Verified end-to-end with a full local build of all 8 packages on the
actual runner host (docker exec against vbatts/slackware:15.0, bind-
mounted repo on the cache pool) instead of round-tripping through
Gitea Actions for each fix — much faster for a chain of issues this
deep. All 8 packages now build successfully from a clean checkout.
Three fixes, all in crun (the last package still failing):
1. "Package requirements (json-c >= 0.14) were not met" — added
json-c to the toolchain bootstrap.
2. crun depends on the libocispec git submodule, which in turn depends
on the image-spec and runtime-spec git submodules. GitHub's source
archive tarball never includes submodule content (no .git directory
for `git submodule update` to work against — the existing `|| true`
masked this failing silently). Fetched all three as their own
pinned tarballs instead, at the exact commits crun 1.28 references
(cross-checked via the GitHub contents API), matching how every
other dependency in this project is already pinned.
3. crun.c unconditionally #includes git-version.h, which crun's own
Makefile only generates via `git describe` (again, no .git) or from
a pre-existing .tarball-git-version.h — the file crun's own `make
dist` would have written, which we never run. Write that file
ourselves in the exact format the Makefile already expects; this is
the documented fallback path bundled release tarballs rely on, not
a workaround around it.
Also includes the podman go-md2man pre-seed fix and setup-slackware-
buildenv.sh python3 addition from the previous commit's follow-up
testing (both already verified working in this same local build run).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
GO_SRC_SHA256 was wrong since it was first pinned in Task 1 — this
path had never actually been exercised in any prior CI run or local
test because every earlier failure happened before reaching the Go
install step, or (once it did run) nothing had checked the pinned
value against go.dev's own published checksum yet. Task 88's log
caught it: the real go1.26.5 linux-amd64 tarball hashes to
5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053
(cross-checked against https://go.dev/dl/?mode=json directly), not
the previously pinned value. Also independently re-verified
LIBSECCOMP_SRC_SHA256 against the real v2.6.1 tarball while looking at
this — that one was already correct.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Task 84's log got further than any run so far — 4 of 8 packages
(aardvark-dns, passt, fuse-overlayfs, unraid-podman) built successfully
— and surfaced four distinct, genuine build-time issues for the rest:
1. podman: go.mod parsing failed with "invalid go version '1.25.6':
must match format 1.23". Root cause: slackpkg's batch-mode
`install gcc` (verified directly) pulls in every gcc-<lang> sibling
package Slackware's gcc SlackBuild produces — including gcc-go, an
ancient bundled go1.16.5. Our Go bootstrap only installed the pinned
$GO_VERSION when `command -v go` found nothing, so gcc-go's go1.16.5
silently won. Fixed by always installing/overwriting the pinned Go
and prepending it to PATH, regardless of what else provides `go`.
2. crun: "no suitable Python interpreter found" — added python3.
3. netavark: build.rs (via prost-build) needs a `protoc` binary;
Slackware packages no protobuf/protoc at all. Added the official
prebuilt release binary, pinned + checksummed (no `unzip` on this
image either, so extracted with `python3 -m zipfile` instead of
adding yet another package).
4. conmon: `make install`'s docs target needs go-md2man, not packaged
by Slackware and no prebuilt release exists upstream. `go install`
it, pinned to a tagged release, now that our own Go is reliably on
PATH.
All four verified directly against vbatts/slackware:15.0 on the actual
runner host before this commit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The toolchain bootstrap fixes finally got build-packages.sh far enough
to attempt actual package builds, surfacing two genuine bugs (not
environment/toolchain issues) in task 80's log:
1. sb_fetch_and_verify() echoed its "Fetching..."/"SHA256 verified..."
progress messages to stdout, same stream its return value (the
tarball path) is returned on. Every caller captures that return value
via `tarball=$(sb_fetch_and_verify ...)`, so command substitution
swallowed the progress lines into $tarball too, and the resulting
multi-line garbage got handed to `tar -xf` as a single bogus
filename. Fixed by sending the progress echoes to stderr.
2. unraid-podman.SlackBuild read plugin/podman.plg's version via
`grep -oP` with a variable-length lookbehind ({1,10} to match
flexible whitespace). PCRE requires fixed-length lookbehind; this
works on a PCRE2 grep (e.g. most dev machines) but fails outright
("lookbehind assertion is not fixed length") on Slackware's PCRE1
grep. Replaced with a portable sed capture group.
