chad/bubblebox-pkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

batch 4: ffmpeg imagemagick ghostscript yt-dlp gpg strace exiftool poppler-utils sqlite mariadb-client #15

Merged
glen merged 14 commits from batch4/b-mixed into main 2026-09-23 17:56:24 -04:00
Conversation 1 Commits 14 Files changed 36 +796
glen commented 2026-09-23 17:15:11 -04:00
Collaborator
Copy link

Campaign batch 4 (DESIGN batch 8) — ten packages on the repo fedora:44 pin: nine archetype B (dnf) + one C-fedora (yt-dlp), one commit each. Flagship: ffmpeg from RPM Fusion — the release RPM is installed from the canonical rpmfusion URL (the -44 filename IS the pin, tracking the base; trust posture documented in the Containerfile: the rpm carries only repo config + the GPG key that verifies everything downstream), license recorded as the rpm's actual tag GPL-3.0-or-later (rpmfusion's GPL-codec build re-licenses upstream's LGPL — corrected from the DESIGN note's LGPL/GPL hypothesis). yt-dlp is C-fedora: fedora:44 + python3, upstream zipapp pinned via ARG VERSION + SHA256 (sha256sum -c in-build per lint L3), sum triple-cross-checked (own download + upstream SHA2-256SUMS + GitHub asset digest), zipapp shebang and --version exit LIVE-verified before commit; binary is the absolute /usr/local/bin/yt-dlp (engine resolves relative names to /usr/bin/ with no PATH search); deliberately NO ffmpeg compose — it's an optional postprocessor, override composes it (opentofu lean-default precedent, argued in comments). gpg: entrypoint is writable_home only, validated against gnupg 2.4.9 homedir.c (socket creation falls back to ~/.gnupg on the engine's ro /run; writable_run rejected with a documented reason — it would expose the HOST agent's gnupg socket dir); pinentry-curses explicit per DESIGN. strace: Yama scope documented (children-tracing fully unprivileged, -p on unrelated processes blocked — stock f44 ptrace_scope). Fedora-name corrections found during research: mariadb-client's rpm is mariadb11.8 (Fedora's versioned-package scheme; unversioned mariadb is gone on f44, cross-checked via koji) and exiftool's rpm is perl-Image-ExifTool; /usr/bin/gpg and /usr/bin/mysql were verified as rpm-payload symlinks, not alternatives ghosts (the batch-3 whois trap — none needed fixing). Smoke banners are source-verified to the file (poppler pdftotext.cc, sqlite shell.c.in, mariadb mysql.cc, strace strace.c, ImageMagick version.c) with version-free anchors; where the banner carries no tool name (ghostscript 10., exiftool 13., sqlite 3.5, yt-dlp full version) the digit/version anchor and its deliberate rebase tripwire are documented in each smoke comment. Versions/licenses cite f44 specs and rpmfusion mirror listings throughout. Authored via the 3-agent fan-out (batch4/{a,b,c} merged here); CI is the first real build+smoke of the set.

