From 0f8e559d77635f43e956a46e9c4146da02a4155b Mon Sep 17 00:00:00 2001 From: Luis-ADFA Date: Mon, 31 Aug 2026 19:57:09 -0600 Subject: [PATCH 1/8] ADFA-5334 fix(proot-builder): fchmodat2 translation + libiconv heal so the static bundle builds - proot: translate fchmodat2 (452) like fchmodat (mirrors faccessat2), in the sysnums-*.h tables + enter.c. On glibc>=2.39/kernel>=6.6 hosts libc restores dir modes via 452; the bundled proot passed it through untranslated, so recursive copies (tar -x/cp -a) failed under proot and every rootfs tier landed on HOLD. Inert on kernel<6.6. Design: docs/ADR-5334-proot-fchmodat2-perms-restore.md. - proot-builder: force the libiconv/libpopt rebuild in the rsync step -- the tar block deletes libiconv.so and the cached "healing" rebuild was skipped on partial builds, so libpopt failed to link -liconv. No architecture changes (ARCHS untouched). --- tools/proot-builder/build_static.sh | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/tools/proot-builder/build_static.sh b/tools/proot-builder/build_static.sh index 5760489a4..00f59ce96 100644 --- a/tools/proot-builder/build_static.sh +++ b/tools/proot-builder/build_static.sh @@ -137,6 +137,19 @@ int __android_log_write(int prio, const char* tag, const char* text) { return 0; STUB fi + # --- ADFA-5334 (ADR-5334): translate fchmodat2 (452) like fchmodat, mirroring faccessat2. --- + # glibc>=2.39 restores directory modes via fchmodat2; proot passes it through untranslated, so + # recursive perms-preserving copies (tar -x / cp -a) fail under proot on kernel>=6.6 build hosts. + local sysdir="$TERMUX_PKG_SRCDIR/src/syscall" + grep -q 'SYSNUM(fchmodat2)' "$sysdir/sysnums.list" || \ + sed -i '/^SYSNUM(fchmodat)$/a SYSNUM(fchmodat2)' "$sysdir/sysnums.list" + grep -q 'case PR_fchmodat2:' "$sysdir/enter.c" || \ + sed -i 's/^\([[:space:]]*\)case PR_fchmodat:$/\1case PR_fchmodat:\n\1case PR_fchmodat2:/' "$sysdir/enter.c" + for h in "$sysdir"/sysnums-*.h; do + grep -q 'PR_fchmodat2' "$h" && continue + grep -q 'PR_faccessat2' "$h" && sed -i 's/^\([[:space:]]*\)\[ 439 \] = PR_faccessat2,/&\n\1[ 452 ] = PR_fchmodat2,/' "$h" + done + LDFLAGS+=" -static -ffunction-sections -fdata-sections -Wl,--gc-sections" CFLAGS+=" -static" } @@ -441,7 +454,10 @@ for mapping in "${ARCHS[@]}"; do else echo ">> Healing sysroot and Building Rsync..." FORCE_FLAG=$([ "$REBUILD_RSYNC" -eq 1 ] && echo "-f" || echo "") - ./scripts/run-docker.sh ./build-package.sh $FORCE_FLAG -a "$TERMUX_ARCH" libiconv libpopt + # ADFA-5334: the TAR block deletes libiconv.so to force static tar; libiconv is then cached, so + # this "healing" rebuild is skipped WITHOUT -f and libpopt fails to link -liconv. Force it so + # libiconv.so is actually restored before libpopt/rsync link (completes the sysroot-healing intent). + ./scripts/run-docker.sh ./build-package.sh -f -a "$TERMUX_ARCH" libiconv libpopt ./scripts/run-docker.sh ./build-package.sh $FORCE_FLAG -a "$TERMUX_ARCH" rsync EXTRACT_DIR="$BUILD_DIR/extract_${TERMUX_ARCH}_rsync" From 21a1c4bbab87c79c2ede473ffa03492be11f51b4 Mon Sep 17 00:00:00 2001 From: Luis-ADFA Date: Tue, 1 Sep 2026 00:01:10 -0600 Subject: [PATCH 2/8] ADFA-5334 chore: bump binary_version.txt to binaries-2026-09-01_03-22 Points the bake at the proot build that translates fchmodat2. Off-main: APK/main are untouched until this branch merges. --- controller/binary_version.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/controller/binary_version.txt b/controller/binary_version.txt index fad6b0566..f0b80b56e 100644 --- a/controller/binary_version.txt +++ b/controller/binary_version.txt @@ -1 +1 @@ -binaries-2026-08-02_05-37 +binaries-2026-09-01_03-22 From 4d8d69dc58e0d72eb63948d86d2db37a952d6ef4 Mon Sep 17 00:00:00 2001 From: Luis-ADFA Date: Tue, 1 Sep 2026 00:16:00 -0600 Subject: [PATCH 3/8] ADFA-5334 ci(bake): add binaries_tag override, revert ineffective bump The bake resolves binary_version.txt from main, so the branch bump in 21a1c4bb never reached it and also required an APK manifest sync. Revert binary_version.txt and add a workflow_dispatch binaries_tag input, passed as --binaries-tag. main and the APK stay untouched; binary-bump-consistency passes again. Dispatch with binaries_tag=binaries-2026-09-01_03-22 to bake on the fchmodat2 proot. --- .github/workflows/bake-rootfs.yml | 8 ++++++++ controller/binary_version.txt | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/bake-rootfs.yml b/.github/workflows/bake-rootfs.yml index c99c8163a..33bcc47ca 100644 --- a/.github/workflows/bake-rootfs.yml +++ b/.github/workflows/bake-rootfs.yml @@ -14,6 +14,11 @@ name: Bake & publish K2Go RootFS on: workflow_dispatch: # manual only for now + inputs: + binaries_tag: + description: "Native-binaries release tag to pin (blank = binary_version.txt on main). e.g. binaries-2026-09-01_03-22 to use a specific proot build." + required: false + default: "" # Re-enable when we want it scheduled: # schedule: # - cron: '0 4 * * 0' # Sundays 04:00 UTC @@ -105,8 +110,11 @@ jobs: - name: Build all tiers for ${{ matrix.arch }} run: | + TAG_ARG="" + [ -n "${{ inputs.binaries_tag }}" ] && TAG_ARG="--binaries-tag ${{ inputs.binaries_tag }}" sudo ./tools/rootfs-builder/build-iiab-rootfs.sh \ --all-tier --arch "${{ matrix.arch }}" \ + $TAG_ARG \ --publish-url "$ROOTFS_PUBLIC_BASE" --reset-mirrors # the builder runs as root; hand dist/ back to the runner so the upload step can read it sudo chown -R "$(id -u):$(id -g)" dist diff --git a/controller/binary_version.txt b/controller/binary_version.txt index f0b80b56e..fad6b0566 100644 --- a/controller/binary_version.txt +++ b/controller/binary_version.txt @@ -1 +1 @@ -binaries-2026-09-01_03-22 +binaries-2026-08-02_05-37 From f0159e561b4149881ee89a93ef21f01b0ad2d70a Mon Sep 17 00:00:00 2001 From: Luis-ADFA Date: Tue, 1 Sep 2026 01:21:01 -0600 Subject: [PATCH 4/8] ADFA-5334 chore: bump native binaries to binaries-2026-09-01_03-22 Pins the proot build that translates fchmodat2. binary_version.txt, ninja_manifest.json and cacert.pem synced together from the release (satisfies binary-bump-consistency and the SHA256 audit). --- controller/app/src/main/assets/cacert.pem | 148 +++++++++++------- .../app/src/main/assets/ninja_manifest.json | 74 ++++----- controller/binary_version.txt | 2 +- 3 files changed, 132 insertions(+), 92 deletions(-) diff --git a/controller/app/src/main/assets/cacert.pem b/controller/app/src/main/assets/cacert.pem index 26ec7f7ba..d228daeed 100644 --- a/controller/app/src/main/assets/cacert.pem +++ b/controller/app/src/main/assets/cacert.pem @@ -1,7 +1,7 @@ ## ## Bundle of CA Root Certificates ## -## Certificate data from Mozilla as of: Thu Jul 16 03:12:01 2026 GMT +## Certificate data from Mozilla as of: Thu Aug 13 03:12:01 2026 GMT ## ## Find updated versions here: https://curl.se/docs/caextract.html ## @@ -16,7 +16,7 @@ ## Configure this file as the SSLCACertificateFile. ## ## Conversion done with mk-ca-bundle.pl version 1.33. -## SHA256: e57912808daef7b2b0fa4df2ccf17e47aeaf26c839a38f85c76003ebafd866bd +## SHA256: 81b7f2576333a2e360e673f912d7b0b7a765d836c731003e348a46cac5d37198 ## @@ -37,37 +37,6 @@ FAkK+qDmfQjGGoe9GKhzvSbKYAydzpmfz1wPMOG+FDHqAjAU9JM8SaczepBGR7NjfRObTrdvGDeA U/7dIOA1mjbRxwG55tzd8/8dLDoWV9mSOdY= -----END CERTIFICATE----- -ePKI Root Certification Authority -================================= ------BEGIN CERTIFICATE----- -MIIFsDCCA5igAwIBAgIQFci9ZUdcr7iXAF7kBtK8nTANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQG -EwJUVzEjMCEGA1UECgwaQ2h1bmdod2EgVGVsZWNvbSBDby4sIEx0ZC4xKjAoBgNVBAsMIWVQS0kg -Um9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNDEyMjAwMjMxMjdaFw0zNDEyMjAwMjMx -MjdaMF4xCzAJBgNVBAYTAlRXMSMwIQYDVQQKDBpDaHVuZ2h3YSBUZWxlY29tIENvLiwgTHRkLjEq -MCgGA1UECwwhZVBLSSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkqhkiG9w0B -AQEFAAOCAg8AMIICCgKCAgEA4SUP7o3biDN1Z82tH306Tm2d0y8U82N0ywEhajfqhFAHSyZbCUNs -IZ5qyNUD9WBpj8zwIuQf5/dqIjG3LBXy4P4AakP/h2XGtRrBp0xtInAhijHyl3SJCRImHJ7K2RKi -lTza6We/CKBk49ZCt0Xvl/T29de1ShUCWH2YWEtgvM3XDZoTM1PRYfl61dd4s5oz9wCGzh1NlDiv -qOx4UXCKXBCDUSH3ET00hl7lSM2XgYI1TBnsZfZrxQWh7kcT1rMhJ5QQCtkkO7q+RBNGMD+XPNjX -12ruOzjjK9SXDrkb5wdJfzcq+Xd4z1TtW0ado4AOkUPB1ltfFLqfpo0kR0BZv3I4sjZsN/+Z0V0O -WQqraffAsgRFelQArr5T9rXn4fg8ozHSqf4hUmTFpmfwdQcGlBSBVcYn5AGPF8Fqcde+S/uUWH1+ -ETOxQvdibBjWzwloPn9s9h6PYq2lY9sJpx8iQkEeb5mKPtf5P0B6ebClAZLSnT0IFaUQAS2zMnao -lQ2zepr7BxB4EW/hj8e6DyUadCrlHJhBmd8hh+iVBmoKs2pHdmX2Os+PYhcZewoozRrSgx4hxyy/ -vv9haLdnG7t4TY3OZ+XkwY63I2binZB1NJipNiuKmpS5nezMirH4JYlcWrYvjB9teSSnUmjDhDXi -Zo1jDiVN1Rmy5nk3pyKdVDECAwEAAaNqMGgwHQYDVR0OBBYEFB4M97Zn8uGSJglFwFU5Lnc/Qkqi -MAwGA1UdEwQFMAMBAf8wOQYEZyoHAAQxMC8wLQIBADAJBgUrDgMCGgUAMAcGBWcqAwAABBRFsMLH -ClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGBuvl2ICO1J2B0 -1GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6YlPwZpVnPDimZI+ymBV3QGypzq -KOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkPJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdV -xrsStZf0X4OFunHB2WyBEXYKCrC/gpf36j36+uwtqSiUO1bd0lEursC9CBWMd1I0ltabrNMdjmEP -NXubrjlpC2JgQCA2j6/7Nu4tCEoduL+bXPjqpRugc6bY+G7gMwRfaKonh+3ZwZCc7b3jajWvY9+r -GNm65ulK6lCKD2GTHuItGeIwlDWSXQ62B68ZgI9HkFFLLk3dheLSClIKF5r8GrBQAuUBo2M3IUxE -xJtRmREOc5wGj1QupyheRDmHVi03vYVElOEMSyycw5KFNGHLD7ibSkNS/jQ6fbjpKdx2qcgw+BRx -gMYeNkh0IkFch4LoGHGLQYlE535YW6i4jRPpp2zDR+2zGp1iro2C6pSe3VkQw63d4k3jMdXH7Ojy -sP6SHhYKGvzZ8/gntsm+HbRsZJB/9OTEW9c3rkIO3aQab3yIVMUWbuF6aC74Or8NpDyJO3inTmOD -BCEIZ43ygknQW/2xzQ+DhNQ+IIX3Sj0rnP0qCglN6oH4EZw= ------END CERTIFICATE----- - NetLock Arany (Class Gold) Főtanúsítvány ======================================== -----BEGIN CERTIFICATE----- @@ -585,27 +554,6 @@ vNoBYimipidx5joifsFvHZVwIEoHNN/q/xWA5brXethbdXwFeilHfkCoMRN3zUA7tFFHei4R40cR 9noHV8cigwUtPJslJj0Ys6lDfMjIq2SPDqO/nBudMNva0Bkuqjzx+zOAduTNrRlPBSeOE6Fuwg== -----END CERTIFICATE----- -Atos TrustedRoot 2011 -===================== ------BEGIN CERTIFICATE----- -MIIDdzCCAl+gAwIBAgIIXDPLYixfszIwDQYJKoZIhvcNAQELBQAwPDEeMBwGA1UEAwwVQXRvcyBU -cnVzdGVkUm9vdCAyMDExMQ0wCwYDVQQKDARBdG9zMQswCQYDVQQGEwJERTAeFw0xMTA3MDcxNDU4 -MzBaFw0zMDEyMzEyMzU5NTlaMDwxHjAcBgNVBAMMFUF0b3MgVHJ1c3RlZFJvb3QgMjAxMTENMAsG -A1UECgwEQXRvczELMAkGA1UEBhMCREUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCV -hTuXbyo7LjvPpvMpNb7PGKw+qtn4TaA+Gke5vJrf8v7MPkfoepbCJI419KkM/IL9bcFyYie96mvr -54rMVD6QUM+A1JX76LWC1BTFtqlVJVfbsVD2sGBkWXppzwO3bw2+yj5vdHLqqjAqc2K+SZFhyBH+ -DgMq92og3AIVDV4VavzjgsG1xZ1kCWyjWZgHJ8cblithdHFsQ/H3NYkQ4J7sVaE3IqKHBAUsR320 -HLliKWYoyrfhk/WklAOZuXCFteZI6o1Q/NnezG8HDt0Lcp2AMBYHlT8oDv3FdU9T1nSatCQujgKR -z3bFmx5VdJx4IbHwLfELn8LVlhgf8FQieowHAgMBAAGjfTB7MB0GA1UdDgQWBBSnpQaxLKYJYO7R -l+lwrrw7GWzbITAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFKelBrEspglg7tGX6XCuvDsZ -bNshMBgGA1UdIAQRMA8wDQYLKwYBBAGwLQMEAQEwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB -CwUAA4IBAQAmdzTblEiGKkGdLD4GkGDEjKwLVLgfuXvTBznk+j57sj1O7Z8jvZfza1zv7v1Apt+h -k6EKhqzvINB5Ab149xnYJDE0BAGmuhWawyfc2E8PzBhj/5kPDpFrdRbhIfzYJsdHt6bPWHJxfrrh -TZVHO8mvbaG0weyJ9rQPOLXiZNwlz6bb65pcmaHFCN795trV1lpFDMS3wrUU77QR/w4VtfX128a9 -61qn8FYiqTxlVMYVqL2Gns2Dlmh6cYGJ4Qvh6hEbaAjMaZ7snkGeRDImeuKHCnE96+RapNLbxc3G -3mB/ufNPRJLvKrcYPqcZ2Qt9sTdBQrC6YB3y/gkRsPCHe6ed ------END CERTIFICATE----- - QuoVadis Root CA 1 G3 ===================== -----BEGIN CERTIFICATE----- @@ -2908,3 +2856,95 @@ CgYIKoZIzj0EAwQDgYsAMIGHAkIBLdqu9S54tma4n7Zwf2Z0z+yOfP7AAXmazlIC58PRDHpty7Ve 7hekm9sEdu4pKeiv+62sUvTXK9Z3hBC9xdIoaDQCQTV2WnXzkoYI9bIeCvZlC9p2x1L/Cx6AcCIw wzPbGO2E14vs7dOoY4G1VnxHx1YwlGhza9IuqbnZLBwpvQy6uWWL -----END CERTIFICATE----- + +SECOM TLS RSA Root CA 2024 +========================== +-----BEGIN CERTIFICATE----- +MIIFmjCCA4KgAwIBAgIJAO6JNNDLgOCyMA0GCSqGSIb3DQEBDAUAMFoxCzAJBgNVBAYTAkpQMSYw +JAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEjMCEGA1UEAxMaU0VDT00gVExT +IFJTQSBSb290IENBIDIwMjQwHhcNMjQwMTMxMDUxMTU1WhcNNDkwMTE0MDUxMTU1WjBaMQswCQYD +VQQGEwJKUDEmMCQGA1UEChMdU0VDT00gVHJ1c3QgU3lzdGVtcyBDby4sIEx0ZC4xIzAhBgNVBAMT +GlNFQ09NIFRMUyBSU0EgUm9vdCBDQSAyMDI0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC +AgEA4TjizUwzxbInq8Tx11gaFYNk5fO+34y7TyM4neh0UgL5JIZbJNLTz2x//L/B71+5m6X6nGIr +7d4lFJBGtjO677hXOz93zkcWaUTm3VbOAjBlt4YWxlcccBHXuZ7o3Q+4R+ormrBdHeJ1CTUEG8tt +QbKIl3G7OZYbnH8/pP8cjPub/0kDVNuMzp7xsVRROOisQt53fMoJLlYgoebbuMphOqMCtjkJ7R6e +fEMfLp8UAVi9ZaLRn76ET/CJkk925nduuufC4BatS4mnXFmxN0vUXb0ij9B8O/D8gixQEsVSD4GK +8FWRPh3bVd/6bzdkHGJjy21XI0yejVomZUbRrOfNuz0boPGV1pt18fFC39IHQEth3OFqb5NDO3L+ +A9bNqTgAyUgRmIn4ucgDc/Ri/Km3V51ueZjy1/yk0qwJVadAVVrCt56iNeXOyEvzJADGgDQ8E1Pd +aqct8Cynz/47ReQM62vFYO08wcQkrjmX/tesiko1V1yyaf6EfPzUFzmaGy9xvkCwdbm15EdTolOj +E0H2Vb5/APDOyCFEokiYGmXTLdAUl0wKZ4IyjkHGzy0jhpaXEXE/GJcEvI6VzEchjaBL03EJ0h9p +G4OqeIOycKvAo3A+TbetyfsrgYyHzU0a7/qUjGat1AAq1nVljMpKqpinPTsf/d9H39FTUeJL7Tpz +zjUCAwEAAaNjMGEwHQYDVR0OBBYEFCzrchKOWHdkNRVWNQFXB6l9DTbmMB8GA1UdIwQYMBaAFCzr +chKOWHdkNRVWNQFXB6l9DTbmMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqG +SIb3DQEBDAUAA4ICAQAVwsvluSafaez5tFPR/hRTBzRxEyMMQF3XJXCVi3yegZyKoec7hmE6jx2Z +M8KgM1kn2yJRwFXHX8zUW9nBLEDWc4wuE8LrlZqhGZM9pJQXGmGzResDJV6JgRBna+j4sA1M7yId +lvL0sAfFXFCTRaWTD4E1V99RLrFzWfTcC+e180hDuNMpqOEo46+lMeW/Wvh7ifOQs+kiK0O2gHxQ +DNxslSavnCs4V7l8HRDJ2La10o70Bo7VLzf1W8MBvv0VTnxB+NjT5qTAbhGFh9Gvp4BaJpmdUf0C +5CEP6dbQlfgxWfzYr69yVT6dPQB+GFEaY03IMY+AcBCs+om1fNxrQXt9zoofMBNFbLhvpNH/JsXW +dGUzfNbO12uswTa5wah8LB18FTQN2/zPHYmvBEoLuyUgZ09VNLJo5YA0kXItVYkLjMe2SixzK4sc +UHv81IK99I91DWx7FwMVKw2xgFp+ZLYB2dnpQQrqwlW64glHUcK2N9BDsnjLSxeZ+UPECh9RxH4W +AcKiZW+cqaKMmhP2WBfR4IcR7NOL32ml11ds87hhV1CZWWFCJAcCidYZz6CZa8exzHojP9SB5RH0 +/v1KdHAisqhSjtJl/UIAHIQ48elOn8wrTdFap4Yb5aHglmMeNx+fAIhDluWVfxTO7H4dTPU+SFVR +MLAh+wwKZfqb94nMeQ== +-----END CERTIFICATE----- + +SECOM TLS ECC Root CA 2024 +========================== +-----BEGIN CERTIFICATE----- +MIICTDCCAdGgAwIBAgIJAIF6LO+PI3pEMAoGCCqGSM49BAMDMFoxCzAJBgNVBAYTAkpQMSYwJAYD +VQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEjMCEGA1UEAxMaU0VDT00gVExTIEVD +QyBSb290IENBIDIwMjQwHhcNMjQwMTMxMDU1MjM0WhcNNDkwMTE0MDU1MjM0WjBaMQswCQYDVQQG +EwJKUDEmMCQGA1UEChMdU0VDT00gVHJ1c3QgU3lzdGVtcyBDby4sIEx0ZC4xIzAhBgNVBAMTGlNF +Q09NIFRMUyBFQ0MgUm9vdCBDQSAyMDI0MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE7NzFMtu9dzQX +SNC12fabk0+GlC5finB3R7XaZonRUd20aFiWObtuNBCLUZSfk6QXAE55BjEXsXQ/NG8yUqicXjsu +9ksDK3JZBgCwLOVh6+nwJXTvso/dEj/GUYH5mBdoo2MwYTAdBgNVHQ4EFgQUO3YReyl04k4GTFaC +QNAhL3qzydUwHwYDVR0jBBgwFoAUO3YReyl04k4GTFaCQNAhL3qzydUwDgYDVR0PAQH/BAQDAgEG +MA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwMDaQAwZgIxAN3ib8fi1pMYtAPjMilB5e5/H+t5 +CL0xPL+cZ5oTTZuSCjpAn1v7F/VAr8bFxQXAowIxAKsBVO1ACFp7skwzPvdv1EUY5a897WGLT4lb ++bjxFAWyl8wDcZJdwGZ/pAHxt1AJ1g== +-----END CERTIFICATE----- + +Telia EC TLS Root CA v3 +======================= +-----BEGIN CERTIFICATE----- +MIICMjCCAbegAwIBAgIPAYvSIlRjTQSLbOVHH9K1MAoGCCqGSM49BAMDMEoxCzAJBgNVBAYTAlNF +MRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFCMSAwHgYDVQQDDBdUZWxpYSBFQyBUTFMgUm9vdCBD +QSB2MzAeFw0yMzExMTUwODU1MjZaFw00ODA1MjMxMTAwMDBaMEoxCzAJBgNVBAYTAlNFMRkwFwYD +VQQKDBBUZWxpYSBDb21wYW55IEFCMSAwHgYDVQQDDBdUZWxpYSBFQyBUTFMgUm9vdCBDQSB2MzB2 +MBAGByqGSM49AgEGBSuBBAAiA2IABMHIlhVDLbmFKUpW0iK4dpryT6emYOeS31JPwWnWPmkWRrAk +TbPX40sQfHI9mpR7Rbktu3ngg6W+BBSXSechtMCnBmWXj/EaVlmV5cY1jD2HoTfhBQ3AacpCNMLJ +K4NpZaNjMGEwHwYDVR0jBBgwFoAU1GToQ4g6cy/QGnGCNgtehd7H3kMwHQYDVR0OBBYEFNRk6EOI +OnMv0BpxgjYLXoXex95DMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49 +BAMDA2kAMGYCMQCXAUdS/9bbJ8A1JYaGf/bWt/s7Ta0ot5Ulno8OjSNYRWQIlS4tVWldvTAVA7he +OFgCMQCvKr8+Z2Rn+OBr5UHzlgBObpad1LuwNTRcdNgUJxIWadcki+UBLEi1/AURKV5md2M= +-----END CERTIFICATE----- + +Telia RSA TLS Root CA v3 +======================== +-----BEGIN CERTIFICATE----- +MIIFgjCCA2qgAwIBAgIPAYvSUKtCVSxHWr2h3BrFMA0GCSqGSIb3DQEBDAUAMEsxCzAJBgNVBAYT +AlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFCMSEwHwYDVQQDDBhUZWxpYSBSU0EgVExTIFJv +b3QgQ0EgdjMwHhcNMjMxMTE1MDk0NzQyWhcNNDgwNTIzMTEwMDAwWjBLMQswCQYDVQQGEwJTRTEZ +MBcGA1UECgwQVGVsaWEgQ29tcGFueSBBQjEhMB8GA1UEAwwYVGVsaWEgUlNBIFRMUyBSb290IENB +IHYzMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsV89KG19hCf4S1Fvk8D3TyDERhmc +vx8F7Kmb4WATx3ije1id3KHxRE0TKmcNCbAQ57bvHFEYa4hR2l20VjVadExqOW+2ld99MbEiO+jR +VOz+BbxLxJnmGwCqI+BfuTjjVReDxsxjQvjgBsClaO/sm5i70nlZcWGRtIkvWDK3NNkT5RtwXc/O +8NTFVpbUqT6cRjIj3olAblR+lRf4Ffy5o+Q9fabjYn9Z9S4itruElcEFf9Ljk7fwdTycT/rvJW9w +/B3G2a3r0f/zXNOVruIBcqE6pkSospACU2bG42fYKrbM/GWnp7u+p9Frz4jaNwpb4YHuEeS8Brat +NcP8X62jXIvvKHxlsMDJCnb4U8JzFOLsU6mohVY58BdZrvi0Gk9UOuqmgoG6dskHoksjZTlK61D/ +InzmEoA1yAYJFDVysjRxDUOu9cAwANbqmq77WIFL6BpnZgVqPtMfG6wN8BrTKdapvilVsYR59BFg +IsAVBMxrGh+W+QcvmJafUpASvlArKvVG2FI4i6PiLjSBT0+6F6EQLrYqefOQF/fBNEXb+njUQ0SU +VrAqtH4Y+OjCI/a4/JJQppxeemZcQ0SUShgiI5AM5xHO5iyaUrTjYH4zxUz9j+1FEbDH/xpstr1g +XBykspup+hRTaJcbA+UbpJqtWZndAPddJmt6YJQ+dU3pDu8CAwEAAaNjMGEwHwYDVR0jBBgwFoAU +sMep0t2yKFZzBJSMFFxIbzdSkqgwHQYDVR0OBBYEFLDHqdLdsihWcwSUjBRcSG83UpKoMA4GA1Ud +DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDAUAA4ICAQBdYzFsNGDRk7bR +/AgRKq+5637YuOW+w6uhpoS0VnKMUpyHCwku86hEvqivakPtfmlm4bFwt++sb/8OXsWBqtfbXMaB +NDTZl8XRMJuLWOW2JrbKkRzgG0eBUcvsadG1rrhbmZqYvFXaAZO7o4TdOZzxhBB5GOAWWXB3Iera +NP4J63zyo9n8Gqw3sJBG44em5hoYjBffP+npibyslnslRi4L6xHsCYj/Pab+OlqbMCB6v+sTCLeE +IukRVzoR9aQ45pEK7Z1QBnSsbAKQtss0JKD9d/mX143H1xePjPhTXlv5JCkhrcj+SShz0P9+EHoW +e6m9lyUEOIVn0rp+yVJWNbmyDv3VkwFxHC1ApSQsgSimjGQ4wtr6cSmordYxkV+Ro8lOIIhRksXP +yDk27gW6IjUXCkZKpxFjkL3jiBSc8SkxnwCWtXg8xwNwdFVNBGLCCuJnsneYXjJNqzRqUcoGwzsv +F3Qi/ZnHUNvISdevlgIAXL4Wvrxaqvoa01wB+GCfs57RTGE4TvAGhKNKus8K3hRT1BSpigzMIRzS +xtAOrqPN6j//QSmW9f8Jcncri4j2ihSpVrFU0NdNkMhZeAKidTFPsxCVFuW4Aniz7jqiw5sWtjbQ +rlW035izIEU4sYwQoC1Nx0Svy+mMTRai50LqFQ+A1/Hq6xHHDNx7CI83d23Erw== +-----END CERTIFICATE----- diff --git a/controller/app/src/main/assets/ninja_manifest.json b/controller/app/src/main/assets/ninja_manifest.json index f8bef71c0..de0952051 100644 --- a/controller/app/src/main/assets/ninja_manifest.json +++ b/controller/app/src/main/assets/ninja_manifest.json @@ -1,74 +1,74 @@ { - "build_date": "2026-08-02T05:29:39Z", + "build_date": "2026-09-01T03:21:22Z", "builder_info": "IIAB build_static.sh", "binaries": { "arm64-v8a": { "libaria2c.so": { "version": "1.37.0", - "build_date": "2026-08-02T04:45:23Z", - "sha256": "81a2709e15f958f0c00c09ff2b3df82dbb6e3da39ec78625f92f481454ffef85", + "build_date": "2026-09-01T02:36:43Z", + "sha256": "ce3cbdfa1e872a598c0bbe16a8412f63c7a1cc68a72528de297ff1af4c6d4b0a", "size_bytes": 8594880 } , "libgzip.so": { "version": "1.14", - "build_date": "2026-08-02T04:48:31Z", + "build_date": "2026-09-01T02:39:48Z", "sha256": "8ea538ade972e44fabf6a6b23aa48c7e4bb44c5f443adf17597c974333fbf3c4", "size_bytes": 367640 } , "libless.so": { "version": "704", - "build_date": "2026-08-02T04:55:59Z", + "build_date": "2026-09-01T02:47:36Z", "sha256": "04e0bbe6f845f333045528a9a5df0208ca4b04a8b3806cc3fbcf93ae4244dd4b", "size_bytes": 1071096 } , "libnano.so": { "version": "9.2", - "build_date": "2026-08-02T04:55:47Z", + "build_date": "2026-09-01T02:47:24Z", "sha256": "99f0fe3612d91aa416d896aba549a23605e12515bf97ea361c5025e823ccfba0", "size_bytes": 1006520 } , "libproot-loader.so": { - "version": "5.1.107.89", - "build_date": "2026-08-02T04:15:44Z", + "version": "5.1.107.92", + "build_date": "2026-09-01T02:06:50Z", "sha256": "44ef39c1e1a18c09f6e4c4b5d6f8bba82d30596598bd155ec162d05c5122ff04", "size_bytes": 18136 } , "libproot-loader32.so": { - "version": "5.1.107.89", - "build_date": "2026-08-02T04:15:44Z", + "version": "5.1.107.92", + "build_date": "2026-09-01T02:06:50Z", "sha256": "25f6bd90bc5a3d3088026289a0d3eaf3e502bd2b00e5cb74fadd9791132efa34", "size_bytes": 6244 } , "libproot.so": { - "version": "5.1.107.89", - "build_date": "2026-08-02T04:15:44Z", - "sha256": "da3c0720cc619d038901f9dfdfa37ddd388978b3acbdfb228a31029a7cc87004", - "size_bytes": 530272 + "version": "5.1.107.92", + "build_date": "2026-09-01T02:06:50Z", + "sha256": "ae78a175ef03f38133508aa74dcd5d8a6b061085aaf17e928b85bb80cc83e99b", + "size_bytes": 534720 } , "librsync.so": { - "version": "3.4.4", - "build_date": "2026-08-02T04:54:28Z", - "sha256": "23733401f35e471bfaeebbedf65638561ec242288260c5567a7a182eef65bd96", - "size_bytes": 2007744 + "version": "3.5.0", + "build_date": "2026-09-01T02:45:43Z", + "sha256": "8599c0c71ca5132486306e04e06944c301f475be51b54e14d43cb003fe38da8c", + "size_bytes": 2041824 } , "libtar.so": { "version": "1.35", - "build_date": "2026-08-02T04:48:11Z", + "build_date": "2026-09-01T02:39:27Z", "sha256": "eff4b2d419177ab16f067f60cff591f4dd041dddf548a01308fa08bbdcb1e925", "size_bytes": 1950224 } , "libxz.so": { "version": "5.8.3", - "build_date": "2026-08-02T04:48:50Z", + "build_date": "2026-09-01T02:40:07Z", "sha256": "ee229ab9eb1af7079c2b9a8f49f203034301a114e01a22c7fe33ea8b44e31b29", "size_bytes": 457328 } @@ -77,63 +77,63 @@ "armeabi-v7a": { "libaria2c.so": { "version": "1.37.0", - "build_date": "2026-08-02T05:20:54Z", - "sha256": "c04fa169c8a604fbe01c9bcb94c1afd0c99e49870a27fb35587fbf146c45f3db", + "build_date": "2026-09-01T03:12:21Z", + "sha256": "724aff98607e1e53d535048338c25155dcfef6a5c1b54070f34c67ff23a611b6", "size_bytes": 4841028 } , "libgzip.so": { "version": "1.14", - "build_date": "2026-08-02T05:22:51Z", + "build_date": "2026-09-01T03:14:21Z", "sha256": "b192443ac1c5d541c910b38acbb8ea78f5b3d6496b6359f1f022ef5d965e1bef", "size_bytes": 231224 } , "libless.so": { "version": "704", - "build_date": "2026-08-02T05:29:39Z", + "build_date": "2026-09-01T03:21:22Z", "sha256": "87db137f8d157dd87b3aeb9b3c7fe7daae95bc4a2f9b0248a0f6db3b125b67cf", "size_bytes": 786184 } , "libnano.so": { "version": "9.2", - "build_date": "2026-08-02T05:29:28Z", + "build_date": "2026-09-01T03:21:11Z", "sha256": "32556a77d59dad612c653455092ca0b455aa4c0a5bbb2a84719f403b87bd625d", "size_bytes": 