fix(runtime): 「可证」要真的可证 —— 三处收窄,两处由 CI 抓到

上一 commit 把 hermetic 下解析不到的 DT_NEEDED 判为可证失败。方向对,范围过宽。

① 产物的格式由产物决定,不由 binding 决定。
Linux→Windows 交叉构建用的是宿主 binding(Linux/glibc/私有加载器 ⇒ hermetic),
产物却是 PE。「不是 ELF」这条解析错误落进 unresolved,于是 crosswin.exe 被判成
「缺一个共享库」而构建失败 —— 一个连 DT_NEEDED 都没有的文件。
validate_runtime_artifact 现在先看 resolution.artifactIsElf。

② unresolved 混装了三种东西,只有一种可证。
「找不到的 SONAME」「读不了的对象」「512 对象上限」此前同住一个 vector。后两种是
关于检查本身的陈述 —— 没能看的检查什么都没证明。拆出 unresolvedSonames,升级只看它。

③ allow_host_libs 必须同时退出两个阶段,否则它意味着两件事。
它本就关掉链接期 hermeticity 检查。既然用户已声明「我有意伸到沙箱外」,mcpp 就不能
再断言产物起不来 —— 他们可能用 LD_LIBRARY_PATH 跑,或装在私有加载器确实会看的地方。
该档下未解析的 NEEDED 报 inconclusive 并指名,不阻断。谓词与 hermetic.cppm 逐字同源
(manifest 键 OR 环境变量),否则「链接放行、闭包判死」是两者中最坏的组合。

顺带把 e2e 206 的一条假绿改成真话。它的「安全宿主 DSO 对照」断言 status==pass,
而 LD_DEBUG=libs 实测:私有加载器的内建默认路径是 glibc 载荷自己的构建期前缀
(…/fromsource-x-glibc/2.39/lib),本机根本不存在,/usr/lib 从不被查,产物 exit 127。
它此前报 pass 只是因为闭包模型回落到宿主目录 —— 与那个被当成 pass 的 GL 程序同一形状。
而这份文件自己的注释「execution is not part of this link-physics control」正是让这条
假绿站住的理由:从来没人运行过它。改为断言 inconclusive + 诊断里指名 libtinfo 与
allow_host_libs。

219 的断言也放松到正确形状:farm 必须是最后一个「绝对路径」条目,而不是字面最后一个。
$ORIGIN 相对条目是另一类东西(它随产物走,不指本机),真实 GLFW 工程的 DT_RPATH
就以 … : <subos>/lib : $ORIGIN 结尾。

Author: speak-agent

CHANGELOG.md

@@ -47,6 +47,22 @@
   现在宿主默认目录只在**非 hermetic** binding 下参与;hermetic 产物上一个谁都提供
   不了的 `DT_NEEDED` 是**可证的**失败(新判决 `unresolvable`),会让构建变红并指名。
 
+  实测佐证(`LD_DEBUG=libs`):私有加载器的内建默认路径是 glibc 载荷**自己的构建期
+  前缀**(`…/fromsource-x-glibc/2.39/lib`),这台机器上根本不存在;`/usr/lib` **从不**
+  被查。因此 e2e `206` 里那条「安全的宿主 DSO 对照」此前报 `pass` 也是假绿 —— 它
+  刻意不运行产物,而产物其实 127。已改为断言 `inconclusive` 并说明原因。
+
+  **`[build] allow_host_libs` 同时退出两个阶段。** 它本就关掉链接期 hermeticity 检查;
+  既然用户已声明「我有意伸到沙箱外」,mcpp 就不能再断言产物起不来(他们可能用
+  `LD_LIBRARY_PATH` 跑,或装在私有加载器会看的地方)。⇒ 该档下未解析的 `NEEDED`
+  报 `inconclusive` 并指名,而不是变红。一条声明,一个含义。
+
+  另两处精度修正(CI 抓到的):`unresolved` 此前混装三种东西 ——「找不到的 SONAME」
+  「读不了的对象」「512 上限」。只有第一种可证,故拆出 `unresolvedSonames`;
+  且**产物的格式由产物决定,不由 binding 决定** —— Linux→Windows 交叉构建拿的是宿主
+  binding(hermetic),产物却是 PE,「不是 ELF」落进 `unresolved` 后被判成「缺库」,
+  让 `crosswin.exe` 构建失败。
+
 ### 变更
 
