fix(installer): install gettext headers on Alpine

2026-09-22 12:14:20 +00:00
11 changed files with 83 additions and 424 deletions
--- a/.crow/build-all-versions.yaml
+++ b/.crow/build-all-versions.yaml
@ -153,7 +153,7 @@ steps:
      # not visible here. Install the packages needed to recompute the snapshot
      # and query build metadata in every build job.
      - UVR_R_BIN=/opt/R/$R_VERSION/bin/R local/uvr-install.sh RPostgres s3fs data.table future jsonlite
-      - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS="-a"; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi
+      - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS=""; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi
      - $XVFB $XVFB_ARGS -n $SPLIT_INDEX -- /opt/R/$R_VERSION/bin/Rscript local/build-all.R $SPLIT_INTO $SPLIT_INDEX $NCPUS 2>&1
      - |
        PRIMARY_MINOR=$(echo "$R_VERSION" | cut -d. -f1-2)
--- a/.crow/process-updates.yaml
+++ b/.crow/process-updates.yaml
@ -192,7 +192,7 @@ steps:
      - UVR_R_BIN=/opt/R/$R_VERSION/bin/R local/uvr-install.sh RPostgres
      - /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
      # rhel-10 ships xwfb-run (Xwayland) instead of xvfb-run; prefer it and start weston, else fall back to xvfb-run
-      - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS="-a"; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi
+      - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS=""; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi
      # options(future.globals.onReference = NULL): for some reason s3fs::file_delete() throws 'Error: Detected a non-exportable reference ('externalptr') in one of the globals ('FUN' of class 'function') used in the future expression' otherwise
      - $XVFB $XVFB_ARGS -- /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = '${OS}', process_updated = TRUE, process_new = ${PROCESS_NEW}, process_removed = TRUE, patches = 'local/patches', r_minor_detection = 'classifier',s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)"
      - |
--- a/.crow/weekly-rebuild-missing.yaml
+++ b/.crow/weekly-rebuild-missing.yaml
@ -388,7 +388,7 @@ steps:
      - rm -rf /mnt/cache/R-pkgs/00LOCK-*
      - /opt/R/$R_VERSION/bin/Rscript local/install-bincraft.R
      - /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
-      - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS="-a"; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi
+      - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS=""; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi
      - UVR_R_BIN=/opt/R/$R_VERSION/bin/R local/uvr-install.sh httr2
      - /opt/R/$R_VERSION/bin/R -q -e 'source("local/fetch-rebuild-packages-from-issue.R")'
      - $XVFB $XVFB_ARGS -n $SPLIT_INDEX -- /opt/R/$R_VERSION/bin/Rscript local/rebuild-missing.R $SPLIT_INTO $SPLIT_INDEX $REBUILD_BUDGET_HOURS 2>&1
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@ -28,11 +28,11 @@ repos:
    hooks:
      - id: markdownlint-cli2
  - repo: https://github.com/rbubley/mirrors-prettier
-    rev: v3.9.10
+    rev: v3.9.8
    hooks:
      - id: prettier
  - repo: https://github.com/posit-dev/air-pre-commit
-    rev: 0.12.0
+    rev: 0.11.0
    hooks:
      - id: air-format
  - repo: https://github.com/editorconfig-checker/editorconfig-checker
--- a/.terraform.lock.hcl
+++ b/.terraform.lock.hcl
@ -38,43 +38,43 @@ provider "registry.opentofu.org/hashicorp/http" {
 }

 provider "registry.terraform.io/bunnyway/bunnynet" {
-  version     = "0.19.1"
-  constraints = "~> 0.19"
+  version     = "0.18.2"
+  constraints = "~> 0.18"
  hashes = [
-    "h1:02CmekB5A4NtAeptTR7waaECJl66Gf3ww7Wtyg1cy+g=",
-    "h1:0VWwMHkHQXusR2vdyYWN1pNvfJUPt9OWh6glgZshCck=",
-    "h1:2NGfMzSWPCcyO2P2T9/lDS5MExYnaOfLuDEMiYvFBg4=",
-    "h1:2dXsvcYEGXsIf1IHD2Rq9HzgwrNNEA4+qOzBKpbFEpw=",
