[BUG] Runtime archive selection depends on filesystem modification time #62

New issue

Closed

opened 2026-09-17 20:22:52 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-17 20:22:52 +02:00

Owner

Summary

Fresh dynamic Kernel, Rootd and service links select a Rust runtime archive by filesystem modification time when the compiler target directory contains multiple matching identities. Touching either candidate can change the link input without an explicit compiler selection.

Reproduction

At Integration fa86d1b64f8e1299c0ee0c886e6f1b35d58ea15b, call the existing archive selector with an owned temporary directory containing two libcore-*.rlib names. Assign opposite modification-time orderings, then equal timestamps. Repeat with two liballoc-*.rlib names containing identical harmless fixture bytes.

Two isolated host controls exercise the original selector. All four required ambiguity refusals fail because it returns a candidate. These are filename-selection fixtures, not compiled Rust archives or a guest exploit.

Expected and actual behavior

Expected: a role with exactly one file is selected; a missing, ambiguous or non-file role fails before the final linker starts. Neither timestamps nor lexical name order establish compiler membership.

Actual: the selector sorts candidates by modification time and returns the last entry. Kernel, Rootd and service artifact builders all share that selector. Cache hits do not execute a new final link and are outside this reproduction.

Environment and identity

Integration revision is identified above; x86-64 Linux host with owned temporary files.
The original two-control run exits 1, with four failed subcases and no compiler or guest execution.
The tests need only access to their own fixture directory; they do not modify an installed compiler, another build, or any runtime capability.
No earlier working revision has been established.

Evidence and prior checks

The unchanged original selector and its actual failing output are retained. Eight corrected controls cover exact single selection, irrelevant names, missing and duplicate roles, reversed/equal timestamps, identical candidate bytes, non-file entries and file aliases. Their first corrected run passes. Full helper checks, native links and matching CI remain pending.

The repair removes the mtime-selection API and updates all three consumers. It does not establish complete source provenance, cache-input coverage or protection against concurrent sysroot mutation. Those remain distinct input-ownership obligations.

Local reviewed correction at signed 77921a7d97874e3f44aae66ae9bef6e6196af2f5: Eight selector controls pass, including four original refusal subcases that fail against the predecessor. All 167 helper commands and four strict Rust configurations pass (320 default/321 all-feature tests), with formatting, Clippy, freestanding builds and private rustdoc. Both original 60-second native invocation/lifetime scenarios pass; their Kernel bytes match the earlier signed diagnostics. A separate retained-graph host package performs 38 fresh native links and reproduces its original Kernel ELF before and after stripping. These are host builds and bounded native regressions, not a complete guest build. Original automatic CI remains pending; this issue stays open for that bounded correction.

Original archive-head regression classification — 17 September 2026: CI 1653 and CI 1654, both at 77921a7d97874e3f44aae66ae9bef6e6196af2f5, each finish with 406 passing and 80 failing scenarios out of 486. All six terminal logs are complete (27,648,897 bytes), with no warning candidates; Rust and Markdown pass. Both retain the 78 layout refusals and quota timeout. The additional original failures are ext4-xattr in push CI 1653 and ext4-metadata in PR CI 1654, each at the unchanged 120-second QEMU deadline. The opposite case passes in the paired run. No serial-stall report, deterministic isolated reproduction or common cause is established. No workflow is restarted.

The bounded archive-selection repair is accepted: the corrected selector controls and artifact-helper regressions run before the catalog, with the previously recorded strict/local native-link evidence. This closes only mtime-based selection. Full-catalog failures remain open in #18, #20 and #57; neither failed workflow is reported as passing. Complete compiler-input ownership and guest builds remain separate work.

Tracking

Owning build validation: #1 and #12. Require the original refusals, all corrected controls, existing artifact-helper regressions, strict component checks and real native links before accepting the bounded repair. Preserve the separate full-catalog failures in #18, #57 and #61.

