feat(nix): add experimental rootless FHS package and desktop launcher

2026-10-26 19:47:42 +00:00 · 2026-10-18 00:30:14 +02:00
1 parent 2cb353c785
commit 3c0b9cdfd3
@@ -0,0 +1,3 @@
 # Unified-diff context uses a single space for an empty source line.
 # Do not report that patch syntax as trailing source whitespace.
 patches/*.patch whitespace=-blank-at-eol
@@ -47,7 +47,34 @@ Game files, Riot installers, account databases, tokens, local prefixes, captures
 Use the dependency list in the [pinned Darling source](https://github.com/darlinghq/darling/tree/60ba801decee7a00782f74f6be4c8ffb013f79ff) for your distribution. `tools/env-check.sh` provides a starting check; its legacy package names may need adapting to your distro.
-## Build on the other PC
+## Experimental Nix/rootless package
 ```sh
 nix run github:lucannez64/darling-lol#installer
 nix run github:lucannez64/darling-lol#default -- --update
 nix run github:lucannez64/darling-lol#default
 nix run github:lucannez64/darling-lol#shell
 ```
 Or from a local checkout:
 ```sh
 nix run .#installer
 nix run .#default
 ```
 Nix supplies the launcher/dependencies, not a prebuilt Darling or game. First
 setup is interactive and builds into the writable per-user workspace. The
 desktop entry requests a terminal; EOF stdin produces an actionable error.
 Run updates only after manually closing the clients and shutting Darling down
 in the original namespace. A live prefix marker blocks a second launch rather
 than killing or attempting to reconnect. One workspace/foreground namespace is
 supported at a time. Readiness is per canonical prefix, configured guest and
 compatible package/runtime/source identity. Store closure roots are retained
 for mutable binaries; do not delete `build/nix-gcroots/` while using them.
 See [Nix setup and operational limits](docs/SETUP.md#nixos-package).
 ## Build on the other PC (non-Nix)
 ```sh
 git clone https://github.com/lucannez64/darling-lol.git
@@ -0,0 +1,60 @@
 #!/usr/bin/env bash
 set -euo pipefail
 WORKSPACE="${XDG_DATA_HOME:-$HOME/.local/share}/darling-lol"
 SHARE_DIR="@SHARE_DIR@"
 FHS_BIN="@FHS_BIN@"
 UNSHARE_BIN="@UNSHARE_BIN@"
 # The store package is both a compatibility identity and a closure GC root.
 export DARLING_PACKAGE_ID="$SHARE_DIR"
 export DISPLAY="${DISPLAY:-:0}"
 export EGL_PLATFORM="${EGL_PLATFORM:-x11}"
 export DPREFIX="${DPREFIX:-$HOME/.darling}"
 export DARLING_HOST_UID="$(id -u)"
 export DARLING_HOST_GID="$(id -g)"
 export DARLING_WORKSPACE="$WORKSPACE"
 python3 - "$WORKSPACE" <<'PY'
 import pathlib, sys
 workspace = pathlib.Path(sys.argv[1])
 for path in [workspace, *workspace.parents]:
    if path.is_symlink():
        raise SystemExit(f'Refusing symlink workspace ancestor: {path}')
 if (workspace / '.launcher.lock').is_symlink():
    raise SystemExit('Refusing symlink workspace lock')
 PY
 mkdir -p "$WORKSPACE"
 # One mutable base runtime per workspace; do not refresh scripts mid-session.
 exec 9<>"$WORKSPACE/.launcher.lock"
 flock -n 9 || { echo 'Another darling-lol workspace session is active; use its terminal.' >&2; exit 1; }
 # Do not attempt to reconnect across separately created user namespaces. No kill,
 # sudo, or shutdown is attempted here (the PID might even be stale/reused).
 if [ -f "$DPREFIX/.init.pid" ]; then
  read -r server_pid < "$DPREFIX/.init.pid" || true
  if [[ "${server_pid:-}" =~ ^[1-9][0-9]*$ ]] && [ -d "/proc/$server_pid" ]; then
    state=$(awk '/^State:/ {print $2}' "/proc/$server_pid/status")
    if [ "$state" != Z ]; then
      echo 'Prefix has a live server marker; namespace reconnect is unsupported.' >&2
      echo 'Use the original darling-lol-shell terminal to run darling shutdown, then retry. No processes were stopped.' >&2
      exit 1
    fi
  fi
 fi
 python3 "$SHARE_DIR/scripts/nix-copy.py" "$SHARE_DIR" "$WORKSPACE"
 mkdir -p "$WORKSPACE/usr-local"
 cd "$WORKSPACE"
 # Map subordinate IDs before bubblewrap sets no_new_privs. UID 0 is not host root.
 fhs_command=("$UNSHARE_BIN" --user --map-auto --map-current-user --setuid=0 --setgid=0 "$FHS_BIN")
 # Keep this supervisor alive to hold the lock: bubblewrap may close extra FDs.
 # It never owns or signals game processes; foreground execution carries SIGINT.
 case "${1:-}" in
  --shell) shift; "${fhs_command[@]}" bash "$@";;
  --update) shift; "${fhs_command[@]}" ./scripts/update.sh "$@";;
  --installer) shift; "${fhs_command[@]}" bash ./scripts/nix-session.sh --installer "$@";;
  *)
    if [ $# -gt 0 ]; then
      "${fhs_command[@]}" "$@"
    else
      "${fhs_command[@]}" bash ./scripts/nix-session.sh
    fi;;
 esac
@@ -0,0 +1,6 @@
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" role="img" aria-label="darling-lol">
  <title>darling-lol</title>
  <rect x="8" y="8" width="112" height="112" rx="26" fill="#0f172a"/>
  <path fill-rule="evenodd" fill="#2dd4bf" d="M38 30h20c21 0 34 15 34 34s-13 34-34 34H38V30zm18 18v32h2c9 0 16-7 16-16s-7-16-16-16h-2z"/>
  <rect x="30" y="90" width="68" height="8" rx="4" fill="#818cf8"/>
 </svg>
@@ -1,5 +1,74 @@
 # Setup and portability
 ## NixOS package
 Use `darling-lol`, `darling-lol --installer`, or `darling-lol-shell` rather than
 invoking the raw FHS environment. The launcher uses `unshare --map-auto` before
 bubblewrap, so the user needs subordinate UID/GID ranges (`/etc/subuid` and
 `/etc/subgid`, or NixOS `users.users.<name>.autoSubUidGidRange = true`).
 Namespace root maps to a subordinate host ID, not host root. The FHS entrypoint
 restores the real Linux user's IDs while retaining namespace-only capabilities;
 the Darling shim temporarily switches effective IDs for mounts. No `sudo`,
 root-owned binary in a writable workspace, or host setuid installation is needed.
 The launcher refreshes managed scripts with executable bits and owner-write access,
 rejecting symlinks in that managed tree. It preserves `build/`, `usr-local/`, and
 the guest prefix. Edit the source checkout, not copied workspace tools.
 First setup: run `darling-lol --installer` in an interactive terminal, choose the
 build when prompted, then choose the Riot region. The desktop entry uses
 `Terminal=true` and delegates terminal selection to the desktop environment.
 A launch with EOF stdin fails with a command to run in a terminal; it does not
 try a hard-coded list of terminal emulators or silently abandon a prompt.
 Update: after manually exiting League and both Riot clients, shut down Darling
 in the ORIGINAL `darling-lol-shell` terminal with `darling shutdown`, then exit
 that shell. Upgrade the Nix package and run `darling-lol --update` in a terminal.
 This rebuilds incrementally, installs into the user-owned `/usr/local` bind,
 and installs paired per-prefix overlays without sudo. For a first-time setup,
 the same rootless update path performs the base build/install. Native/manual
 (non-Nix) instructions below still use their normal privileged base install.
 Readiness JSON under `build/nix-ready/` is keyed by canonical prefix and checks
 the configured guest and resolved host guest home, UID/GID, package path,
 maintained patch/tool identities, executable modes, base SDK/runtime metadata
 and required-overlay inventory. Stamping reuses required-artifact validation.
 Changing `RIOT_GUEST_HOME` invalidates readiness. Explicit `DPREFIX` and
 `RIOT_GUEST_HOME` environment overrides take precedence over saved configuration;
 clear stale values before selecting a different installation. A separate base
 manifest avoids rebuilding when only a new prefix needs overlays.
 Updates invalidate readiness before replacing the base; failed/interrupted setup
 cannot leave the previous prefix stamp authoritative. Existing app bundles never
 bypass these checks. Normal ready launches only check state, not rebuild.
 Operational limits: each workspace supports one foreground namespace session.
 The launcher holds a lock while its child runs, even if bubblewrap closes file
 descriptors. It refuses a live `.init.pid` rather than reconnecting across new
 user namespaces or killing anything. A stale/reused live PID can therefore block
 a launch conservatively; inspect it before taking manual action. Never remove a
 marker just to force another launch. Manual stop/reconnect and game lifecycle
 acceptance have not been exercised with this repaired package. Keep the original
 shell open if you need to stop a session. Maintenance requires that prefix idle;
 rootless CMake's shutdown hook checks only that prefix, never enumerates and
 shuts down every user's launchd. The inherited scoped stop helper remains used
 by overlay installers; it is fixture-tested, not live-game tested here.
 Mutable Linux ELF outputs can retain Nix-store interpreter/library references.
 A native compiler probe executed successfully with its store-path interpreter;
 there is no evidence that all such outputs require `patchelf`. The update path
 creates indirect closure roots under `build/nix-gcroots/` before compiling and
 retains old package roots for incremental outputs. Keep those roots while using
 the workspace; remove them only when discarding/rebuilding all dependent mutable
 outputs. This trades disk retention for GC safety, not a claim of full runtime
 relocatability. A full Darling build/upgrade and GC acceptance test remains open.
 The FFmpeg dependency is explicitly 8.x: generated Darling AV wrappers reference
 `libavformat.so.62`, `libavcodec.so.62`, and `libavutil.so.60`; FFmpeg 9 cannot
 replace those ABI versions.
 Run the package regression suite with `python3 -m unittest discover -s tests -v`.
 The patch manifest pins Darling to `60ba801decee7a00782f74f6be4c8ffb013f79ff` and records every changed submodule's revision. `scripts/prepare.py` checks each revision before applying patches and never resets an existing checkout to make a patch apply. Re-running it accepts an already-applied patch.
 Git LFS must be available before fetching the upstream submodules. The pinned `darling-swift` submodule's `.lfsconfig` points at the retired `git-lfs.darlinghq.org`, which no longer accepts connections; `prepare.py` redirects that submodule's LFS requests to GitHub, which still serves the objects. Without that override a fresh `git submodule update` blocks with no output right after `src/external/sqlite` is checked out. The local development checkout had removed prebuilt Swift files from its working directory; that deletion is deliberately not exported. A fresh upstream checkout keeps its original Swift assets and licensing. Do not install Git LFS pointer text as a library.
@@ -12,22 +81,7 @@ python3 scripts/configure.py --guest-user my-linux-user
 python3 scripts/configure.py --sdk /usr/local/libexec/darling
 ```
-The runtime installation wrappers resolve `DPREFIX` first, otherwise the saved
+The normal wrappers currently support the default `~/.darling` prefix and `/usr/local` base installation. The configurator exposes a custom prefix for developers, but several archived tools assume the default layout. Custom prefixes/install locations have not been tested end to end.
 `configure.py --prefix` setting. The configured guest account supplies the
 default guest home. `RIOT_GUEST_HOME`, when set, is an absolute **host** path
 inside the selected prefix, not a guest `/Users/...` path. Installers, runtime
 validation and the Riot launcher's guest library paths use that selection.
 Paths containing spaces are supported by isolated regression fixtures. Explicit
 environment overrides win over saved configuration; clear stale values before
 selecting a different installation.
 A complete real installation using a custom prefix has not been verified.
 Archived tools may still assume the default layout. Runtime validation fails on
 missing expected binaries, unreadable/missing directories or checker errors;
 an empty input set is not a successful validation.
 Runtime installation requires the selected runtime to stop before overlay
 replacement. Failed shutdown blocks replacement.
 The build uses Unix Makefiles because the incremental runtime helpers read CMake `flags.make` and `link.txt`. Ninja is not a drop-in replacement for those helpers.