Campaign batch 4 (DESIGN batch 8) — ten packages on the repo `fedora:44` pin: nine archetype B (dnf) + one C-fedora (yt-dlp), one commit each. Flagship: **ffmpeg from RPM Fusion** — the release RPM is installed from the canonical rpmfusion URL (the `-44` filename IS the pin, tracking the base; trust posture documented in the Containerfile: the rpm carries only repo config + the GPG key that verifies everything downstream), license recorded as the rpm's actual tag **GPL-3.0-or-later** (rpmfusion's GPL-codec build re-licenses upstream's LGPL — corrected from the DESIGN note's LGPL/GPL hypothesis). **yt-dlp** is C-fedora: fedora:44 + python3, upstream zipapp pinned via ARG VERSION + SHA256 (`sha256sum -c` in-build per lint L3), sum triple-cross-checked (own download + upstream SHA2-256SUMS + GitHub asset digest), zipapp shebang and `--version` exit LIVE-verified before commit; binary is the absolute `/usr/local/bin/yt-dlp` (engine resolves relative names to `/usr/bin/` with no PATH search); deliberately NO ffmpeg compose — it's an optional postprocessor, override composes it (opentofu lean-default precedent, argued in comments). **gpg**: entrypoint is `writable_home` only, validated against gnupg 2.4.9 `homedir.c` (socket creation falls back to `~/.gnupg` on the engine's ro `/run`; `writable_run` rejected with a documented reason — it would expose the HOST agent's gnupg socket dir); pinentry-curses explicit per DESIGN. **strace**: Yama scope documented (children-tracing fully unprivileged, `-p` on unrelated processes blocked — stock f44 ptrace_scope). Fedora-name corrections found during research: **mariadb-client's rpm is `mariadb11.8`** (Fedora's versioned-package scheme; unversioned `mariadb` is gone on f44, cross-checked via koji) and **exiftool's rpm is `perl-Image-ExifTool`**; `/usr/bin/gpg` and `/usr/bin/mysql` were verified as rpm-payload symlinks, not alternatives ghosts (the batch-3 whois trap — none needed fixing). Smoke banners are source-verified to the file (poppler `pdftotext.cc`, sqlite `shell.c.in`, mariadb `mysql.cc`, strace `strace.c`, ImageMagick `version.c`) with version-free anchors; where the banner carries no tool name (ghostscript `10.`, exiftool `13.`, sqlite `3.5`, yt-dlp full version) the digit/version anchor and its deliberate rebase tripwire are documented in each smoke comment. Versions/licenses cite f44 specs and rpmfusion mirror listings throughout. Authored via the 3-agent fan-out (`batch4/{a,b,c}` merged here); CI is the first real build+smoke of the set.
glen added 12 commits 2026-09-23 17:15:11 -04:00 
Batch 4 / DESIGN-ecosystem.md §5.1 row 8. Fedora proper only carries
ffmpeg-free; per the campaign decision this is the full-codec build from
RPM Fusion free.

- dnf install of the canonical rpmfusion free release rpm, pinned by the
  Fedora release in the filename (rpmfusion-free-release-44.noarch.rpm,
  the exact URL rpmfusion's Configuration page documents for f44); trust
  posture documented in the Containerfile: the release rpm floats with
  rpmfusion signing (currently 44-3) but carries only repo config + the
  GPG key that verifies every subsequent rpmfusion package.
- Version: 8.1.2-3.fc44 (rpmfusion free updates/44).
  https://download1.rpmfusion.org/free/fedora/updates/44/x86_64/f/
- License: rpm tag 'GPLv3+' -> GPL-3.0-or-later; redistribution ok (GPL
  family + rpmfusion free = Fedora-guidelines open source).
  https://rpmfind.net/linux/RPM/rpmfusion/free/fedora/updates/44/x86_64/f/ffmpeg-8.1.2-3.fc44.x86_64.html
- Smoke: ffmpeg -version (single dash) -> 'ffmpeg version ...', exit 0;
  version-free anchor.
Batch 4 / DESIGN-ecosystem.md §5.1 row 8. The Fedora pkg is ImageMagick
(capital I); the IM7 entrypoint binary is magick, with the legacy
convert/identify/mogrify names riding along in the same image (user-side
override territory, openssh-clients precedent).

- Version: 7.1.2.31-1 (f44 spec, Epoch 1).
  https://src.fedoraproject.org/rpms/ImageMagick/raw/f44/f/ImageMagick.spec
- License: 'ImageMagick' — the verbatim f44 spec tag (special permissive
  ImageMagick License, also the SPDX id); redistribution expressly
  permitted, ok.
- Smoke: magick -version -> 'Version: ImageMagick 7.x ...', exit 0;
  version-free anchor.
- No entrypoint: stateless CLI, reads no dotfiles (config is
  /etc/ImageMagick-7, image keeps Fedora's stock policy).
Batch 4 / DESIGN-ecosystem.md §5.1 row 8.

