llvm-tools: build host llvm-objcopy/strip/profdata under ZigToolchain

Add an `llvm-tools` target artifact that downloads llvm-project source
matching the version of clang shipped by the active zig install,
builds llvm-objcopy, llvm-strip and llvm-profdata into
PKG_ROOT_PATH/llvm-tools/bin, and exposes them through the same
path/binary/isInstalled static surface as the other artifacts.

A new LlvmToolsCheck doctor item runs when the active toolchain is
ZigToolchain and reports whether the three tools are built, with a
fix that installs the package and runs the build.

PackageBuilder now picks the right tool when the active toolchain is
ZigToolchain:
- extractDebugInfo() honours OBJCOPY from the environment, then falls
  back to llvm-tools' llvm-objcopy under Zig and plain objcopy
  otherwise.
- stripBinary() uses llvm-strip under Zig and plain strip otherwise.

System strip/objcopy refuse zig-produced archives and bitcode
sections, so without this the strip stage breaks LTO builds. Other
toolchains keep using the system binaries.

ApplicationContext::tryGet() wraps the container's get() in a
try/catch and returns null on failure, so PackageBuilder can ask
"which toolchain is active right now" without PHP-DI throwing on
autowirable-but-unconstructable classes.

Depends on v3c/artifact-static-helpers (uses zig::isInstalled()
and zig::binary()).

README-zh.md

@@ -5,7 +5,7 @@
 [![Releases](https://img.shields.io/packagist/v/crazywhalecc/static-php-cli?include_prereleases&label=Release&style=flat-square)](https://github.com/crazywhalecc/static-php-cli/releases)
 [![CI](https://img.shields.io/github/actions/workflow/status/crazywhalecc/static-php-cli/tests.yml?branch=main&label=Build%20Test&style=flat-square)](https://github.com/crazywhalecc/static-php-cli/actions/workflows/tests.yml)
 [![License](https://img.shields.io/badge/License-MIT-blue.svg?style=flat-square)](https://github.com/crazywhalecc/static-php-cli/blob/main/LICENSE)
-[![Discord](https://img.shields.io/discord/nrSRbpMJ?label=Discord&logo=discord&style=flat-square)](https://discord.gg/nrSRbpMJ)
+[![Discord](https://img.shields.io/discord/nrSRbpMJ?label=Discord&logo=discord&style=flat-square)](https://discord.gg/xf6Rd4pEAk)
 
 **StaticPHP** 是一个强大的工具，用于构建可移植的可执行文件，包括 PHP、扩展等。
 

README.md

@@ -5,7 +5,7 @@
 [![Releases](https://img.shields.io/packagist/v/crazywhalecc/static-php-cli?include_prereleases&label=Release&style=flat-square)](https://github.com/crazywhalecc/static-php-cli/releases)
 [![CI](https://img.shields.io/github/actions/workflow/status/crazywhalecc/static-php-cli/tests.yml?branch=main&label=Build%20Test&style=flat-square)](https://github.com/crazywhalecc/static-php-cli/actions/workflows/tests.yml)
 [![License](https://img.shields.io/badge/License-MIT-blue.svg?style=flat-square)](https://github.com/crazywhalecc/static-php-cli/blob/main/LICENSE)
-[![Discord](https://img.shields.io/discord/nrSRbpMJ?label=Discord&logo=discord&style=flat-square)](https://discord.gg/nrSRbpMJ)
+[![Discord](https://img.shields.io/discord/nrSRbpMJ?label=Discord&logo=discord&style=flat-square)](https://discord.gg/xf6Rd4pEAk)
 
 **StaticPHP** is a powerful tool designed for building portable executables including PHP, extensions, and more.
 

config/artifact/ncurses.yml

@@ -4,5 +4,5 @@ ncurses:
       - COPYING
   source:
     type: filelist
-    url: 'https://ftp.gnu.org/pub/gnu/ncurses/'
+    url: 'https://ftpmirror.gnu.org/gnu/ncurses/'
     regex: '/href="(?<file>ncurses-(?<version>[^"]+)\.tar\.gz)"/'

config/env.ini

@@ -142,7 +142,7 @@ CXX=${SPC_DEFAULT_CXX}
 AR=${SPC_DEFAULT_AR}
 LD=${SPC_DEFAULT_LD}
 ; default compiler flags, used in CMake toolchain file, openssl and pkg-config build
-SPC_DEFAULT_CFLAGS="--target=${MAC_ARCH}-apple-darwin -O3 -fno-plt -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -ffunction-sections -fdata-sections"
+SPC_DEFAULT_CFLAGS="--target=${MAC_ARCH}-apple-darwin -O3 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -ffunction-sections -fdata-sections"
 SPC_DEFAULT_CXXFLAGS="${SPC_DEFAULT_CFLAGS}"
 SPC_DEFAULT_LDFLAGS="-Wl,-dead_strip"
 ; phpmicro patches, for more info, see: https://github.com/easysoft/phpmicro/tree/master/patches