Both verified directly against vbatts/slackware:15.0 on the runner host
before this commit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
yajl (needed by conmon, bootstrapped from source since Slackware ships
no package for it) builds via CMake, not the cmake-free autoconf script
its ./configure wrapper name suggests. Tracing the failure through the
actual vbatts/slackware:15.0 image on the runner host surfaced a chain
of packages slackpkg does not auto-resolve (Slackware packages carry no
dependency metadata at all): cmake needs libarchive, which needs lz4 and
libxml2; the patched make/gmake this mirror serves needs guile, which
needs gc; compiling anything needs kernel-headers for <linux/errno.h>;
and this build's binutils (ar/ranlib) needs flex, while objdump needs
elfutils. All added to the same slackpkg install list as the rest of
the toolchain, keeping everything on one mutually consistent version
set. Verified end-to-end against vbatts/slackware:15.0 on the actual
runner host at each step of this dependency chain.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The git fix alone got further, but actions/checkout@v4 (and later,
actions/upload-artifact@v4) are Node-based actions — Gitea Actions
execs their JS bundle with the "node" binary from inside the job's
own container rather than injecting a runtime of its own, and
vbatts/slackware:15.0 has no nodejs package anywhere on the official
Slackware mirror. Install a pinned, checksum-verified Node.js release
straight from nodejs.org in the same "Install git" step, matching the
existing Go/Rust bootstrap style in setup-slackware-buildenv.sh.
Verified end-to-end (node --version succeeds after a fresh install) in
vbatts/slackware:15.0 on the actual runner host.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The build-packages.yml run was failing for two compounding reasons,
found by testing directly against vbatts/slackware:15.0 on the actual
runner host:
1. The image ships neither git nor its HTTPS runtime libs, so
actions/checkout failed immediately.
2. It's a minimal rootfs with none of the 'D' (development) series —
no gcc, make, autoconf, pkg-config, curl, glib2, libcap, or fuse3 —
contrary to setup-slackware-buildenv.sh's assumption that a "full"
Slackware install already provides these.
An earlier fix attempt hand-pinned git + its deps (nghttp2, brotli,
cyrus-sasl) by exact file + SHA256 from the base 15.0 release
directory. That drifted out of sync with the newer, patched curl
slackpkg installs later in the same container — same shared library,
two different builds, causing a runtime symbol lookup error. Both
steps now resolve every package through slackpkg's own prioritized
mirror instead, keeping the whole toolchain on one mutually consistent
version set. Verified end-to-end (git ls-remote and curl both succeed
over HTTPS against the real Gitea instance, full toolchain present)
in a fresh vbatts/slackware:15.0 container.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
vbatts/slackware:15.0 ships neither git nor its runtime shared libs
(nghttp2, brotli, cyrus-sasl) or ca-certificates, so actions/checkout
was failing immediately with "base image is missing git/tar". Install
git and its dependencies from Slackware's own official mirror, pinned
by exact filename and verified SHA256, and build the CA bundle so git
can trust HTTPS remotes. Verified end-to-end against the real Gitea
instance (git ls-remote succeeds) in a fresh vbatts/slackware:15.0
container.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- podman-common.sh: file-wide shellcheck disable=SC2034 for its
constants, which are intentionally defined for other scripts to
source, not used within the file itself (ShellCheck can't see
cross-file usage in that direction). Confirmed as the actual cause
of the failing ShellCheck job via the real Gitea Actions log.
- podman-storage.sh: use the retry counter in cmd_unmount's log
message instead of leaving it genuinely unused (real SC2034 hit,
not a false positive).
- lint.yml: replace the editorconfig-checker/action-* marketplace
action with a pinned, checksum-verified direct binary download —
more robust than relying on third-party action resolution on
self-hosted Gitea Actions runners — and disable its IndentSize
check, which false-positives on Markdown's nested-list indentation
and shell heredoc bodies. scripts/dev/lint.sh mirrors the same check
for local use. All three lint.yml jobs verified passing locally.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- versions.env pins podman, conmon, crun, netavark, aardvark-dns, passt,
and fuse-overlayfs to verified upstream source checksums; SlackBuild
recipes, scripts/build-packages.sh, checksums.sh, release.sh, and
update-versions.sh implement the reproducible pipeline; GitHub Actions
workflows build in a Slackware container and publish releases without
committing any binaries.
- plugin/podman.plg installs/updates/removes all eight packages (the
seven components plus the plugin's own unraid-podman scaffolding
package) via upgradepkg, using the official Unraid array-event hook
mechanism (event/disks_mounted, event/stopping) instead of editing
/boot/config/go. rc.podman and the sbin/ helper scripts implement
storage creation, config seeding/sync, preflight checks, autostart
with per-container Safe-Mode, and package verify/update/rollback.
- webui/plugins/podman implements the Dashboard, Containers, Pods,
Images, Volumes, Networks, Logs, Terminal, Compose, and Settings
panels against the approved mockup (webui/mockups/prototype.html),
talking to podman system service exclusively via PodmanClient.php
(libpod REST API over the Unix socket), with two documented
exceptions: Terminal's one-shot exec model and Compose's use of the
podman compose CLI, since libpod has no REST equivalent for either.
- docs/ARCHITECTURE.md and docs/ROADMAP.md record the design decisions
and honest current status (syntax-checked, unit- and
integration-tested against fake sockets/servers; not yet run against
a real Unraid/Podman/Slackware system).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
maggesandClaude Sonnet 5