@@ -39,7 +93,7 @@ Linux 5.14 or newer is required for `MADV_POPULATE_WRITE`, used when Darwin's al
 The runtime installer requires native `pkg-config` entries for `x11`, `x11-xcb`, `xcb-shm` and `xext`, plus the base Darling SDK.
-Run configuration, builds and the per-user runtime installation as your ordinary account. Use sudo only for the base CMake installation and the incremental server installer. Running the whole build or per-user install under sudo can create root-owned files and configure the wrong guest home. `scripts/install-runtime.sh` initializes the selected user prefix and creates its `private/tmp` directory with mode `1777`, so the installer can write guest temporary files. It then shuts down Darling before replacing the paired runtime: first exit the game and both clients manually.
+Run configuration, builds and the per-user runtime installation as your ordinary account. Use sudo only for the base CMake installation and the incremental server installer. Running the whole build or per-user install under sudo can create root-owned files and configure the wrong guest home. `scripts/install-runtime.sh` initializes the default user prefix and creates `~/.darling/private/tmp` with mode `1777`, so the installer can write guest temporary files. It then shuts down Darling before replacing the paired runtime: first exit the game and both clients manually.
 The normal launcher starts neither an Electron inspector nor client API/UI helpers. It clears inherited `DYLD_INSERT_LIBRARIES`, retains Darling runtime library/framework overrides, supplies an absolute log directory to the launcher, and selects the League product. The log-directory/Chromium argument shim, empty-autofill hook and optional native VPX bridge are no longer injected or built by runtime installation. Existing copies on disk are inactive and may remain. Child-process log-directory rewriting and Chromium feature overrides previously supplied by the shim are removed; client startup without those workarounds needs manual validation. The first-time installer uses `--skip-to-install` and omits the installed client's `--app-root`, avoiding an immediate exit or inaccessible intro screen. The project ships no inspector hooks, client API helpers, input automation or client binary patches. Keep account data, logs and captures private.
@@ -1,5 +1,23 @@
 # Troubleshooting
 ## NixOS launcher fails before Riot opens
 A message saying Darling must be setuid root is not fixed by running `sudo`
 inside `buildFHSEnv`: bubblewrap enables `no_new_privs`, so setuid elevation is
 ignored there. Use the package's rootless launcher with subordinate UID/GID
 mapping enabled. Never make a mutable workspace executable host-setuid-root.
 If a newly installed client aborts with `Cannot load libavformat.so.62 (ELF)`,
 check the FHS runtime dependencies. The generated Darling wrappers use FFmpeg 8
 SONAMEs, so an unversioned nixpkgs `ffmpeg` dependency can break them when its
 major changes. The package pins `ffmpeg_8`; do not create fake ABI symlinks.
 Older packages used `cp -n` and never refreshed already-copied tools. The current
 launcher replaces packaged source files while retaining compiled/runtime data.
 An incomplete prefix can be backed up by renaming it with Darling stopped;
 never delete a populated Riot/game prefix just to repair the launcher.
 Use the [setup instructions](SETUP.md) from the repository root as your ordinary user. Exit the game and both clients manually before a full installation or Darling restart. Incremental server/memory installers can replace files without interrupting processes, but their changes need a later full restart to activate.
 ## Memory installer: permission denied
@@ -56,18 +74,6 @@ The installer fetcher no longer treats a missing archive `Info.plist` or the inf
 There is also a separate known compatibility gap: native LaunchAgent watch registration can return HTTP 409 after the League install path is accepted, leaving the download idle. A historical inspector hook handles this and interrupted `pending_verify` states in 28 mock cases, but that hook is disabled in normal launches and excluded from the manual workflow. There is no verified runtime-only replacement for that handoff in this snapshot. Do not assume the native permission and launcher fixes resolve every idle Install case, or enable debugger/API automation to work around it.
 ## `Unable to read system root certificates` or `Error -25263`
 Riot logs `CertBundle: Unable to read system root certificates` and Chromium logs `[known_roots_mac.cc(60)] Unable to determine trusted roots; assuming all roots are trusted! Error -25263` when the prefix has no system trust domain. Security reads that domain from `/System/Library/Keychains/SystemRootCertificates.keychain` and `SystemTrustSettings.plist`, which Darling does not ship, so `SecTrustSettingsCopyCertificates` returns `errSecNoTrustSettings`.
 `tools/ensure-darling-root-certificates.py` builds both from the host CA bundle (`/etc/ssl/cert.pem` or whichever bundle Python's `ssl` reports; `--bundle` overrides it). The launcher and `scripts/install-runtime.sh` run it. Each self-signed root gets an unrestricted trust entry. The keychain is built with the guest `security` tool in a single `darling shell`. A stamp in the same directory records the bundle's digest, so later launches skip it without starting Darling until the host bundle changes. If Darling was already running and the guest could not write the directory, the script installs the files on the host and says they apply after `darling shutdown`. A failure prints `Darling system root certificates were not installed: …` and the launch continues. To rebuild by hand:
 ```sh
 python3 build/runtime/tools/ensure-darling-root-certificates.py --force
 ```
 `python3 -m unittest tests.test_root_certificates` compares the generated SHA-1 keys, issuer names and serial numbers with OpenSSL, and checks that an unchanged bundle is skipped. It uses stub `darling` and `security` commands. Reading the keychain and the system trust domain inside a real guest (`security find-certificate -a /System/Library/Keychains/SystemRootCertificates.keychain`, `security dump-trust-settings -s`) is not yet confirmed.
 ## Riot closes after a network lookup is cancelled
 Two local crashes were traced to `CFNetwork::_HostCancel` calling `CFRetain(NULL)`.
@@ -246,18 +252,6 @@ A non-zero error or `FAILED` means the frames cannot reach the window. Before 20
 An additional NVIDIA report on `68f816d` showed successful optimal-tiling import but repeated `Metal Device timed out giving us a Drawable to present` messages. Its [presentation trace](https://github.com/lucannez64/darling-lol/issues/3#issuecomment-6214732591) shows all three drawables queued and all three main-thread presentation callbacks running, followed by timeouts with three frames still queued. The compositor only prepared a Metal layer when it was the root layer, skipping nested Metal layers. It now prepares Metal layers throughout the tree. A standalone nested-layer reproduction exhausts the pool before this correction and passes ten presentations with pixel readback after it; the root-layer probe also passes. Confirmation on the reporter's NVIDIA system is still needed.
 ### What Metal reports about the GPU
 `MTLDevice.name` is the selected Vulkan device's name in macOS style: the trailing driver note in brackets and the `(R)`/`(TM)` marks are removed (`AMD Radeon RX 6800 XT (RADV NAVI21)` becomes `AMD Radeon RX 6800 XT`, `Intel(R) UHD Graphics 630 (CML GT2)` becomes `Intel UHD Graphics 630`, `llvmpipe (LLVM …)` becomes `llvmpipe`). NVIDIA names are unchanged. The name is never replaced with another vendor's GPU. Before 2026-10-17 it was always `Darling Indium Device`.
 `recommendedMaxWorkingSetSize` is the size of the device-local Vulkan heaps (the VRAM) on a discrete GPU. On integrated and software GPUs it is the size of all heaps, because their device-local heap can be just the firmware carve-out while they also use system RAM; macOS likewise reports a large share of system RAM for unified-memory GPUs. It falls back to the old 1 GiB when Vulkan reports no usable heap. `hasUnifiedMemory` stays `YES` by default: with `NO`, apps switch to managed and private resource paths (`synchronizeResource:`, private buffers created with data) that are not implemented here. Set these in the game's environment to override:
 - `DARLING_METAL_GPU_NAME=<name>`: report this name.
 - `DARLING_METAL_VRAM_MB=<positive integer>`: report this working-set size in MiB. Other values are ignored.
 - `DARLING_METAL_HOST_UNIFIED_MEMORY=1`: report `hasUnifiedMemory` from the GPU type (`YES` for integrated and software GPUs, `NO` for discrete ones). This is experimental; on a discrete GPU it can break rendering.
 Each process reads these once.
 ### Host-side checks
 These are host settings, not game settings. Run on AC power, and use a performance power profile (`powerprofilesctl set performance`, or `asusctl profile -P Performance` on ASUS laptops). On the tested desktop the game is limited mostly by its own main thread on the CPU, not by the GPU (see [status](STATUS.md#game-fps-2026-10-1314)), so laptop CPU power limits matter as much as the GPU choice.
@@ -0,0 +1,27 @@
 {
  "nodes": {
    "nixpkgs": {
      "locked": {
        "lastModified": 1791956154,
        "narHash": "sha256-jBYGPi4udQ9uo4KQp9m2J0546nJVQitG15gvZSaVVAs=",
        "owner": "nixos",
        "repo": "nixpkgs",
        "rev": "55bfb4d7437bd4e09ab7cba58a43bd68eb310044",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
        "ref": "nixos-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "root": {
      "inputs": {
        "nixpkgs": "nixpkgs"
      }
    }
  },
  "root": "root",
  "version": 7
 }
@@ -0,0 +1,328 @@
 {
  description = "Darling League of Legends - experimental macOS LoL runner on Linux via Darling";
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
  };
  outputs =
    { self, nixpkgs }:
    let
      system = "x86_64-linux";
      pkgs = nixpkgs.legacyPackages.${system};
      # Python environment with dependencies required by tooling
      pythonEnv = pkgs.python3.withPackages (
        ps: with ps; [
          requests
          urllib3
          websocket-client
          pillow
        ]
      );
      darlingEntry = pkgs.writeShellScript "darling-lol-entry" (builtins.readFile ./scripts/fhs-entry.sh);
      darlingRunner = pkgs.runCommand "darling-lol-rootless-runner" { } ''
        mkdir -p $out/bin
        cp ${./scripts/darling-rootless.sh} $out/bin/darling
        chmod +x $out/bin/darling
        patchShebangs $out/bin/darling
      '';
      # Common runtime libraries needed by Darling, Vulkan, X11, Audio, and graphics
      buildDeps = with pkgs; [
        # Build tools & compilers
        cmake
        gnumake
        ninja
        pkg-config
        clang
        lld
        llvm
        llvm.dev
        llvmPackages.clang-unwrapped
        bison
        flex
        git
        git-lfs
        nix
        curl
        unzip
        file
        patchelf
        util-linux
        # System & core libraries
        glibc
        glibc.dev
        glibc.static
        zlib
        zlib.dev
        libffi
        libffi.dev
        libbsd
        libbsd.dev
        libmd
        libmd.dev
        libcap
        libelf
        fuse
        systemdLibs # libudev
        dbus
        libxml2
        openssl
        libedit
        # Graphics & Display
        libGL
        libGLU
        mesa
        vulkan-headers
        vulkan-loader
        vulkan-tools
        cairo
        freetype
        fontconfig
        libpng
        libpng.dev
        libjpeg
        libjpeg.dev
        libtiff
        giflib
        # Darling's generated AV wrappers bind FFmpeg 8 SONAMEs (e.g. .62).
        # Do not let nixpkgs' default FFmpeg major silently break installed builds.
        ffmpeg_8
        # X11 & input
        xorgproto
        libx11
        libxext
        libxrandr
        libxcursor
        libxinerama
        libxcomposite
        libxdamage
        libxfixes
        libxi
        libxrender
        libxtst
        libxcb
        xcbutil
        xcbutilwm
        xcbutilimage
        xcbutilkeysyms
        xcbutilrenderutil
        libxkbfile
        libxkbcommon
        # Audio
        pulseaudio
        libpulseaudio
        alsa-lib
        # Python
        pythonEnv
      ];
      # FHS environment for building and running Darling and League of Legends.
      # Darling requires root/multitasking mount & namespace semantics, /usr/local layout,
      # and dynamically compiled overlays. An FHS environment provides the standard standard
      # filesystem hierarchies (/usr/include, /usr/lib, /usr/bin) and native dynamic linker.
      darlingLolFhs = pkgs.buildFHSEnv {
        name = "darling-lol-fhs";
        targetPkgs = pkgs: buildDeps;
        multiPkgs = pkgs: [ pkgs.glibc ];
        extraOutputsToInstall = [ "dev" "out" ];
