[BUG] Cargo setup helpers replace original Git identities with path packages #17

New issue

Open

opened 2026-09-12 11:03:28 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-12 11:03:28 +02:00

Owner

Summary

Maintained Cargo setup helpers verify original Git commits and construct local transport mirrors, but also generate cross-repository path patches. Cargo then reports those dependencies as local path packages rather than their original Git URL/revision identities. This violates the declared original-source validation contract and prevents those results from qualifying as exact-source build evidence.

The observed defect is source identity substitution. It does not establish that different commit bytes were compiled.

Reproduction

At Integration 5bf0fd2c84dd7cd838655cd8abc6915997868a04, use the standalone setup generator for a component with pinned Git dependencies, then run Cargo metadata using its generated Cargo home. Inspect both the generated config.toml and packages[].source/package IDs. Repeat through the monorepo generator.

A retained read-only reproduction used the six independently verified original kernel dependency checkouts. The generated configuration contained six nonempty path-patch URL sections; actual Cargo metadata reported all six external dependencies with source: null and path package IDs. The monorepo filtering stage retained those same six path entries. No compilation or VM was used to establish this result.

Expected and actual behavior

Expected: local Git mirrors change transport only. Cargo must retain each external dependency's original URL, declared complete revision and resolved original commit hash. Same-repository local workspace paths remain valid.

Actual: the generated path patches replace external Cargo source identities even though checkout and mirror commits match. The normal generators expose no transport-only branch; the existing monorepo test explicitly expects an active patch section.

Environment and identity

Integration head: 5bf0fd2c84dd7cd838655cd8abc6915997868a04.
The decisive setup/config helper files are byte-identical to published helper 44f51633e571d6f76cb6df49008880d8a69909ce.
Linux host Cargo metadata inspection, restricted to original local Git mirrors; no guest, image or firmware involved.
Source selectors: explicit original Git URL/full revision and verified checkout heads. The generated configuration is the affected boundary.
No previously correct revision of these generator routes has been established.

Evidence and prior checks

The current standalone generator supplies every needed Git package to the path-patch writer. The monorepo generator writes those patches before metadata inspection and recognizes patched packages by local manifest paths. Correct Git mirrors therefore coexist with substituted Cargo source identities.

Existing tests verify checkout/mirror commits and build success but omit actual external Cargo source-ID assertions. Independently accepted local kernel matrices use a separate empty-patch transport configuration and retain all six original Git identities; those results are unaffected. Direct-rustc shared-object builds are a separate route and are not implicated by this Cargo metadata reproduction.

The correction is signed and pushed at e2b1cf5995
in WIP PR #12. Both generators prepare original Cargo Git caches through local
transport and validate external package URL/revision/commit and manifest
membership. Existing locks remain unchanged; generated outputs and bounded
process cleanup are explicit. Source suites pass, and the real Integration
library passes 21 strict commands and 320/321 default/all-feature unit tests
without warnings using its verified original dependencies. Exact-head CI,
component helper rollout and coordinated image acceptance remain open.

Tracking

Related work: #1, #2, #11 and WIP PR #12. Remove path-substitution plumbing from both normal generator routes while preserving original commit verification, offline mirrors, same-repository paths, dirty/conflicting/missing-source rejection and branch-movement immunity. Add actual-generator metadata regressions for direct/transitive/nested/optional dependencies. Validate complete source IDs before admitting coordinated image builds; retain the pre-fix failing witness.

## Summary Maintained Cargo setup helpers verify original Git commits and construct local transport mirrors, but also generate cross-repository path patches. Cargo then reports those dependencies as local path packages rather than their original Git URL/revision identities. This violates the declared original-source validation contract and prevents those results from qualifying as exact-source build evidence. The observed defect is source identity substitution. It does not establish that different commit bytes were compiled. ## Reproduction At Integration `5bf0fd2c84dd7cd838655cd8abc6915997868a04`, use the standalone setup generator for a component with pinned Git dependencies, then run Cargo metadata using its generated Cargo home. Inspect both the generated `config.toml` and `packages[].source`/package IDs. Repeat through the monorepo generator. A retained read-only reproduction used the six independently verified original kernel dependency checkouts. The generated configuration contained six nonempty path-patch URL sections; actual Cargo metadata reported all six external dependencies with `source: null` and path package IDs. The monorepo filtering stage retained those same six path entries. No compilation or VM was used to establish this result. ## Expected and actual behavior Expected: local Git mirrors change transport only. Cargo must retain each external dependency's original URL, declared complete revision and resolved original commit hash. Same-repository local workspace paths remain valid. Actual: the generated path patches replace external Cargo source identities even though checkout and mirror commits match. The normal generators expose no transport-only branch; the existing monorepo test explicitly expects an active patch section. ## Environment and identity - Integration head: `5bf0fd2c84dd7cd838655cd8abc6915997868a04`. - The decisive setup/config helper files are byte-identical to published helper `44f51633e571d6f76cb6df49008880d8a69909ce`. - Linux host Cargo metadata inspection, restricted to original local Git mirrors; no guest, image or firmware involved. - Source selectors: explicit original Git URL/full revision and verified checkout heads. The generated configuration is the affected boundary. - No previously correct revision of these generator routes has been established. ## Evidence and prior checks The current standalone generator supplies every needed Git package to the path-patch writer. The monorepo generator writes those patches before metadata inspection and recognizes patched packages by local manifest paths. Correct Git mirrors therefore coexist with substituted Cargo source identities. Existing tests verify checkout/mirror commits and build success but omit actual external Cargo source-ID assertions. Independently accepted local kernel matrices use a separate empty-patch transport configuration and retain all six original Git identities; those results are unaffected. Direct-rustc shared-object builds are a separate route and are not implicated by this Cargo metadata reproduction. The correction is signed and pushed at e2b1cf5995bcf6334839cda9a013e90fa97787d5 in WIP PR #12. Both generators prepare original Cargo Git caches through local transport and validate external package URL/revision/commit and manifest membership. Existing locks remain unchanged; generated outputs and bounded process cleanup are explicit. Source suites pass, and the real Integration library passes 21 strict commands and 320/321 default/all-feature unit tests without warnings using its verified original dependencies. Exact-head CI, component helper rollout and coordinated image acceptance remain open. ## Tracking Related work: #1, #2, #11 and WIP PR #12. Remove path-substitution plumbing from both normal generator routes while preserving original commit verification, offline mirrors, same-repository paths, dirty/conflicting/missing-source rejection and branch-movement immunity. Add actual-generator metadata regressions for direct/transitive/nested/optional dependencies. Validate complete source IDs before admitting coordinated image builds; retain the pre-fix failing witness.

erikinkinen added the

bug

phase-6

labels

2026-09-12 11:03:28 +02:00

~~erikinkinen referenced this issue 2026-09-12 11:24:43 +02:00~~

WIP: Coordinate native authority, shell workspace and source transport #12

erikinkinen referenced this issue from erix/e2fsd

2026-09-12 12:37:52 +02:00

WIP: Validate filesystem media and explicit build inputs #3

erikinkinen referenced this issue

2026-09-12 13:58:03 +02:00