mirror of
https://github.com/Klipper4FlashForge/firmware.git
synced 2026-10-22 13:22:16 -05:00
Oleksandr ShyshatskyiandClaude Opus 5
f8b925e48f
docs/notes/85-packaging.md chose opkg in 2026-08 on one argument: every package
is cross-built here anyway, so the winner is whichever format is cheapest to
PRODUCE -- and .ipk had an upstream tool where .apk meant abuild, a keypair and
an Alpine host. Two lines of that comparison were wrong.
apk mkpkg is an applet of apk itself: -I key:value metadata, -F directory, no
keypair, no abuild, no Alpine host. The "making a package" row described
apk-tools 2. And the on-device client was counted a wash when it is better than
one -- openssl and zlib were already cross-built for CPython, and libarchive
existed in this tree only for opkg, so adopting apk REMOVES a cross-build.
What made it possible at all is that apk resolves its database relative to
--root and uses the same root as the file destination, while / here is a
read-only squashfs -- measured: neither /lib/apk nor /etc/apk can be created.
pkgs/3rdparty/apk-tools/prefix.patch splits the two. Upstream already carries
root_fd and dest_fd separately and merely aliases them in context.c, so the
patch defaults the database root to $MODDIR and leaves files extracting at /.
That is opkg's compile-time VARDIR plus `dest root /`, in apk's spelling.
THE FEED IS SIGNED NOW, which it never was: opkg signed the index and
bin/build-packages.sh signed nothing, so nothing was verified on a printer.
apk verifies with raw PEM public keys, not X.509 -- measured on the machine,
where every certificate directory is empty. ./bin/apk-keygen.sh makes an RSA
pair, APK_SIGN_KEY in config.env points at the private half, and the public
half both seeds the USB stick (so the first install can verify) and ships in
anvil-core (so the printer keeps trusting). An empty APK_SIGN_KEY still builds
an unsigned feed, deliberately: `make packages` has to run on a bare checkout
or the packaging lane stops being a CI gate.
WHAT IT COST is a carried patch, against an internal with one consumer, on a
branch mid v2->v3 transition, on an architecture with no upstream apk port to
share the rebasing. That is the standing risk and it does not go away.
Four bugs this shook out, all silent, all found by a gate rather than by
reading:
* The prune deleted seventeen packages it had just built. The all -> noarch
mapping went into the emitter and not into pkg_pkgfile, so the prune looked
for a name nothing wrote. `make packages` exited 0.
* Whitespace-separated Depends dropped nineteen packages. opkg's pkg_parse.c
splits that field on ',' and nothing else, so the whole list became one
dependency whose name contained spaces and resolved to nothing -- and opkg
neither warned nor failed. `make build` shipped a payload with no Tornado
in it. test_the_payload_is_dependency_closed is what catches that now.
* Ownership was recorded as `nobody`. apk resolves an owner to a NAME against
<--root>/etc/passwd and the build lane runs --user with no passwd entry, so
every file in every package would have installed as uid 65534, with no
error at build or install time. build-packages.sh writes a two-line
synthetic passwd naming the build user root and points --root at it.
* Four recipes carried versions apk cannot parse -- two spelled a commit
+git<sha> where the grammar's hash slot is ~, x264 had a snapshot name
whose -2245 reads as a malformed release, and helixscreen had
0.99.115.creator5.3 where apk allows one trailing letter and then only a
suffix from a closed set of nine words. All four were valid opkg versions,
which is why nothing had noticed. pkg_version_ok gates every recipe now.
A v3 .apk begins with ADBd magic and is not a tar stream, so there is no apk
equivalent of the `ar -p | gunzip | tar` that hand-unpacked anvil-opkg: you
cannot open a package without a package manager. bin/build-payload.py puts the
cross-built binary on the stick at /mnt/apk instead. It is the same build
anvil-apk-tools contains, that package installs normally, and the bootstrap
copy never lands.
Two gates retired rather than moved. apk's installed database is plain text
(F: sets a directory, R: names a file in it), so the payload-ownership check
reads one file where it used to glob info/*.list. And it carries no clock at
all -- apk records no install time and mkpkg sets no build-time -- so the
Installed-Time normalisation case-build-payload.sh did on every build is gone,
and the test asserts the ABSENCE of a t: line instead. Clock-free by
construction rather than by repair.
