From ac02da724e08f652040bb956dcb9d9e806e9adc0 Mon Sep 17 00:00:00 2001 From: karl Date: Tue, 13 Oct 2026 12:05:46 +0200 Subject: [PATCH] Record optimized WSL verification of GLib iterator backport --- docs/DEPENDENCY-REVIEW.md | 25 ++++++++++++++++++++----- tools/glib-regression/README.md | 6 ++++++ 2 files changed, 26 insertions(+), 5 deletions(-) diff --git a/docs/DEPENDENCY-REVIEW.md b/docs/DEPENDENCY-REVIEW.md index f59bccf..760f9a8 100644 --- a/docs/DEPENDENCY-REVIEW.md +++ b/docs/DEPENDENCY-REVIEW.md @@ -5,7 +5,7 @@ by the desktop lockfile. Root independently verified all 121 original archive members and the exact two-line patch using `tools/glib-regression/verify_vendor.py`. The patched source retains original LF bytes; provenance records were updated after removing an unintended Windows newline conversion. Optimized Linux tests -and native desktop validation remain pending; the broad security gate stays open. +now pass; native desktop validation and the broad security gate stay open. Recorded 2026-10-13 against commit `4e60038c2f3b0a7b1d2dd0f4361309a735ee140f`. This is an advisory inventory and dependency-path review, not a complete security @@ -198,7 +198,7 @@ The cost is explicitly owning a small documented vendor patch and its future review; root coordination and actual Linux validation are required before claiming remediation. -## Prepared local backport (execution pending) +## Local backport and optimized Linux execution The desktop manifest now overrides GLib with `vendor/glib`. All 121 upstream files were compared byte-for-byte with the official archive; the only difference @@ -211,6 +211,21 @@ source. The all-target inverse graph selects it for every GTK/WebKit consumer. An isolated `tools/glib-regression` harness and lockfile are prepared for actual optimized Linux execution, including an owner-lifetime compile-fail doctest. -No Linux compilation/test or native desktop check has been executed for this -backport yet. The advisory remains recorded as unresolved validation, and the -separate macro maintenance notice remains open. +Actual optimized execution passed in Ubuntu 24.04 WSL on 2026-10-13: all three +unit tests and the owner-lifetime compile-fail doctest passed. The inverse graph +confirmed the selected local GLib 0.18.5 package. The archive verifier again +confirmed all 121 official files and only the exact two-line fix; harness source +and lockfile matched the repository byte-for-byte before execution. + +Rust 1.99.0, system GLib 2.80.0; one Cargo build job, no inference or GPU. +After downloading a missing locked dependency, the recorded repeat used +`--release --locked --offline --jobs 1` and passed. The upstream crate emitted +34 compiler warnings; this is not a warning-free Clippy result. Its official +source was not reformatted or otherwise edited to suppress those warnings. + +Raw WSL evidence: +`/home/karl/.cache/searchi-validation/glib-optimized-20261013.log`, SHA-256 +`98ce2a1580e6b73f58040d6efefdbdcc2dcb5e2cab6f64dc88d8a9424a0031dc`. +This validates the focused iterator regression, not all GLib memory safety or +the patched native desktop. Desktop interaction, broad security review and the +separate macro maintenance notice remain open. diff --git a/tools/glib-regression/README.md b/tools/glib-regression/README.md index 43ae3b5..b78b04f 100644 --- a/tools/glib-regression/README.md +++ b/tools/glib-regression/README.md @@ -26,3 +26,9 @@ decoders, network inference or GPU providers are used. This harness does not replace a native desktop build/interaction check or an advisory audit. Record actual execution and selected package identity before calling the local backport validated. + +Recorded execution, 2026-10-13: Ubuntu 24.04 WSL, Rust 1.99.0, GLib 2.80.0, +three optimized unit tests and one compile-fail doctest passed. Archive bytes +and exact patch were independently reverified. See +[dependency review](../../docs/DEPENDENCY-REVIEW.md) for hashes, compiler warnings +and remaining native desktop/security checks.