pat-s
853b924765
## Why bincraft PR #124 makes the `abi_classification` cache authoritative for the risky-package set, breaking the circularity where a package counted as ABI-risky only once it had already been built per-minor. On its own that changes nothing for the packages actually at risk. The cache only holds verdicts for packages that passed through the build pipeline after the per-minor scheme existed; everything older has no verdict, and no verdict means the flat binary is carried into every per-minor index. That is exactly how a `base64enc` built under R 4.4.3 reached an R 4.6.1 client: ``` base64enc.so: undefined symbol: SETLENGTH ``` This is the backfill that gives those packages a verdict. ## What it does `local/backfill-abi-classification.R` enumerates a slot's flat index and runs each compiled package through `bincraft::classify_r_minor_sensitive()`, which looks the verdict up in the cache, and on a miss downloads the CRAN source, classifies it and stores the result. The verdict is a property of the source, independent of OS, arch and R minor, so **one run populates the cache for every slot**. The arch/codename arguments only choose which flat index to enumerate. Only `NeedsCompilation=yes` packages are classified: a package with no compiled code has no symbols to bind and cannot fail this way, so proving it by download would be wasted work. On amd64/resolute that is 4585 packages rather than 23218. Re-running is cheap and resumable: cached verdicts return without touching the network, so a second run costs one query per package and downloads only the remainder. ## Verification The enumeration was run against the live indexes and matches an independent symbol scan of the same slot exactly: ``` flat binaries: 23218 | due classification: 4585 base64enc included: TRUE lobstr included: TRUE ``` 4585 is the same population I scanned with `nm -D --undefined-only` when establishing the blast radius, and both packages confirmed to break under 4.6 are in it. `crow lint` passes. ## Sequencing Merge after bincraft #124 and after a bincraft release the pipelines pick up, otherwise the verdicts are written but nothing reads them yet. Writing them early is harmless. Then re-index the slots so the per-minor indexes are rebuilt with the widened risky set. Expect coverage in the per-minor indexes to *drop* slightly as newly-recognised risky packages are dropped rather than served from a mismatched minor; those then need per-minor builds, either through the normal pipeline or the targeted workflow in devxy/build-cran-binaries#198. Reviewed-on: #199
90 lines
3 KiB
YAML
90 lines
3 KiB
YAML
# Populate the ABI classifier cache for packages that predate the per-minor scheme.
|
|
#
|
|
# bincraft decides whether a flat binary may be carried into a per-minor index
|
|
# from its risky-package set. That set is now the union of the per-minor tarball
|
|
# scan and the `abi_classification` cache, but the cache only holds verdicts for
|
|
# packages that passed through the build pipeline after the scheme existed.
|
|
# Everything older has no verdict, and no verdict means "carry it" - which is how
|
|
# a base64enc built under R 4.4.3 reached R 4.6 clients and died at dyn.load()
|
|
# on SETLENGTH.
|
|
#
|
|
# The verdict is computed from the package source, so it does not depend on OS,
|
|
# arch or R minor: one run populates the cache for every slot. The arch/codename
|
|
# below only choose which flat index to enumerate.
|
|
#
|
|
# Re-running is cheap. Cached verdicts are returned without touching the network,
|
|
# so a second run costs one query per package and downloads only what is still
|
|
# unclassified.
|
|
#
|
|
# crow pipeline create devxy/build-cran-binaries --var backfill_abi=run
|
|
|
|
variables:
|
|
# A manual pipeline creation instantiates every file in .crow/, so the default
|
|
# must be a value the `when` clause rejects.
|
|
backfill_abi:
|
|
description: "Set to 'run' to classify the flat index into the ABI cache."
|
|
options:
|
|
- none
|
|
- run
|
|
default: none
|
|
BACKFILL_ARCH:
|
|
description: 'Arch of the flat index to enumerate.'
|
|
options:
|
|
- amd64
|
|
- arm64
|
|
default: amd64
|
|
BACKFILL_CODENAME:
|
|
description: 'Codename of the flat index to enumerate.'
|
|
default: resolute
|
|
BACKFILL_LIMIT:
|
|
description: 'Classify at most this many packages (0 = no limit).'
|
|
default: '0'
|
|
|
|
when:
|
|
- event: manual
|
|
evaluate: 'backfill_abi == "run"'
|
|
|
|
skip_clone: true
|
|
|
|
labels:
|
|
group: rpkgs-amd64
|
|
|
|
steps:
|
|
- name: 'Classify the flat index into the ABI cache'
|
|
image: reg.devxy.io/rpkgs/build-env-ubuntu:resolute
|
|
pull: true
|
|
environment:
|
|
OTEL_R_TRACES_EXPORTER: none
|
|
OTEL_R_LOGS_EXPORTER: none
|
|
OTEL_R_METRICS_EXPORTER: none
|
|
PGPASS:
|
|
from_secret: PGPASS
|
|
REPO_RO_TOKEN:
|
|
from_secret: REPO_RO_TOKEN
|
|
GITHUB_PAT:
|
|
from_secret: GITHUB_PAT
|
|
GIT_USER: pat-s
|
|
# Pipeline variables are substituted into the YAML, not exported, so they
|
|
# have to be bound here to be readable as env vars in the script below.
|
|
BACKFILL_ARCH: ${BACKFILL_ARCH}
|
|
BACKFILL_CODENAME: ${BACKFILL_CODENAME}
|
|
BACKFILL_LIMIT: ${BACKFILL_LIMIT}
|
|
R_LIBS_USER: /tmp/R-pkgs
|
|
commands:
|
|
- git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
|
|
- mkdir -p /tmp/R-pkgs
|
|
- /opt/R/4.5.3/bin/Rscript local/install-bincraft.R
|
|
- |
|
|
set -eu
|
|
LIMIT=""
|
|
if [ "$$BACKFILL_LIMIT" != "0" ]; then
|
|
LIMIT="$$BACKFILL_LIMIT"
|
|
fi
|
|
/opt/R/4.5.3/bin/Rscript local/backfill-abi-classification.R \
|
|
"$$BACKFILL_ARCH" "$$BACKFILL_CODENAME" $$LIMIT
|
|
backend_options:
|
|
docker:
|
|
resources:
|
|
requests:
|
|
memory: 4Gi
|
|
cpu: 1000m
|