 - xlings 强相关模块归入 `src/platform/xlings/`:`mcpp.platform.xlings`、

docs/08-toolchain-internals.md

@@ -225,7 +225,24 @@ so reported "resolved" for binaries that exited 127.
 The closure is recorded in `resolution.json` under `runtime.search.closure` and
 printed by `mcpp why runtime`. A `DT_NEEDED` that nothing on a hermetic
 artifact's path can satisfy is a **proven** failure (`unresolvable`), not an
-inconclusive one, and it fails the build.
+inconclusive one, and it fails the build. Measured with `LD_DEBUG=libs`: the
+private loader's built-in default path is the glibc payload's own *build-time*
+prefix, a directory that does not exist on the machine — `/usr/lib` is never
+consulted.
+
+Three things narrow that proof, and each of them is a case where mcpp knows less
+than the wording suggests:
+
+- **The artifact's format decides, not the binding's.** A cross build runs with
+  this host's binding while producing a PE or Mach-O. ELF rules do not apply to
+  the artifact whatever the binding says.
+- **Only an unfindable SONAME proves anything.** "I could not read this object"
+  and "I stopped after 512 objects" are statements about the *check*; a check
+  that could not look has proven nothing, so those stay inconclusive.
+- **`[build] allow_host_libs` opts out of both phases.** It already switches off
+  the link-time hermeticity check; once resolution is the user's responsibility
+  mcpp reports rather than blocks, because they may run under `LD_LIBRARY_PATH`
+  or on a machine where the library sits where the private loader looks.
 
 mcpp also declares `XLINGS_SUBOS_LD_PATHS=0` for every process it spawns. That
 is the opt-out from xlings' linker-wrapper path injection

docs/zh/08-toolchain-internals.md

@@ -185,7 +185,19 @@ farm 在前的话,一次 `xlings install` 就能在事后悄悄换掉一个**已
 
 闭包记录在 `resolution.json` 的 `runtime.search.closure`,并由 `mcpp why runtime`
 打印。hermetic 产物上一个谁都提供不了的 `DT_NEEDED` 是**可证的**失败
-(`unresolvable`),不是「没查过」,它会让构建变红。
+(`unresolvable`),不是「没查过」,它会让构建变红。`LD_DEBUG=libs` 实测:私有加载器的
+内建默认路径是 glibc 载荷**自己的构建期前缀**,该目录在本机并不存在 —— `/usr/lib`
+从不被查。
+
+有三件事收窄这个「可证」,每一件都是 mcpp 知道的比措辞暗示的少:
+
+- **产物的格式由产物决定,不由 binding 决定。** 交叉构建用的是本宿主的 binding,
+  产物却是 PE / Mach-O;无论 binding 怎么说,ELF 规则都不适用于它。
+- **只有「找不到的 SONAME」能证明什么。**「这个对象读不了」「我在 512 个之后停了」
+  都是关于**检查**的陈述;没能看的检查什么都没证明,故仍报 inconclusive。
+- **`[build] allow_host_libs` 同时退出两个阶段。** 它本就关掉链接期 hermeticity 检查;
+  既然解析责任已归用户,mcpp 就只报告不阻断 —— 他们可能用 `LD_LIBRARY_PATH` 跑,
+  或装在私有加载器确实会看的地方。
 
 mcpp 还会给它启动的每个进程声明 `XLINGS_SUBOS_LD_PATHS=0` —— 这是 xlings 链接器
 包装器路径注入的退出声明(openxlings/xlings#540):mcpp 要它的

src/build/runtime_validation.cppm

@@ -159,6 +159,18 @@ std::string status_name(mcpp::platform::elf::RuntimeVerdict::Status status) {
     return "inconclusive";
 }
 