-    "h1:8R0H9DumQe0DjXTHRJXNiZUyTBDHT2vjfu/vB+WdRIw=",
-    "h1:9Gi5M2iKY+Oz8wAYoJh7i0u3mySBk5pretuyzcwgJOw=",
-    "h1:BZwoP8Ubi1iDueWXhSWb3Tlt/II4bJI0/p6/tqw4i1M=",
-    "h1:F4yWXkyv55F+97IQi/jYBLhBLyhz4hkokVCyEEQzbM4=",
-    "h1:MGHXEapStuXemfw3SikP2aLQCT+b7Ee/RrCHevSAAWA=",
-    "h1:Q10nENYoX8jIsBMz1kP8OBrkMeSNmFI2CfB6/MsWKAc=",
-    "h1:R9z1oacW8gD9hPTGTO37ngDAhAvlP33/PRhzkgXDStY=",
-    "h1:UYLBa5/V+giaZ2YYjkbPDKMRO9eQRNcWEnpZqU2I/yU=",
-    "h1:Wz/QDxt1Kved07fCwqMh+6jtTtwQ/xKi9mXE2StV7vw=",
-    "h1:Yq0JSIW4Jir3EVO2w7C/iM76yzYKG5eYw51woX6CXJo=",
-    "h1:e/PEmAJszFbjdfsAMJosDbkxtHwHNnByd/3nKJmE3Sg=",
-    "h1:lMVwei5IGLQCrPMqAmcpbXs/BjaG7k6HbjhuWtr0kIA=",
-    "h1:m8dyuq1sXJ9sxjZkU3ZUsjC77BWY87GiraNvxHluSYs=",
-    "zh:15e84e2fca2bbaec9c9f4d14d1a037d02f4d8cc1d1bdff04709d51085f950774",
-    "zh:1b9d0cbb7f08e7a554afb8c1e733942a77aa0c8112e8b2b7092c040794f0b113",
-    "zh:28768988a8ec70e5392ca93375717b83a9aa2eeaa21be2f53c28550273b97065",
-    "zh:2f357c1d2c013627e4e785c350fc72ccc0bfbebaa6062e536ec7eb9cfecfc913",
-    "zh:4a41bab7fba5415b8c422f5c03d6fb054ae210e1eb180fab4081d4fa976080b5",
-    "zh:6c10fad0bd03bbf053b97ad51f0a24e9a0c43a7fc10727033a39eec90ed0a51e",
-    "zh:795980ac64b0f9bda521f829187eb7b296baa682b7e8d409126f85e6a6f9bcc0",
-    "zh:841a7e234852ecd516e2dc52c7d31025a704242aeafee15eb36bf392e62f918f",
+    "h1:3rZl+Co3WMpwj8SciPaCNXoGA31aSoqp6iweLarr5m4=",
+    "h1:6d9cKLhz8QOZ4R5yVX1G0TsWL+K1Abtfbm3xngndxto=",
+    "h1:EBjjkfp5Gx7nXP1DVO+tLhsow6fEUvaIjsCEFRT2fY8=",
+    "h1:Nu2DoHGOv2YN7ag4kFGpfnPeRDh6bzWqY5anW+ETGpM=",
+    "h1:OnvZxg28m4/UJeEhHVLU4kM2MZ704sxRzYfLWlLxnhA=",
+    "h1:PiCse2/UcB7nkPxosveHsJN/jKdBC8AH6tKTxcHSYKw=",
+    "h1:QAahdtlDBUon7eMwNN0D2V6CxgasOXIi+9/UExik6Sg=",
+    "h1:Su5z0A7/UaSm/E7FJnFjpDVQaa1Ju5+fZ8Mirf8E+k8=",
+    "h1:UA3a78FJAPAGqCCvlIg9ekPltpVsrmEhwFLalWCFnew=",
+    "h1:XAlCTNHRtgUkNjdUItkiak6ajjT7wFJzJN8frXKD5Ms=",
+    "h1:ZgLBOPebYxH059z1cGHmjYO8CTf+tbWPb3VbO97S2YM=",
+    "h1:anR91C2F6NDJoQQQIy6KHChodnTaSKnApSWSGM4jSX0=",
+    "h1:gVmaNmIu4gEiITM+CAb66e+zncAqzNBYkniTZfvxZ5Y=",
+    "h1:pODlGrkPqHV4yhXiO7LLLu11HtcuxOAB2zUx3B8w1vI=",
+    "h1:qEYeHEKVRcc78q5xiRGJSY8DGQpLj40KafEXUxFfaQc=",
+    "h1:qdVz+O0lLHhyf5YX3ujmoVvAGlKqvi+YOPUzVTqpKzY=",
+    "h1:yTrPkdc9eQkxfPLBYydFf0fpcjarP5w0sdLPzekD9RQ=",
+    "zh:0fe3987c927d81196c97504470ce4d26c3ad0014f8ee3d0c1be422d08cfcf49c",
+    "zh:15c36dc69e058876921ac887213e1716217d159b7ee7f0f233e21fb35be85178",
+    "zh:29d58d7b76dcb142a06d4edd15b8500fe6c1afb7f7c056ada17e2d42bb999fbd",
+    "zh:33d313836c0e985186b3456c0946e062b27cacfcb08611d0a394f36db9ee1aef",
+    "zh:47e085e52e9b24ad85fa2988dbb8604256a970a6f53f7fa6aab04d8ae756a738",
+    "zh:4ba4f87571ca72fbc6c24ab71f2f7b5a086938262e2d8e5c0b39701ed52f8bbc",
+    "zh:4c6bae97b543c5b328e1ecbcf7c976351b4b381654e9d3e569270dcab3ba816c",
    "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
-    "zh:8c876a0a26b249151f0918ee836e24660513c2345c23a06e0f54a28c7c6966b7",
-    "zh:906a791496cf11dcfdfe43a4167414cb473e548f0bd86d4b8a6a95450b523133",
-    "zh:9431757bf5b7d055ecc1d3c8465216d5e7a648b75e0e35b136ac8fc25382e97d",
-    "zh:967fd248df86fc246536727e996a7334711f4c6fe9e3d01ec9f03abe621a9783",
-    "zh:a6710fbd30f8a4844eb025d616057e78bbb255a7d05cc73876dae55a5d6b0d06",
-    "zh:b5f260899555430c109da35d2c483999d61b127beda6c2a7b39eb67f27d754c8",
-    "zh:d24882eb63c6452ed27666e896224b1d866ad00645d6ecc53de84d1687d27fc4",
-    "zh:e573eb0c99ea7195ec1ed3da728caddacc68a126d82679fb490438c781382f4d",
-    "zh:fcf0a66c0c0b62af505c5f0f8fe59bca77d6085a0b07763be33420101183702e",
+    "zh:9ba7ab56537963db2449d217528a751469c9dc4e413dec3e3d63fd7daf3db4ef",
+    "zh:a3c48eda7e11b03b831f2a639797524bb335f155f0dff0e999cf3496994da8b3",
+    "zh:aab8f4814d55ef8c6c285d2496ae412437017d0fd1be70106f7b3a4a6e764feb",
