Backport official GLib iterator safety fix for Linux desktop

tools/glib-regression/verify_vendor.py

@@ -0,0 +1,65 @@
+"""Check the complete vendored crate against the pinned official archive.
+
+Usage: python tools/glib-regression/verify_vendor.py PATH_TO_glib-0.18.5.crate
+Reads archive members without extracting them or modifying the Cargo cache.
+"""
+import hashlib
+import io
+import json
+from pathlib import Path
+import sys
+import tarfile
+
+ARCHIVE_SHA = "233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5"
+PREFIX = "glib-0.18.5/"
+MODIFIED = "src/variant_iter.rs"
+
+
+def verify(archive_path, vendor_root, record_path):
+    archive = archive_path.read_bytes()
+    if hashlib.sha256(archive).hexdigest() != ARCHIVE_SHA:
+        raise ValueError("Official archive checksum mismatch")
+    originals = {}
+    with tarfile.open(fileobj=io.BytesIO(archive), mode="r:gz") as source:
+        for member in source:
+            if member.isdir():
+                continue
+            if not member.isfile() or not member.name.startswith(PREFIX):
+                raise ValueError("Unexpected archive member")
+            name = member.name[len(PREFIX):]
+            path = Path(name)
+            if path.is_absolute() or ".." in path.parts or name in originals:
+                raise ValueError("Invalid or duplicate archive path")
+            originals[name] = source.extractfile(member).read()
+    actual_paths = {p.relative_to(vendor_root).as_posix()
+                    for p in vendor_root.rglob("*") if p.is_file()}
+    if actual_paths != set(originals):
+        raise ValueError("Vendored file inventory differs from official crate")
+    record = json.loads(record_path.read_text(encoding="utf-8"))
+    records = {row["path"]: row for row in record["files"]}
+    if (record["archive_sha256"] != ARCHIVE_SHA or
+            len(records) != len(record["files"]) or set(records) != set(originals)):
+        raise ValueError("Provenance inventory differs")
+    for name, original in originals.items():
+        expected = original
+        if name == MODIFIED:
+            for before, after in [(b"let p: *mut libc::c_char", b"let mut p: *mut libc::c_char"),
+                                  (b"                &p,", b"                &mut p,")]:
+                if expected.count(before) != 1:
+                    raise ValueError("Upstream patch context differs")
+                expected = expected.replace(before, after, 1)
+        actual = (vendor_root / name).read_bytes()
+        if actual != expected:
+            raise ValueError("Unexpected vendor modification: " + name)
+        if (records[name]["upstream_sha256"] != hashlib.sha256(original).hexdigest() or
+                records[name]["patched_sha256"] != hashlib.sha256(actual).hexdigest()):
+            raise ValueError("Provenance checksum mismatch: " + name)
+    return len(originals)
+
+
+if __name__ == "__main__":
+    root = Path(__file__).resolve().parents[2]
+    vendor = root / "apps/desktop/src-tauri/vendor"
+    count = verify(Path(sys.argv[1]), vendor / "glib",
+                   vendor / "glib-backport/SEARCHI-BACKPORT.json")
+    print(f"Verified {count} official files; only the exact two-line upstream fix differs.")