Also removed: PKG_SECTION, which 45 recipes declared and nothing read once
apk's schema had no field for it, and the `make apk-host` target -- the
packager is built on demand by bin/build-packages.sh and stamped on the pin,
the way pkg_toolchain and pkg_buildpython already work.
Verified from a cold work/host and work/packages: 47 packages built and signed,
`make build` installs 35 and verifies them against the shipped public key,
`make qa-static` 195 passed, `make qa-replica` 135 passed -- the printer
installing off a simulated USB stick and booting. The installed set was checked
against the declared closure of the eleven roots: 35 expected, 35 installed,
nothing extra and nothing missing.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013rbKEyLXrzSE6wm3iNApVp
45 lines
2.4 KiB
Plaintext
45 lines
2.4 KiB
Plaintext
# anvil-python -- CPython, cross-compiled for the printer.
|
|
#
|
|
# WHY THERE IS A SECOND PYTHON ON THIS MACHINE: FlashForge built its 3.8.2
|
|
# without _sqlite3, and that single omission is what pins MOONRAKER_VERSION to
|
|
# a 2023 commit.
|
|
#
|
|
# THE PREFIX IS COMPILED IN, exactly as for s6: sys.prefix and the stdlib
|
|
# search that follows are baked in at configure time, so moving the directory
|
|
# on the printer breaks the interpreter -- it has to be rebuilt, not renamed.
|
|
#
|
|
# ONLY bin/python3.13 SHIPS, and the name matters: anvil-env.sh PREPENDS
|
|
# $MODDIR/bin to PATH, so a bin/python3 of ours would sit AHEAD of
|
|
# FlashForge's for every process that sources it, and anything saying
|
|
# `python3` rather than "$FF_PYTHON" would silently change interpreter.
|
|
PKG_NAME=anvil-python
|
|
PKG_VERSION="$PY_VERSION"
|
|
PKG_RELEASE=1
|
|
|
|
PKG_EXCLUDE=".version"
|
|
|
|
# NO Depends, AND THAT IS A MEASURED CLAIM. Every C library this interpreter
|
|
# uses is linked in STATICALLY, so the only shared objects it needs are the
|
|
# printer's own libc, libm, libdl, libpthread and libatomic.so.1, all on the
|
|
# stock rootfs.
|
|
PKG_DEPENDS=""
|
|
|
|
# SEVEN LIBRARIES, EACH EXACTLY ONE stdlib MODULE: openssl is _ssl and
|
|
# _hashlib, sqlite _sqlite3, zlib zlib, libffi _ctypes, xz _lzma, bzip2 _bz2,
|
|
# expat pyexpat. build.sh gates all seven by name, because CPython's answer to
|
|
# a library it cannot link is to record the module absent and CARRY ON.
|
|
PKG_BUILD_DEPENDS="openssl sqlite zlib libffi xz bzip2 expat"
|
|
|
|
# THE HEADERS ARE THE POINT OF THE DEV SPLIT. The eighteen python-* recipes
|
|
# cross-compile C extensions against them; before this package existed they
|
|
# reached them by building inside bin/payload.sh at the one moment an untrimmed
|
|
# staging tree happened to be on disk. A -dev package makes that durable, and
|
|
# a printer installs none of it.
|
|
#
|
|
# config-3.13-* comes along because sysconfig's LIBPL points into it.
|
|
# libpython3.13.a is deleted in build.sh: 35MB of archive nothing links.
|
|
PKG_DEV_FILES="include lib/pkgconfig lib/python$PY_MM/config-$PY_MM-*"
|
|
PKG_DEV_DESCRIPTION="CPython headers and build configuration for mipsel. This is what the pkgs/3rdparty/python-* recipes compile their C extensions against; nothing installs it on a printer."
|
|
|
|
PKG_DESCRIPTION="CPython $PY_VERSION for the printer, with sqlite3, ssl, lzma, bz2, ctypes and expat linked in statically. Installs as bin/python3.13 -- never as python3, which would shadow the stock interpreter on PATH."
|