+// Did this build declare that it reaches outside the sandbox?
+//
+// Spelled here exactly as `mcpp.build.hermetic` spells it — manifest key OR
+// environment variable — because the two checks must agree. A build whose link
+// was allowed to resolve host libraries and whose closure was then judged as if
+// it had not is the worst of both: it links, and mcpp calls it broken.
+bool host_libs_allowed(const mcpp::build::BuildPlan& plan) {
+    if (plan.manifest.buildConfig.allowHostLibs) return true;
+    const char* e = std::getenv("MCPP_ALLOW_HOST_LIBS");
+    return e && *e && *e != '0';
+}
+
 // How bad each state is, for rolling many artifacts into one summary.
 // `Unresolvable` sits above `Inconclusive` (it is proven, not unknown) and
 // below `ProvenMismatch` (mixing payloads is the more fundamental error, and
@@ -406,8 +418,12 @@ ValidationReport validate_changed_artifacts(
         validated.artifact = artifact;
         auto resolution = mcpp::platform::elf::resolve_runtime_closure(
             artifact, plan.runtimeBinding, searchDirs);
+        // The SAME opt-out the link-time hermeticity check honours, read the
+        // same way (manifest key or environment). A build that declared it is
+        // reaching outside the sandbox on purpose has taken responsibility for
+        // run-time resolution, so mcpp reports rather than blocks.
         validated.verdict = mcpp::platform::elf::validate_runtime_artifact(
-            artifact, plan.runtimeBinding, resolution);
+            artifact, plan.runtimeBinding, resolution, host_libs_allowed(plan));
         store_artifact(doc, key, fp, validated);
         changedCache = true;
         report.artifacts.push_back(std::move(validated));

src/platform/elf_runtime.cppm

@@ -68,7 +68,27 @@ struct RuntimeResolution {
     ElfRuntimeFacts artifact;
     std::vector<ElfRuntimeFacts> objects;
     std::vector<std::filesystem::path> resolvedLibcs;
+
+    // Everything that stopped the walk, as human-readable text. A mixed bag on
+    // purpose: an object that could not be parsed, a closure that hit the size
+    // cap, and a SONAME nothing provides all belong in the report.
     std::vector<std::string> unresolved;
+
+    // The strict subset that means "a DT_NEEDED nothing on the search path
+    // provides". SEPARATE because only this one is PROVABLE.
+    //
+    // `unresolved` also collects "I could not read this file" and "I stopped
+    // after 512 objects", which are statements about the CHECK, not about the
+    // artifact. Treating the whole bag as proof made a cross-built PE fail its
+    // build: `crosswin.exe` is not ELF, that fact landed in `unresolved`, and a
+    // "you are missing a library" verdict was issued for a file with no
+    // DT_NEEDED at all. Caught by CI, not by reading.
+    std::vector<std::string> unresolvedSonames;
+
+    // Did the artifact itself parse as ELF? False ⇒ the ELF rules do not apply
+    // to it, whatever the binding says. The binding describes the HOST; a cross
+    // build's artifact is a different format entirely.
+    bool artifactIsElf = false;
 };
 
 struct RuntimeVerdict {
@@ -113,10 +133,19 @@ RuntimeResolution resolve_runtime_closure(
     const mcpp::platform::runtime::RuntimeBinding& binding,
     std::span<const std::filesystem::path> additionalSearchDirs = {});
 
+// `hostLibsAllowed` mirrors `[build] allow_host_libs` (and
+// `MCPP_ALLOW_HOST_LIBS`). It is the user's explicit statement that this build
+// reaches outside the sandbox on purpose, and it already switches off the
+// link-time hermeticity check. It has to switch off the RUN-time proof for the
+// same reason: once resolution is the user's responsibility, mcpp can no longer
+// claim the artifact is unstartable — they may run it under LD_LIBRARY_PATH, or
+// on a machine where the library is installed where the private loader looks.
+// One declaration, one meaning, both phases.
 RuntimeVerdict validate_runtime_artifact(
     const std::filesystem::path& artifact,
     const mcpp::platform::runtime::RuntimeBinding& binding,
-    const RuntimeResolution& resolution);
+    const RuntimeResolution& resolution,
+    bool hostLibsAllowed = false);
 