        extraBwrapArgs = [
          # The outer user namespace maps subordinate IDs before no_new_privs.
          # These capabilities apply only inside that namespace, not on the host.
          "--cap-add" "ALL"
          "--bind-try" (''$'' + ''{DARLING_WORKSPACE}/usr-local'') "/usr-local"
        ];
        extraBuildCommands = ''
          mkdir -p bin usr/bin
          rm -f bin/clang bin/clang++ usr/bin/clang usr/bin/clang++
          ln -sfn /usr-local $out/usr/local
          cat << 'EOF' > usr/bin/clang
 #!/usr/bin/env bash
 is_darwin=0
 for a in "$@"; do
  if [[ "$a" == *darwin* ]] || [[ "$a" == *apple* ]] || [[ "$a" == *macosx* ]]; then
    is_darwin=1
    break
  fi
 done
 if [[ "$is_darwin" -eq 1 ]]; then
  exec ${pkgs.llvmPackages.clang-unwrapped}/bin/clang "$@"
 else
  exec ${pkgs.clang}/bin/clang -idirafter /usr/include "$@"
 fi
 EOF
          chmod +x usr/bin/clang
          cat << 'EOF' > usr/bin/clang++
 #!/usr/bin/env bash
 is_darwin=0
 for a in "$@"; do
  if [[ "$a" == *darwin* ]] || [[ "$a" == *apple* ]] || [[ "$a" == *macosx* ]]; then
    is_darwin=1
    break
  fi
 done
 if [[ "$is_darwin" -eq 1 ]]; then
  exec ${pkgs.llvmPackages.clang-unwrapped}/bin/clang++ "$@"
 else
  exec ${pkgs.clang}/bin/clang++ -idirafter /usr/include "$@"
 fi
 EOF
          chmod +x usr/bin/clang++
          cp -f usr/bin/clang bin/clang
          cp -f usr/bin/clang++ bin/clang++
        '';
        profile = ''
          export DPREFIX="''${DPREFIX:-$HOME/.darling}"
          export LC_ALL=C.UTF-8
          export LANG=C.UTF-8
          export DARLING_RUNNER_DIR=${darlingRunner}/bin
          export PATH="$DARLING_RUNNER_DIR:/usr/local/bin:''${PATH:-}"
          export PKG_CONFIG_PATH="/usr/local/lib/pkgconfig:/usr/local/share/pkgconfig:/usr/lib/pkgconfig:/usr/lib64/pkgconfig:/usr/share/pkgconfig:''${PKG_CONFIG_PATH:-}"
          export CMAKE_PREFIX_PATH="/usr/local:/usr:/usr/lib/cmake/llvm:''${CMAKE_PREFIX_PATH:-}"
          unset NIX_LDFLAGS NIX_CFLAGS_COMPILE NIX_HARDENING_ENABLE CPATH LIBRARY_PATH
        '';
        runScript = pkgs.writeShellScript "darling-lol-run" ''
          if [ $# -eq 0 ]; then
            exec ${darlingEntry} bash
          else
            exec ${darlingEntry} "$@"
          fi
        '';
      };
      # Wrapper script package to run scripts directly
      darlingLol = pkgs.stdenv.mkDerivation {
        pname = "darling-lol";
        version = "0.1.0";
        src = pkgs.lib.cleanSourceWith {
          src = ./.;
          filter = path: type:
            let name = baseNameOf path; in
            !(builtins.elem name [ ".git" "build" "__pycache__" "usr-local" "darling-install" ])
            && !(pkgs.lib.hasPrefix "result" name);
        };
        nativeBuildInputs = [
          pkgs.makeWrapper
        ];
        installPhase = ''
          runHook preInstall
          mkdir -p $out/bin $out/share/darling-lol $out/share/icons/hicolor/scalable/apps $out/share/icons/hicolor/128x128/apps $out/share/pixmaps $out/share/applications
          cp -r * $out/share/darling-lol/
          cp darling-lol.svg $out/share/icons/hicolor/scalable/apps/darling-lol.svg
          cp darling-lol.png $out/share/icons/hicolor/128x128/apps/darling-lol.png
          cp darling-lol.png $out/share/pixmaps/darling-lol.png
          cp darling-lol.svg $out/share/pixmaps/darling-lol.svg
          # Install configured launcher
          substitute ./darling-lol-launcher.sh $out/bin/darling-lol \
            --replace-fail "@SHARE_DIR@" "$out/share/darling-lol" \
            --replace-fail "@FHS_BIN@" "${darlingLolFhs}/bin/darling-lol-fhs" \
            --replace-fail "@UNSHARE_BIN@" "${pkgs.util-linux}/bin/unshare"
          chmod +x $out/bin/darling-lol
          wrapProgram $out/bin/darling-lol --prefix PATH : ${pkgs.lib.makeBinPath [ pythonEnv pkgs.coreutils pkgs.util-linux pkgs.gawk ]}
          makeWrapper $out/bin/darling-lol $out/bin/darling-lol-installer \
            --add-flags "--installer"
          makeWrapper $out/bin/darling-lol $out/bin/darling-lol-shell \
            --add-flags "--shell"
          makeWrapper $out/bin/darling-lol $out/bin/darling-lol-build \
            --add-flags "./scripts/build.sh"
          cat << 'DESKTOP_EOF' > $out/share/applications/darling-lol.desktop
 [Desktop Entry]
 Categories=Game;
 Comment=Play League of Legends macOS client on Linux via Darling
 Exec=darling-lol
 GenericName=MOBA Game
 Icon=darling-lol
 Keywords=League;LoL;Riot;Darling;
 Name=League of Legends
 StartupWMClass=RiotClientServices
 Terminal=true
 Type=Application
 Version=1.5
 DESKTOP_EOF
          runHook postInstall
        '';
        meta = with pkgs.lib; {
          description = "Tooling and patches to run macOS League of Legends on Linux with Darling";
          homepage = "https://github.com/lucannez64/darling-lol";
          license = licenses.gpl3Only;
          platforms = [ "x86_64-linux" ];
        };
      };
    in
    {
      checks.${system}.packaging = pkgs.runCommand "darling-lol-packaging-tests" {
        nativeBuildInputs = [ pythonEnv pkgs.bash pkgs.git pkgs.coreutils pkgs.util-linux pkgs.gawk ];
      } ''
        cp -R ${darlingLol}/share/darling-lol source
        chmod -R u+w source
        cd source
        export HOME="$TMPDIR/home" PYTHONDONTWRITEBYTECODE=1
        mkdir -p "$HOME"
        # Tests use private stub binaries/repositories, never Darling itself.
        python3 -m unittest discover -s tests -v
        python3 scripts/validate.py
        grep -q '^Terminal=true$' ${darlingLol}/share/applications/darling-lol.desktop
        touch "$out"
      '';
      packages.${system} = {
        darling-lol = darlingLol;
        darling-lol-fhs = darlingLolFhs;
        default = darlingLol;
      };
      apps.${system} = {
        default = {
          type = "app";
          program = "${darlingLol}/bin/darling-lol";
          meta.description = "Launch League of Legends via Darling";
        };
        shell = {
          type = "app";
          program = "${darlingLol}/bin/darling-lol-shell";
          meta.description = "Open an interactive shell inside the Darling FHS environment";
        };
        installer = {
          type = "app";
          program = "${darlingLol}/bin/darling-lol-installer";
          meta.description = "Run the Darling and League of Legends rootless installer";
        };
        build = {
          type = "app";
          program = "${darlingLol}/bin/darling-lol-build";
          meta.description = "Build the Darling runtime tree inside the FHS sandbox";
        };
      };
      devShells.${system}.default = pkgs.mkShell {
        packages = buildDeps ++ [ darlingLolFhs ];
        shellHook = ''
          echo "Darling LoL build & development environment loaded."
          echo "Tip: Run 'darling-lol-fhs' to enter the FHS build sandbox if standard paths (/usr/include, /usr/lib) are needed."
        '';
      };
    };
 }
@@ -0,0 +1,38 @@
 diff --git a/cctools/ld64/src/3rd/strlcpy.h b/cctools/ld64/src/3rd/strlcpy.h
 --- a/cctools/ld64/src/3rd/strlcpy.h
 +++ b/cctools/ld64/src/3rd/strlcpy.h
@@ -7,8 +7,15 @@
 extern "C" {
 #endif
 #include <stddef.h>
 +#include <string.h>
 +#if defined(__GLIBC__)
 +# if !__GLIBC_PREREQ(2, 38)
 size_t strlcpy(char *dst, const char *src, size_t siz);
 +# endif
 +#else
 +size_t strlcpy(char *dst, const char *src, size_t siz);
 +#endif
 #ifdef __cplusplus
 }
 diff --git a/cctools/ld64/src/3rd/strlcat.h b/cctools/ld64/src/3rd/strlcat.h
 --- a/cctools/ld64/src/3rd/strlcat.h
 +++ b/cctools/ld64/src/3rd/strlcat.h
@@ -7,8 +7,15 @@
 extern "C" {
 #endif
 #include <stddef.h>
 +#include <string.h>
 +#if defined(__GLIBC__)
 +# if !__GLIBC_PREREQ(2, 38)
 size_t strlcat(char *dst, const char *src, size_t siz);
 +# endif
 +#else
 +size_t strlcat(char *dst, const char *src, size_t siz);
 +#endif
 #ifdef __cplusplus
 }
@@ -10588,13 +10588,19 @@ diff --git a/tools/shutdown-user.sh b/tools/shutdown-user.sh
 index 072a6e2..c804100 100755
 --- a/tools/shutdown-user.sh
 +++ b/tools/shutdown-user.sh
-@@ -1,26 +1,34 @@
+@@ -1,26 +1,40 @@
 #!/bin/sh
 -if [ "$(whoami)" != "root" ]
 -then
 -	echo "$0 must be run as root, invoking sudo"
 -	exec sudo su -c "$0" "$@"
 +# Rootless installs own only this workspace/prefix, never all launchd users.
 +if [ -n "${DARLING_WORKSPACE:-}" ]; then
 +    : "${DPREFIX:?rootless install requires an explicit prefix}"
 +    exec python3 "$DARLING_WORKSPACE/scripts/nix-idle.py"
 +fi
 +
 +if [ "$(whoami)" != "root" ]; then
 +    echo "$0 must be run as root, invoking sudo"
 +    exec sudo sh "$0" "$@"
@@ -20,4 +20,8 @@ cmake -S build/darling-src -B build/darling-src/build -G 'Unix Makefiles' \
  -DCMAKE_C_FLAGS="-O3 -march=native -mtune=generic -pipe" \
  -DCMAKE_CXX_FLAGS="-O3 -march=native -mtune=generic -pipe"
 cmake --build build/darling-src/build --parallel "${JOBS:-$(nproc)}"
-echo 'Build complete. Install the base runtime with: sudo cmake --install build/darling-src/build'
+if [ -n "${DARLING_WORKSPACE:-}" ]; then
  echo 'Build complete. Install the base runtime with: cmake --install build/darling-src/build'
 else
  echo 'Build complete. Install the base runtime with: sudo cmake --install build/darling-src/build'
 fi
@@ -0,0 +1,14 @@
 #!/usr/bin/env bash
 set -euo pipefail
 : "${DARLING_HOST_UID:?missing Darling user namespace}"
 : "${DARLING_WORKSPACE:?missing Darling workspace}"
 if [ "${DARLING_SETUP:-0}" != 1 ] && [ "${1:-}" != shutdown ]; then
  python3 "$DARLING_WORKSPACE/scripts/nix-state.py" check || {
    echo 'Rootless runtime readiness missing; run darling-lol --installer in a terminal.' >&2
    exit 1
  }
 fi
 # This is namespace root (a subordinate host UID), not host root. Keep real
 # UID/GID intact so Darling initializes the correct guest account and ownership.
 exec setpriv --euid 0 --egid 0 --keep-groups \
  "$DARLING_WORKSPACE/usr-local/bin/darling" "$@"
@@ -0,0 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 : "${DARLING_HOST_UID:?start this environment with darling-lol}"
 : "${DARLING_HOST_GID:?start this environment with darling-lol}"