- Version: 10.06.0-2 (f44 spec).
  https://src.fedoraproject.org/rpms/ghostscript/raw/f44/f/ghostscript.spec
- License: AGPL-3.0-or-later — the verbatim f44 spec tag, no exception
  clauses; redistribution ok (AGPL permits conveying verbatim/modified
  builds with source; CMap/CIDFont data comes in via Fedora's
  adobe-mappings-* packages under permissive terms).
- Fonts verified in-spec: libgs hard-Requires urw-base35-fonts (+ google-
  droid-sans-fonts for CJK fallback) — image renders out of the box.
- Smoke: gs --version prints ONLY the bare '10.06.0' (no 'gs' in the
  banner), exit 0; digit anchor '10.' on the verified f44 major, drift
  tradeoff documented in the smoke comment.
- No entrypoint: stateless CLI; no %post/alternatives in the spec (no
  whois-style fix needed).
Fedora f44 strace 7.2-1 (src.fedoraproject.org/rpms/strace/raw/f44/f/strace.spec).
License LGPL-2.1-or-later (upstream strace.c SPDX; the spec's fuller compound
covers the GPL test suite + bundled headers the rpm doesn't ship). Containerfile
documents the Yama scope story: children-tracing (the normal 'strace some-cmd')
is unprivileged-safe in the sandbox; '-p PID' attach is blocked by stock Yama
scope 1, same as any unprivileged host shell. Smoke: --version -> 'strace --
version 7.2' banner verified against upstream v7.2 print_version() printf
format; anchored on the stable wording, version-free.
Fedora f44 perl-Image-ExifTool 13.50-1 — the distro name for exiftool (the
CLI ships with the Perl library in that one noarch package; there is no bare
'exiftool' src rpm). License GPL-1.0-or-later OR Artistic-1.0-Perl (the spec
tag, verbatim). No entrypoint: stateless reader, ~/.exiftoolrc is opt-in via
user override (htop precedent). Smoke: '-ver' (the version flag; --version
doesn't exist) prints the bare number '13.50' — no name in the output, so the
anchor is the major prefix '13.' with the drift tradeoff documented in the
smoke comment (a 14.x rebase fails the check on purpose).
Fedora f44 gnupg2 2.4.9 (%autorelease) + pinentry-curses explicit
(install_weak_deps=False strips 'Recommends: pinentry'; curses is the only
headless-in-TTY prompter). /usr/bin/gpg verified as rpm payload in the f44
spec %files (gpg2 is the payload compat symlink, ln -sf gpg gpg2 in %install)
— no alternatives indirection, no whois-style fix needed. License: the spec's
compound tag verbatim (gpg core GPL-3.0-or-later). Entrypoint: writable_home
only — gnupg 2.4.9 homedir.c _gnupg_socketdir_internal never consults
XDG_RUNTIME_DIR, stats /run/user/<uid> directly, and falls back to the homedir
when /run/user/<uid>/gnupg can't be created, so the engine's ro /run just
lands sockets in ~/.gnupg; writable_run deliberately NOT set (rw /run would
let the sandbox mkdir/steal the HOST agent's /run/user/<uid>/gnupg). Smoke:
'gpg --version' -> 'gpg (GnuPG) 2.4.9' banner shape verified in gnupg-2.4.9
source (my_strusage(11) = '<tool> (GnuPG)'); anchored version-free.
f44 rpm poppler-utils 26.01.0 (subpackage of poppler.spec; pulls the
libpoppler .so + poppler-data). Multi-binary unit (13 pdf* tools) with no
binary named poppler-utils, so entrypoint.toml pins the workhorse
binary = "pdftotext" (bind-utils batch-3 shape); siblings reachable via
user overrides.

Version/license source: https://src.fedoraproject.org/rpms/poppler/raw/f44/f/poppler.spec
(Version: 26.01.0; License: (GPL-2.0-only OR GPL-3.0-only) AND
GPL-2.0-or-later AND LGPL-2.0-or-later AND LGPL-2.1-or-later AND MIT —
%package utils inherits it; the utils' own sources are GPL-2.0-or-later).

Smoke: pdftotext -v -> "pdftotext version <x>" on stderr, exit 0 —
source-verified in utils/pdftotext.cc at tag poppler-26.01.0
(https://gitlab.freedesktop.org/poppler/poppler/-/raw/poppler-26.01.0/utils/pdftotext.cc):
printVersion branch prints the banner and returns 0 from main; the
no-args path returns 99, so -v is load-bearing.
f44 rpm sqlite 3.51.2-2 (shell /usr/bin/sqlite3 + sqlite-libs hard dep).
The dir name is the library brand, not a binary — entrypoint.toml pins
binary = "sqlite3"; no sandbox surface (stateless file-based CLI).