config/pkg/ext/builtin-extensions.yml

@@ -186,6 +186,7 @@ ext-password-argon2:
   type: php-extension
   depends:
     - libargon2
+  suggests:
     - ext-openssl
   php-extension:
     os:

config/pkg/lib/gettext-win.yml

@@ -4,6 +4,6 @@ gettext-win:
     source:
       type: git
       url: 'https://github.com/winlibs/gettext.git'
-      rev: master
+      rev: '0.18'
   static-libs@windows:
     - libintl_a.lib

config/pkg/lib/gettext.yml

@@ -3,7 +3,7 @@ gettext:
   artifact:
     source:
       type: filelist
-      url: 'https://ftp.gnu.org/pub/gnu/gettext/'
+      url: 'https://ftpmirror.gnu.org/gnu/gettext/'
       regex: '/href="(?<file>gettext-(?<version>[^"]+)\.tar\.xz)"/'
     metadata:
       license-files: [gettext-runtime/intl/COPYING.LIB]

config/pkg/lib/gmp.yml

@@ -3,7 +3,7 @@ gmp:
   artifact:
     source:
       type: filelist
-      url: 'https://ftp.gnu.org/gnu/gmp/'
+      url: 'https://ftpmirror.gnu.org/gnu/gmp/'
       regex: '/href="(?<file>gmp-(?<version>[^"]+)\.tar\.xz)"/'
     source-mirror:
       type: url

config/pkg/lib/idn2.yml

@@ -3,7 +3,7 @@ idn2:
   artifact:
     source:
       type: filelist
-      url: 'https://ftp.gnu.org/gnu/libidn/'
+      url: 'https://ftpmirror.gnu.org/gnu/libidn/'
       regex: '/href="(?<file>libidn2-(?<version>[^"]+)\.tar\.gz)"/'
     metadata:
       license-files: [COPYING.LESSERv3]

config/pkg/lib/libiconv.yml

@@ -3,7 +3,7 @@ libiconv:
   artifact:
     source:
       type: filelist
-      url: 'https://ftp.gnu.org/gnu/libiconv/'
+      url: 'https://ftpmirror.gnu.org/gnu/libiconv/'
       regex: '/href="(?<file>libiconv-(?<version>[^"]+)\.tar\.gz)"/'
     metadata:
       license-files: [COPYING.LIB]

config/pkg/lib/libunistring.yml

@@ -3,7 +3,7 @@ libunistring:
   artifact:
     source:
       type: filelist
-      url: 'https://ftp.gnu.org/gnu/libunistring/'
+      url: 'https://ftpmirror.gnu.org/gnu/libunistring/'
       regex: '/href="(?<file>libunistring-(?<version>[^"]+)\.tar\.gz)"/'
     metadata:
       license-files: [COPYING.LIB]

config/pkg/lib/readline.yml

@@ -3,7 +3,7 @@ readline:
   artifact:
     source:
       type: filelist
-      url: 'https://ftp.gnu.org/pub/gnu/readline/'
+      url: 'https://ftpmirror.gnu.org/gnu/readline/'
       regex: '/href="(?<file>readline-(?<version>[^"]+)\.tar\.gz)"/'
     metadata:
       license-files: [COPYING]

config/pkg/target/llvm-tools.yml

@@ -0,0 +1,6 @@
+llvm-tools:
+  type: target
+  artifact:
+    binary: custom
+  depends:
+    - zig

docs/en/guide/index.md

@@ -47,7 +47,7 @@ Build your CLI with [symfony/console](https://symfony.com/doc/current/components
 
 ## Community
 
-Join our [Discord server](https://discord.gg/nrSRbpMJ) to ask questions, share your builds, and connect with other StaticPHP users.
+Join our [Discord server](https://discord.gg/xf6Rd4pEAk) to ask questions, share your builds, and connect with other StaticPHP users.
 