 # Carry only namespace-scoped capabilities into the ordinary-user process.
 # Darling's shim temporarily switches effective IDs; real IDs stay the user's.
 exec setpriv --ruid "$DARLING_HOST_UID" --euid "$DARLING_HOST_UID" \
  --rgid "$DARLING_HOST_GID" --egid "$DARLING_HOST_GID" --keep-groups \
  --inh-caps +all --ambient-caps +all "$@"
@@ -3,6 +3,13 @@
 set -eu
 repo=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 cd "$repo"
 if [ -n "${DARLING_WORKSPACE:-}" ]; then
  python3 scripts/nix-idle.py
  python3 scripts/nix-state.py check-base || { echo 'Base runtime readiness missing; run darling-lol --update.' >&2; exit 1; }
  python3 scripts/nix-state.py invalidate
  # Prefix initialization is a setup-only exception to the runner launch gate.
  export DARLING_SETUP=1
 fi
 python3 scripts/configure.py
 . build/runtime/tools/runtime-paths.sh
 if [ -d build/venv/bin ]; then PATH="$repo/build/venv/bin:$PATH"; export PATH; fi
@@ -16,7 +23,7 @@ prefix=$prefix_dir
 mkdir -p "$prefix/private/tmp"
 chmod 1777 "$prefix/private/tmp"
 # Build the system root store now that the prefix exists; Darling is stopped next anyway.
-python3 build/runtime/tools/ensure-darling-root-certificates.py ||
+python3 build/runtime/tools/ensure-darling-root-certificates.py || \
  echo 'Darling system root store not installed; the launcher retries it' >&2
 python3 build/runtime/tools/stop-darling-runtime.py
 sh build/runtime/tools/install-riot-presentation-runtime.sh
@@ -29,3 +36,9 @@ fi
 python3 build/runtime/tools/install-darling-system-profiler.py
 # Every guest process loads these overlays; refuse a set the compiler broke (check-darwin-tlv-calls.py).
 python3 build/runtime/tools/validate-riot-runtime.py
 # Mark this canonical prefix and configured guest ready only after validation.
 if [ -n "${DARLING_WORKSPACE:-}" ]; then
  # Overlay installation can also refresh darlingserver; record the final base.
  python3 scripts/nix-state.py stamp-base
  python3 scripts/nix-state.py stamp
 fi
@@ -2,10 +2,13 @@
 set -eu
 repo=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 cd "$repo"
 if [ -n "${DARLING_WORKSPACE:-}" ] && ! python3 scripts/nix-state.py check; then
  echo 'Rootless runtime readiness is missing or incompatible; run darling-lol --installer in a terminal.' >&2
  exit 1
 fi
 export PATH="${DARLING_RUNNER_DIR:+$DARLING_RUNNER_DIR:}$repo/usr-local/bin:/usr/local/bin:$PATH"
 region=${1:-euw}
-# Riot publishes LAN, LAS and OCE installers under their platform codes.
+case "$region" in euw|eune|na|br|kr|jp|lan|las|oce|ru|tr) ;; *) echo 'Use a Riot installer region code' >&2; exit 1;; esac
 case "$region" in lan) region=la1;; las) region=la2;; oce) region=oc1;; esac
 case "$region" in euw|eune|na|br|kr|jp|la1|la2|oc1|ru|tr) ;; *) echo 'Use a Riot installer region code' >&2; exit 1;; esac
 python3 scripts/configure.py >/dev/null
 bash build/runtime/tools/fetch-installer.sh "$region" build/installer
 unzip -q -o "build/installer/live.$region.zip" -d build/installer
@@ -0,0 +1,44 @@
 #!/usr/bin/env python3
 """Refresh managed package files without following mutable destination symlinks."""
 import os
 from pathlib import Path
 import shutil
 import stat
 import sys
 import tempfile
 source, destination = map(Path, sys.argv[1:])
 items = 'docs patches research scripts tests tools upstream LICENSE NOTICE.md README.md requirements.txt'.split()
 # Preflight the entire managed tree before writing anything. Never chmod or copy
 # through a link planted by a previous installation (including directory links).
 for root in [destination, *destination.parents]:
    if root.is_symlink():
        raise SystemExit(f'Refusing symlink workspace ancestor: {root}')
 for item in items:
    for base in [source / item, destination / item]:
        for path in [base, *base.rglob('*')] if base.is_dir() else [base]:
            if path.is_symlink():
                raise SystemExit(f'Refusing symlink in managed package tree: {path}')
            if path.exists() and not (path.is_file() or path.is_dir()):
                raise SystemExit(f'Refusing special file in managed package tree: {path}')
 for item in items:
    src = source / item
    if not src.exists():
        continue
    for path in [src, *src.rglob('*')] if src.is_dir() else [src]:
        target = destination / path.relative_to(source)
        if path.is_dir():
            target.mkdir(parents=True, exist_ok=True)
            target.chmod(0o755)
        else:
            target.parent.mkdir(parents=True, exist_ok=True)
            fd, temporary = tempfile.mkstemp(prefix='.package-', dir=target.parent)
            try:
                with os.fdopen(fd, 'wb') as output, path.open('rb') as input_file:
                    shutil.copyfileobj(input_file, output)
                # Keep executable bits, remove special bits, and keep owner writable.
                os.chmod(temporary, stat.S_IMODE(path.stat().st_mode) & 0o777 | 0o600)
                os.replace(temporary, target)
            finally:
                if os.path.exists(temporary):
                    os.unlink(temporary)
@@ -0,0 +1,36 @@
 #!/usr/bin/env python3
 """Read-only, fail-closed rootless maintenance preflight. Never signal a process."""
 import os
 from pathlib import Path
 prefix = Path(os.environ.get('DPREFIX', str(Path.home() / '.darling'))).resolve()
 try:
    pid = int((prefix / '.init.pid').read_text().strip())
 except FileNotFoundError:
    pid = 0
 except (OSError, ValueError):
    raise SystemExit('Cannot validate prefix server marker; inspect it before maintenance.')
 if pid > 0:
    try:
        status = (Path('/proc') / str(pid) / 'status').read_text()
        if not any(line.startswith('State:') and line.split()[1] == 'Z' for line in status.splitlines()):
            raise SystemExit('Prefix has a live server marker; exit Riot/League and run darling shutdown in the ORIGINAL namespace before updating. No process was stopped.')
    except FileNotFoundError:
        pass
 # Only inspect same-user mappings under this exact prefix. An unrelated game's
 # command name is not grounds to stop or modify it. Unreadable same-user maps
 # fail closed because we cannot rule out a client still using these files.
 paths = [str(prefix / name) + '/' for name in (
    'Applications/Riot Client.app', 'Applications/League of Legends.app',
    'Users/Shared/Riot Games')]
 for process in Path('/proc').iterdir():
    if not process.name.isdigit():
        continue
    try:
        if process.stat().st_uid != os.getuid():
            continue
        mappings = (process / 'maps').read_text()
        if any(path in mappings for path in paths):
            raise SystemExit('A client maps this prefix; exit it before rootless maintenance. No process was stopped.')
    except (FileNotFoundError, ProcessLookupError, PermissionError):
        continue
@@ -0,0 +1,32 @@
 #!/usr/bin/env bash
 # Run setup and the client in the SAME namespace. Never reconnect by killing it.
 set -euo pipefail
 cd "${DARLING_WORKSPACE:?start with darling-lol}"
 ready() { python3 scripts/nix-state.py check; }
 interactive() {
  if [ ! -t 0 ]; then
    echo 'Setup needs an interactive terminal. Run darling-lol --installer in a terminal (or use the desktop entry with Terminal=true).' >&2
    exit 1
  fi
 }
 if ! ready; then
  interactive
  echo "Prefix: $DPREFIX"
  if ! python3 scripts/nix-state.py check-base; then
    echo 'Base runtime missing or incompatible; building requires about 40–50 GB.'
    read -r -p 'Build/update the rootless runtime? [y/N] ' reply || exit 1
    case "$reply" in y|Y) ;; *) exit 1;; esac
    ./scripts/update.sh
  else
    ./scripts/install-runtime.sh
  fi
 fi
 # Ready existing installations never rebuild merely because the launcher opens.
 if [ "${1:-}" = --installer ] ||
   { [ ! -e "$DPREFIX/Applications/Riot Client.app" ] &&
     [ ! -d "$DPREFIX/Users/Shared/Riot Games/Riot Client.app" ]; }; then
  interactive
  read -r -p 'Region [euw]: ' region || exit 1
  exec ./scripts/installer.sh "${region:-euw}"
 fi
 exec ./scripts/run.sh
@@ -0,0 +1,164 @@
 #!/usr/bin/env python3
 """Per-prefix rootless readiness; no Darling execution or prefix writes."""
 import hashlib
 import json
 import os
 from pathlib import Path
 import pwd
 import sys
 sys.dont_write_bytecode = True
 ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(ROOT / 'tools'))
 from runtime_paths import runtime_paths
 def selected_paths():
    config_path = ROOT / 'build/config.json'
    config = json.loads(config_path.read_text()) if config_path.exists() else {}
    guest = config.get('guest_user') or pwd.getpwuid(os.getuid()).pw_name
    config.setdefault('prefix', str(Path.home() / '.darling'))
    config.setdefault('guest_home', '/Users/' + guest)
    configured_prefix = Path(os.environ.get('DPREFIX') or config['prefix']).resolve()
    env_prefix = os.environ.get('DPREFIX')
    try:
        os.environ['DPREFIX'] = str(configured_prefix)
        prefix, home = runtime_paths(config)
    finally:
        if env_prefix is None:
            os.environ.pop('DPREFIX', None)
        else:
            os.environ['DPREFIX'] = env_prefix
    return prefix.resolve(), home.resolve(), guest
 def guest_user():
    return selected_paths()[2]
 def digest(paths):
    result = hashlib.sha256()
    for path in sorted(paths):
        if path.is_file():
            result.update(str(path.relative_to(ROOT)).encode() + b'\0' + path.read_bytes())
    return result.hexdigest()
 def base_identity():
    runtime_tree = ROOT / 'usr-local/libexec/darling'
    runtime_modes = {name: (ROOT / 'usr-local/bin' / name).stat().st_mode & 0o777
                     if (ROOT / 'usr-local/bin' / name).exists() else None
                     for name in ('darling', 'darlingserver')}
    return {'schema': 2, 'package': os.environ.get('DARLING_PACKAGE_ID', ''),
            'runtime_modes': runtime_modes,
            'runtime_tree': inventory(runtime_tree),
            'sources': digest([* (ROOT / 'patches').glob('*.patch'),
                               ROOT / 'upstream/manifest.json',
                               * (ROOT / 'scripts').glob('*.py'),
                               * (ROOT / 'scripts').glob('*.sh'),
                               * (ROOT / 'tools').glob('*')]),
            'runtime': digest([ROOT / 'usr-local/bin/darling',
                               ROOT / 'usr-local/bin/darlingserver'])}
 def inventory(root):
    """Include all required trees and modes without hashing large installed binaries."""
    if not root.is_dir():
        return None
    result = hashlib.sha256()
    def enumeration_error(error):
        raise error
    for directory, dirs, files in os.walk(root, followlinks=False,
                                         onerror=enumeration_error):
        for name in sorted(dirs + files):
            path = Path(directory) / name
            if any(token in path.name for token in ('.before-', '.rt-', '.llvm')):
                continue
            info = path.lstat()
            target_str = ''
            if path.is_symlink():
                try:
                    target_str = f':{os.readlink(path)}'
                except OSError:
                    pass
            result.update(str(path.relative_to(root)).encode() + b'\0')
            result.update(f'{info.st_mode}:{info.st_size}:{info.st_mtime_ns}{target_str}'.encode())
    return result.hexdigest()
 def overlay_identity(home):
    result: dict[str, object] = {name: inventory(home / name) for name in
              ('RuntimeLibraries', 'RuntimeFrameworks',
               'Library/Audio/Plug-Ins/Components/DarlingRiotAudio.component')}
    helper = home / 'libDarlingXShm.dylib'
    result['xshm'] = ([helper.stat().st_mode, helper.stat().st_size,
                       helper.stat().st_mtime_ns] if helper.is_file() else None)
    return result
 def identity():
    prefix, home, guest = selected_paths()
    return dict(base_identity(), prefix=str(prefix), guest=guest, guest_home=str(home),
                overlays=overlay_identity(home), uid=os.getuid(), gid=os.getgid())
 def read(path):
    try:
        return json.loads(path.read_text())
    except (OSError, ValueError):
        return None
 def atomic(path, value):
    path.parent.mkdir(parents=True, exist_ok=True)
    temporary = path.with_suffix('.tmp')
    temporary.write_text(json.dumps(value, sort_keys=True) + '\n')
    temporary.replace(path)
 def main():
    action = sys.argv[1]
    state = identity()
    key = hashlib.sha256(state['prefix'].encode()).hexdigest()
    marker = ROOT / 'build/nix-ready' / (key + '.json')
    base_marker = ROOT / 'build/nix-base.json'
    if action == 'guest':
        print(state['guest'])
    elif action == 'check-base':
        return 0 if read(base_marker) == base_identity() else 1
    elif action == 'check':
        return 0 if read(marker) == state and read(base_marker) == base_identity() else 1
    elif action == 'stamp-base':
        if (not all((ROOT / 'usr-local/bin' / name).is_file() and
                    os.access(ROOT / 'usr-local/bin' / name, os.X_OK)
                    for name in ('darling', 'darlingserver')) or
                not (ROOT / 'usr-local/libexec/darling').is_dir() or not state['package']):
            raise SystemExit('Cannot stamp readiness without executable base runtime, SDK and package identity')
        atomic(base_marker, base_identity())
    elif action == 'stamp':
        if read(base_marker) != base_identity():
            raise SystemExit('Base runtime readiness is missing; run darling-lol --update in a terminal.')
