feat(compat): the farm carries only what its runtime can reach, and a moved pin is carried down the chain - #383
Merged
Sunrisepeak merged 1 commit intoSep 10, 2026
Conversation
… moved pin is carried down the chain
Three farms move to 2026.09.11 and the consumers that pin them move with them:
compat.glfw 3.4.0.1, compat.opencl 2026.09.11, compat.vulkan 1.4.357.2,
compat.sycl-runtime 2026.09.11. An installed copy records the pin it resolved
with, so every link in sycl-runtime -> opencl -> opencl-runtime needs its own
key or the farm at the end never arrives.
`libnvidia-pkcs11*` leaves both farms, and the OpenSSL declaration it was the
only reason for leaves with it. It is a PKCS#11 token module, loaded by an
application's own configuration and by nothing in a GPU driver's dispatch; it
was in the farm because its name matched `libnvidia*.so.*`. Measured with
`LD_DEBUG=libs` AND A CONTROL: `pkcs11` appears zero times on both the Vulkan
and the SYCL/OpenCL run, while `libnvidia-glvkspirv` appears six times and the
OpenCL adapter twenty-three -- so the zero is a reading rather than a silence.
An earlier criterion -- remove the member, see whether the example still runs --
measured nothing: removing glvkspirv left the example working too, because the
binary under test and the farm being edited were different objects.
Three defects that only appear when the code is executed:
* `never_farm_patterns` was iterated and then ignored: the loop bound `pat`
and passed a literal `libnvidia-gtk*`, so the table read like a list and
behaved like one entry. Adding pkcs11 to it did nothing at all.
* `readelf -d` is not transitive, so one round does not close the farm. The
pass this replaced asked `ldd`, whose answer is the whole closure. Measured
on glx-runtime's first real install: 52 members became 77 and were still
nine sonames short, `libLLVM.so.20.1` and `libstdc++.so.6` among them. Now
iterated to a fixed point, bounded so a cycle cannot spin.
* a missing `readelf` returned an empty answer, which reads exactly like a
closed farm. It warns now, and glx-runtime's tool lookup reaches the xim
store before PATH.
Measured on this host, with the driver: glx-runtime 86 members, 0 gaps, and NO
direct host reach -- four entries route through xim:nvidia-gl-host-link,
twenty-four through other xim payloads, the rest through the subos view. The
SYCL example records members 49, walked 49, no findings; the Vulkan example 56,
56, no findings; both compute the right answer on an RTX 4080.
Sunrisepeak
deleted the
fix/the-farm-carries-only-what-its-runtime-can-reach
branch
September 10, 2026 11:13
Sunrisepeak
added a commit
to mcpp-community/mcpp
that referenced
this pull request
Sep 10, 2026
* fix(examples): follow the farms to 2026.09.11
`compat:vulkan-runtime` and `compat:opencl-runtime` no longer carry
`libnvidia-pkcs11*` -- a PKCS#11 token module the vendor name pattern swept in
and that no GPU driver's dispatch reaches -- and the chain that delivers them
took new versions so an installed copy stops recording the old pin.
Measured on this host with the driver, both examples rebuilt from an empty
target directory:
sycl members 49, walked 49, findings none
vulkan members 56, walked 56, findings none
and both compute `12 24 36 48` on an RTX 4080.
Follows mcpplibs/mcpp-index#383.
* fix(examples): offscreen stops naming a dependency its dependency already declares
`compat.vulkan` declares `compat.vulkan-runtime` itself on Linux. Naming it here
too pinned one version in two places, in two repositories, with nothing
enforcing that they agree -- and they drifted three times in one day: the farm
moved its key, this file moved its own, and a runner holding an installed
`compat.vulkan` still recorded the previous one. Each time the build stopped
with `irreconcilable versions` and each time the repair was to edit the other
place.
Measured after removing it: the example still receives the farm --
`library_dirs` names `compat-x-vulkan-runtime/2026.09.11`, and the record reads
members 56, walked 56, no findings -- because the package that needs the
adapter is the package that says so.
The comment that explained why the adapter exists stays, and now explains why
this file does not name it.
---------
Co-authored-by: speak-agent <248744407+speak-agent@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three farms move to
2026.09.11and every consumer that pins them moves with them:compat.glfw3.4.0.1,compat.opencl2026.09.11,compat.vulkan1.4.357.2,compat.sycl-runtime2026.09.11. An installed copy records the pin it resolved with, so every link insycl-runtime → opencl → opencl-runtimeneeds its own key or the farm at the end never arrives.libnvidia-pkcs11*leaves, and OpenSSL leaves with itIt is a PKCS#11 token module, loaded by an application's own configuration and by nothing in a GPU driver's dispatch. It was in the farm because its name matched
libnvidia*.so.*.Measured with
LD_DEBUG=libsand a control:pkcs11(Vulkan run)pkcs11(SYCL/OpenCL run)libnvidia-glvkspirv(Vulkan)libur_adapter_opencl/libOpenCLThe last two are the control: the instrument does report a member the driver reaches, so the zero is a reading rather than a silence. They were also the only members needing
libcryptoat all, so the unanswerablelibcrypto.so.1.1(OpenSSL 1.1 is EOL upstream) goes with them.An earlier criterion measured nothing: remove the member and see whether the example still runs — removing
glvkspirvleft it working too, because the binary under test and the farm being edited were different objects (two target dirs pinned to different versions).Three defects that only appear when the code is executed
never_farm_patternswas iterated and then ignored. The loop boundpatand passed a literallibnvidia-gtk*, so the table read like a list and behaved like one entry. Adding pkcs11 to it did nothing — the farm still had 81 members and both providers after the exclusion was written.readelf -dis not transitive, so one round does not close the farm. The pass this replaced askedldd, whose answer is the whole closure. On glx-runtime's first real install: 52 members became 77 and were still nine sonames short,libLLVM.so.20.1andlibstdc++.so.6among them. Now iterated to a fixed point, bounded so a cycle cannot spin.readelfreturned an empty answer, which reads exactly like a closed farm. It warns now, and glx-runtime's tool lookup reaches the xim store before PATH.Measured on this host, with the driver
mcpp's examples re-pin in a follow-up PR there, after this publishes.