## Summary Fresh dynamic Kernel, Rootd and service links select a Rust runtime archive by filesystem modification time when the compiler target directory contains multiple matching identities. Touching either candidate can change the link input without an explicit compiler selection. ## Reproduction At Integration `fa86d1b64f8e1299c0ee0c886e6f1b35d58ea15b`, call the existing archive selector with an owned temporary directory containing two `libcore-*.rlib` names. Assign opposite modification-time orderings, then equal timestamps. Repeat with two `liballoc-*.rlib` names containing identical harmless fixture bytes. Two isolated host controls exercise the original selector. All four required ambiguity refusals fail because it returns a candidate. These are filename-selection fixtures, not compiled Rust archives or a guest exploit. ## Expected and actual behavior Expected: a role with exactly one file is selected; a missing, ambiguous or non-file role fails before the final linker starts. Neither timestamps nor lexical name order establish compiler membership. Actual: the selector sorts candidates by modification time and returns the last entry. Kernel, Rootd and service artifact builders all share that selector. Cache hits do not execute a new final link and are outside this reproduction. ## Environment and identity - Integration revision is identified above; x86-64 Linux host with owned temporary files. - The original two-control run exits 1, with four failed subcases and no compiler or guest execution. - The tests need only access to their own fixture directory; they do not modify an installed compiler, another build, or any runtime capability. - No earlier working revision has been established. ## Evidence and prior checks The unchanged original selector and its actual failing output are retained. Eight corrected controls cover exact single selection, irrelevant names, missing and duplicate roles, reversed/equal timestamps, identical candidate bytes, non-file entries and file aliases. Their first corrected run passes. Full helper checks, native links and matching CI remain pending. The repair removes the mtime-selection API and updates all three consumers. It does not establish complete source provenance, cache-input coverage or protection against concurrent sysroot mutation. Those remain distinct input-ownership obligations. Local reviewed correction at signed `77921a7d97874e3f44aae66ae9bef6e6196af2f5`: Eight selector controls pass, including four original refusal subcases that fail against the predecessor. All 167 helper commands and four strict Rust configurations pass (320 default/321 all-feature tests), with formatting, Clippy, freestanding builds and private rustdoc. Both original 60-second native invocation/lifetime scenarios pass; their Kernel bytes match the earlier signed diagnostics. A separate retained-graph host package performs 38 fresh native links and reproduces its original Kernel ELF before and after stripping. These are host builds and bounded native regressions, not a complete guest build. Original automatic CI remains pending; this issue stays open for that bounded correction. Original archive-head regression classification — 17 September 2026: [CI 1653](https://git.erikinkinen.fi/erix/integration/actions/runs/1653) and [CI 1654](https://git.erikinkinen.fi/erix/integration/actions/runs/1654), both at `77921a7d97874e3f44aae66ae9bef6e6196af2f5`, each finish with 406 passing and 80 failing scenarios out of 486. All six terminal logs are complete (27,648,897 bytes), with no warning candidates; Rust and Markdown pass. Both retain the 78 layout refusals and quota timeout. The additional original failures are ext4-xattr in push CI 1653 and ext4-metadata in PR CI 1654, each at the unchanged 120-second QEMU deadline. The opposite case passes in the paired run. No serial-stall report, deterministic isolated reproduction or common cause is established. No workflow is restarted. The bounded archive-selection repair is accepted: the corrected selector controls and artifact-helper regressions run before the catalog, with the previously recorded strict/local native-link evidence. This closes only mtime-based selection. Full-catalog failures remain open in #18, #20 and #57; neither failed workflow is reported as passing. Complete compiler-input ownership and guest builds remain separate work. ## Tracking Owning build validation: #1 and #12. Require the original refusals, all corrected controls, existing artifact-helper regressions, strict component checks and real native links before accepting the bounded repair. Preserve the separate full-catalog failures in #18, #57 and #61.

erikinkinen added the

refactor

bug

phase-6

labels

2026-09-17 20:22:52 +02:00

erikinkinen referenced this issue from erix/docs

2026-09-17 20:31:45 +02:00

WIP: Document native authority and verify workspace and command evidence #4

erikinkinen referenced this issue

2026-09-17 20:34:24 +02:00

WIP: Coordinate native authority, shell workspace and source transport #12