 } // namespace mcpp::platform::elf
 
@@ -579,6 +608,7 @@ RuntimeResolution resolve_runtime_closure(
         return resolution;
     }
     resolution.artifact = std::move(*root);
+    resolution.artifactIsElf = true;
 
     std::deque<ElfRuntimeFacts> queue;
     queue.push_back(resolution.artifact);
@@ -606,6 +636,7 @@ RuntimeResolution resolve_runtime_closure(
                     soname, requester, binding, additionalSearchDirs);
                 if (!path) {
                     resolution.unresolved.push_back(soname);
+                    resolution.unresolvedSonames.push_back(soname);
                     continue;
                 }
                 loadedBySoname.emplace(soname, *path);
@@ -644,6 +675,7 @@ RuntimeResolution resolve_runtime_closure(
     if (!queue.empty())
         resolution.unresolved.push_back("runtime closure exceeds 512 ELF objects");
     detail::sort_unique(resolution.unresolved);
+    detail::sort_unique(resolution.unresolvedSonames);
     std::sort(resolution.artifact.resolvedObjects.begin(),
               resolution.artifact.resolvedObjects.end());
     resolution.artifact.resolvedObjects.erase(
@@ -656,7 +688,8 @@ RuntimeResolution resolve_runtime_closure(
 RuntimeVerdict validate_runtime_artifact(
     const std::filesystem::path& artifact,
     const mcpp::platform::runtime::RuntimeBinding& binding,
-    const RuntimeResolution& resolution) {
+    const RuntimeResolution& resolution,
+    bool hostLibsAllowed) {
     RuntimeVerdict verdict;
     const bool isGlibc = binding.runtimeId.starts_with("glibc@");
     if constexpr (!mcpp::platform::is_linux) {
@@ -689,6 +722,22 @@ RuntimeVerdict validate_runtime_artifact(
 
     const auto artifactPath = detail::canonical_text(artifact);
     const auto& facts = resolution.artifact;
+
+    // THE ARTIFACT'S FORMAT DECIDES, NOT THE BINDING'S.
+    //
+    // The binding describes this HOST — Linux, glibc, a private loader. A cross
+    // build's artifact is a different format entirely, and ELF rules say
+    // nothing about it. Without this, a Linux→Windows cross build reached the
+    // ELF validator with `crosswin.exe`, the "not an ELF file" parse error sat
+    // in `unresolved`, and the build was failed for a missing library on a file
+    // that has no DT_NEEDED at all.
+    if (!resolution.artifactIsElf) {
+        verdict.diagnostics.push_back(std::format(
+            "runtime physics: {} is not ELF; ELF/glibc rules are not applicable",
+            artifactPath));
+        return verdict;
+    }
+
     // ET_REL and static ET_EXEC/ET_DYN files carry no dynamic closure.
     if (facts.interp.empty() && facts.needed.empty() && resolution.unresolved.empty())
         return verdict;
@@ -807,11 +856,14 @@ RuntimeVerdict validate_runtime_artifact(
 
