Linux: RUNPATH guard, packaging in the container on CI, source archives per commit (L1.7)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/TASKS.md

@@ -207,4 +207,5 @@
 - [x] L1.4 Linux 构建环境：`ubuntu:26.04` 容器里构建全部引擎与六个应用（glibc 不高于 2.43）；`packaging/linux/container.sh`、`tests/scripts/linux-glibc.sh` — R1 读不出当作静态、缺件照过、注释超长；R2 链接文件、读错；R3 链接目录；R4 PASS
 - [x] L1.5 Linux 包：deb、rpm、Arch（pkg.tar.zst）、AppImage 出自同一份分装，装到 `/opt/ely-office/<应用>`，带桌面项、图标与文件类型；依赖按 `packaging/linux/depends.tsv`；LibreOffice 的 cairo RUNPATH 改为 `$ORIGIN`；`tests/scripts/linux-packages.sh` — R1 列举与读错被吞、坏入口照过、无执行位；R2 坏 git-lfs 照过；R3 PASS
 - [x] L1.6 本机出六个应用的四种包；Omarchy 上装 Arch 包与 AppImage 出窗口；deb、rpm 在各自发行版的容器里装上并冒烟；`linux-installed.sh`、`linux-distros.sh`、`linux-mark-idle.sh` — R1 deb/rpm 未运行、外部改动未核对显示；R2 内核未出图也过、OCR 大小写、清理竞态；R3 公式栏冒充网格、OCR 与 pgrep 错误被吞；R4 取色、存活、截图错误被吞；R5 hyprctl 查询失败被当作未出窗口（第五轮后修正并以注入失败核对）
-- [ ] L1.7 v0.1.3：删去旧 AppImage，上传新包；`ci.sh` 的 Linux 产出四种包；agents.md 与官网随之
+- [x] L1.7 v0.1.3：删去旧 AppImage，上传新包；`ci.sh` 的 Linux 产出四种包；agents.md 与官网随之（官网只链到发布页，无需改）；`package.sh` 拒绝指向包外的 RUNPATH；Linux CI 进容器；`packaging/source.sh` 随发布上传本提交的源码 — R1 前缀检查可越出、读错被吞、CI 未进容器、无对应源码；R2 空项、拆分错误、未跟踪文件；R3 换行、git 配置；R4 `]` 加换行；R5 末尾换行（第五轮后修正并以编译的 ELF 核对）
+- [ ] L1.8 macOS 发布：CI 从零编 LibreOffice 超过 act_runner 的 3 小时被杀（v0.1.3 无 dmg）；Mac 任务以 `ELY_SHARE` 借用 Mac mini 开发克隆 `ElyOfficeSuite` 的引擎，CI 克隆里自建的残留引擎即报错而非混用

tasks/reviews/L1.7-r1.md

@@ -0,0 +1,9 @@
+FAIL
+
+1. packaging/linux/package.sh:146 — The RUNPATH guard checks only a string prefix, so paths beginning with `$ORIGIN` can still escape the AppDir. In a copied tree, an ELF with `$ORIGIN/../../../../../../../../outside` passed packaging and produced all four formats. Its library loaded successfully while the external build-tree dependency existed, then failed with `libleaf.so: cannot open shared object file` when that dependency was removed. `$ORIGINsuffix` also passed. Resolve recognized origin tokens relative to each ELF, normalize the resulting paths, and reject destinations outside the packaged runtime tree. Add regression cases for traversal and malformed tokens. Evidence: `.work/L1.7-r1/guard-probes.log`.
+
+2. packaging/linux/package.sh:147 — RUNPATH extraction errors do not propagate out of the process substitution. Making the guard's `sed` exit 73 caused a library with RUNPATH `/old/lo/workdir/fontconfig` to bypass validation; the copied packager exited 0 and produced all four formats. Check the extraction pipeline's status before consuming its output, and add a regression that requires packaging to fail when extraction fails. Evidence: `.work/L1.7-r1/guard-errors.log`.
+
+3. scripts/ci.sh:44 — Linux CI bypasses the required Ubuntu 26.04 container. The branch calls the packager directly, whose staging step invokes Cargo in the caller's environment; the engine-build branch likewise runs directly. An isolated CI invocation with shared engines ran all six packagers with `container=no` and reported success. This contradicts the container requirement in `tasks/TASKS.md:202` and `agents.md:307`; the new same-glibc statement does not enforce that requirement. Route Linux builds and packaging through `packaging/linux/container.sh`, preserve access to shared engines, and test that CI actually enters it. Evidence: `.work/L1.7-r1/ci-probe.log`.
+
+4. agents.md:310 — The replacement Linux binaries have no matching published source entry, violating PRD §§21.3 and 24.2. The [v0.1.3 release](https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/ElyOffice/releases/tags/v0.1.3) has an empty description and only binary assets; its source archives still reference commit `62f9839170efe66f80be74975c65de53b9876438`. That version's [Cargo.toml](https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/ElyOffice/raw/Cargo.toml?ref=v0.1.3) enables only `font-kit`, without the Wayland/X11 fix, and its new packaging script returns 404. The local L1.6 commit also returns 404 from the public commit API. A recipient following the release's source link therefore receives the old headless implementation and cannot reproduce the replacement packages. Publish an immutable corresponding-source snapshot, including the fixes and build materials, and link it from the release. Evidence: `.work/L1.7-r1/release.log` and `.work/L1.7-r1/source-release.log`.