Version/license source: https://src.fedoraproject.org/rpms/sqlite/raw/f44/f/sqlite.spec
(Version: 3.51.2 via rpmver; License: blessing — Fedora's id for SQLite's
public-domain dedication, redistribution ok).

Smoke: sqlite3 --version -> "<ver> <date> <source-id> (<bits>)" on
stdout, exit 0 — source-verified in src/shell.c.in at tag version-3.51.2
(https://github.com/sqlite/sqlite/tree/version-3.51.2): '--version'
normalizes to the -version handler, which prints
libversion()/sourceid() and returns 0. Banner has no program name, so the
anchor is the two-part version prefix "3.5" (documented drift tradeoff:
survives 3.5x.x, a 3.60+/4.x move needs a one-word smoke edit).
Latest STABLE upstream release (GitHub releases/latest, prerelease=false;
nightly/master channels deliberately not used). Zipapp sha256
1fa6733c37ea6fb51c99ad8fe785e7b7e5f3246c9b980230329d4fb72ed8d4d6 —
cross-checked: my own download's sha256 AND upstream's SHA2-256SUMS line
agree (the SUMS asset is GPG-signed per release). Shebang verified as
'#!/usr/bin/env python3'; '--version' -> bare '2026.08.19', exit 0, run
directly at pin time. fedora:44 base for python3 (3.13) + ca-certificates
(terraform fetch-and-verify shape, minus git/ssh — yt-dlp execs no VCS).
ffmpeg NOT vendored (compose-don't-vendor; rpmfusion-off) and entrypoint
ships NO compose on purpose: an optional postprocessor must not make every
invocation (incl. the version smoke) hard-depend on a second image —
opentofu lean-default precedent; override composes ffmpeg from the same
campaign batch. binary = '/usr/local/bin/yt-dlp' absolute (engine resolves
relative names as /usr/bin/<name>; config.rs binary_path). Entrypoint
writable_home for ~/.config/yt-dlp config/cookies. License Unlicense
(zipapp bundles ISC/MIT components per upstream README — noted in
metadata.toml). Gate 300 (fedora-base C, slack-class). Smoke anchored on
the full version — output is the bare version, no name anchor exists
(packer/glab precedent), documented in the smoke comment.
f44 rpm mariadb11.8-11.8.8-3.fc44 (versioned-package scheme; the unversioned
'mariadb' name is the spec's default-variant only, and mariadb dist-git
branching stops at f40 — koji build 3023084 is the f44 rpm). Client-only:
mariadb11.8-server Requires the client, never the reverse; deliberately not
installed. install_weak_deps=False keeps the perl client-utils Recommends
out. Multi-binary unit; entrypoint pins binary = "mariadb" (canonical
modern CLI) + writable_home for ~/.my.cnf/~/.mysql_history (psql shape).

/usr/bin/mysql verified as a PLAIN payload symlink to mariadb in the f44
spec %files (%{_bindir}/{mysql,mariadb}), not an update-alternatives ghost
— no whois-style fix needed.

Version source: koji f44 tag build mariadb11.8-11.8.8-3.fc44 +
https://src.fedoraproject.org/rpms/mariadb11.8/raw/f44/f/mariadb11.8.spec
(%global package_version 11.8.8; License: long chain, client proper is
GPL-2.0-only per client/mysql.cc at tag mariadb-11.8.8).

Smoke: mariadb --version -> "mariadb from 11.8.8-MariaDB, client ..." on
stdout, exit 0 — source-verified in client/mysql.cc at tag mariadb-11.8.8
(https://github.com/MariaDB/server/tree/mariadb-11.8.8): usage(version=1)
prints '%s from %s, client %s for ...' and the -V handler sets
status.exit_status = 0. Anchor "mariadb from" is version-free.
merge batch4/c
Some checks failed
verify / verify (pull_request) Failing after 3m30s
Details
d77fc950b6
chad approved these changes 2026-09-23 17:55:34 -04:00
glen merged commit 3628af5420 into main 2026-09-23 17:56:24 -04:00
Sign in to join this conversation.
Reviewers
No reviewers
chad
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
chad/bubblebox-pkgs!15
No description provided.