Skip to content

0.23.3: propagate the corrected Linux confinement graph #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Sunrisepeak merged 1 commit into from
Nov 3, 2026
Merged

0.23.3: propagate the corrected Linux confinement graph #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,12 @@ openkal-llvm-runtime 0.18.2 and openkal-image 0.4.2 are built over it).
library's image dependency selects openkal-ld 0.4.2, matching the loader in
this platform's version group. The earlier 0.23.1 archive remains unchanged.

0.23.3 names openkal-linux 0.24.1, openkal-musl 0.27.3,
openkal-llvm-runtime 0.18.4 and all four image packages at 0.4.3. The Linux
implementation and the native runner require Landlock ABI 3 before claiming
confinement of read-only grants; earlier ABIs cannot restrict file truncation.
The ABI probe cache uses atomic accesses during concurrent first queries.

These words reach every unit of the target, the std module included, from mcpp
2026.11.3.1 on, which this release requires (`[package] mcpp`): clang records
`-fcf-protection` in a module's BMI, and an earlier mcpp compiled the std module
Expand Down
36 changes: 18 additions & 18 deletions mcpp.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
[package]
namespace = "mcpplibs"
name = "openkal-platform"
version = "0.23.2"
version = "0.23.3"
description = "The platform of ok images (<arch>-openkal): their toolchain, C library and C++ run-time, tools, compile and link conventions, seal, runner and carrier, as one versioned statement mcpp reads."
license = "Apache-2.0"
authors = ["mcpplibs"]
Expand All @@ -28,26 +28,26 @@ toolchain = "llvm@23.1.3"
runner = { cmd = ["okrun", "{}"], host = "same-arch", hosts = ["linux-x86_64", "linux-aarch64", "macos-aarch64", "windows-x86_64"] }
# `mcpp pack --mode self-contained`: a program of the packing machine that
# carries the image in a section and runs it through libokrun (M3).
carrier = { package = "openkal-run@0.4.2", section = ".oke", main = "carrier/main.cpp" }
carrier = { package = "openkal-run@0.4.3", section = ".oke", main = "carrier/main.cpp" }
# The `okb` package format (`mcpp pack --pkg-format okb`): the images of every
# architecture as one file okrun runs (openkal-image docs/okb.md).
plugin = "build.mcpp"

# The C library and the C++ run-time inside an image. A package of the graph
# that provides a layer takes its place (`provides`), and `false` leaves it out.
[platform.layers]
compiler-runtime = "openkal-llvm-runtime@0.18.3"
"c++-abi" = "openkal-llvm-runtime@0.18.3"
c-abi = { name = "openkal-musl", version = "0.27.2", default-features = false, features = ["posix", "malloc-mimalloc"] }
compiler-runtime = "openkal-llvm-runtime@0.18.4"
"c++-abi" = "openkal-llvm-runtime@0.18.4"
c-abi = { name = "openkal-musl", version = "0.27.3", default-features = false, features = ["posix", "malloc-mimalloc"] }

# Built for the building machine: `okld` writes and checks the notes, `okrun`
# runs an image, `okprof` reads what a measured run recorded (0.23.0: the
# order of a start's first executions, which a producer lays its code out by
# and writes as the touch note).
[platform.tools]
okld = "openkal-tools@0.4.2"
okrun = "openkal-tools@0.4.2"
okprof = "openkal-tools@0.4.2"
okld = "openkal-tools@0.4.3"
okrun = "openkal-tools@0.4.3"
okprof = "openkal-tools@0.4.3"

# Every unit of an image (SPEC 12.2):
# -fPIC the image is ET_DYN and has no text relocation;
Expand Down Expand Up @@ -154,9 +154,9 @@ targets = ["x86_64-linux-gnu", "aarch64-linux-gnu", "x86_64-linux-musl", "aarc
toolchain = "llvm@23.1.3"

[platform.hosted.layers]
compiler-runtime = "openkal-llvm-runtime@0.18.3"
"c++-abi" = "openkal-llvm-runtime@0.18.3"
c-abi = { name = "openkal-musl", version = "0.27.2", default-features = false, features = ["posix", "malloc-mimalloc"] }
compiler-runtime = "openkal-llvm-runtime@0.18.4"
"c++-abi" = "openkal-llvm-runtime@0.18.4"
c-abi = { name = "openkal-musl", version = "0.27.3", default-features = false, features = ["posix", "malloc-mimalloc"] }

# The family released together for openkal 0.17 (the 0.17.2 round: okb, the
# runner's bundle and library interfaces, musl's renameat2; the 0.17.3 round:
Expand Down Expand Up @@ -186,19 +186,19 @@ c-abi = { name = "openkal-musl", version = "0.27.2", default-features
# one version of each in a build (their pins are exact).
[platform.versions]
openkal = "0.23.0"
openkal-linux = "0.24.0"
openkal-linux = "0.24.1"
openkal-macos = "0.21.3"
openkal-windows = "0.19.0"
openkal-musl = "0.27.2"
openkal-llvm-runtime = "0.18.3"
openkal-ld = "0.4.2"
openkal-run = "0.4.2"
openkal-tools = "0.4.2"
openkal-musl = "0.27.3"
openkal-llvm-runtime = "0.18.4"
openkal-ld = "0.4.3"
openkal-run = "0.4.3"
openkal-tools = "0.4.3"

# The plugin's tool, `okld bundle`, which writes the okb, and its library, the
# provider of a package format (mcpp.plugins.platform).
[build-dependencies]
openkal-tools = { version = "0.4.2", tools = ["okld"] }
openkal-tools = { version = "0.4.3", tools = ["okld"] }

[build-dependencies.mcpp]
plugins = { version = "0.20.0", features = ["plugins-platform"], host-module = true }
Loading