+    "zh:b92b9beacf71ae894717c2036ceb68db52c9c43af4a01b8209eceae9f91a2c8e",
+    "zh:da389285938e22e1249e6a00cebf12a9f67334743f0b3f66399e6881028bda11",
+    "zh:dadcc33d06e6f64a17d1965478af5e8bbdc971e92ec9b14e384c5d43861d63f7",
+    "zh:e090c916e6da685125194af4f0a1fd772494a0c63f3f16ab3741782e17f4a8f9",
+    "zh:e5881e00fa970c08e66e8079b47d69b76def6e7ff3bdc35b68d7811e5ece55d1",
+    "zh:eeebb25a066a6287d545c91c0fc264acee5b28174d0979faeebdac3bd14f0fff",
+    "zh:f368195116c9ce0181aa7527c51ae5e7ab23d42fb966acf4eddca344621ae339",
  ]
 }
--- a/local/patches/RcppParallel/force-bundled-tbb-6.1.x.patch
+++ b/local/patches/RcppParallel/force-bundled-tbb-6.1.x.patch
@ -1,157 +0,0 @@
-diff --git a/R/aaa.R b/R/aaa.R
-index 568a2aa..2744059 100644
--- a/R/aaa.R
-+++ b/R/aaa.R
-@@ -5,4 +5,21 @@ TBB_LIB  <- ""
- TBB_INC  <- ""
- 
- TBB_NAME <- "tbb"
-TBB_MALLOC_NAME <- "tbbmalloc"
-\ No newline at end of file
-+TBB_MALLOC_NAME <- "tbbmalloc"
-+
-+# bincraft patch: build images (ours did until build-env-images c51ed09) and
-+# plenty of user environments export TBB_ROOT / TBB_LIB / TBB_INC. A binary we
-+# publish always carries its own oneTBB in RcppParallel/lib -- see the
-+# companion changes in tools/config/configure.R and src/install.libs.R -- so
-+# honouring those variables at run time is actively harmful: .onLoad() would
-+# dyn.load() a second, unrelated TBB into the process next to the bundled one
-+# (two copies of the same symbols in the global scope, which segfaults R on
-+# load), and RcppParallelLibs() / CxxFlags() would hand that system TBB to
-+# dependents such as rstan, putting NEEDED libtbb.so.12 back into their
-+# binaries. Read the variables only when explicitly opted back in.
-+bincraftGetenv <- function(name, unset = "") {
-+   if (Sys.getenv("BINCRAFT_ALLOW_SYSTEM_TBB", unset = "FALSE") == "TRUE")
-+      Sys.getenv(name, unset = unset)
-+   else
-+      unset
-+}
-\ No newline at end of file
-diff --git a/R/tbb.R b/R/tbb.R
-index 152fd16..4b06aa5 100644
--- a/R/tbb.R
-+++ b/R/tbb.R
-@@ -17,7 +17,7 @@ tbbLibraryPath <- function(name = NULL) {
-    sysname <- Sys.info()[["sysname"]]
- 
-    # find root for TBB install
-   tbbRoot <- Sys.getenv("TBB_LIB", unset = tbbRoot())
-+   tbbRoot <- bincraftGetenv("TBB_LIB", unset = tbbRoot())
-    if (is.null(name))
-       return(tbbRoot)
- 
-@@ -58,7 +58,7 @@ tbbCxxFlags <- function() {
-    flags <- c("-DRCPP_PARALLEL_USE_TBB=1")
- 
-    # if TBB_INC is set, apply those library paths
-   tbbInc <- Sys.getenv("TBB_INC", unset = TBB_INC)
-+   tbbInc <- bincraftGetenv("TBB_INC", unset = TBB_INC)
-    if (!file.exists(tbbInc)) {
-       tbbInc <- system.file("include", package = "RcppParallel")
-    }
-@@ -96,7 +96,7 @@ tbbLdFlags <- function() {
-    }
-    
-    # shortcut if TBB_LIB defined
-   tbbLib <- Sys.getenv("TBB_LINK_LIB", Sys.getenv("TBB_LIB", unset = TBB_LIB))
-+   tbbLib <- bincraftGetenv("TBB_LINK_LIB", bincraftGetenv("TBB_LIB", unset = TBB_LIB))
-    if (nzchar(tbbLib)) {
-       if (R.version$os == "emscripten") {
-          fmt <- "-L%1$s -l%2$s"
-diff --git a/src/install.libs.R b/src/install.libs.R
-index e770838..1dd2fc7 100644
--- a/src/install.libs.R
-+++ b/src/install.libs.R
-@@ -492,6 +492,18 @@ prependFlags <- function(prependFlags, toFlags) {
- tbbLib <- Sys.getenv("TBB_LIB")
- tbbInc <- Sys.getenv("TBB_INC")
- 
-+# bincraft patch: the companion change in tools/config/configure.R stops an
-+# ambient TBB_LIB / TBB_INC from selecting a system TBB, but this script is
-+# also run directly by `R CMD INSTALL` (not only through the `tbb` rule in
-+# src/Makevars, which passes the configured values), so at install time it
-+# still sees the image's environment and would symlink the system libraries
-+# into RcppParallel/lib. Drop them here for the same reason, under the same
-+# opt-out.