        home = Path(str(state['guest_home']))
        if not home.is_dir() or not any((home / 'RuntimeLibraries').glob('*')) or not any((home / 'RuntimeFrameworks').glob('*')):
            raise SystemExit('Cannot stamp an empty or missing prefix runtime')
        # Reuse the complete installation gate; readiness must never mint an
        # apparently valid manifest for partial overlays, even when called directly.
        import importlib.util
        spec = importlib.util.spec_from_file_location('runtime_validation', ROOT / 'tools/validate-riot-runtime.py')
        assert spec is not None and spec.loader is not None
        module = importlib.util.module_from_spec(spec)
        spec.loader.exec_module(module)
        module.inputs(Path(str(state['prefix'])), home)
        atomic(marker, state)
    elif action in ('invalidate', 'invalidate-base'):
        marker.unlink(missing_ok=True)
        if action == 'invalidate-base':
            base_marker.unlink(missing_ok=True)
    else:
        raise SystemExit(f'Unknown state action: {action}')
    return 0
 if __name__ == '__main__':
    raise SystemExit(main())
@@ -1,7 +1,9 @@
 #!/usr/bin/env python3
 """Fetch pinned Darling sources and apply each patch to its owning repository."""
-import argparse,json,os,subprocess,tempfile
+import argparse,json,os,subprocess,tempfile,sys
 from pathlib import Path
 # --check-only must not create import caches in the source package either.
 sys.dont_write_bytecode=True
 from common import ROOT,render
 p=argparse.ArgumentParser(description=__doc__)
 p.add_argument('--source',type=Path,default=ROOT/'build/darling-src')
@@ -25,19 +27,27 @@ def previous_patches(component):
        if shown.returncode==0:yield render(shown.stdout)
 if not (source/'.git').exists():
    if a.check_only:p.error('check-only requires an existing pinned source checkout')
    if source.exists():p.error('refusing non-checkout destination; choose an empty source path')
    source.parent.mkdir(parents=True,exist_ok=True)
-    run(['git','clone',manifest['upstream'],str(source)])
+    # Fetch the exact pin, not today's master. Publish only a complete checkout;
-    run(['git','-C',str(source),'checkout','--detach',manifest['revision']])
+    # failed downloads are removed without touching an existing user checkout.
-    # Recursive initialization can spend a long time fetching nested repos (and
+    with tempfile.TemporaryDirectory(prefix='darling-clone-',dir=source.parent) as temporary:
-    # Git LFS assets). Explicit progress keeps the last completed submodule
+        checkout=Path(temporary)/'source'
-    # from looking like the operation that is currently stuck. The pinned
+        run(['git','init',str(checkout)])
-    # darling-swift .lfsconfig points at the retired git-lfs.darlinghq.org, so
+        run(['git','-C',str(checkout),'remote','add','origin',manifest['upstream']])
-    # fetch that submodule's LFS objects from GitHub, which still serves them;
+        run(['git','-C',str(checkout),'fetch','--depth','1','origin',manifest['revision']])
-    # otherwise the checkout blocks on the dead host right after sqlite.
+        run(['git','-C',str(checkout),'checkout','--detach','FETCH_HEAD'])
-    print('Initializing Darling submodules (large repositories/LFS assets may take a while)...',flush=True)
+        print('Initializing Darling submodules (large repositories/LFS assets may take a while)...',flush=True)
-    run(['git','-C',str(source),'-c','lfs.url=https://github.com/darlinghq/darling-swift.git/info/lfs',
+        for attempt in range(1,4):
-         'submodule','update','--init','--recursive','--progress'])
+            try:
-    print('Darling submodules initialized.',flush=True)
+                run(['git','-C',str(checkout),'-c','lfs.url=https://github.com/darlinghq/darling-swift.git/info/lfs',
                     'submodule','update','--init','--recursive','--depth','1','--progress'])
                break
            except subprocess.CalledProcessError:
                if attempt==3:raise
                print(f'Submodule fetch interrupted (attempt {attempt}/3). Retrying...',flush=True)
        checkout.rename(source)
 # Never reset someone else's checkout to make a patch apply.
 for component in manifest['components']:
    repo=source/component['path']
@@ -2,6 +2,11 @@
 set -eu
 repo=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 cd "$repo"
 if [ -n "${DARLING_WORKSPACE:-}" ] && ! python3 scripts/nix-state.py check; then
  echo 'Rootless runtime readiness is missing or incompatible; run darling-lol --installer in a terminal.' >&2
  exit 1
 fi
 export PATH="${DARLING_RUNNER_DIR:+$DARLING_RUNNER_DIR:}$repo/usr-local/bin:/usr/local/bin:$PATH"
 python3 scripts/configure.py >/dev/null
 if [ -d build/venv/bin ]; then PATH="$repo/build/venv/bin:$PATH"; export PATH; fi
 # darling-lol perf: optionally wrap with gamemoderun for automatic
@@ -1,10 +1,29 @@
 #!/bin/sh
 # Bring an existing build and installation up to date after `git pull`: re-apply the patches that changed
 # (prepare.py reverts the earlier version it finds applied), rebuild incrementally, and reinstall the base
-# runtime and the per-user overrides. Run it with no Riot/League session open; it never stops one.
+# runtime, and the per-user overrides. Run it after manually closing Riot/League.
 # Rootless callers must remain in their original namespace; the outer launcher
 # refuses a live prefix marker instead of trying to reconnect or stop a session.
 set -eu
 repo=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 cd "$repo"
 if [ -n "${DARLING_WORKSPACE:-}" ]; then
  python3 scripts/nix-idle.py
  # Initial setup and upgrades use the same supported user-owned install path.
  # Keep each package closure rooted: copied ELF files can retain its loader.
  package=${DARLING_PACKAGE_ID%/share/darling-lol}
  case "$package" in /nix/store/*) ;; *) echo 'Missing Nix package identity' >&2; exit 1;; esac
  mkdir -p build/nix-gcroots
  nix-store --realise "$package" --add-root "$repo/build/nix-gcroots/$(basename "$package")" --indirect >/dev/null
  python3 scripts/nix-state.py invalidate-base
  ./scripts/build.sh
  python3 build/runtime/tools/stop-darling-runtime.py
  cmake --install build/darling-src/build
  python3 scripts/nix-state.py stamp-base
  ./scripts/install-runtime.sh
  echo 'Rootless update installed. In this shell use scripts/run.sh; otherwise exit this shell and start darling-lol.'
  exit 0
 fi
 if [ ! -d build/darling-src/build ]; then
 	echo 'No existing build; follow the first-time setup in README.md instead.' >&2
 	exit 1
@@ -12,6 +12,9 @@ errors=[]
 secret_patterns=[r'gh[pousr]_[A-Za-z0-9]{30,}',r'AKIA[0-9A-Z]{16}',r'eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}',r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----']
 for name in filter(None,files):
    p=ROOT/name;data=p.read_bytes()
    # The Nix desktop package intentionally ships this icon, not a runtime binary.
    if name == 'darling-lol.png' and data.startswith(b'\x89PNG\r\n\x1a\n'):
        continue
    if data.startswith((b'\x7fELF',b'MZ',b'\xcf\xfa\xed\xfe',b'\xca\xfe\xba\xbe')) or b'\0' in data:
        errors.append(name+': binary content is not part of this source package');continue
    try:text=data.decode()
@@ -0,0 +1,90 @@
 """Regression tests for the Nix launcher; no root or game account required."""
 import os
 from pathlib import Path
 import subprocess
 import tempfile
 import unittest
 ROOT = Path(__file__).resolve().parents[1]
 class LauncherTests(unittest.TestCase):
    def setUp(self):
        self.tmp = tempfile.TemporaryDirectory()
        self.addCleanup(self.tmp.cleanup)
        self.folder = Path(self.tmp.name)
        self.home = self.folder / 'home'
        self.home.mkdir()
        self.share = self.folder / 'share'
        (self.share / 'scripts').mkdir(parents=True)
        (self.share / 'scripts/run.sh').write_text('new packaged script\n')
        import shutil
        shutil.copy(ROOT / 'scripts/nix-copy.py', self.share / 'scripts/nix-copy.py')
        self.workspace = self.home / '.local/share/darling-lol'
        self.log = self.folder / 'calls'
        self.bin = self.folder / 'bin'
        self.bin.mkdir()
        for name in ['unshare', 'fhs']:
            executable = self.bin / name
            executable.write_text('#!/bin/sh\nprintf "%s\\n" "$0" "$@" > "$TEST_LOG"\n')
            executable.chmod(0o755)
        self.launcher = self.folder / 'launcher'
        self.launcher.write_text((ROOT / 'darling-lol-launcher.sh').read_text()
                                 .replace('@SHARE_DIR@', str(self.share))
                                 .replace('@FHS_BIN@', str(self.bin / 'fhs'))
                                 .replace('@UNSHARE_BIN@', str(self.bin / 'unshare')))
        self.env = dict(os.environ, HOME=str(self.home), XDG_DATA_HOME=str(self.home / '.local/share'),
                        TEST_LOG=str(self.log), PATH=str(self.bin) + ':' + os.environ['PATH'])
    def launch(self, *args):
        return subprocess.run(['bash', str(self.launcher), *args], env=self.env,
                              text=True, capture_output=True, timeout=10)
    def test_package_upgrade_refreshes_tools_without_touching_build(self):
        (self.workspace / 'scripts').mkdir(parents=True)
        (self.workspace / 'scripts/run.sh').write_text('stale script\n')
        (self.workspace / 'build').mkdir()
        binary = self.workspace / 'build/keep-me'
        binary.write_text('compiled runtime')
        result = self.launch('true')
        self.assertEqual(result.returncode, 0, result.stderr)
        self.assertEqual((self.workspace / 'scripts/run.sh').read_text(), 'new packaged script\n')
        self.assertEqual(binary.read_text(), 'compiled runtime')
    def test_fhs_enters_subuid_namespace_before_bubblewrap(self):
        result = self.launch('echo', 'hello world')
        self.assertEqual(result.returncode, 0, result.stderr)
        calls = self.log.read_text().splitlines()
        self.assertEqual(calls[0], str(self.bin / 'unshare'))
        self.assertIn('--map-auto', calls)
        self.assertIn('--map-current-user', calls)
        self.assertIn('--setuid=0', calls)
        self.assertIn('--setgid=0', calls)
        self.assertEqual(calls[-3:], [str(self.bin / 'fhs'), 'echo', 'hello world'])
    def test_setup_never_makes_a_user_writable_runtime_setuid(self):
        result = self.launch('--installer')
        self.assertEqual(result.returncode, 0, result.stderr)
        setup = (ROOT / 'scripts/nix-session.sh').read_text() + (ROOT / 'scripts/update.sh').read_text().split('if [ ! -d build/darling-src/build ]; then')[0]
        self.assertNotIn('    sudo ', setup)
        self.assertNotIn('\nsudo ', setup)
        self.assertNotIn('chmod 4755', setup)
        self.assertIn('install-runtime.sh', setup)
 class RuntimeEntryTests(unittest.TestCase):
    def test_entry_preserves_host_identity_and_uses_namespace_only_privileges(self):
        entry = ROOT / 'scripts/fhs-entry.sh'
        self.assertTrue(entry.is_file(), 'missing rootless FHS entrypoint')
        text = entry.read_text()
        self.assertIn('DARLING_HOST_UID', text)
        self.assertIn('DARLING_HOST_GID', text)
        self.assertIn('--ambient-caps', text)
        shim = ROOT / 'scripts/darling-rootless.sh'
        self.assertTrue(shim.is_file(), 'missing namespace-local Darling shim')
        self.assertIn('setpriv', shim.read_text())
        self.assertIn('--euid', shim.read_text())
 if __name__ == '__main__':
    unittest.main()
@@ -0,0 +1,519 @@
 """Safe packaging regressions: only temporary repositories, homes and stub commands."""