 ## Next steps
 

docs/zh/guide/index.md

@@ -55,7 +55,7 @@ StaticPHP 支持将 FrankenPHP 连同所需扩展一起静态编译，
 
 ## 社区
 
-加入我们的 [Discord 服务器](https://discord.gg/nrSRbpMJ)，提问、分享构建成果，与其他 StaticPHP 用户交流。
+加入我们的 [Discord 服务器](https://discord.gg/xf6Rd4pEAk)，提问、分享构建成果，与其他 StaticPHP 用户交流。
 
 ## 接下来
 

src/Package/Artifact/go_win.php

@@ -20,8 +20,6 @@ class go_win
     ])]
     public function downBinary(ArtifactDownloader $downloader): DownloadResult
     {
-        $pkgroot = PKG_ROOT_PATH;
-
         // get version
         [$version] = explode("\n", default_shell()->executeCurl('https://go.dev/VERSION?m=text', retries: $downloader->getRetry()) ?: '');
         if ($version === '') {
@@ -52,7 +50,7 @@ class go_win
             throw new DownloaderException("Hash mismatch for downloaded go-win binary. Expected {$hash}, got {$file_hash}");
         }
 
-        return DownloadResult::archive(basename($path), ['url' => $url, 'version' => $version], extract: "{$pkgroot}/go-win", verified: true, version: $version);
+        return DownloadResult::archive(basename($path), ['url' => $url, 'version' => $version], extract: '{pkg_root_path}/go-win', verified: true, version: $version);
     }
 
     #[CustomBinaryCheckUpdate('go-win', ['windows-x86_64'])]

src/Package/Artifact/llvm_tools.php

@@ -0,0 +1,162 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Package\Artifact;
+
+use StaticPHP\Artifact\ArtifactDownloader;
+use StaticPHP\Artifact\Downloader\DownloadResult;
+use StaticPHP\Artifact\Downloader\Type\CheckUpdateResult;
+use StaticPHP\Artifact\Downloader\Type\GitHubTokenSetupTrait;
+use StaticPHP\Attribute\Artifact\AfterBinaryExtract;
+use StaticPHP\Attribute\Artifact\CustomBinary;
+use StaticPHP\Attribute\Artifact\CustomBinaryCheckUpdate;
+use StaticPHP\DI\ApplicationContext;
+use StaticPHP\Exception\BuildFailureException;
+use StaticPHP\Exception\DownloaderException;
+use StaticPHP\Package\PackageBuilder;
+
+class llvm_tools
+{
+    use GitHubTokenSetupTrait;
+
+    public const array TOOLS = ['llvm-objcopy', 'llvm-strip', 'llvm-profdata'];
+
+    /** Install prefix for the locally-built llvm-tools. */
+    public static function path(): string
+    {
+        return PKG_ROOT_PATH . '/llvm-tools';
+    }
+
+    /** Path to a binary under llvm-tools/bin (llvm-objcopy, llvm-strip, llvm-profdata, …). */
+    public static function binary(string $name = 'llvm-strip'): string
+    {
+        return self::path() . '/bin/' . $name;
+    }
+
+    /** True when every required TOOLS binary is present and executable. */
+    public static function isInstalled(): bool
+    {
+        foreach (self::TOOLS as $t) {
+            $p = self::binary($t);
+            if (!is_file($p) || !is_executable($p)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    #[CustomBinary('llvm-tools', [
+        'linux-x86_64',
+        'linux-aarch64',
+        'macos-x86_64',
+        'macos-aarch64',
+    ])]
+    public function downBinary(ArtifactDownloader $downloader): DownloadResult
+    {
+        $llvmVersion = $this->detectLlvmVersion()
+            ?? throw new DownloaderException('Could not detect a clang version on host; install zig or clang first');
+        $tarball = "llvm-project-{$llvmVersion}.src.tar.xz";
+        $url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-{$llvmVersion}/{$tarball}";
+        $tarballPath = DOWNLOAD_PATH . '/' . $tarball;
+        default_shell()->executeCurlDownload($url, $tarballPath, headers: $this->getGitHubTokenHeaders(), retries: $downloader->getRetry());
+        return DownloadResult::archive($tarball, ['url' => $url, 'version' => $llvmVersion], extract: '{source_path}/llvm-tools', verified: false, version: $llvmVersion);
+    }
+
+    #[CustomBinaryCheckUpdate('llvm-tools', [
+        'linux-x86_64',
+        'linux-aarch64',
+        'macos-x86_64',
+        'macos-aarch64',
+    ])]
+    public function checkUpdateBinary(?string $old_version, ArtifactDownloader $downloader): CheckUpdateResult
+    {
+        $llvmVersion = $this->detectLlvmVersion()
+            ?? throw new DownloaderException('Could not detect a clang version on host; install zig or clang first');
+        return new CheckUpdateResult(
+            old: $old_version,
+            new: $llvmVersion,