tasks/reviews/L1.7-r2.md

@@ -0,0 +1,7 @@
+FAIL
+
+1. packaging/linux/package.sh:156 — Dropping empty RUNPATH components hides searches outside the AppDir: leading or trailing `:` means the current working directory to the loader. In the compiled ELF probe, both `:$ORIGIN/missing` and `$ORIGIN/missing:` passed packaging and produced deb, rpm, and Arch packages. Loading returned 42 with `libleaf.so` in the working directory, then failed when that external library was removed. Preserve empty components and reject current-directory searches; add leading/trailing-colon regression cases. Evidence: `.work/L1.7-r2/guard.log`.
+
+2. packaging/linux/package.sh:156 — The original extraction error now propagates, but failures in the splitting process substitution still bypass validation. Making its `sed` exit 74 or its `tr` exit 75 let an ELF with an absolute external RUNPATH pass; the copied packager exited 0 and produced all three native packages. Capture and check the complete splitting pipeline before consuming its output, and add failure-injection regressions for both commands. Evidence: `.work/L1.7-r2/guard.log`.
+
+3. packaging/source.sh:9 — `--untracked-files=no` lets uncommitted build inputs pass the clean-tree check, so the commit-labelled archive can differ from the binary, contrary to PRD §§21.3 and 24.2. In a Rust probe checkout using this script, an untracked, automatically discovered `build.rs` changed the built program's output to `untracked-build-input`; `source.sh` succeeded but omitted that file, and rebuilding its archive printed `committed`. Reject untracked build inputs or build from the same committed snapshot that is archived; add a regression covering this mismatch. Evidence: `.work/L1.7-r2/source.log`.

tasks/reviews/L1.7-r3.md

@@ -0,0 +1,5 @@
+FAIL
+
+1. packaging/linux/package.sh:146 — A RUNPATH containing a literal newline is silently treated as absent: readelf prints its value across lines, so the line-based sed extracts nothing and validation skips it. In Ubuntu 26.04, a compiled ELF with `$ORIGIN/missing\n:/outside` passed the unmodified guard and produced deb, rpm and Arch packages; the ELF extracted from its deb returned 42 with the external library present, then failed to load when that library was removed. Reject present but unparsed RUNPATH records, and parse or reject multiline values before validating every component; add a compiled-ELF regression. Evidence: `.work/L1.7-r3/guard.log`, `.work/L1.7-r3/ubuntu-newline.log`, `.work/L1.7-r3/native-newline.log`.
+
+2. packaging/source.sh:9 — The clean-tree check inherits `status.showUntrackedFiles`, so round 2's untracked-build-input defect persists when that Git setting is `no`. In the Rust probe, an untracked, automatically discovered build.rs changed the binary output to `untracked-build-input`; source.sh exited 0 and omitted it, and rebuilding the commit-labelled archive printed `committed`, violating PRD §§21.3 and 24.2. Explicitly enumerate untracked files regardless of Git settings, and add a regression with `status.showUntrackedFiles=no`. Evidence: `.work/L1.7-r3/source.log`.

tasks/reviews/L1.7-r4.md

@@ -0,0 +1,3 @@
+FAIL
+
+1. packaging/linux/package.sh:146 — The newline fix still truncates RUNPATH when a literal `]` precedes the newline. With `$ORIGIN]\n:/outside`, sed extracts only `$ORIGIN`, and the record-count check accepts it, skipping the external directory. In Ubuntu 26.04, the staged packager with real linuxdeploy, appimagetool and nfpm produced all four formats; the library extracted from its deb returned 42 with the external dependency present and failed to load after it was removed. Parse complete ELF dynamic strings or reliably reject multiline values before validating components; add a compiled-ELF regression covering this case. Evidence: `.work/L1.7-r4/guard.log`, `.work/L1.7-r4/ubuntu-bracket-newline.log`, `.work/L1.7-r4/native-newline.log`.

tasks/reviews/L1.7-r5.md

@@ -0,0 +1,3 @@
+FAIL
+
+1. packaging/linux/package.sh:155 — Command substitution strips trailing newlines from `patchelf` output before line 156 checks it. A compiled ELF with RUNPATH `$ORIGIN\n` (literal terminal LF) passes as `$ORIGIN`; the unmodified staged packager in Ubuntu 26.04 exits 0 and produces all four formats. Its library extracted from the deb cannot load the adjacent bundled `libleaf.so`: it returns 42 only after supplying an unpackaged `program\n` directory, and fails again when that directory is removed. Preserve trailing newlines before validation and add a compiled-ELF regression. Evidence: `.work/L1.7-r5/guard.log`, `.work/L1.7-r5/guard-followup.log`.