-+if (Sys.getenv("BINCRAFT_ALLOW_SYSTEM_TBB", unset = "FALSE") != "TRUE") {
-+   tbbLib <- ""
-+   tbbInc <- ""
-+}
-+
- args <- commandArgs(trailingOnly = TRUE)
- if (identical(args, "build")) {
-    if (nzchar(tbbLib) && nzchar(tbbInc)) {
-diff --git a/tools/config/configure.R b/tools/config/configure.R
-index c3842f9..adf7876 100644
--- a/tools/config/configure.R
-+++ b/tools/config/configure.R
-@@ -66,6 +66,24 @@ tbbRoot  <- Sys.getenv("TBB_ROOT", unset = NA)
- tbbLib   <- Sys.getenv("TBB_LIB", unset = NA)
- tbbInc   <- Sys.getenv("TBB_INC", unset = NA)
- 
-+# bincraft patch: ignore an ambient TBB_ROOT / TBB_LIB / TBB_INC. Our build
-+# images exported these until build-env-images c51ed09 (a leftover from
-+# RcppParallel 5.x, whose bundled Intel TBB would not build on musl or with
-+# modern g++), and any of them switches the branches below to a system TBB.
-+# The published binary then records NEEDED libtbb.so.12 (or libtbb.so.2 for
-+# the classic Intel TBB) and gets a RcppParallel/lib full of absolute symlinks
-+# into the image's library dir, so it cannot dyn.load on a consumer machine
-+# without that exact TBB. 6.x bundles oneTBB 2022 and builds it with cmake on
-+# every platform we ship, so the bundled copy is always the right choice here;
-+# forcing it in the package rather than relying on the image environment keeps
-+# the binary correct whichever image version CI happens to pull. Set
-+# BINCRAFT_ALLOW_SYSTEM_TBB=TRUE to restore the upstream behaviour.
-+if (Sys.getenv("BINCRAFT_ALLOW_SYSTEM_TBB", unset = "FALSE") != "TRUE") {
-+   tbbRoot <- NA
-+   tbbLib  <- NA
-+   tbbInc  <- NA
-+}
-+
- tbbName  <- Sys.getenv("TBB_NAME", unset = "tbb")
- tbbMallocName <- Sys.getenv("TBB_MALLOC_NAME", unset = "tbbmalloc")
- 
-@@ -146,6 +164,18 @@ define(
- )
- 
- # set PKG_LIBS
-+#
-+# bincraft patch: the non-Windows library directories below are passed as
-+# plain '-L', not '-Wl,-L'. gcc expands its own search dirs (/usr/lib64,
-+# /usr/lib/<triplet>) into explicit '-L' options ahead of anything forwarded
-+# verbatim with '-Wl,', so with '-Wl,-L' a system libtbb.so wins over the one
-+# named here: on a build host with a distro TBB installed, '-ltbb' resolves to
-+# that library and RcppParallel.so records its SONAME (libtbb.so.12, or
-+# libtbb.so.2 for the classic Intel TBB) instead of the bundled 'libtbb.so'.
-+# The binary then loads the system TBB rather than the copy shipped in
-+# RcppParallel/lib, and fails outright on a machine that has no system TBB.
-+# gcc places a plain '-L' before its built-in dirs, so the intended library is
-+# found first.