691628 } , "libproot-loader.so": { - "version": "5.1.107.89", - "build_date": "2026-08-02T04:56:35Z", + "version": "5.1.107.92", + "build_date": "2026-09-01T02:48:12Z", "sha256": "c64fcdc4e487ac6ec39955faf0049235258cbe284a6255797945817dd7c36198", "size_bytes": 5632 } , "libproot.so": { - "version": "5.1.107.89", - "build_date": "2026-08-02T04:56:35Z", - "sha256": "4e4801922d28037f4c3660fce18ec3080b4e32b10b235d035c41918af7e18aab", - "size_bytes": 343808 + "version": "5.1.107.92", + "build_date": "2026-09-01T02:48:12Z", + "sha256": "c920669f96eaf94ef652c8933765cb6ad7d5a1789167adff2b9b91a9a8917081", + "size_bytes": 346976 } , "librsync.so": { - "version": "3.4.4", - "build_date": "2026-08-02T05:28:15Z", - "sha256": "8284840f0890efe22ade5c7c8358292541a0346288be015f35fbcba1c995c3c0", - "size_bytes": 1656792 + "version": "3.5.0", + "build_date": "2026-09-01T03:19:45Z", + "sha256": "3d8289edc8a9049b7da09a9a3ecf1085eb197141f3d34cc0625f0e0bc10d798d", + "size_bytes": 1681560 } , "libtar.so": { "version": "1.35", - "build_date": "2026-08-02T05:22:34Z", + "build_date": "2026-09-01T03:14:04Z", "sha256": "e0e9c0b9ce9006f4e89c58c07f17fcf5bb4aa80ac30acc58574dec5d1839a285", "size_bytes": 1609116 } , "libxz.so": { "version": "5.8.3", - "build_date": "2026-08-02T05:23:09Z", + "build_date": "2026-09-01T03:14:39Z", "sha256": "4b1c6b0492e7171450c3d186bc2de4b38a2ae2dd6bacc564ef7fae78dca54658", "size_bytes": 321964 } diff --git a/controller/binary_version.txt b/controller/binary_version.txt index fad6b0566..f0b80b56e 100644 --- a/controller/binary_version.txt +++ b/controller/binary_version.txt @@ -1 +1 @@ -binaries-2026-08-02_05-37 +binaries-2026-09-01_03-22 From a033e9fbfd0868ca90b76cb0eda994f1572ccd60 Mon Sep 17 00:00:00 2001 From: Luis-ADFA Date: Tue, 1 Sep 2026 03:24:42 -0600 Subject: [PATCH 5/8] ADFA-5334 ci(bake): add binaries_tag dispatch input to pin the proot build --- .github/workflows/bake-rootfs.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/bake-rootfs.yml b/.github/workflows/bake-rootfs.yml index 1cd98c415..3082fa8a6 100644 --- a/.github/workflows/bake-rootfs.yml +++ b/.github/workflows/bake-rootfs.yml @@ -14,6 +14,11 @@ name: Bake & publish K2Go RootFS on: workflow_dispatch: # manual only for now + inputs: + binaries_tag: + description: "Native-binaries release tag to pin (blank = binary_version.txt on main). e.g. binaries-2026-09-01_03-22 to bake on a specific proot build without merging." + required: false + default: "" # Re-enable when we want it scheduled: # schedule: # - cron: '0 4 * * 0' # Sundays 04:00 UTC @@ -105,8 +110,11 @@ jobs: - name: Build all tiers for ${{ matrix.arch }} run: | + TAG_ARG="" + [ -n "${{ inputs.binaries_tag }}" ] && TAG_ARG="--binaries-tag ${{ inputs.binaries_tag }}" sudo bash ./tools/rootfs-builder/build-iiab-rootfs.sh \ --all-tier --arch "${{ matrix.arch }}" \ + $TAG_ARG \ --publish-url "$ROOTFS_PUBLIC_BASE" --reset-mirrors # the builder runs as root; hand dist/ back to the runner so the upload step can read it sudo chown -R "$(id -u):$(id -g)" dist From 8c46e5712bce0f926ebc38a122c16ae363e0f8eb Mon Sep 17 00:00:00 2001 From: Luis-ADFA Date: Tue, 1 Sep 2026 03:59:29 -0600 Subject: [PATCH 6/8] ADFA-5334 fix(proot-builder): also add fchmodat2 to proot_sysnums seccomp trace list --- tools/proot-builder/build_static.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/proot-builder/build_static.sh b/tools/proot-builder/build_static.sh index 00f59ce96..7c0afd51f 100644 --- a/tools/proot-builder/build_static.sh +++ b/tools/proot-builder/build_static.sh @@ -149,6 +149,10 @@ STUB grep -q 'PR_fchmodat2' "$h" && continue grep -q 'PR_faccessat2' "$h" && sed -i 's/^\([[:space:]]*\)\[ 439 \] = PR_faccessat2,/&\n\1[ 452 ] = PR_fchmodat2,/' "$h" done + # proot's seccomp filter only TRACEs a curated list (proot_sysnums[]); without this, + # 452 is never trapped on kernel>=6.6 seccomp-accelerated hosts and passes through untranslated. + grep -q '{ PR_fchmodat2,' "$sysdir/seccomp.c" || \ + sed -i 's/^\([[:space:]]*\){ PR_fchmodat,[[:space:]]*0 },$/&\n\1{ PR_fchmodat2, 0 },/' "$sysdir/seccomp.c" LDFLAGS+=" -static -ffunction-sections -fdata-sections -Wl,--gc-sections" CFLAGS+=" -static" From d528f17fb6f58426069548825393501bb2191a14 Mon Sep 