 import hashlib
 import importlib.util
 import json
 import getpass
 import os
 from pathlib import Path
 import shutil
 import subprocess
 import sys
 import tempfile
 import unittest
 ROOT = Path(__file__).resolve().parents[1]
 def run(*args, cwd=None, env=None):
    return subprocess.run(args, cwd=cwd, env=env, input='', text=True,
                          capture_output=True, timeout=30)
 def git(repo, *args):
    result = run('git', '-C', str(repo), *args)
    if result.returncode:
        raise AssertionError(result.stderr)
    return result.stdout.strip()
 def init(repo):
    repo.mkdir(parents=True)
    git(repo, 'init', '-b', 'master')
    git(repo, 'config', 'user.name', 'Fixture')
    git(repo, 'config', 'user.email', '[email protected]')
 def shutdown_patch():
    return 'diff --git a/tools/shutdown-user.sh b/tools/shutdown-user.sh\n' + (
        ROOT / 'patches/darling.patch').read_text().split(
        'diff --git a/tools/shutdown-user.sh b/tools/shutdown-user.sh\n', 1)[1].split('\ndiff --git ', 1)[0] + '\n'
 def patch_base(patch):
    lines = patch.splitlines()
    start = next(i for i, line in enumerate(lines) if line.startswith('@@')) + 1
    return '\n'.join(line[1:] for line in lines[start:] if line.startswith((' ', '-'))) + '\n'
 class PrepareTests(unittest.TestCase):
    def setUp(self):
        self.tmp = tempfile.TemporaryDirectory(prefix='nix-prepare-test-')
        self.addCleanup(self.tmp.cleanup)
        self.root = Path(self.tmp.name)
        self.project = self.root / 'project'
        for name in ['scripts', 'patches', 'upstream']:
            (self.project / name).mkdir(parents=True)
        for name in ['prepare.py', 'common.py']:
            shutil.copy(ROOT / 'scripts' / name, self.project / 'scripts' / name)
        self.source = self.root / 'source'
        init(self.source)
        self.env = dict(os.environ, PYTHONDONTWRITEBYTECODE='1', HOME=str(self.root))
    def prepare(self, check=False):
        return run(sys.executable, 'scripts/prepare.py', '--source', str(self.source),
                   *(['--check-only'] if check else []), cwd=self.project, env=self.env)
    def manifest(self, revision, components, upstream=None):
        (self.project / 'upstream/manifest.json').write_text(json.dumps({
            'upstream': upstream or self.source.as_uri(), 'revision': revision, 'components': components}))
    def test_prepare_twice_and_check_only_preserves_all_files(self):
        patch = shutdown_patch()
        (self.source / 'tools').mkdir()
        (self.source / 'tools/shutdown-user.sh').write_text(patch_base(patch))
        git(self.source, 'add', '.')
        git(self.source, 'commit', '-m', 'base')
        rev = git(self.source, 'rev-parse', 'HEAD')
        (self.project / 'patches/darling.patch').write_text(patch)
        self.manifest(rev, [{'path': '.', 'patch': 'patches/darling.patch', 'revision': rev}])
        for _ in range(2):
            result = self.prepare()
            self.assertEqual(result.returncode, 0, result.stderr)
        before = {str(p): (p.read_bytes(), p.stat().st_mtime_ns) for p in self.root.rglob('*') if p.is_file()}
        result = self.prepare(True)
        self.assertEqual(result.returncode, 0, result.stderr)
        after = {str(p): (p.read_bytes(), p.stat().st_mtime_ns) for p in self.root.rglob('*') if p.is_file()}
        self.assertEqual(before, after)
    def test_check_only_does_not_rewrite_compatibility_headers(self):
        path = self.source / 'src/external/cctools-port/cctools/ld64/src/3rd/strlcpy.h'
        path.parent.mkdir(parents=True)
        path.write_text('size_t strlcpy(char *dst, const char *src, size_t siz);\n')
        git(self.source, 'add', '.')
        git(self.source, 'commit', '-m', 'header')
        self.manifest(git(self.source, 'rev-parse', 'HEAD'), [])
        before = path.read_bytes(), path.stat().st_mtime_ns
        self.assertEqual(self.prepare(True).returncode, 0)
        self.assertEqual(before, (path.read_bytes(), path.stat().st_mtime_ns))
    def test_rootless_shutdown_dispatches_only_scoped_helper_and_propagates_failure(self):
        with tempfile.TemporaryDirectory(prefix='nix-hook-test-') as directory:
            root = Path(directory)
            (root / 'scripts').mkdir()
            helper = root / 'scripts/nix-idle.py'
            helper.write_text('import os, sys\nprint(os.environ["DPREFIX"])\nsys.exit(int(os.environ["TEST_EXIT"]))\n')
            patch = shutdown_patch().splitlines()
            start = next(i for i, line in enumerate(patch) if line.startswith('@@')) + 1
            script = root / 'shutdown.sh'
            script.write_text('\n'.join(line[1:] for line in patch[start:] if line.startswith((' ', '+'))) + '\n')
            bin_dir = root / 'bin'
            bin_dir.mkdir()
            # These commands must never be reached by rootless preparation.
            for name in ['sudo', 'ps', 'su', 'darling', 'killall', 'pkill']:
                stub = bin_dir / name
                stub.write_text('#!/bin/sh\necho unexpected-' + name + ' >&2\nexit 99\n')
                stub.chmod(0o755)
            env = dict(os.environ, DARLING_WORKSPACE=str(root), DPREFIX=str(root / 'prefix'),
                       TEST_EXIT='0', PATH=str(bin_dir) + ':' + os.environ['PATH'])
            success = run('sh', str(script), env=env)
            self.assertEqual(success.returncode, 0, success.stderr)
            self.assertEqual(success.stdout.strip(), env['DPREFIX'])
            env['TEST_EXIT'] = '23'
            self.assertEqual(run('sh', str(script), env=env).returncode, 23)
    def test_cctools_patch_is_maintained_and_repeatable(self):
        component = next(c for c in json.loads((ROOT / 'upstream/manifest.json').read_text())['components']
                         if c['path'] == 'src/external/cctools-port')
        patch = (ROOT / component['patch']).read_text()
        # Reconstruct exactly the base of each maintained hunk in a local repo.
        for section in patch.split('diff --git ')[1:]:
            lines = section.splitlines()
            path = lines[0].split(' b/')[1]
            header = next(i for i, line in enumerate(lines) if line.startswith('@@'))
            # Header hunk starts at line six; use a neutral prefix of that length.
            start = int(lines[header].split('-')[1].split(',')[0])
            base = ['/* untouched */\n'] * (start - 1)
            base += [line[1:] + '\n' if line else '\n' for line in lines[header + 1:] if not line or line.startswith((' ', '-'))]
            target = self.source / path
            target.parent.mkdir(parents=True, exist_ok=True)
            target.write_text(''.join(base))
        git(self.source, 'add', '.')
        git(self.source, 'commit', '-m', 'cctools')
        rev = git(self.source, 'rev-parse', 'HEAD')
        (self.project / 'patches/cctools-port.patch').write_text(patch)
        self.manifest(rev, [{'path': '.', 'revision': rev, 'patch': 'patches/cctools-port.patch'}])
        for check in [False, False, True]:
            result = self.prepare(check)
            self.assertEqual(result.returncode, 0, result.stderr)
    def test_fetch_pin_older_than_advanced_remote_and_failed_retry(self):
        (self.source / 'file').write_text('pinned')
        git(self.source, 'add', '.')
        git(self.source, 'commit', '-m', 'pin')
        pin = git(self.source, 'rev-parse', 'HEAD')
        (self.source / 'file').write_text('advanced')
        git(self.source, 'commit', '-am', 'advance')
        remote = self.source
        self.source = self.root / 'clone'
        self.manifest('0' * 40, [], remote.as_uri())
        failed = self.prepare()
        self.assertNotEqual(failed.returncode, 0)
        self.assertFalse(self.source.exists(), 'failed initial checkout must not poison retries')
        self.manifest(pin, [], remote.as_uri())
        result = self.prepare()
        self.assertEqual(result.returncode, 0, result.stderr)
        self.assertEqual(git(self.source, 'rev-parse', 'HEAD'), pin)
        self.assertEqual((self.source / 'file').read_text(), 'pinned')
 class CopyTests(unittest.TestCase):
    def test_symlink_workspace_is_rejected_without_external_writes(self):
        with tempfile.TemporaryDirectory(prefix='nix-symlink-test-') as directory:
            root = Path(directory)
            share = root / 'share'
            (share / 'scripts').mkdir(parents=True)
            shutil.copy(ROOT / 'scripts/nix-copy.py', share / 'scripts/nix-copy.py')
            outside = root / 'outside'
            outside.mkdir()
            data = root / 'data'
            data.mkdir()
            (data / 'darling-lol').symlink_to(outside, target_is_directory=True)
            launcher = root / 'launcher'
            launcher.write_text((ROOT / 'darling-lol-launcher.sh').read_text().replace('@SHARE_DIR@', str(share)))
            env = dict(os.environ, HOME=str(root), XDG_DATA_HOME=str(data), DPREFIX=str(root / 'prefix'))
            result = run('bash', str(launcher), 'true', env=env)
            self.assertNotEqual(result.returncode, 0)
            self.assertEqual(list(outside.iterdir()), [])
    def test_copied_scripts_execute_and_upgrade_without_following_symlinks(self):
        with tempfile.TemporaryDirectory(prefix='nix-copy-test-') as directory:
            root = Path(directory)
            share, workspace = root / 'share', root / 'workspace'
            (share / 'scripts').mkdir(parents=True)
            shutil.copy(ROOT / 'scripts/nix-copy.py', share / 'scripts/nix-copy.py')
            entry = share / 'scripts/run.sh'
            entry.write_text('#!/bin/sh\nprintf first\n')
            entry.chmod(0o555)
            env = dict(os.environ, HOME=str(root), XDG_DATA_HOME=str(root / 'data'))
