Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
| Comment: | Seed: BusyBox wget fetches https through bq2 tls-connect, checking the hostname (x86_64, aarch64)
Intent: ticket d78258f03b, reported by cleave's x86-1 session. The maintainer asked, through that session, for a ticket and a fix. Also F1 on log ticket 2a8699a249. Expression: - Cause: BusyBox 1.36.1's wget runs openssl s_client ... -verify_hostname NAME for https. LibreSSL 3.8.2's s_client rejects that option, and wget hides s_client's stderr, so every https URL failed with "Connection reset by peer". - LibreSSL's s_client cannot check a hostname at all: wrong.host.badssl.com passes with -verify_return_error, and no release up to 4.1.0 adds the option. Dropping the option would therefore have accepted any valid certificate for the wrong host. - New bq2 applet tls-connect [--insecure] HOST:PORT NAME (src/tls_connect_command.cr). It connects with Crystal's TLS client, which checks the chain and the name, then pipes stdin and stdout over the connection. It strips the brackets wget keeps around IPv6 addresses. - patches/busybox-1_36_1/wget-use-bq2-tls-connect.patch makes wget run tls-connect, passing --insecure for --no-check-certificate, and leaves stderr open so the real error shows. It also removes is_ip_address(), which nothing uses any more. The seed's /usr/bin/tls-connect link comes from the bq2 applet list. Demonstrates: - crystal tool format --check is clean. crystal spec gives 203 examples, 0 failures, 5 pending; the new pending case needs network. - Built by hand in this run's root filesystem (x86_64): BusyBox 1.36.1 with both patches and defconfig minus STATIC_LIBGCC and MODPROBE_SMALL. Its wget, with tls-connect on PATH: - fetches https://www.example.com/ and https://1.1.1.1/, both exit 0; - fetches a GitHub tarball through a redirect, byte-identical to upstream (sha256 ea549484...); - refuses wrong.host, expired and self-signed .badssl.com with "certificate verify failed", exit 1; - with --no-check-certificate, fetches wrong.host, exit 0. - PatchApplier applies both patches to pristine source, and the resulting wget.c is identical to the one tested. - Not yet shown on a rebuilt seed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUH8KP8UEDm35iV7mCqbNY |
|---|---|
| Downloads: | Tarball | ZIP archive |
| Timelines: | family | ancestors | descendants | both | seed-ocx-links |
| Files: | files | file ages | folders |
| SHA3-256: |
ee75b652a0dd7084e7edaa5282474610 |
| User & Date: | x86-1-bq2 2026-11-04 13:45:35.235 |
|
2026-11-04
| ||
| 19:04 |
Seed: busybox is built with BB_GLOBAL_CONST emptied, and the rootfs installs the busybox it just built (aarch64, x86_64)
Intent: run 0de68bf272 (native aarch64 seed check), step 4, which could not continue. Announced in that run's thread before the change, as its objective requires. Expression: - Fault: the BQ2-from-BQ2 aarch64 build stopped at the start of system-from-sysroot: m4's configure found "no acceptable grep". autoconf's grep probe checks with diff, and the new rootfs's busybox diff segfaults (exit 139). - Cause 1, a miscompile: clang on aarch64 loads ptr_to_globals before SET_PTR_TO_GLOBALS stores it, because BusyBox declares it const. diff_main+0x64 then stores G.opt_U_context through NULL (address 0x4). Found with an LD_PRELOAD SIGSEGV handler and llvm-objdump. - Fix 1: src/step_runner.cr's busybox strategy also sets CONFIG_EXTRA_CFLAGS="-DBB_GLOBAL_CONST=''", libbb.h's own remedy, for every compiler. disable_kconfig_symbols becomes set_kconfig_symbols, and BUSYBOX_DISABLED_SYMBOLS becomes the one table BUSYBOX_KCONFIG. - Cause 2, a stale binary: rootfs-from-sysroot set STRIP=/bin/true. BusyBox's Makefile makes busybox by stripping busybox_unstripped, so that rule wrote nothing, and make install shipped the busybox left in the same tree by sysroot-from-seed, built by the seed's compiler. Seeds built from Alpine therefore ship Alpine gcc's busybox, which hid cause 1. - Fix 2: src/sysroot_builder.cr gives rootfs-from-sysroot SKIP_STRIP=y, so the Makefile copies busybox_unstripped to busybox. finalize-rootfs still strips debug info. Demonstrates: - crystal tool format --check is clean. - crystal spec on aarch64-1: 204 examples, 3 failures, 5 pending. The same 3 fail without this change (spec/sysroot_builder_spec.cr:290, :379, :563 expect x86_64 triples, and the builder defaults to the host arch). spec/step_runner_spec.cr covers set_kconfig_symbols and the BB_GLOBAL_CONST value. - Control on aarch64-1: step 4's busybox tree, rebuilt by the BQ2 seed's clang with SKIP_STRIP=y, segfaults in diff as-is; with only the flag added, diff returns 0 for identical files and 1 for different ones. - Not yet shown on a rebuilt seed; run 0de68bf272 redoes steps 3 and 4 at this check-in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUH8KKecLJryWiTGbAfUrh check-in: 2469a5375c user: aarch64-1-bootstrap-qcow2-session tags: seed-ocx-links | |
| 13:45 |
Seed: BusyBox wget fetches https through bq2 tls-connect, checking the hostname (x86_64, aarch64)
Intent: ticket d78258f03b, reported by cleave's x86-1 session. The maintainer asked, through that session, for a ticket and a fix. Also F1 on log ticket 2a8699a249. Expression: - Cause: BusyBox 1.36.1's wget runs openssl s_client ... -verify_hostname NAME for https. LibreSSL 3.8.2's s_client rejects that option, and wget hides s_client's stderr, so every https URL failed with "Connection reset by peer". - LibreSSL's s_client cannot check a hostname at all: wrong.host.badssl.com passes with -verify_return_error, and no release up to 4.1.0 adds the option. Dropping the option would therefore have accepted any valid certificate for the wrong host. - New bq2 applet tls-connect [--insecure] HOST:PORT NAME (src/tls_connect_command.cr). It connects with Crystal's TLS client, which checks the chain and the name, then pipes stdin and stdout over the connection. It strips the brackets wget keeps around IPv6 addresses. - patches/busybox-1_36_1/wget-use-bq2-tls-connect.patch makes wget run tls-connect, passing --insecure for --no-check-certificate, and leaves stderr open so the real error shows. It also removes is_ip_address(), which nothing uses any more. The seed's /usr/bin/tls-connect link comes from the bq2 applet list. Demonstrates: - crystal tool format --check is clean. crystal spec gives 203 examples, 0 failures, 5 pending; the new pending case needs network. - Built by hand in this run's root filesystem (x86_64): BusyBox 1.36.1 with both patches and defconfig minus STATIC_LIBGCC and MODPROBE_SMALL. Its wget, with tls-connect on PATH: - fetches https://www.example.com/ and https://1.1.1.1/, both exit 0; - fetches a GitHub tarball through a redirect, byte-identical to upstream (sha256 ea549484...); - refuses wrong.host, expired and self-signed .badssl.com with "certificate verify failed", exit 1; - with --no-check-certificate, fetches wrong.host, exit 0. - PatchApplier applies both patches to pristine source, and the resulting wget.c is identical to the one tested. - Not yet shown on a rebuilt seed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUH8KP8UEDm35iV7mCqbNY check-in: ee75b652a0 user: x86-1-bq2 tags: seed-ocx-links | |
|
2026-11-03
| ||
| 03:24 |
Seed: link ar, ranlib and the LLVM runtime sonames (x86_64, aarch64)
Intent: plan step 1 of ticket 2a8699a249 (what OCX's client needs beyond the 1.0.0 seed). The maintainer, 2026-11-02: "go ahead with plan step 1". Fixes F4 and N5. Expression: - system-from-sysroot links /usr/lib/libunwind.so.1, libc++.so.1 and libc++abi.so.1 to the triple directory. Today they resolve only through /etc/ld-musl-ARCH.path, which OCX's sandbox does not bind, so ocx2, confine, serve and receipt-reader fail to load. Only the sonames are linked: that is what the loader looks up, and clang already finds the triple directory for -l. - It also links /usr/bin/ar -> llvm-ar and /usr/bin/ranlib -> llvm-ranlib, the names make and autotools default to. - sysroot-functest gains ar-archive and runtime-libs. The contract row "cc, c++, ld" becomes "cc, c++, ld, ar, ranlib"; the crystal row also cites runtime-libs. FUNCTEST.md matches. Demonstrates: crystal tool format --check is clean; crystal spec gives 198 examples, 0 failures, 4 pending, with the seed-links spec asserting all five links on aarch64. The two new cases' commands pass in this run's rootfs, whose overlay has equivalent links. Not yet shown on a rebuilt seed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUH8KP8UEDm35iV7mCqbNY check-in: 0cb221436e user: x86-1-bq2 tags: seed-ocx-links | |