ORIGIN_FILE = "origin"
+    RUNTIME_TYPE = "ruby"
+    LOCK_TIMEOUT = 300
+    DOWNLOAD_ATTEMPTS = 3
+    RETRY_DELAY = 1.0
+    REDIRECT_LIMIT = 5
+    INDEX_FILES = ["manifest.json", "SHA256SUMS.txt"].freeze
+
+    # The requested index asset is missing or unusable; try the next one
+    class IndexUnavailable < StandardError; end
+    # A download failed (after redirects/retries, at the HTTP layer)
+    class DownloadFailed < StandardError; end
+
+    class << self
+      def default_cache_root
+        tebako_home = ENV.fetch("TEBAKO_HOME", nil)
+        return tebako_home unless tebako_home.nil? || tebako_home.empty?
+
+        if Gem.win_platform?
+          File.join(ENV.fetch("LOCALAPPDATA", File.join(Dir.home, "AppData", "Local")), "tebako")
+        else
+          File.join(Dir.home, ".tebako")
+        end
+      end
+
+      def resolve(ruby_version, platform, tebako_version: Tebako::VERSION)
+        new.resolve(ruby_version, platform, tebako_version: tebako_version)
+      end
+    end
+
+    def initialize(cache_root: nil, mirror: nil, lock_timeout: LOCK_TIMEOUT, retry_delay: RETRY_DELAY)
+      @cache_root = cache_root || self.class.default_cache_root
+      @mirror = (mirror || ENV.fetch("TEBAKO_RUNTIME_MIRROR", nil) || DEFAULT_MIRROR).sub(%r{/+\z}, "")
+      @lock_timeout = lock_timeout
+      @retry_delay = retry_delay
+    end
+
+    attr_reader :cache_root
+
+    def resolve(ruby_version, platform, tebako_version: Tebako::VERSION)
+      dir = entry_dir(ruby_version, platform, tebako_version)
+      executable = File.join(dir, runtime_filename(ruby_version, platform, tebako_version))
+      return executable if File.file?(executable)
+
+      with_entry_lock(dir, runtime_ref(ruby_version, platform, tebako_version)) do
+        install(executable, ruby_version, platform, tebako_version) unless File.file?(executable)
+      end
+      executable
+    end
+
+    def entries
+      base = File.join(@cache_root, RUNTIMES_DIR)
+      return [] unless Dir.exist?(base)
+
+      Dir.children(base).sort.filter_map do |name|
+        path = File.join(base, name)
+        next unless File.directory?(path)
+
+        { name: name, path: path, size_bytes: dir_size(path), installed_at: File.mtime(path) }
+      end
+    end
+
+    def prune(all: false, older_than_days: nil)
+      raise ArgumentError, "prune requires :all or :older_than_days" unless all || older_than_days
+
+      cutoff = older_than_days && (Time.now - (older_than_days * 86_400))
+      entries.each_with_object([]) do |entry, removed|
+        next unless all || entry[:installed_at] < cutoff
+
+        FileUtils.rm_rf(entry[:path], secure: true)
+        removed << entry[:name]
+      end
+    end
+
+    private
+
+    def install(executable, ruby_version, platform, tebako_version)
+      ref = runtime_ref(ruby_version, platform, tebako_version)
+      offline_check(ref, tebako_version)
+      entry = find_entry(fetch_index(tebako_version), ruby_version, platform, tebako_version)
+      url = package_url(entry["filename"], tebako_version)
+      tmp = download(url, entry["filename"])
+      verify!(tmp, entry)
+      place(tmp, executable, entry, url)
+    end
+
+    def offline_check(ref, tebako_version)
+      return unless offline?
+
+      Tebako.packaging_error(123, "#{ref} is not cached and downloads are disabled " \
+                                  "(release index: #{index_urls(tebako_version).join(", ")}; " \
+                                  "TEBAKO_RUNTIME_MIRROR=#{@mirror})")
+    end
+
+    def find_entry(index, ruby_version, platform, tebako_version)
+      entry = index.find { |candidate| candidate["ruby_version"] == ruby_version && candidate["platform"] == platform }
+      return entry if entry
+
+      combos = index.map { |candidate| "#{candidate["ruby_version"]}/#{candidate["platform"]}" }
+      Tebako.packaging_error(120, "no package for ruby #{ruby_version} on #{platform} " \
+                                  "(tebako #{tebako_version}). Available: #{combos.join(", ")}. " \
+                                  "Use --build-runtime to build the runtime from source instead.")