- pkgLibs <- if (.Platform$OS.type == "windows") {
- 
-    if (!is.na(tbbLib) && file.exists(file.path(tbbInc, "oneapi"))) {
-@@ -183,7 +213,7 @@ pkgLibs <- if (.Platform$OS.type == "windows") {
- } else if (!is.na(tbbLib)) {
- 
-    c(
-      "-Wl,-L\"$(TBB_LIB)\"",
-+      "-L\"$(TBB_LIB)\"",
-       sprintf("-Wl,-rpath,%s", shQuote(tbbLib)),
-       "-l$(TBB_NAME)",
-       "-l$(TBB_MALLOC_NAME)"
-@@ -192,14 +222,14 @@ pkgLibs <- if (.Platform$OS.type == "windows") {
- } else if (R.version$os == "emscripten") {
-    
-    c(
-      "-Wl,-Ltbb/build/lib_release",
-+      "-Ltbb/build/lib_release",
-       "-l$(TBB_NAME)"
-    )
-    
- } else {
-    
-    c(
-      "-Wl,-Ltbb/build/lib_release",
-+      "-Ltbb/build/lib_release",
-       "-l$(TBB_NAME)",
-       "-l$(TBB_MALLOC_NAME)"
-    )
--- a/local/patches/RcppParallel/force-bundled-tbb-6.0.0.patch
+++ b/local/patches/RcppParallel/force-bundled-tbb-6.0.0.patch
@ -1,5 +1,5 @@
 diff --git a/R/aaa.R b/R/aaa.R
-index 568a2aa..2744059 100644
+index 568a2aa..bfdab4c 100644
 --- a/R/aaa.R
 +++ b/R/aaa.R
@@ -5,4 +5,21 @@ TBB_LIB  <- ""
@ -10,16 +10,16 @@ index 568a2aa..2744059 100644
 \ No newline at end of file
 +TBB_MALLOC_NAME <- "tbbmalloc"
 +
-+# bincraft patch: build images (ours did until build-env-images c51ed09) and
-+# plenty of user environments export TBB_ROOT / TBB_LIB / TBB_INC. A binary we
-+# publish always carries its own oneTBB in RcppParallel/lib -- see the
-+# companion changes in tools/config/configure.R and src/install.libs.R -- so
-+# honouring those variables at run time is actively harmful: .onLoad() would
-+# dyn.load() a second, unrelated TBB into the process next to the bundled one
-+# (two copies of the same symbols in the global scope, which segfaults R on
-+# load), and RcppParallelLibs() / CxxFlags() would hand that system TBB to
-+# dependents such as rstan, putting NEEDED libtbb.so.12 back into their
-+# binaries. Read the variables only when explicitly opted back in.
+# bincraft patch: our build images (and plenty of user environments) export
+# TBB_ROOT / TBB_LIB / TBB_INC. A binary we publish always carries its own
+# oneTBB in RcppParallel/lib -- see the companion changes in
+# tools/config/configure.R and src/install.libs.R -- so honouring those
+# variables at run time is actively harmful: .onLoad() would dyn.load() a
+# second, unrelated TBB into the process next to the bundled one (two copies
+# of the same symbols in the global scope, which segfaults R on load), and
+# RcppParallelLibs() / CxxFlags() would hand that system TBB to dependents
+# such as rstan, putting NEEDED libtbb.so.12 back into their binaries. Read
+# the variables only when explicitly opted back in.
 +bincraftGetenv <- function(name, unset = "") {
 +   if (Sys.getenv("BINCRAFT_ALLOW_SYSTEM_TBB", unset = "FALSE") == "TRUE")
 +      Sys.getenv(name, unset = unset)
@ -28,7 +28,7 @@ index 568a2aa..2744059 100644
 +}
 \ No newline at end of file
 diff --git a/R/tbb.R b/R/tbb.R
-index 3d8fbb3..9560165 100644
+index 6f6a745..e407986 100644
 --- a/R/tbb.R
 +++ b/R/tbb.R
@@ -17,7 +17,7 @@ tbbLibraryPath <- function(name = NULL) {
@ -40,18 +40,14 @@ index 3d8fbb3..9560165 100644
    if (is.null(name))
       return(tbbRoot)
 
-@@ -60,7 +60,7 @@ tbbCxxFlags <- function() {
-    flags <- c("-DRCPP_PARALLEL_USE_TBB=1")
- 
+@@ -58,3 +58,3 @@ tbbCxxFlags <- function() {
    # if TBB_INC is set, apply those library paths
 -   tbbInc <- Sys.getenv("TBB_INC", unset = TBB_INC)
 +   tbbInc <- bincraftGetenv("TBB_INC", unset = TBB_INC)
    if (!file.exists(tbbInc)) {
-       tbbInc <- system.file("include", package = "RcppParallel")