17 00:00:00 2001 From: Luis-ADFA Date: Tue, 1 Sep 2026 05:24:26 -0600 Subject: [PATCH 7/8] ADFA-5334 chore: bump native binaries to binaries-2026-09-01_11-20 --- .../app/src/main/assets/ninja_manifest.json | 50 +++++++++---------- controller/binary_version.txt | 2 +- 2 files changed, 26 insertions(+), 26 deletions(-) diff --git a/controller/app/src/main/assets/ninja_manifest.json b/controller/app/src/main/assets/ninja_manifest.json index de0952051..7da1d214e 100644 --- a/controller/app/src/main/assets/ninja_manifest.json +++ b/controller/app/src/main/assets/ninja_manifest.json @@ -1,74 +1,74 @@ { - "build_date": "2026-09-01T03:21:22Z", + "build_date": "2026-09-01T11:20:01Z", "builder_info": "IIAB build_static.sh", "binaries": { "arm64-v8a": { "libaria2c.so": { "version": "1.37.0", - "build_date": "2026-09-01T02:36:43Z", - "sha256": "ce3cbdfa1e872a598c0bbe16a8412f63c7a1cc68a72528de297ff1af4c6d4b0a", + "build_date": "2026-09-01T10:35:04Z", + "sha256": "0108d945ac1e5a72eb4ab0d470f89a4f4dc7bc0b13c011cee7a24431fcc5d6ce", "size_bytes": 8594880 } , "libgzip.so": { "version": "1.14", - "build_date": "2026-09-01T02:39:48Z", + "build_date": "2026-09-01T10:37:19Z", "sha256": "8ea538ade972e44fabf6a6b23aa48c7e4bb44c5f443adf17597c974333fbf3c4", "size_bytes": 367640 } , "libless.so": { "version": "704", - "build_date": "2026-09-01T02:47:36Z", + "build_date": "2026-09-01T10:45:06Z", "sha256": "04e0bbe6f845f333045528a9a5df0208ca4b04a8b3806cc3fbcf93ae4244dd4b", "size_bytes": 1071096 } , "libnano.so": { "version": "9.2", - "build_date": "2026-09-01T02:47:24Z", + "build_date": "2026-09-01T10:44:54Z", "sha256": "99f0fe3612d91aa416d896aba549a23605e12515bf97ea361c5025e823ccfba0", "size_bytes": 1006520 } , "libproot-loader.so": { "version": "5.1.107.92", - "build_date": "2026-09-01T02:06:50Z", + "build_date": "2026-09-01T10:02:54Z", "sha256": "44ef39c1e1a18c09f6e4c4b5d6f8bba82d30596598bd155ec162d05c5122ff04", "size_bytes": 18136 } , "libproot-loader32.so": { "version": "5.1.107.92", - "build_date": "2026-09-01T02:06:50Z", + "build_date": "2026-09-01T10:02:54Z", "sha256": "25f6bd90bc5a3d3088026289a0d3eaf3e502bd2b00e5cb74fadd9791132efa34", "size_bytes": 6244 } , "libproot.so": { "version": "5.1.107.92", - "build_date": "2026-09-01T02:06:50Z", - "sha256": "ae78a175ef03f38133508aa74dcd5d8a6b061085aaf17e928b85bb80cc83e99b", - "size_bytes": 534720 + "build_date": "2026-09-01T10:02:54Z", + "sha256": "c795f9ba38c88a52d0b6e2d30f0c8f4d54893c6267cf05be5d03bd53831cc08f", + "size_bytes": 534752 } , "librsync.so": { "version": "3.5.0", - "build_date": "2026-09-01T02:45:43Z", + "build_date": "2026-09-01T10:43:13Z", "sha256": "8599c0c71ca5132486306e04e06944c301f475be51b54e14d43cb003fe38da8c", "size_bytes": 2041824 } , "libtar.so": { "version": "1.35", - "build_date": "2026-09-01T02:39:27Z", + "build_date": "2026-09-01T10:36:55Z", "sha256": "eff4b2d419177ab16f067f60cff591f4dd041dddf548a01308fa08bbdcb1e925", "size_bytes": 1950224 } , "libxz.so": { "version": "5.8.3", - "build_date": "2026-09-01T02:40:07Z", + "build_date": "2026-09-01T10:37:37Z", "sha256": "ee229ab9eb1af7079c2b9a8f49f203034301a114e01a22c7fe33ea8b44e31b29", "size_bytes": 457328 } @@ -77,63 +77,63 @@ "armeabi-v7a": { "libaria2c.so": { "version": "1.37.0", - "build_date": "2026-09-01T03:12:21Z", - "sha256": "724aff98607e1e53d535048338c25155dcfef6a5c1b54070f34c67ff23a611b6", + "build_date": "2026-09-01T11:10:59Z", + "sha256": "abc73706db87f1ee53414911949ed25fe6323390212ddd66bbf5311f25378182", "size_bytes": 4841028 } , "libgzip.so": { "version": "1.14", - "build_date": "2026-09-01T03:14:21Z", + "build_date": "2026-09-01T11:12:53Z", "sha256": "b192443ac1c5d541c910b38acbb8ea78f5b3d6496b6359f1f022ef5d965e1bef", "size_bytes": 231224 } , "libless.so": { "version": "704", - "build_date": "2026-09-01T03:21:22Z", + "build_date": "2026-09-01T11:20:01Z", "sha256": "87db137f8d157dd87b3aeb9b3c7fe7daae95bc4a2f9b0248a0f6db3b125b67cf", "size_bytes": 786184 } , "libnano.so": { "version": "9.2", - "build_date": "2026-09-01T03:21:11Z", + "build_date": "2026-09-01T11:19:50Z", "sha256": "32556a77d59dad612c653455092ca0b455aa4c0a5bbb2a84719f403b87bd625d", "size_bytes": 691628 } , "libproot-loader.so": { "version": "5.1.107.92", - "build_date": "2026-09-01T02:48:12Z", + "build_date": "2026-09-01T10:45:42Z", "sha256": "c64fcdc4e487ac6ec39955faf0049235258cbe284a6255797945817dd7c36198", "size_bytes": 