+    end
+
+    def verify!(tmp, entry)
+      actual = Digest::SHA256.file(tmp).hexdigest
+      expected = entry["sha256"].to_s.downcase
+      return if actual == expected
+
+      FileUtils.rm_f(tmp)
+      Tebako.packaging_error(121, "#{entry["filename"]}: expected #{expected}, got #{actual}; download deleted")
+    end
+
+    def place(tmp, executable, entry, url)
+      FileUtils.chmod(0o755, tmp)
+      File.rename(tmp, executable)
+      dir = File.dirname(executable)
+      File.write(File.join(dir, SHA256_FILE), "#{entry["sha256"]}\n")
+      File.write(File.join(dir, ORIGIN_FILE), "#{url}\n")
+    end
+
+    def fetch_index(tebako_version)
+      tried = []
+      INDEX_FILES.each do |name|
+        return parse_index(name, fetch_text(index_url(name, tebako_version)), tebako_version)
+      rescue IndexUnavailable
+        tried << index_url(name, tebako_version)
+      rescue DownloadFailed => e
+        Tebako.packaging_error(122, e.message)
+      end
+      Tebako.packaging_error(124, "tebako-runtime-ruby release v#{tebako_version} provides no usable package " \
+                                  "index (tried: #{tried.join(", ")})")
+    end
+
+    def parse_index(name, body, tebako_version)
+      name == "manifest.json" ? parse_manifest(body, tebako_version) : parse_sha256sums(body, tebako_version)
+    end
+
+    def parse_manifest(body, tebako_version)
+      data = JSON.parse(body)
+      raise IndexUnavailable, "manifest.json is not an array" unless data.is_a?(Array)
+
+      data.select { |entry| entry["tebako_version"] == tebako_version && entry["sha256"] && entry["filename"] }
+    rescue JSON::ParserError
+      raise IndexUnavailable, "manifest.json is not valid JSON"
+    end
+
+    def parse_sha256sums(body, tebako_version)
+      pattern = /\Atebako-runtime-#{Regexp.escape(tebako_version)}-(\d+\.\d+\.\d+)-(.+?)(?:\.exe)?\z/
+      body.each_line.filter_map do |line|
+        sha256, file = line.strip.split(/\s+/, 2)
+        match = file && pattern.match(file.sub(/\A\*/, ""))
+        next unless match
+
+        { "tebako_version" => tebako_version, "ruby_version" => match[1], "platform" => match[2],
+          "filename" => file.sub(/\A\*/, ""), "sha256" => sha256.downcase, "size_bytes" => nil }
+      end
+    end
+
+    def download(url, filename)
+      FileUtils.mkdir_p(File.join(@cache_root, TMP_DIR))
+      tmp = File.join(@cache_root, TMP_DIR, "#{filename}.#{Process.pid}.part")
+      File.binwrite(tmp, with_retries(url) { read_url(url) })
+      tmp
+    rescue IndexUnavailable
+      FileUtils.rm_f(tmp)
+      Tebako.packaging_error(122, "#{url}: not found")
+    rescue DownloadFailed => e
+      FileUtils.rm_f(tmp)
+      Tebako.packaging_error(122, e.message)
+    end
+
+    def fetch_text(url)
+      with_retries(url) { read_url(url) }
+    end
+
+    def with_retries(url) # rubocop:disable Metrics/MethodLength
+      attempts = 0
+      begin
+        attempts += 1
+        yield
+      rescue IndexUnavailable
+        raise
+      rescue StandardError => e
+        raise DownloadFailed, retry_message(url, e) if attempts >= DOWNLOAD_ATTEMPTS
+
+        sleep @retry_delay
+        retry
+      end
+    end
+
+    def retry_message(url, error)
+      "failed to download #{url} after #{DOWNLOAD_ATTEMPTS} attempts: #{error.message}"
+    end
+
+    def read_url(url, redirects_left = REDIRECT_LIMIT)
+      uri = URI.parse(url)
+      return read_file_url(uri) if uri.scheme == "file"
+      raise DownloadFailed, "too many redirects fetching #{url}" if redirects_left.zero?