     if (verdict.status != RuntimeVerdict::Status::ProvenMismatch
         && !resolution.unresolved.empty()) {
-        std::string names;
-        for (auto const& name : resolution.unresolved) {
-            if (!names.empty()) names += ", ";
-            names += name;
-        }
+        auto join = [](std::span<const std::string> values) {
+            std::string out;
+            for (auto const& value : values) {
+                if (!out.empty()) out += ", ";
+                out += value;
+            }
+            return out;
+        };
         // PROVEN under a hermetic binding, merely UNKNOWN otherwise.
         //
         // Hermetic means the artifact's PT_INTERP is a private loader whose
@@ -825,7 +877,12 @@ RuntimeVerdict validate_runtime_artifact(
         // A non-hermetic artifact runs under the host loader, which also
         // consults `ld.so.cache` — something mcpp deliberately does not parse.
         // There, unresolved really is unknown.
-        if (binding.hermetic()) {
+        //
+        // And it must be an unfindable SONAME, not merely "something stopped
+        // the walk": an unreadable object or the 512-object cap are statements
+        // about the CHECK, and a check that could not look has proven nothing.
+        if (binding.hermetic() && !resolution.unresolvedSonames.empty()
+            && !hostLibsAllowed) {
             verdict.status = RuntimeVerdict::Status::Unresolvable;
             verdict.diagnostics.push_back(std::format(
                 "runtime closure for {} cannot be satisfied: {} not found on the "
@@ -836,11 +893,21 @@ RuntimeVerdict validate_runtime_artifact(
                 "       Fix: install the provider into the selected SubOS "
                 "(`xlings install <pkg>`), or declare the dependency so mcpp "
                 "resolves it.",
-                artifactPath, names));
+                artifactPath, join(resolution.unresolvedSonames)));
+        } else if (hostLibsAllowed && !resolution.unresolvedSonames.empty()) {
+            inconclusive(std::format(
+                "runtime closure for {} is inconclusive: {} is not on the search "
+                "path this artifact will use, but [build] allow_host_libs is set "
+                "— resolution at run time is yours to arrange (e.g. "
+                "LD_LIBRARY_PATH, or installing it where the private loader "
+                "looks).\n"
+                "       Measured: this loader's built-in default path is the "
+                "glibc payload's own prefix, NOT /usr/lib.",
+                artifactPath, join(resolution.unresolvedSonames)));
         } else {
             inconclusive(std::format(
                 "runtime closure for {} is inconclusive; unresolved objects: {}",
-                artifactPath, names));
+                artifactPath, join(resolution.unresolved)));
         }
     }
     return verdict;

tests/e2e/206_runtime_binding_physics.sh

@@ -1,9 +1,10 @@
 #!/usr/bin/env bash
 # requires: elf gcc
 # 206_runtime_binding_physics.sh — a selected RuntimeBinding must become the
-# physical PT_INTERP/libc pair, and a host DSO whose GLIBC floor is satisfiable
-# must remain a supported control. Proven mismatches fail at link completion;
-# hot no-ops neither relink nor rewrite/re-probe the stored verdict.
+# physical PT_INTERP/libc pair, and a host DSO linked under `allow_host_libs`
+# must still BUILD (the declaration is honoured) while being reported honestly
+# (the private loader does not consult /usr/lib). Proven mismatches fail at link
+# completion; hot no-ops neither relink nor rewrite/re-probe the stored verdict.
 set -euo pipefail
 
 TMP=$(mktemp -d)
@@ -45,8 +46,36 @@ verdict="$output_dir/.mcpp-runtime-verdicts.json"
 [[ -x "$artifact" && -f "$verdict" ]] || fail "artifact/verdict missing"
 readelf -d "$artifact" | grep -q 'libtinfo\.so' \
     || fail "safe control did not retain host libtinfo in DT_NEEDED"
-[[ $(jq -r '.artifacts["bin/runtime-physics-safe"].status' "$verdict") == pass ]] \
-    || { cat "$verdict"; fail "safe host-DSO closure did not pass"; }
+
+# INCONCLUSIVE, not pass — and the change from `pass` is a correction, not a
+# relaxation.
+#
+# This artifact links a HOST libtinfo while carrying a PRIVATE PT_INTERP, and
+# measured with LD_DEBUG=libs the private loader's built-in default path is the
+# glibc payload's own build-time prefix (`…/fromsource-x-glibc/2.39/lib`) — a
+# directory that does not exist on this machine. /usr/lib is never consulted,
+# and the binary exits 127 with "libtinfo.so.6: cannot open shared object file".
+#
+# It used to report `pass` because the closure model fell back to the HOST's
+# default directories, where libtinfo of course is. The model was describing a
+# loader the artifact does not use — the same defect that shipped a GL program
+# as `validation: pass` while it exited 127. This file's own header note
+# ("execution is not part of this link-physics control") is what let the false
+# green stand: nothing ever ran it.
+#
+# `allow_host_libs` is still honoured, and that is the point of the state: the
+# user declared they are reaching outside the sandbox, so mcpp REPORTS rather
+# than blocks — resolution at run time (LD_LIBRARY_PATH, or installing where the
+# private loader looks) is theirs to arrange.
+status=$(jq -r '.artifacts["bin/runtime-physics-safe"].status' "$verdict")
+[[ "$status" == inconclusive ]] \
+    || { cat "$verdict"; fail "host-DSO closure status is '$status', expected inconclusive"; }
+jq -r '.artifacts["bin/runtime-physics-safe"].diagnostics[]' "$verdict" \
+    | grep -q 'libtinfo\.so\.6' \
+    || { cat "$verdict"; fail "the verdict does not name the library it could not resolve"; }
+jq -r '.artifacts["bin/runtime-physics-safe"].diagnostics[]' "$verdict" \
+    | grep -q 'allow_host_libs' \
+    || { cat "$verdict"; fail "the verdict does not say why it stopped short of a proof"; }
 