+@@ -117,7 +117,7 @@ tbbLdFlags <- function() {
    }
-@@ -100,7 +100,7 @@ tbbLdFlags <- function() {
-    }
-    
+ 
    # shortcut if TBB_LIB defined
 -   tbbLib <- Sys.getenv("TBB_LINK_LIB", Sys.getenv("TBB_LIB", unset = TBB_LIB))
 +   tbbLib <- bincraftGetenv("TBB_LINK_LIB", bincraftGetenv("TBB_LIB", unset = TBB_LIB))
@ -59,10 +55,10 @@ index 3d8fbb3..9560165 100644
       if (R.version$os == "emscripten") {
          fmt <- "-L%1$s -l%2$s"
 diff --git a/src/install.libs.R b/src/install.libs.R
-index 4dcbac2..57dbc74 100644
+index 3b3cfda..c0e6f3e 100644
 --- a/src/install.libs.R
 +++ b/src/install.libs.R
-@@ -258,6 +258,18 @@ prependFlags <- function(prependFlags, toFlags) {
+@@ -477,6 +477,18 @@ prependFlags <- function(prependFlags, toFlags) {
 tbbLib <- Sys.getenv("TBB_LIB")
 tbbInc <- Sys.getenv("TBB_INC")
 
@ -82,24 +78,24 @@ index 4dcbac2..57dbc74 100644
 if (identical(args, "build")) {
    if (nzchar(tbbLib) && nzchar(tbbInc)) {
 diff --git a/tools/config/configure.R b/tools/config/configure.R
-index a001e63..bfe8c8e 100644
+index 6293fe1..eae4aaa 100644
 --- a/tools/config/configure.R
 +++ b/tools/config/configure.R
-@@ -144,6 +144,24 @@ tbbRoot  <- Sys.getenv("TBB_ROOT", unset = NA)
+@@ -40,6 +40,24 @@ tbbRoot  <- Sys.getenv("TBB_ROOT", unset = NA)
 tbbLib   <- Sys.getenv("TBB_LIB", unset = NA)
 tbbInc   <- Sys.getenv("TBB_INC", unset = NA)
 
-+# bincraft patch: ignore an ambient TBB_ROOT / TBB_LIB / TBB_INC. Our build
-+# images exported these until build-env-images c51ed09 (a leftover from
-+# RcppParallel 5.x, whose bundled Intel TBB would not build on musl or with
-+# modern g++), and any of them switches the branches below to a system TBB.
-+# The published binary then records NEEDED libtbb.so.12 (or libtbb.so.2 for
-+# the classic Intel TBB) and gets a RcppParallel/lib full of absolute symlinks
-+# into the image's library dir, so it cannot dyn.load on a consumer machine
-+# without that exact TBB. 6.x bundles oneTBB 2022 and builds it with cmake on
-+# every platform we ship, so the bundled copy is always the right choice here;
-+# forcing it in the package rather than relying on the image environment keeps
-+# the binary correct whichever image version CI happens to pull. Set
+# bincraft patch: ignore an ambient TBB_ROOT / TBB_LIB / TBB_INC. Several of
+# our build images export these (a leftover from RcppParallel 5.x, whose
+# bundled Intel TBB would not build on musl or with modern g++), and any of
+# them switches the branches below to a system TBB. The published binary then
+# records NEEDED libtbb.so.12 (or libtbb.so.2 for the classic Intel TBB) and
+# gets a RcppParallel/lib full of absolute symlinks into the image's library
+# dir, so it cannot dyn.load on a consumer machine without that exact TBB.
+# 6.x bundles oneTBB 2022 and builds it with cmake on every platform we ship,
+# so the bundled copy is always the right choice here; forcing it in the
+# package rather than relying on the image environment keeps the binary
+# correct whichever image version CI happens to pull. Set
 +# BINCRAFT_ALLOW_SYSTEM_TBB=TRUE to restore the upstream behaviour.
 +if (Sys.getenv("BINCRAFT_ALLOW_SYSTEM_TBB", unset = "FALSE") != "TRUE") {
 +   tbbRoot <- NA
@ -110,7 +106,7 @@ index a001e63..bfe8c8e 100644
 tbbName  <- Sys.getenv("TBB_NAME", unset = "tbb")
 tbbMallocName <- Sys.getenv("TBB_MALLOC_NAME", unset = "tbbmalloc")
 
-@@ -224,10 +242,21 @@ define(
+@@ -186,12 +204,23 @@ define(
 )
 
 # set PKG_LIBS
@ -126,24 +122,26 @@ index a001e63..bfe8c8e 100644
 +# outright on a machine that has no system TBB. gcc places a plain '-L' before
 +# its built-in dirs, so the intended library is found first.