            # Use real cp/filesystem execution, but never a real namespace or Darling.
            launcher = root / 'launcher'
            launcher.write_text((ROOT / 'darling-lol-launcher.sh').read_text()
                .replace('@SHARE_DIR@', str(share)).replace('@FHS_BIN@', shutil.which('true'))
                .replace('@UNSHARE_BIN@', shutil.which('true')).replace('@TERMINAL_BIN@', shutil.which('false')))
            workspace = root / 'data/darling-lol'
            result = run('bash', str(launcher), 'true', env=env)
            self.assertEqual(result.returncode, 0, result.stderr)
            target = workspace / 'scripts/run.sh'
            self.assertTrue(os.access(target, os.X_OK), 'copied entrypoint lost executable bits')
            self.assertTrue(target.stat().st_mode & 0o200)
            self.assertEqual(run(str(target), env=env).stdout, 'first')
            entry.chmod(0o755)
            entry.write_text('#!/bin/sh\nprintf second\n')
            entry.chmod(0o555)
            self.assertEqual(run('bash', str(launcher), 'true', env=env).returncode, 0)
            self.assertEqual(run(str(target), env=env).stdout, 'second')
            external = root / 'external'
            external.write_text('untouched')
            target.unlink()
            target.symlink_to(external)
            result = run('bash', str(launcher), 'true', env=env)
            self.assertNotEqual(result.returncode, 0, 'reject managed destination symlinks')
            self.assertEqual(external.read_text(), 'untouched')
 def populate_overlays(prefix, home, tools):
    for name in ('validate-riot-runtime.py', 'runtime_paths.py'):
        shutil.copy(ROOT / 'tools' / name, tools / name)
    sys.path.insert(0, str(tools))
    try:
        spec = importlib.util.spec_from_file_location('validation_fixture', tools / 'validate-riot-runtime.py')
        assert spec is not None and spec.loader is not None
        module = importlib.util.module_from_spec(spec)
        spec.loader.exec_module(module)
        guest_req = getattr(module, 'GUEST_REQUIRED', getattr(module, 'REQUIRED', ()))
        prefix_req = getattr(module, 'PREFIX_REQUIRED', ())
        for relative in guest_req:
            path = home / relative
            path.parent.mkdir(parents=True, exist_ok=True)
            path.write_bytes(b'\xcf\xfa\xed\xfe' + b'inert test fixture')
        for relative in prefix_req:
            path = prefix / relative
            path.parent.mkdir(parents=True, exist_ok=True)
            path.write_bytes(b'\xcf\xfa\xed\xfe' + b'inert test fixture')
    finally:
        sys.path.remove(str(tools))
 class ReadinessTests(unittest.TestCase):
    def setUp(self):
        self.tmp = tempfile.TemporaryDirectory(prefix='nix-state-test-')
        self.addCleanup(self.tmp.cleanup)
        self.root = Path(self.tmp.name)
        self.repo = self.root / 'repo'
        shutil.copytree(ROOT / 'scripts', self.repo / 'scripts', ignore=shutil.ignore_patterns('__pycache__'))
        for folder in ['upstream', 'patches', 'tools', 'usr-local/bin']:
            (self.repo / folder).mkdir(parents=True)
        (self.repo / 'upstream/manifest.json').write_text('{}')
        shutil.copy(ROOT / 'tools/runtime_paths.py', self.repo / 'tools/runtime_paths.py')
        (self.repo / 'usr-local/bin/darling').write_text('fixture, never executed')
        (self.repo / 'usr-local/bin/darlingserver').write_text('server fixture, never executed')
        (self.repo / 'usr-local/libexec/darling/usr/lib').mkdir(parents=True)
        (self.repo / 'usr-local/libexec/darling/usr/lib/libSystem.B.dylib').write_text('SDK fixture')
        for name in ['darling', 'darlingserver']:
            (self.repo / 'usr-local/bin' / name).chmod(0o755)
        (self.repo / 'usr-local/libexec/darling').mkdir(parents=True, exist_ok=True)
        (self.repo / 'build').mkdir()
        (self.repo / 'build/config.json').write_text(json.dumps({'guest_user': 'guest-one'}))
        self.env = dict(os.environ, HOME=str(self.root), DPREFIX=str(self.root / 'prefix'),
                        DARLING_WORKSPACE=str(self.repo), DARLING_PACKAGE_ID='package-one',
                        DARLING_GUEST_USER='guest-one', PYTHONDONTWRITEBYTECODE='1')
        self.env.pop('RIOT_GUEST_HOME', None)
        populate_overlays(Path(self.env['DPREFIX']), Path(self.env['DPREFIX']) / 'Users/guest-one', self.repo / 'tools')
    def state(self, action):
        return run(sys.executable, str(self.repo / 'scripts/nix-state.py'), action, env=self.env)
    def test_prefix_guest_package_source_and_runtime_identity(self):
        self.assertNotEqual(self.state('check').returncode, 0)
        (Path(self.env['DPREFIX']) / 'Applications/Riot Client.app').mkdir(parents=True)
        self.assertNotEqual(self.state('check').returncode, 0, 'existing app is not readiness')
        self.assertEqual(self.state('stamp-base').returncode, 0)
        self.assertEqual(self.state('stamp').returncode, 0)
        self.assertEqual(self.state('check').returncode, 0)
        # Canonical aliases share readiness, but a different prefix must not.
        self.env['DPREFIX'] += '/../prefix'
        self.assertEqual(self.state('check').returncode, 0)
        for key, value in [('DPREFIX', str(self.root / 'new-prefix')),
                           ('DARLING_PACKAGE_ID', 'package-two')]:
            old = self.env[key]
            self.env[key] = value
            self.assertNotEqual(self.state('check').returncode, 0, key)
            self.env[key] = old
        (self.repo / 'build/config.json').write_text(json.dumps({'guest_user': 'guest-two'}))
        self.assertNotEqual(self.state('check').returncode, 0)
        (self.repo / 'build/config.json').write_text(json.dumps({'guest_user': 'guest-one'}))
        (self.repo / 'patches/change.patch').write_text('upgrade')
        self.assertNotEqual(self.state('check').returncode, 0)
        self.assertEqual(self.state('stamp-base').returncode, 0)
        self.assertEqual(self.state('stamp').returncode, 0)
        (self.repo / 'usr-local/bin/darlingserver').write_text('server-one')
        self.assertEqual(self.state('stamp-base').returncode, 0)
        self.assertEqual(self.state('stamp').returncode, 0)
        (self.repo / 'usr-local/bin/darlingserver').write_text('server-two')
        self.assertNotEqual(self.state('check').returncode, 0)
        (self.repo / 'usr-local/bin/darling').write_text('changed runtime')
        self.assertNotEqual(self.state('check').returncode, 0)
    def test_deleted_overlay_invalidates_readiness(self):
        overlay = Path(self.env['DPREFIX']) / 'Users/guest-one/RuntimeLibraries/library.dylib'
        overlay.parent.mkdir(parents=True, exist_ok=True)
        overlay.write_text('fixture overlay')
        self.assertEqual(self.state('stamp-base').returncode, 0)
        self.assertEqual(self.state('stamp').returncode, 0)
        self.assertEqual(self.state('check').returncode, 0)
        overlay.unlink()
        self.assertNotEqual(self.state('check').returncode, 0)
    def test_missing_runtime_and_noop_checks_do_not_create_or_rebuild(self):
        self.assertEqual(self.state('stamp-base').returncode, 0)
        self.assertEqual(self.state('stamp').returncode, 0)
        before = {str(p): p.stat().st_mtime_ns for p in self.repo.rglob('*') if p.is_file()}
        for _ in range(2):
            self.assertEqual(self.state('check').returncode, 0)
        after = {str(p): p.stat().st_mtime_ns for p in self.repo.rglob('*') if p.is_file()}
        self.assertEqual(before, after)
        (self.repo / 'usr-local/bin/darling').unlink()
        self.assertNotEqual(self.state('check').returncode, 0)
        self.assertNotEqual(self.state('stamp-base').returncode, 0)
    def test_interrupted_setup_invalidates_previous_stamp(self):
        self.assertEqual(self.state('stamp-base').returncode, 0)
        self.assertEqual(self.state('stamp').returncode, 0)
        self.assertEqual(self.state('invalidate').returncode, 0)
        self.assertNotEqual(self.state('check').returncode, 0)
    def test_runner_refuses_unready_even_for_raw_launch_paths(self):
        runner = ROOT / 'scripts/darling-rootless.sh'
        env = dict(self.env, DARLING_HOST_UID=str(os.getuid()))
        result = run('bash', str(runner), 'shell', '/usr/bin/true', env=env)
        self.assertNotEqual(result.returncode, 0)
        self.assertIn('readiness', result.stderr)
    def test_run_and_installer_refuse_unready_before_configure_or_darling(self):
        for name in ['run.sh', 'installer.sh']:
            result = run('sh', str(self.repo / 'scripts' / name), env=self.env)
            self.assertNotEqual(result.returncode, 0)
            self.assertIn('readiness', result.stderr.lower())
            self.assertFalse((self.repo / 'build/runtime').exists())
 class SessionTests(unittest.TestCase):
    def test_workspace_lock_survives_namespace_closing_extra_fds(self):
        with tempfile.TemporaryDirectory(prefix='nix-lock-test-') as directory:
            root = Path(directory)
            share = root / 'share'
            (share / 'scripts').mkdir(parents=True)
            shutil.copy(ROOT / 'scripts/nix-copy.py', share / 'scripts/nix-copy.py')
            stub = root / 'namespace'
            stub.write_text('#!/bin/sh\nexec 9>&-\ntouch "$TEST_ENTERED"\nsleep 1\n')
            stub.chmod(0o755)
            launcher = root / 'launcher'
            launcher.write_text((ROOT / 'darling-lol-launcher.sh').read_text()
                .replace('@SHARE_DIR@', str(share)).replace('@UNSHARE_BIN@', str(stub)))
            entered = root / 'entered'
            env = dict(os.environ, HOME=str(root), XDG_DATA_HOME=str(root / 'data'), TEST_ENTERED=str(entered))
            first = subprocess.Popen(['bash', str(launcher), 'true'], env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
            try:
                import time
                for _ in range(100):
                    if entered.exists():
                        break
                    time.sleep(.01)
                self.assertTrue(entered.exists())
                second = run('bash', str(launcher), 'true', env=env)
                self.assertNotEqual(second.returncode, 0)
                self.assertIn('session is active', second.stderr)
            finally:
                first.communicate(timeout=10)
    def test_live_prefix_marker_refuses_before_refresh_or_namespace(self):
        with tempfile.TemporaryDirectory(prefix='nix-marker-test-') as directory:
            root = Path(directory)
            prefix = root / 'prefix'
            prefix.mkdir()
