From e60a2e7be98aac0344e641553a20c0cf883bbcdd Mon Sep 17 00:00:00 2001 From: bryan Date: Wed, 22 Jul 2026 14:44:23 -0700 Subject: [PATCH 1/2] Add zvelte-check-bin 0.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A fast Svelte diagnostic tool written in Zig, from the ampcode/homebrew-tap Homebrew formula. First package produced by `pkgmgr import homebrew`. Prebuilt per-arch binaries from upstream's own GitHub releases. Both sha256 values were RECOMPUTED from the downloaded bytes rather than copied out of the formula, so the tap is a cross-check and not the root of trust for the only value anchoring this package's integrity. `strip_prefix` is absent because the archives are genuinely flat — read off the real tarball (`tar -tzf` lists one entry, `zvelte-check`), not guessed. Homebrew auto-strips a single leading directory before `def install` and minimal does not, so this is unknowable from the formula text. Provenance is derived from the ARTIFACT URLs, which are literally github.com/ampcode/zvelte-check/releases/..., and cross-checked against the homepage. That buys real CPE identity (not a dark package) and free version checking via the GitHub tier. NOT a source build, and worth stating plainly: `zig` IS packaged, and pkgs CLAUDE.md prefers building from source when the toolchain exists. Prebuilt was chosen only because pkgmgr has no Zig BuildFlavor yet — not because the toolchain is missing. Mitigating: these are upstream's own release binaries, not a third-party redistribution, and we verify their hashes ourselves. A source-built `zvelte-check` can take the bare name later, which is why this one carries the `-bin` suffix. No reviewer TODOs: licence, provenance, outputs and deps were all resolved mechanically. Co-Authored-By: Claude Opus 4.8 --- packages/zvelte-check-bin/build.ncl | 51 +++++++++++++++++++++++++++++ packages/zvelte-check-bin/build.sh | 7 ++++ 2 files changed, 58 insertions(+) create mode 100644 packages/zvelte-check-bin/build.ncl create mode 100755 packages/zvelte-check-bin/build.sh diff --git a/packages/zvelte-check-bin/build.ncl b/packages/zvelte-check-bin/build.ncl new file mode 100644 index 00000000..e3aef4d9 --- /dev/null +++ b/packages/zvelte-check-bin/build.ncl @@ -0,0 +1,51 @@ +let { Attrs, BuildSpec, Local, OutputBin, Source, .. } = import "minimal.ncl" in +let { target, .. } = import "config.ncl" in +let base = import "../base/build.ncl" in +let glibc = import "../glibc/build.ncl" in + +# Imported from the Homebrew formula `ampcode/homebrew-tap/zvelte-check` by `pkgmgr import homebrew`. +# +# PREBUILT vendor binary — there is no source build. The pinned sha256 +# per architecture is the ONLY integrity anchor for this package. +let version = "0.2.0" in +let target_suffix = match { { arch = 'Amd64, .. } => "x86_64", { arch = 'Arm64, .. } => "aarch64" } target in +{ + name = "zvelte-check-bin", + build_deps = [ + { file = "build.sh" } | Local, + match { + { arch = 'Amd64, .. } => + { + url = "https://github.com/ampcode/zvelte-check/releases/download/v%{version}/zvelte-check-linux-x86_64.tar.gz", + sha256 = "f3326fe48a0a2bc056b16ce424abd705ca7864d3632fd8f02ace1ea8ecfc8b9b", + } | Source, + { arch = 'Arm64, .. } => + { + url = "https://github.com/ampcode/zvelte-check/releases/download/v%{version}/zvelte-check-linux-aarch64.tar.gz", + sha256 = "05a2661648952ba12b2da618242698c3065d2db375340cb605288a38f59c4105", + } | Source, + } target, + base, + ], + runtime_deps = [ + glibc, + ], + + cmd = "./build.sh", + build_args = { include version, arch = target_suffix }, + + outputs = { + zvelte-check = { glob = "usr/bin/zvelte-check" } | OutputBin, + }, + + attrs = + { + upstream_version = version, + license_spdx = "MIT", + source_provenance = { + category = 'GithubRepo, + owner = "ampcode", + repo = "zvelte-check", + }, + } | Attrs, +} | BuildSpec diff --git a/packages/zvelte-check-bin/build.sh b/packages/zvelte-check-bin/build.sh new file mode 100755 index 00000000..b5894863 --- /dev/null +++ b/packages/zvelte-check-bin/build.sh @@ -0,0 +1,7 @@ +#!/bin/sh +# Imported from the Homebrew formula `ampcode/homebrew-tap/zvelte-check` by `pkgmgr import homebrew`. +# Prebuilt vendor binary: unpacked and installed, never compiled. +set -ex + +tar -xof "zvelte-check-linux-${MINIMAL_ARG_ARCH}.tar.gz" +install -D -m 755 "zvelte-check" "$OUTPUT_DIR/usr/bin/zvelte-check" From 760e160dcfe32992cb1a9ebe1c8f2c5d4375dc6a Mon Sep 17 00:00:00 2001 From: bryan Date: Wed, 22 Jul 2026 14:54:29 -0700 Subject: [PATCH 2/2] =?UTF-8?q?zvelte-check-bin:=20drop=20glibc=20?= =?UTF-8?q?=E2=80=94=20the=20binary=20is=20statically=20linked?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Refined against the real built tree with `pkgmgr import homebrew … --from-build`, which reads the installed ELF instead of guessing. The binary is statically linked (`file`: "ELF 64-bit LSB executable, ARM aarch64 … statically linked"), so it needs no runtime_deps at all. The discovery-mode `[glibc]` was a template default, not an observation. Verified by rebuilding: the package produces a new content-addressed tree and a real 5 MB aarch64 binary at usr/bin/zvelte-check. Co-Authored-By: Claude Opus 4.8 --- packages/zvelte-check-bin/build.ncl | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/packages/zvelte-check-bin/build.ncl b/packages/zvelte-check-bin/build.ncl index e3aef4d9..07d836aa 100644 --- a/packages/zvelte-check-bin/build.ncl +++ b/packages/zvelte-check-bin/build.ncl @@ -1,7 +1,6 @@ let { Attrs, BuildSpec, Local, OutputBin, Source, .. } = import "minimal.ncl" in let { target, .. } = import "config.ncl" in let base = import "../base/build.ncl" in -let glibc = import "../glibc/build.ncl" in # Imported from the Homebrew formula `ampcode/homebrew-tap/zvelte-check` by `pkgmgr import homebrew`. # @@ -27,9 +26,8 @@ let target_suffix = match { { arch = 'Amd64, .. } => "x86_64", { arch = 'Arm64, } target, base, ], - runtime_deps = [ - glibc, - ], + # No runtime_deps: the installed binary is statically linked + # (verified against the built tree, not assumed). cmd = "./build.sh", build_args = { include version, arch = target_suffix },