+
+      read_http_url(url, uri, redirects_left)
+    end
+
+    def read_file_url(uri)
+      File.binread(uri.path)
+    rescue Errno::ENOENT
+      raise IndexUnavailable, uri.path
+    end
+
+    def read_http_url(url, uri, redirects_left)
+      response = http_get(uri)
+      case response
+      when Net::HTTPSuccess then response.body
+      when Net::HTTPRedirection
+        read_url(URI.join(url, response["location"]).to_s, redirects_left - 1)
+      when Net::HTTPNotFound then raise IndexUnavailable, url
+      else raise DownloadFailed, "#{response.code} #{response.message} fetching #{url}"
+      end
+    end
+
+    def http_get(uri)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      http.open_timeout = 15
+      http.read_timeout = 300
+      http.start { |session| session.get(uri.request_uri.empty? ? "/" : uri.request_uri) }
+    end
+
+    def with_entry_lock(dir, ref)
+      FileUtils.mkdir_p(dir)
+      File.open(File.join(dir, LOCK_FILE), File::RDWR | File::CREAT, 0o644) do |lock|
+        acquire_lock(lock, ref)
+        begin
+          yield
+        ensure
+          lock.flock(File::LOCK_UN)
+        end
+      end
+    end
+
+    def acquire_lock(lock, ref)
+      deadline = Time.now + @lock_timeout
+      until lock.flock(File::LOCK_EX | File::LOCK_NB)
+        if Time.now >= deadline
+          Tebako.packaging_error(125, "#{ref}: another process is installing this runtime " \
+                                      "(no lock after #{@lock_timeout}s; lockfile: #{lock.path})")
+        end
+        sleep 0.1
+      end
+    end
+
+    def offline?
+      %w[1 true yes].include?(ENV.fetch("TEBAKO_OFFLINE", "").downcase)
+    end
+
+    def entry_dir(ruby_version, platform, tebako_version)
+      File.join(@cache_root, RUNTIMES_DIR,
+                "#{RUNTIME_TYPE}-#{ruby_version}-#{tebako_version}-#{platform}")
+    end
+
+    def runtime_filename(ruby_version, platform, tebako_version)
+      suffix = platform.start_with?("windows") ? ".exe" : ""
+      "tebako-runtime-#{tebako_version}-#{ruby_version}-#{platform}#{suffix}"
+    end
+
+    def runtime_ref(ruby_version, platform, tebako_version)
+      "ruby@#{ruby_version} (tebako #{tebako_version}, #{platform})"
+    end
+
+    def release_url(tebako_version)
+      "#{@mirror}/v#{tebako_version.to_s.sub(/\Av/, "")}"
+    end
+
+    def index_url(name, tebako_version)
+      "#{release_url(tebako_version)}/#{name}"
+    end
+
+    def index_urls(tebako_version)
+      INDEX_FILES.map { |name| index_url(name, tebako_version) }
+    end
+
+    def package_url(filename, tebako_version)
+      "#{release_url(tebako_version)}/#{filename}"
+    end
+
+    def dir_size(path)
+      Dir.glob(File.join(path, "**", "*")).select { |file| File.file?(file) }.sum { |file| File.size(file) }
+    end
+  end
+end

data/lib/tebako/stitcher.rb

@@ -0,0 +1,255 @@
+# frozen_string_literal: true
+
+# Copyright (c) 2026 [Ribose Inc](https://www.ribose.com).
+# All rights reserved.
+# This file is a part of the Tebako project.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+require "fileutils"
+require "open3"
+require "rbconfig"
+require "zlib"
+
+require_relative "error"
+require_relative "version"
+
+# Tebako - an executable packager
+module Tebako
+  # Stitches tebako images onto a prebuilt runtime binary, producing a
+  # single-file package with a tpkg manifest trailer (spec §4.3).
+  #
+  # Wire layout (all integers little-endian), appended after the runtime:
+  #   [runtime bytes][pad to 8][image 0][pad to 8]...[image n-1]
+  #   [slot table: slot_count x 280 bytes][trailer header: 166 bytes at EOF]
+  #
+  # This is a pure-Ruby reimplementation of the tpkg.h writer (libtfs
+  # include/tebako/tpkg.h); the byte stream is identical to tpkg_write_fd()
+  # for the same manifest. CRC32 is the zlib polynomial (0xEDB88320,
+  # init/xorout 0xFFFFFFFF) — exactly what Zlib.crc32 computes.
+  #
+  # Codesigning: appending bytes invalidates any embedded code signature.
