fix(package-deps): reject unsafe support META templates - #16131
Draft
Alizter wants to merge 23 commits into
Draft
Conversation
Record that a package root reached under a competing virtual implementation does not receive its own link closure. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Exercise library dependencies, private libraries, stubs, redirects, namespaces, virtual implementations, PPX runtime libraries, nested Dune consumers, installed packages, and only-packages masking. Record the current missing-library failures before materializing the closure. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Record that a scoped package layout retains melange_requires metadata without materializing its referenced workspace library. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Make workspace packages declared with (deps (package ...)) expose the ordinary OCaml library closure required by their installed libraries. Materialize only selected library artifacts and generated metadata, including direct redirects, PPX runtime dependencies, and virtual default implementations. Do not follow package metadata: external packages have no reliable package dependency graph, while OCaml library metadata provides the closure consumers resolve. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Record that a scoped package dependency omits the intermediate metadata in a deprecated-library redirect chain. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Compute each workspace root library closure in Melange mode as well as OCaml mode so scoped package layouts satisfy serialized melange_requires edges. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Record that a support redirect owned by another package omits metadata generated for its deprecated package name. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Materialize each intermediate deprecated-library redirect needed to reach a selected workspace library without exposing unrelated libraries from the redirects' owning packages. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Generate the META and dune-package files owned by deprecated package names when their redirects are selected by a scoped workspace library closure. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Record that a scoped package dependency omits the library referenced by a serialized PPX driver replacement edge. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Record that scoped package metadata can reference an inline-test runner library outside the traversed OCaml requires closure. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Move scoped library-closure resolution behind the install-layout resolver so metadata-specific closure edges can be added without introducing dependencies from dependency evaluation back to rule-generation modules. Signed-off-by: Ali Caglayan <alizter@gmail.com>
A META file template can parse before expansion and become malformed when a later generation marker is replaced. Snapshot that behavior and the presence of multiple markers. Signed-off-by: Ali Caglayan <alizter@gmail.com>
A promoted META file template can differ from a stale source counterpart. Snapshot acceptance of the generated build contents when promotion is disabled. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Include libraries named by inline-test runner and PPX-driver replacement metadata in scoped workspace library layouts. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Record that a package dependency does not yet materialize a nested library namespace, including the intermediate template metadata that must be filtered once support metadata is generated. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Validate exact template contents before and after rendering, preserve structured source and build diagnostics, and attribute expansion failures to the responsible generation marker. Escape generated backslashes so rendered metadata round-trips through META parsing. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Record that a scoped package layout preserves a template-defined archive that points to an artifact absent from the layout. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Record that scoped support metadata can advertise a dependency added by a META file template without materializing that dependency. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Record that a scoped package dependency omits the PPX library and separately owned redirect chain named by serialized instrumentation backend metadata. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Include the PPX and complete deprecated-library redirect chain named by serialized instrumentation backend metadata in scoped workspace library layouts. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Render a support package's validated META template, retain only the selected library hierarchy, and preserve inherited directory metadata without exposing unrelated namespace entries. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Reject selected META template rules that change library dependencies or artifact metadata after namespace filtering, preventing scoped layouts from advertising files or libraries they do not materialize. Signed-off-by: Ali Caglayan <alizter@gmail.com>
Alizter
force-pushed
the
push-pssnxlzzwzon
branch
from
August 23, 2026 15:35
df3fb72 to
a76651a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Stacked on #16130 and the regressions in #16019 and #16027. Reject selected META-template rules that advertise dependencies or artifacts absent from the scoped layout.
Related to #15511.