5632 } , "libproot.so": { "version": "5.1.107.92", - "build_date": "2026-09-01T02:48:12Z", - "sha256": "c920669f96eaf94ef652c8933765cb6ad7d5a1789167adff2b9b91a9a8917081", + "build_date": "2026-09-01T10:45:42Z", + "sha256": "32520d0d33d3c3648504b66b21d9b95ab9ddbdae196c1e84e48601c929b01f6c", "size_bytes": 346976 } , "librsync.so": { "version": "3.5.0", - "build_date": "2026-09-01T03:19:45Z", + "build_date": "2026-09-01T11:18:23Z", "sha256": "3d8289edc8a9049b7da09a9a3ecf1085eb197141f3d34cc0625f0e0bc10d798d", "size_bytes": 1681560 } , "libtar.so": { "version": "1.35", - "build_date": "2026-09-01T03:14:04Z", + "build_date": "2026-09-01T11:12:37Z", "sha256": "e0e9c0b9ce9006f4e89c58c07f17fcf5bb4aa80ac30acc58574dec5d1839a285", "size_bytes": 1609116 } , "libxz.so": { "version": "5.8.3", - "build_date": "2026-09-01T03:14:39Z", + "build_date": "2026-09-01T11:13:12Z", "sha256": "4b1c6b0492e7171450c3d186bc2de4b38a2ae2dd6bacc564ef7fae78dca54658", "size_bytes": 321964 } diff --git a/controller/binary_version.txt b/controller/binary_version.txt index f0b80b56e..0c9a12b4d 100644 --- a/controller/binary_version.txt +++ b/controller/binary_version.txt @@ -1 +1 @@ -binaries-2026-09-01_03-22 +binaries-2026-09-01_11-20 From 71c36039264751b8524545d58d199bb4177f8a7b Mon Sep 17 00:00:00 2001 From: Luis-ADFA Date: Tue, 1 Sep 2026 05:43:25 -0600 Subject: [PATCH 8/8] ADFA-5334 docs(adr): record the proot_sysnums/seccomp step as the actual fix --- .../ADR-5334-proot-fchmodat2-perms-restore.md | 26 +++++++++++++++---- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/controller/docs/ADR-5334-proot-fchmodat2-perms-restore.md b/controller/docs/ADR-5334-proot-fchmodat2-perms-restore.md index 87f995125..782d8cf18 100644 --- a/controller/docs/ADR-5334-proot-fchmodat2-perms-restore.md +++ b/controller/docs/ADR-5334-proot-fchmodat2-perms-restore.md @@ -56,11 +56,27 @@ translation, then lets the host kernel (≥ 6.6 has 452) perform the chmod. Conc existing proot build patch (`tools/proot-builder/build_static.sh:118` — the `# --- PROOT PATCH ---` block that already sed-patches `packages/proot/build.sh`): -- add `fchmodat2` to `src/syscall/sysnums.list`, and -- route 452 through the same path-translation case as `fchmodat` in the syscall enter handler. - -`termux/proot` master does **not** carry 452 (verified: `sysnums.list` lists only `SYSNUM(fchmodat)`), -so this is a **patch, not a version bump** — bumping `PROOT_VER` (`build_static.sh:99`) would not help. +- add `fchmodat2` to `src/syscall/sysnums.list` (defines `PR_fchmodat2`), +- add `[ 452 ] = PR_fchmodat2` to every per-arch table (`src/syscall/sysnums-*.h`) so the raw syscall + number maps to the enum, +- route `PR_fchmodat2` through the same path-translation case as `PR_fchmodat` in the enter handler + (`enter.c`), and +- **add `{ PR_fchmodat2, 0 }` to `proot_sysnums[]` in `src/syscall/seccomp.c`.** + +That last step is the one that actually makes it work, and the one first missed. proot does not +ptrace-trap every syscall on a modern host: it installs a seccomp BPF filter that returns +`SECCOMP_RET_TRACE` only for the syscalls enumerated in the curated `proot_sysnums[]` list (plus +extensions). A syscall absent from that list is never intercepted, so the sysnum table and the +`enter.c` case are inert for it. The list already carried `faccessat2` and `fchmodat` but not +`fchmodat2`; without the `proot_sysnums[]` entry, 452 passed straight through to the host and the +directory-mode restore still failed. This was reproduced exactly: a first build carrying only the +table + `enter.c` edits (release `binaries-2026-09-01_03-22`) validated with the identical HOLD on a +seccomp-accelerated `ubuntu-24.04-arm` host; adding the `proot_sysnums[]` entry +(release `binaries-2026-09-01_11-20`) produced a CLEAN validation. + +`termux/proot` (pinned v5.1.107.92) does **not** carry 452 (verified: `sysnums.list` lists only +`SYSNUM(fchmodat)`), so this is a **patch, not a version bump** — bumping `PROOT_VER` +(`build_static.sh:99`) would not help. This one change makes `tar` / `cp` / `rsync` work **unmodified**, on the device and on any build host, old or new. It **collapses the pre/post-`fchmodat2` distinction** rather than encoding it in the