+  # On macOS a signed runtime (ad-hoc included, detected via `codesign -dv`)
+  # is re-signed ad-hoc after stitching (codesign --remove-signature, then
+  # codesign --sign - --force). Note that codesign(1) refuses to re-sign thin
+  # Mach-O binaries carrying trailing payload ("main executable failed strict
+  # validation"), so the re-sign is best-effort: on failure a warning is
+  # printed and the package is kept — the ad-hoc linker signature is
+  # invalidated by construction, but the binary still executes on macOS
+  # (verified on macOS 14/arm64). Re-signing with a real identity remains a
+  # user post-press step. An unsigned runtime is left alone.
+  # On Windows signing is a no-op — re-applying an Authenticode signature
+  # (signtool) is left to the user as a post-press step.
+  class Stitcher # rubocop:disable Metrics/ClassLength
+    MAGIC = "TEBAKOTFS\0".b # 10 bytes, NUL-terminated
+    VERSION = 1
+    MAX_SLOTS = 8
+    HEADER_SIZE = 166
+    SLOT_SIZE = 280
+    MOUNT_POINT_LEN = 256
+    RUNTIME_REF_LEN = 128
+    ALIGNMENT = 8
+
+    FLAG_LEAN = 0x1
+
+    FORMAT_AUTO = 0
+    FORMAT_DWARFS = 1
+    FORMAT_SQUASHFS = 2
+    FORMAT_ZIP = 3
+    FORMAT_IDS = (FORMAT_AUTO..FORMAT_ZIP).freeze
+
+    # Header field offsets
+    OFF_PACKAGE_FLAGS = 14
+    OFF_SLOT_COUNT = 18
+    OFF_TABLE = 22
+    OFF_RUNTIME_REF = 30
+    OFF_CRC32 = 162
+
+    class << self
+      # Stitch +images+ (Array of {path:, mount_point:, format_id:}) onto a
+      # copy of the runtime at +runtime_path+, writing +output+.
+      # lean: true marks the package LEAN and records runtime_ref
+      # ("ruby@<ruby_version>;tebako=<tebako_version>"); classic packages
+      # carry an empty runtime_ref.
+      def stitch(runtime_path, images:, output:, lean: false, ruby_version: nil, # rubocop:disable Metrics/ParameterLists
+                 tebako_version: Tebako::VERSION, launcher_abi: 0)
+        images = normalize_images(images)
+        validate_inputs!(runtime_path, images, lean, ruby_version)
+
+        FileUtils.mkdir_p(File.dirname(output))
+        FileUtils.cp(runtime_path, output)
+        FileUtils.chmod(0o755, output)
+
+        append(images, output, package_flags(lean), runtime_ref(lean, ruby_version, tebako_version), launcher_abi)
+        resign_if_needed(output)
+        output
+      end
+
+      def macos?
+        RbConfig::CONFIG["host_os"] =~ /darwin/i ? true : false
+      end
+
+      # True when +path+ carries any code signature (ad-hoc included)
+      def signed?(path)
+        _out, _err, status = Open3.capture3("codesign", "-dv", path)
+        status.success?
+      rescue Errno::ENOENT
+        false
+      end
+
+      # Re-apply an ad-hoc signature after the binary was mutated; true on
+      # success. codesign(1) refuses to re-sign thin Mach-O binaries with
+      # trailing payload (strict validation) — callers treat failure as
+      # non-fatal (see the class comment).
+      def adhoc_resign(path)
+        system("codesign", "--remove-signature", path, out: File::NULL, err: File::NULL) &&
+          system("codesign", "--sign", "-", "--force", path, out: File::NULL, err: File::NULL)
+      end
+
+      private
+
+      def normalize_images(images)
+        images.map do |image|
+          { path: image[:path], mount_point: image[:mount_point].to_s,
+            format_id: image.fetch(:format_id, FORMAT_DWARFS) }
+        end
+      end
+
+      def validate_inputs!(runtime_path, images, lean, ruby_version)
+        Tebako.packaging_error(126, "at least one image is required") if images.empty?
+        if images.size > MAX_SLOTS
+          Tebako.packaging_error(126, "#{images.size} images given, at most #{MAX_SLOTS} are supported")
+        end
+        if lean && ruby_version.nil?
