Verify native binaries before packing - #6
Open
henrikottesorensen wants to merge 3 commits into
Open
Conversation
Adds build/verify_native_binary.sh, called from pack_runtime_package, so a binary that fails inspection never becomes a package. Checks per RID: - architecture matches the RID. A mis-targeted binary produces a package that restores fine and never loads. - every P/Invoke symbol is exported. The expected list is read from the EntryPoint attributes in NativeMethod.cs rather than kept in the script, so it cannot drift away from what the wrapper imports. - no dependency outside a per-platform allowlist. This is the check that catches the libgcc_s_dw2-1.dll class of bug, where a binary links against a toolchain runtime that the package does not ship: it works on the machine that built it and fails everywhere else. - Linux only, the highest required glibc symbol version stays within a declared floor. The floor decides which distributions can consume the packages and is a property of the build image, so it can rise silently when that image is bumped. Currently 2.34, which covers RHEL 9, Debian 12 and Ubuntu 22.04. linux-x86 sits exactly on it. Verified against all eight RIDs, and against two deliberately bad inputs: an x86-64 binary declared as linux-arm64, and a win-x86 built without -static-libgcc, which is the bug this repository actually shipped. Both are rejected. Note that bug only reproduces with the mingw gcc 10 on jammy; the gcc 13 on noble does not emit the dependency at all. -static-libgcc stays so the output does not depend on which compiler the base image happens to ship. llvm is added to the build image because binutils cannot read aarch64 PE. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This was referenced Aug 5, 2026
Two problems, both found by running the script from outside the repository while verifying the 3.38.0 bump. The symbol check passed against an empty list. expected_symbols read NativeMethod.cs and was called through command substitution, so when the file could not be read it printed an error, exited its own subshell, and left the caller to compare against nothing. The output read "all 0 P/Invoke symbols exported", which looks like a pass and asserts nothing. The list is now resolved once in the main shell, where a missing or unparsable NativeMethod.cs stops the script. find_tool only looked where Linux distributions put things, so on macOS the ELF checks could not run at all: command -v nm finds BSD nm, which has no -D. It now takes several interchangeable names in preference order and also searches Homebrew's keg-only prefixes, so llvm-readelf, llvm-nm and llvm-readobj are used when present. Those read ELF, PE and Mach-O alike, so with brew install llvm all eight RIDs can be verified on a Mac without a container. Verified: all eight RIDs pass natively on macOS, and a script run where NativeMethod.cs is unreachable now exits 1 instead of reporting success. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
henrikottesorensen
force-pushed
the
feature/native-package-verification
branch
from
August 5, 2026 11:42
4e4593b to
71ca13b
Compare
CI failed fetching linux-libc-dev, a dependency of build-essential: E: Failed to fetch .../linux-libc-dev_5.15.0-187.197_amd64.deb 404 archive.ubuntu.com does not update its index and its pool atomically, so a package version can still be listed after it has been removed, and the fetch 404s. Nothing to do with the packages this image asks for; it is luck, and a single apt-get run has none to spare. Both apt steps now try three times, refreshing the index each time, since a newer index is usually what resolves it. The explicit ok check is load bearing: a bare loop that never succeeds still falls through, and the layer would build with nothing installed and fail much later with something unrecognisable. Verified with --no-cache, which is the case that actually hits the network. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This was referenced Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
build/verify_native_binary.sh, called frompack_runtime_package, so a binary that fails inspection never becomes a package.Checks, per RID
EntryPointNotFoundExceptionat first use.libgcc_s_dw2-1.dllclass of bug.GLIBC_version within a declared floor (Linux)The expected symbols are read from the
EntryPointattributes inLibLouis.NET/NativeMethod.csrather than listed in the script, so the check cannot drift from what the wrapper actually imports — 18 symbols today, and adding a P/Invoke extends the check automatically.The glibc floor is
MAX_GLIBC, currently 2.34, covering RHEL 9, Debian 12 and Ubuntu 22.04 and later.linux-x86sits exactly on it. Raising it drops support for older distributions, so it should be a deliberate decision rather than a side effect of bumping the base image — which is exactly what this check makes it.Verification
Run against all eight RIDs, and against two deliberately bad inputs:
linux-arm64→ rejected on architecturewin-x86built without-static-libgcc→ rejected onlibgcc_s_dw2-1.dllThe second is the bug this repository actually shipped, so the check is demonstrated against a real regression rather than a hypothetical one.
Worth recording: that bug only reproduces with mingw gcc 10 on jammy. gcc 13 on noble does not emit the dependency at all, so an earlier attempt to reproduce it there produced an already-clean binary and looked like the check had failed.
-static-libgccstays regardless, so the output does not depend on which compiler the base image happens to ship.Notes
llvmis added to the build image because binutils cannot read aarch64 PE. The ELF checks usereadelf/nm, which come with build-essential; macOS usesnm/otool.SKIP_NATIVE_VERIFICATION=1bypasses the checks, for deliberately building something they were not written for.🤖 Generated with Claude Code