 pkgLibs <- if (!is.na(tbbLib)) {
-    
+ 
+    # a TBB supplied via TBB_LIB / TBB_ROOT. an rpath is meaningless on Windows,
+    # where the loader has no equivalent -- see R/zzz.R for how we resolve there
    c(
 -      "-Wl,-L\"$(TBB_LIB)\"",
 +      "-L\"$(TBB_LIB)\"",
-       sprintf("-Wl,-rpath,%s", shQuote(tbbLib)),
+       if (.Platform$OS.type != "windows")
+          sprintf("-Wl,-rpath,%s", shQuote(tbbLib)),
       "-l$(TBB_NAME)",
-       "-l$(TBB_MALLOC_NAME)"
-@@ -240,14 +269,14 @@ pkgLibs <- if (!is.na(tbbLib)) {
+@@ -201,14 +230,14 @@ pkgLibs <- if (!is.na(tbbLib)) {
 } else if (R.version$os == "emscripten") {
-    
+ 
    c(
 -      "-Wl,-Ltbb/build/lib_release",
 +      "-Ltbb/build/lib_release",
       "-l$(TBB_NAME)"
    )
-    
+ 
 } else {
-    
+ 
    c(
 -      "-Wl,-Ltbb/build/lib_release",
 +      "-Ltbb/build/lib_release",
--- a/local/patches/registry.json
+++ b/local/patches/registry.json
@ -6,48 +6,8 @@
    "env": {},
    "configure_args": [],
    "makevars": {},
-    "patch": "RcppParallel/force-bundled-tbb-6.2.x.patch",
-    "reason": "RcppParallel 6.x builds its bundled oneTBB 2022 with cmake, but tools/config/configure.R passes the library dir as '-Wl,-L...', and gcc places its own search dirs (/usr/lib64, /usr/lib/<triplet>) ahead of anything forwarded with '-Wl,'. Every build image installs a distro libtbb, so '-ltbb' resolves to it: the binary records NEEDED libtbb.so.12 (libtbb.so.2 on el8/el9) instead of the bundled libtbb.so and cannot load on a machine without that exact system TBB. The patch passes a plain '-L' so the bundled build dir wins. As a safeguard it also makes configure.R, src/install.libs.R and R/tbb.R ignore an ambient TBB_ROOT/TBB_LIB/TBB_INC (opt out with BINCRAFT_ALLOW_SYSTEM_TBB=TRUE): the build images stopped exporting them in build-env-images c51ed09, but a stale image or ~/.Renviron would otherwise switch the build back to the system TBB, and R reads ~/.Renviron after the process environment, so no pipeline env can override it. The read sites move between releases, so each entry pins a patch generated against that version. Upstream still uses '-Wl,-L' in 6.2.1; drop these entries once a release passes a plain '-L'."
-  },
-  {
-    "package": "RcppParallel",
-    "versions": "6.2.0",
-    "platforms": ["*"],
-    "env": {},
-    "configure_args": [],
-    "makevars": {},
-    "patch": "RcppParallel/force-bundled-tbb-6.2.x.patch",
-    "reason": "RcppParallel 6.x builds its bundled oneTBB 2022 with cmake, but tools/config/configure.R passes the library dir as '-Wl,-L...', and gcc places its own search dirs (/usr/lib64, /usr/lib/<triplet>) ahead of anything forwarded with '-Wl,'. Every build image installs a distro libtbb, so '-ltbb' resolves to it: the binary records NEEDED libtbb.so.12 (libtbb.so.2 on el8/el9) instead of the bundled libtbb.so and cannot load on a machine without that exact system TBB. The patch passes a plain '-L' so the bundled build dir wins. As a safeguard it also makes configure.R, src/install.libs.R and R/tbb.R ignore an ambient TBB_ROOT/TBB_LIB/TBB_INC (opt out with BINCRAFT_ALLOW_SYSTEM_TBB=TRUE): the build images stopped exporting them in build-env-images c51ed09, but a stale image or ~/.Renviron would otherwise switch the build back to the system TBB, and R reads ~/.Renviron after the process environment, so no pipeline env can override it. The read sites move between releases, so each entry pins a patch generated against that version. Upstream still uses '-Wl,-L' in 6.2.1; drop these entries once a release passes a plain '-L'."
-  },
-  {
-    "package": "RcppParallel",
-    "versions": "6.1.1",
-    "platforms": ["*"],
-    "env": {},
-    "configure_args": [],
-    "makevars": {},
-    "patch": "RcppParallel/force-bundled-tbb-6.1.x.patch",
-    "reason": "RcppParallel 6.x builds its bundled oneTBB 2022 with cmake, but tools/config/configure.R passes the library dir as '-Wl,-L...', and gcc places its own search dirs (/usr/lib64, /usr/lib/<triplet>) ahead of anything forwarded with '-Wl,'. Every build image installs a distro libtbb, so '-ltbb' resolves to it: the binary records NEEDED libtbb.so.12 (libtbb.so.2 on el8/el9) instead of the bundled libtbb.so and cannot load on a machine without that exact system TBB. The patch passes a plain '-L' so the bundled build dir wins. As a safeguard it also makes configure.R, src/install.libs.R and R/tbb.R ignore an ambient TBB_ROOT/TBB_LIB/TBB_INC (opt out with BINCRAFT_ALLOW_SYSTEM_TBB=TRUE): the build images stopped exporting them in build-env-images c51ed09, but a stale image or ~/.Renviron would otherwise switch the build back to the system TBB, and R reads ~/.Renviron after the process environment, so no pipeline env can override it. The read sites move between releases, so each entry pins a patch generated against that version. Upstream still uses '-Wl,-L' in 6.2.1; drop these entries once a release passes a plain '-L'."