            # This fixture's own PID is harmless; the launcher must never signal it.
            (prefix / '.init.pid').write_text(str(os.getpid()))
            launcher = root / 'launcher'
            launcher.write_text((ROOT / 'darling-lol-launcher.sh').read_text()
                .replace('@SHARE_DIR@', str(root / 'missing-share'))
                .replace('@UNSHARE_BIN@', 'must-not-execute'))
            env = dict(os.environ, HOME=str(root), DPREFIX=str(prefix), XDG_DATA_HOME=str(root / 'data'))
            result = run('bash', str(launcher), env=env)
            self.assertNotEqual(result.returncode, 0)
            self.assertIn('reconnect is unsupported', result.stderr)
            self.assertFalse((root / 'data/darling-lol/scripts').exists())
    def test_ready_session_launches_without_rebuild_and_missing_stamp_refuses_eof(self):
        with tempfile.TemporaryDirectory(prefix='nix-dispatch-test-') as directory:
            root = Path(directory)
            (root / 'scripts').mkdir()
            for name in ['nix-state.py', 'nix-session.sh']:
                shutil.copy(ROOT / 'scripts' / name, root / 'scripts' / name)
            (root / 'usr-local/bin').mkdir(parents=True)
            (root / 'usr-local/bin/darling').write_text('never executed')
            (root / 'usr-local/bin/darlingserver').write_text('never executed')
            for name in ['darling', 'darlingserver']:
                (root / 'usr-local/bin' / name).chmod(0o755)
            (root / 'usr-local/libexec/darling/usr/lib').mkdir(parents=True, exist_ok=True)
            (root / 'usr-local/libexec/darling/usr/lib/libSystem.B.dylib').write_text('SDK fixture')
            (root / 'tools').mkdir()
            (root / 'usr-local/libexec/darling').mkdir(parents=True, exist_ok=True)
            shutil.copy(ROOT / 'tools/runtime_paths.py', root / 'tools/runtime_paths.py')
            (root / 'prefix/Applications/Riot Client.app').mkdir(parents=True)
            for name in ['run.sh', 'update.sh', 'install-runtime.sh', 'installer.sh']:
                path = root / 'scripts' / name
                path.write_text('#!/bin/sh\necho ' + name + ' >> "$TEST_LOG"\n')
                path.chmod(0o755)
            log = root / 'calls'
            env = dict(os.environ, HOME=str(root), DPREFIX=str(root / 'prefix'),
                       DARLING_WORKSPACE=str(root), DARLING_PACKAGE_ID='fixture', TEST_LOG=str(log),
                       PYTHONDONTWRITEBYTECODE='1')
            env.pop('RIOT_GUEST_HOME', None)
            populate_overlays(root / 'prefix', root / 'prefix/Users' / getpass.getuser(), root / 'tools')
            for action in ['stamp-base', 'stamp']:
                self.assertEqual(run(sys.executable, str(root / 'scripts/nix-state.py'), action, env=env).returncode, 0)
            for _ in range(2):
                result = run('bash', str(root / 'scripts/nix-session.sh'), env=env)
                self.assertEqual(result.returncode, 0, result.stderr)
            self.assertEqual(log.read_text().splitlines(), ['run.sh', 'run.sh'])
            run(sys.executable, str(root / 'scripts/nix-state.py'), 'invalidate', env=env)
            result = run('bash', str(root / 'scripts/nix-session.sh'), env=env)
            self.assertNotEqual(result.returncode, 0)
            self.assertIn('terminal', result.stderr)
            self.assertEqual(log.read_text().splitlines(), ['run.sh', 'run.sh'])
            env['DPREFIX'] = str(root / 'other-prefix')
            result = run('bash', str(root / 'scripts/nix-session.sh'), env=env)
            self.assertNotEqual(result.returncode, 0)
            self.assertFalse((root / 'other-prefix').exists())
    def test_first_run_eof_is_actionable_and_desktop_requests_terminal(self):
        with tempfile.TemporaryDirectory(prefix='nix-session-test-') as directory:
            root = Path(directory)
            (root / 'scripts').mkdir()
            for p in (ROOT / 'scripts').glob('*'):
                if p.is_file():
                    shutil.copy(p, root / 'scripts' / p.name)
            env = dict(os.environ, HOME=str(root), DPREFIX=str(root / 'prefix'),
                       DARLING_WORKSPACE=str(root), DARLING_PACKAGE_ID='fixture')
            result = run('bash', str(root / 'scripts/nix-session.sh'), env=env)
            self.assertNotEqual(result.returncode, 0)
            self.assertIn('terminal', result.stderr.lower())
            self.assertFalse((root / 'build').exists())
        self.assertIn('Terminal=true', (ROOT / 'flake.nix').read_text())
        self.assertIn('checks.${system}.packaging', (ROOT / 'flake.nix').read_text())
    def test_rootless_update_refuses_live_marker_without_build_or_stop(self):
        with tempfile.TemporaryDirectory(prefix='nix-update-idle-') as directory:
            root = Path(directory)
            (root / 'scripts').mkdir()
            for name in ['update.sh', 'nix-idle.py']:
                if (ROOT / 'scripts' / name).exists():
                    shutil.copy(ROOT / 'scripts' / name, root / 'scripts' / name)
            prefix = root / 'prefix'
            prefix.mkdir()
            (prefix / '.init.pid').write_text(str(os.getpid()))
            env = dict(os.environ, DARLING_WORKSPACE=str(root), DPREFIX=str(prefix),
                       DARLING_PACKAGE_ID='/nix/store/fixture-package/share/darling-lol')
            result = run('sh', str(root / 'scripts/update.sh'), env=env)
            self.assertNotEqual(result.returncode, 0)
            self.assertIn('live server', result.stderr.lower())
            self.assertFalse((root / 'build').exists())
    def test_rootless_update_executes_without_sudo_and_fails_closed(self):
        with tempfile.TemporaryDirectory(prefix='nix-update-test-') as directory:
            root = Path(directory)
            scripts, tools, bin_dir = root / 'scripts', root / 'build/runtime/tools', root / 'bin'
            scripts.mkdir()
            tools.mkdir(parents=True)
            bin_dir.mkdir()
            shutil.copy(ROOT / 'scripts/update.sh', scripts / 'update.sh')
            # Process discovery has its own read-only marker test; isolate this
            # installer-order fixture from unrelated host /proc permissions.
            (scripts / 'nix-idle.py').write_text('pass\n')
            log = root / 'calls'
            for name, body in [('build.sh', 'echo build >> "$TEST_LOG"'),
                               ('install-runtime.sh', 'echo overlays >> "$TEST_LOG"')]:
                path = scripts / name
                path.write_text('#!/bin/sh\n' + body + '\n')
                path.chmod(0o755)
            (scripts / 'nix-state.py').write_text('import os, sys\nwith open(os.environ["TEST_LOG"], "a") as f: f.write(sys.argv[1]+"\\n")\n')
            (tools / 'stop-darling-runtime.py').write_text('import os\nwith open(os.environ["TEST_LOG"], "a") as f: f.write("stop\\n")\n')
            for name in ['cmake', 'sudo', 'nix-store']:
                path = bin_dir / name
                path.write_text('#!/bin/sh\necho ' + name + ' >> "$TEST_LOG"\n' +
                                ('exit "${INSTALL_EXIT:-0}"\n' if name == 'cmake' else 'exit 0\n'))
                path.chmod(0o755)
            env = dict(os.environ, DARLING_WORKSPACE=str(root), HOME=str(root), DPREFIX=str(root / 'prefix'),
                       DARLING_PACKAGE_ID='/nix/store/fixture-package/share/darling-lol',
                       TEST_LOG=str(log), PATH=str(bin_dir) + ':' + os.environ['PATH'])
            result = run('sh', str(scripts / 'update.sh'), env=env)
            self.assertEqual(result.returncode, 0, result.stderr)
            self.assertEqual(log.read_text().splitlines(),
                             ['nix-store', 'invalidate-base', 'build', 'stop', 'cmake', 'stamp-base', 'overlays'])
            log.write_text('')
            env['INSTALL_EXIT'] = '23'
            self.assertEqual(run('sh', str(scripts / 'update.sh'), env=env).returncode, 23)
            self.assertNotIn('stamp-base', log.read_text())
            self.assertNotIn('overlays', log.read_text())
            self.assertNotIn('sudo', log.read_text())
    def test_rootless_update_never_uses_sudo_and_stamps_only_after_success(self):
        text = (ROOT / 'scripts/update.sh').read_text()
        self.assertIn('DARLING_WORKSPACE', text)
        self.assertIn('stamp-base', text)
        self.assertIn('invalidate-base', text)
        self.assertIn('nix-state.py', text)
 if __name__ == '__main__':
    unittest.main()
@@ -0,0 +1,111 @@
 """Readiness regression fixtures: inert runtime bytes, no Darling execution."""
 import importlib.util
 import json
 import os
 from pathlib import Path
 import shutil
 import subprocess
 import sys
 import tempfile
 import unittest
 ROOT = Path(__file__).resolve().parents[1]
 class RuntimeIdentityTests(unittest.TestCase):
    def setUp(self):
        self.temporary = tempfile.TemporaryDirectory(prefix='nix-identity-test-')
        self.addCleanup(self.temporary.cleanup)
        self.root = Path(self.temporary.name)
        for name in ('scripts', 'tools'):
            shutil.copytree(ROOT / name, self.root / name)
        self.prefix = self.root / 'prefix'
        self.guest = self.prefix / 'Users/tester'
        (self.guest / 'RuntimeLibraries').mkdir(parents=True)
        (self.guest / 'RuntimeFrameworks').mkdir()
        (self.guest / 'RuntimeLibraries/test.dylib').write_bytes(b'\xcf\xfa\xed\xfe' + b'fixture')
        (self.guest / 'libDarlingXShm.dylib').write_bytes(b'\xcf\xfa\xed\xfe' + b'fixture')
        audio = self.guest / 'Library/Audio/Plug-Ins/Components/DarlingRiotAudio.component/Contents/MacOS/CoreAudio'
        audio.parent.mkdir(parents=True)
        audio.write_bytes(b'\xcf\xfa\xed\xfe' + b'fixture')
        spec = importlib.util.spec_from_file_location('validation_fixture', self.root / 'tools/validate-riot-runtime.py')
        sys.path.insert(0, str(self.root / 'tools'))
        self.addCleanup(lambda: sys.path.remove(str(self.root / 'tools')))
        validation = importlib.util.module_from_spec(spec)
        spec.loader.exec_module(validation)
        guest_req = getattr(validation, 'GUEST_REQUIRED', getattr(validation, 'REQUIRED', ()))
        prefix_req = getattr(validation, 'PREFIX_REQUIRED', ())
        for relative in guest_req:
            path = self.guest / relative
            path.parent.mkdir(parents=True, exist_ok=True)
            path.write_bytes(b'\xcf\xfa\xed\xfe' + b'inert fixture')
        for relative in prefix_req:
            path = self.prefix / relative
            path.parent.mkdir(parents=True, exist_ok=True)
            path.write_bytes(b'\xcf\xfa\xed\xfe' + b'inert fixture')
        for name in ('usr-local/bin/darling', 'usr-local/bin/darlingserver',
                     'usr-local/libexec/darling/usr/lib/libSystem.B.dylib'):
            path = self.root / name
            path.parent.mkdir(parents=True, exist_ok=True)
            path.write_text('inert runtime fixture\n')
            path.chmod(0o755)
        (self.root / 'build').mkdir()
        self.config = self.root / 'build/config.json'
        self.config.write_text(json.dumps({'prefix': str(self.prefix), 'guest_user': 'tester',
                                          'guest_home': '/Users/tester'}))
        self.env = dict(os.environ, DPREFIX=str(self.prefix),
                        DARLING_PACKAGE_ID='/nix/store/fixture-package/share/darling-lol')
        self.env.pop('RIOT_GUEST_HOME', None)
        for action in ('stamp-base', 'stamp'):
            result = self.state(action)
            self.assertEqual(result.returncode, 0, result.stderr)
        self.assertEqual(self.state('check').returncode, 0)
    def state(self, action, env=None):
        return subprocess.run([sys.executable, '-B', 'scripts/nix-state.py', action],
                              cwd=self.root, env=env or self.env, text=True,
                              capture_output=True, timeout=20)
    def test_host_guest_home_override_invalidates_readiness(self):
        env = dict(self.env, RIOT_GUEST_HOME=str(self.prefix / 'Users/alternate'))
        self.assertNotEqual(self.state('check', env).returncode, 0)
    def test_configured_guest_home_change_invalidates_readiness(self):
        config = json.loads(self.config.read_text())
        config['guest_home'] = '/Users/alternate'
        self.config.write_text(json.dumps(config))
        self.assertNotEqual(self.state('check').returncode, 0)
    def test_required_xshm_loss_invalidates_readiness(self):
        (self.guest / 'libDarlingXShm.dylib').unlink()
        self.assertNotEqual(self.state('check').returncode, 0)
    def test_audio_component_loss_invalidates_readiness(self):
        shutil.rmtree(self.guest / 'Library')
        self.assertNotEqual(self.state('check').returncode, 0)
    def test_launcher_execute_permission_loss_invalidates_readiness(self):
        (self.root / 'usr-local/bin/darling').chmod(0o644)
        self.assertNotEqual(self.state('check').returncode, 0)
    def test_base_runtime_tree_loss_invalidates_readiness(self):
        shutil.rmtree(self.root / 'usr-local/libexec')
        self.assertNotEqual(self.state('check').returncode, 0)
    def test_missing_base_server_cannot_be_restamped(self):
        (self.root / 'usr-local/bin/darlingserver').unlink()
        self.assertNotEqual(self.state('stamp-base').returncode, 0)
    def test_empty_prefix_cannot_be_stamped(self):
        shutil.rmtree(self.prefix)
        self.prefix.mkdir()
        self.assertNotEqual(self.state('stamp').returncode, 0)
    def test_configured_prefix_used_without_environment_override(self):
        env = dict(self.env)
        env.pop('DPREFIX')
        self.assertEqual(self.state('check', env).returncode, 0)
 if __name__ == '__main__':
    unittest.main()
@@ -246,7 +246,6 @@
        "private-include/Metal/MTLArgumentInternal.h",
        "private-include/Metal/MTLBlitCommandEncoderInternal.h",
        "private-include/Metal/MTLDepthStencilInternal.h",
        "private-include/Metal/MTLDeviceInfo.h",
        "private-include/Metal/MTLSamplerStateInternal.h",
        "private-include/Metal/MTLVertexDescriptorInternal.h",
        "src/Metal/MTLArgument.mm",
@@ -317,6 +316,11 @@
      "patch": "patches/cfnetwork.patch",
      "modified_files": 1,
      "new_files": []
    },
    {
      "path": "src/external/cctools-port",
      "revision": "d9456c221e1f462e17c0b3297748bc089d5a861e",
      "patch": "patches/cctools-port.patch"
    }
  ],
  "omitted": [