 artifact_before=$(stat -c '%y:%s' "$artifact")
 verdict_before=$(stat -c '%y:%s' "$verdict")
@@ -59,8 +88,8 @@ noop_out=$($MCPP build 2>&1) || { echo "$noop_out"; fail "hot no-op build"; }
 doctor_out=$($MCPP self doctor 2>&1 || true)
 grep -q 'last runtime closure verdict' <<<"$doctor_out" \
     || { echo "$doctor_out"; fail "doctor omitted stored runtime verdict"; }
-grep -q 'runtime-physics-safe.*pass' <<<"$doctor_out" \
-    || { echo "$doctor_out"; fail "doctor did not reuse passing verdict"; }
+grep -q 'runtime-physics-safe.*inconclusive' <<<"$doctor_out" \
+    || { echo "$doctor_out"; fail "doctor did not reuse the stored verdict"; }
 
 # Force form-X into a proven Rule-B mismatch: mcpp still supplies the selected
 # private libc RUNPATH, while the final user flag replaces PT_INTERP with the

tests/e2e/219_runtime_search_farm_is_last.sh

@@ -148,12 +148,24 @@ PY
 echo "DT_RPATH: $DT_RPATH"
 [[ -n "$DT_RPATH" ]] || { echo "FAIL: executable carries no DT_RPATH"; exit 1; }
 
-RPATH_LAST="${DT_RPATH##*:}"
-[[ "$RPATH_LAST" == "$FARM" ]] || {
-    echo "FAIL: DT_RPATH does not end with the farm"
-    echo "      recorded farm: $FARM"
-    echo "      DT_RPATH last: $RPATH_LAST"
-    echo "      full:          $DT_RPATH"
+# The farm must be the last ABSOLUTE entry — not literally the last entry.
+#
+# `$ORIGIN`-relative entries are a different kind: they address the artifact's
+# own directory, not this machine, so they travel with it and their position
+# says nothing about which machine-local directory wins. A project with a shared
+# library dependency gets one appended after everything else, and an assertion
+# of "literally last" would fail on every such project while the invariant it
+# meant to check still held. (Measured on a real GLFW app, whose DT_RPATH ends
+# `… : <subos>/lib : $ORIGIN`.)
+RPATH_LAST_ABS="$(python3 -c "
+p = [x for x in '''$DT_RPATH'''.split(':') if x.startswith('/')]
+print(p[-1] if p else '')
+")"
+[[ "$RPATH_LAST_ABS" == "$FARM" ]] || {
+    echo "FAIL: the farm is not the last absolute entry of DT_RPATH"
+    echo "      recorded farm:      $FARM"
+    echo "      last absolute entry: $RPATH_LAST_ABS"
+    echo "      full:               $DT_RPATH"
     exit 1
 }