Repository navigation
build(nix): package Linux SEA release binaries without ELF fixup - #11
Draft
378-kaiabot[bot] wants to merge 1 commit into
Draft
378-kaiabot[bot] wants to merge 1 commit into
378-kaiabot[bot] wants to merge 1 commit into
Conversation
Add packages.obsdx (x86_64-linux and aarch64-linux) and the checks.obsdx-sea-smoke flake check, and document the packaging decision in the README. Empirical result: autoPatchelfHook is not safe for the Node SEA artifact. Its fixup shrinks the PT_NOTE segment that covers the injected NODE_SEA_BLOB note (0xb27a4 -> 0x108), and the packaged binary segfaults on startup before printing anything. The package therefore installs the release artifact unchanged (dontFixup) and NixOS consumers run it via nix-ld; the smoke check exercises the binary the same way, through the store loader with an explicit library path. The aarch64 leg is wired per-system and covered by a documented native-arm run of the same check. Refs #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Automated pull request by Pi, model
aperture/synthetic/hf:moonshotai/Kimi-K3. Implemented by an orchestrated Pi agent and validated empirically by the orchestrating agent againstaliou/obsdxon a worktree ofmain(commit0e839d2).Verdict
autoPatchelfHook is not safe for this Node SEA artifact. Empirically: its ELF fixup shrinks the
PT_NOTEsegment covering the injectedNODE_SEA_BLOBnote (0xb27a4 → 0x108), and the patched binary segfaults on startup before printing anything — the same failure class as nodejs/node#61483. Note: the378labs/pkgsrepo referenced in the issue was not accessible from this environment (auth scope), so its stated strategy was replicated in-repo against the same release artifacts instead.Changes
flake.nix—packages.obsdx(x86_64-linux + aarch64-linux) installing the release asset byte-identical (dontFixup), andchecks.obsdx-sea-smoke, which runs the packaged binary through the glibc store loader with an explicit library path — the same mechanism nix-ld uses on NixOS, and the recommended consumption path for this artifactREADME.md— packaging decision documented: measured pre/post-fixupPT_NOTEsizes, whydontFixup+ nix-ld is safe here, and the exact native-aarch64 procedure (the host had no ARM64, so that leg is documented rather than faked; the aarch64 package output does evaluate)Verification
nix flake check✅ — plus the smoke check rebuilt from scratch by the orchestrator (nix build .#checks.x86_64-linux.obsdx-sea-smoke --rebuild): the packaged binary runs and prints its version; interpreter recorded as/lib64/ld-linux-x86-64.so.2with empty RPATHpnpm check/build/test/lint✅ (no TS changes; run anyway)--version 0.1.0while its tag is 0.2.0 (release stamping quirk; the smoke check deliberately doesn't assert version equality)Refs #8 — kept open on purpose: the aarch64 smoke test needs one run of the documented procedure on native ARM hardware, and the resulting verdict should be ported back into
378labs/pkgsonce accessible.Run host:
confident-somerville· Session:01a0d467-7973-766f-ada1-dddc5d84111d· Model:aperture/synthetic/hf:moonshotai/Kimi-K3