+          Tebako.packaging_error(126, "lean packages require ruby_version for the runtime_ref")
+        end
+        validate_files!(runtime_path, images)
+        validate_images!(images)
+      end
+
+      def validate_files!(runtime_path, images)
+        Tebako.packaging_error(127, "runtime not found: #{runtime_path}") unless File.file?(runtime_path)
+        images.each do |image|
+          Tebako.packaging_error(127, "image not found: #{image[:path]}") unless File.file?(image[:path])
+        end
+      end
+
+      def validate_images!(images)
+        seen = {}
+        images.each do |image|
+          validate_image!(image)
+          mount = image[:mount_point]
+          Tebako.packaging_error(126, "duplicate mount point '#{mount}'") if seen[mount]
+
+          seen[mount] = true
+        end
+      end
+
+      def validate_image!(image)
+        unless FORMAT_IDS.cover?(image[:format_id])
+          Tebako.packaging_error(126, "invalid format_id #{image[:format_id]} (0..3 expected)")
+        end
+        return unless image[:mount_point].bytesize >= MOUNT_POINT_LEN
+
+        Tebako.packaging_error(126,
+                               "mount point '#{image[:mount_point][0, 32]}...' exceeds #{MOUNT_POINT_LEN - 1} bytes")
+      end
+
+      def package_flags(lean)
+        lean ? FLAG_LEAN : 0
+      end
+
+      def runtime_ref(lean, ruby_version, tebako_version)
+        return "" unless lean
+
+        ref = "ruby@#{ruby_version};tebako=#{tebako_version}"
+        if ref.bytesize >= RUNTIME_REF_LEN
+          Tebako.packaging_error(126, "runtime_ref '#{ref}' exceeds #{RUNTIME_REF_LEN - 1} bytes")
+        end
+        ref
+      end
+
+      # Appends images at 8-byte-aligned offsets; returns slot descriptors
+      def append(images, output, package_flags, runtime_ref, launcher_abi)
+        File.open(output, "ab") do |io|
+          io.seek(0, IO::SEEK_END) # append mode starts at pos 0 until the first write
+          slots = append_images(io, images)
+          write_trailer(io, slots, package_flags, runtime_ref, launcher_abi)
+        end
+      end
+
+      def append_images(io, images)
+        images.map do |image|
+          pad(io)
+          offset = io.pos
+          File.open(image[:path], "rb") { |src| IO.copy_stream(src, io) }
+          { offset: offset, size: io.pos - offset, format_id: image[:format_id], flags: 0,
+            mount_point: image[:mount_point] }
+        end
+      end
+
+      def pad(io)
+        remainder = io.pos % ALIGNMENT
+        io.write("\0" * (ALIGNMENT - remainder)) unless remainder.zero?
+      end
+
+      def write_trailer(io, slots, package_flags, runtime_ref, launcher_abi)
+        slot_table_offset = io.pos
+        slots.each { |slot| io.write(pack_slot(slot)) }
+        io.write(pack_header(slots.size, slot_table_offset, package_flags, runtime_ref, launcher_abi))
+      end
+
+      def pack_slot(slot)
+        [slot[:offset], slot[:size]].pack("Q2") +
+          [slot[:format_id], slot[:flags]].pack("V2") +
+          fixed_string(slot[:mount_point], MOUNT_POINT_LEN)
+      end
+
+      def pack_header(slot_count, slot_table_offset, package_flags, runtime_ref, launcher_abi)
+        header = MAGIC.dup
+        header << [VERSION, package_flags, slot_count].pack("V3")
+        header << [slot_table_offset].pack("Q")
+        header << fixed_string(runtime_ref, RUNTIME_REF_LEN)
+        header << [launcher_abi].pack("V")
+        header << [Zlib.crc32(header)].pack("V") # header bytes [0, 162)
+        header
+      end
+
+      # NUL-padded fixed-width field; callers validate the length beforehand
+      def fixed_string(string, width)
+        string.b.ljust(width, "\0")
+      end
+
+      def resign_if_needed(output)
+        # Windows: no-op. Re-signing an Authenticode-signed runtime is a
+        # documented user post-press step (signtool sign ...).
+        return unless macos?
+        return unless signed?(output)
+        return if adhoc_resign(output)
+
+        warn "Warning: ad-hoc re-sign failed for #{output}; the package still executes on macOS, " \
+             "but its code signature is invalidated by the appended images. " \
+             "Re-sign it with your own identity if you need a valid signature."
+      end
+    end
+  end
+end

data/lib/tebako/version.rb

@@ -26,5 +26,5 @@
 # POSSIBILITY OF SUCH DAMAGE.
 
 module Tebako
-  VERSION = "0.14.0"
+  VERSION = "0.15.0"
 end