-  },
-  {
-    "package": "RcppParallel",
-    "versions": "6.1.0",
-    "platforms": ["*"],
-    "env": {},
-    "configure_args": [],
-    "makevars": {},
-    "patch": "RcppParallel/force-bundled-tbb-6.1.x.patch",
-    "reason": "RcppParallel 6.x builds its bundled oneTBB 2022 with cmake, but tools/config/configure.R passes the library dir as '-Wl,-L...', and gcc places its own search dirs (/usr/lib64, /usr/lib/<triplet>) ahead of anything forwarded with '-Wl,'. Every build image installs a distro libtbb, so '-ltbb' resolves to it: the binary records NEEDED libtbb.so.12 (libtbb.so.2 on el8/el9) instead of the bundled libtbb.so and cannot load on a machine without that exact system TBB. The patch passes a plain '-L' so the bundled build dir wins. As a safeguard it also makes configure.R, src/install.libs.R and R/tbb.R ignore an ambient TBB_ROOT/TBB_LIB/TBB_INC (opt out with BINCRAFT_ALLOW_SYSTEM_TBB=TRUE): the build images stopped exporting them in build-env-images c51ed09, but a stale image or ~/.Renviron would otherwise switch the build back to the system TBB, and R reads ~/.Renviron after the process environment, so no pipeline env can override it. The read sites move between releases, so each entry pins a patch generated against that version. Upstream still uses '-Wl,-L' in 6.2.1; drop these entries once a release passes a plain '-L'."
-  },
-  {
-    "package": "RcppParallel",
-    "versions": "6.0.0",
-    "platforms": ["*"],
-    "env": {},
-    "configure_args": [],
-    "makevars": {},
-    "patch": "RcppParallel/force-bundled-tbb-6.0.0.patch",
-    "reason": "RcppParallel 6.x builds its bundled oneTBB 2022 with cmake, but tools/config/configure.R passes the library dir as '-Wl,-L...', and gcc places its own search dirs (/usr/lib64, /usr/lib/<triplet>) ahead of anything forwarded with '-Wl,'. Every build image installs a distro libtbb, so '-ltbb' resolves to it: the binary records NEEDED libtbb.so.12 (libtbb.so.2 on el8/el9) instead of the bundled libtbb.so and cannot load on a machine without that exact system TBB. The patch passes a plain '-L' so the bundled build dir wins. As a safeguard it also makes configure.R, src/install.libs.R and R/tbb.R ignore an ambient TBB_ROOT/TBB_LIB/TBB_INC (opt out with BINCRAFT_ALLOW_SYSTEM_TBB=TRUE): the build images stopped exporting them in build-env-images c51ed09, but a stale image or ~/.Renviron would otherwise switch the build back to the system TBB, and R reads ~/.Renviron after the process environment, so no pipeline env can override it. The read sites move between releases, so each entry pins a patch generated against that version. Upstream still uses '-Wl,-L' in 6.2.1; drop these entries once a release passes a plain '-L'."
+    "patch": "RcppParallel/force-bundled-tbb.patch",
+    "reason": "RcppParallel 6.x bundles oneTBB 2022 and builds it with cmake on every platform we ship, so the system-TBB workaround needed for 5.x is gone, but two things still steer the build back to a system TBB. (1) Ambient TBB_ROOT/TBB_LIB/TBB_INC: several build images still export these (build-env-images dropped them, but the images are rebuilt only by cron/manual runs, so a stale image keeps them), and R reads ~/.Renviron *after* the process environment, so no pipeline-side env override can undo it. configure.R then takes the system-TBB branch, install.libs.R symlinks the image's libraries into RcppParallel/lib as absolute paths, and the binary records NEEDED libtbb.so.12 (libtbb.so.2 for the classic Intel TBB on el8/el9) -- it cannot dyn.load on a consumer machine without that exact TBB. Both files are patched to ignore those variables (opt out with BINCRAFT_ALLOW_SYSTEM_TBB=TRUE); install.libs.R needs it separately because R CMD INSTALL runs it outside the src/Makevars rule that passes the configured values. (2) Link order: the bundled branch passes its build dir as '-Wl,-Ltbb/build/lib_release', and gcc expands its own search dirs (/usr/lib64, /usr/lib/<triplet>) into '-L' options ahead of anything forwarded with '-Wl,', so '-ltbb' would still resolve to a distro TBB when one is installed; a plain '-L' puts the bundled dir first. Verified on the current build-env-ubuntu:jammy image (which still exports TBB_INC/TBB_LIB): NEEDED libtbb.so, RUNPATH $ORIGIN/../lib, real libtbb.so.2 in RcppParallel/lib, and the package loads with every system libtbb moved away."
  },
  {
    "package": "fs",
--- a/local/uvr-install.sh
+++ b/local/uvr-install.sh
@ -30,7 +30,7 @@
 set -eu

 # renovate: datasource=github-releases depName=nbafrank/uvr
-UVR_PIN="v0.4.7"
+UVR_PIN="v0.4.6"

 if [ "$#" -eq 0 ]; then
  echo "usage: $0 <pkg-spec>..." >&2
--- a/provider.tf
+++ b/provider.tf
@ -2,7 +2,7 @@ terraform {
  required_providers {
    bunnynet = {
      source = "registry.terraform.io/BunnyWay/bunnynet"
-      version = "~> 0.19"
+      version = "~> 0.18"
    }
  }
 }