+            needUpdate: $old_version === null || $llvmVersion !== $old_version,
+        );
+    }
+
+    #[AfterBinaryExtract('llvm-tools', [
+        'linux-x86_64',
+        'linux-aarch64',
+        'macos-x86_64',
+        'macos-aarch64',
+    ])]
+    public function postExtract(string $target_path): void
+    {
+        $this->buildForHost($target_path);
+    }
+
+    public function buildForHost(?string $sourceRoot = null): void
+    {
+        $sourceRoot ??= SOURCE_PATH . '/llvm-tools';
+        if (self::isInstalled()) {
+            return;
+        }
+        $llvmDir = "{$sourceRoot}/llvm";
+        if (!is_dir($llvmDir)) {
+            throw new BuildFailureException("llvm-tools: missing source at {$llvmDir} (extraction layout changed?)");
+        }
+        $buildDir = "{$sourceRoot}/build";
+        $installDir = self::path();
+        $binDir = self::path() . '/bin';
+        f_mkdir($buildDir, recursive: true);
+        f_mkdir($binDir, recursive: true);
+
+        $cmakeArgs = implode(' ', array_map('escapeshellarg', [
+            '-S', $llvmDir,
+            '-B', $buildDir,
+            '-DCMAKE_BUILD_TYPE=Release',
+            '-DLLVM_ENABLE_PROJECTS=',
+            '-DLLVM_TARGETS_TO_BUILD=',
+            '-DLLVM_INCLUDE_BENCHMARKS=OFF',
+            '-DLLVM_INCLUDE_TESTS=OFF',
+            '-DLLVM_INCLUDE_EXAMPLES=OFF',
+            '-DLLVM_INCLUDE_DOCS=OFF',
+            '-DLLVM_ENABLE_ZLIB=OFF',
+            '-DLLVM_ENABLE_ZSTD=OFF',
+            '-DLLVM_ENABLE_LIBXML2=OFF',
+            '-DLLVM_ENABLE_TERMINFO=OFF',
+            '-DLLVM_ENABLE_LIBEDIT=OFF',
+            '-DLLVM_ENABLE_LIBPFM=OFF',
+            '-DLLVM_BUILD_LLVM_DYLIB=OFF',
+            '-DLLVM_LINK_LLVM_DYLIB=OFF',
+            '-DBUILD_SHARED_LIBS=OFF',
+            '-DCMAKE_C_COMPILER=' . zig::binary('zig-cc'),
+            '-DCMAKE_CXX_COMPILER=' . zig::binary('zig-c++'),
+            '-DCMAKE_INSTALL_PREFIX=' . $installDir,
+        ]));
+        $jobs = ApplicationContext::get(PackageBuilder::class)->concurrency;
+        $targetArgs = implode(' ', array_map(fn ($t) => '--target ' . escapeshellarg($t), self::TOOLS));
+
+        shell()
+            ->setEnv(['SPC_TARGET' => GNU_ARCH . '-linux-musl'])
+            ->exec('cmake ' . $cmakeArgs)
+            ->exec('cmake --build ' . escapeshellarg($buildDir) . ' ' . $targetArgs . " -j {$jobs}");
+
+        foreach (self::TOOLS as $t) {
+            $built = "{$buildDir}/bin/{$t}";
+            if (!is_file($built)) {
+                throw new BuildFailureException("llvm-tools: missing build output {$built}");
+            }
+            copy($built, self::binary($t));
+            chmod(self::binary($t), 0755);
+        }
+    }
+
+    private function detectLlvmVersion(): ?string
+    {
+        if (!zig::isInstalled()) {
+            return null;
+        }
+        [$rc, $out] = shell()->execWithResult(escapeshellarg(zig::binary()) . ' cc --version', false);
+        if ($rc !== 0) {
+            return null;
+        }
+        return preg_match('/clang version (\d+\.\d+\.\d+)/', implode("\n", $out), $m) ? $m[1] : null;
+    }
+}

src/Package/Artifact/rust.php

@@ -46,7 +46,7 @@ class rust
         $download_url = "https://static.rust-lang.org/dist/rust-{$latest_version}-{$arch}-unknown-linux-{$distro}.tar.xz";
         $path = DOWNLOAD_PATH . DIRECTORY_SEPARATOR . basename($download_url);
         default_shell()->executeCurlDownload($download_url, $path, retries: $downloader->getRetry());
-        return DownloadResult::archive(basename($path), ['url' => $download_url, 'version' => $latest_version], extract: PKG_ROOT_PATH . '/rust-install', verified: false, version: $latest_version);
+        return DownloadResult::archive(basename($path), ['url' => $download_url, 'version' => $latest_version], extract: '{pkg_root_path}/rust-install', verified: false, version: $latest_version);
     }
 
     #[CustomBinaryCheckUpdate('rust', [

src/Package/Artifact/zig.php

@@ -15,6 +15,23 @@ use StaticPHP\Runtime\SystemTarget;
 
 class zig
 {
+    /** Directory zig extracts into. */
+    public static function path(): string
+    {
+        return PKG_ROOT_PATH . '/zig';
+    }
+
+    /** Path to a binary inside the zig install dir (zig, zig-cc, zig-c++, zig-ar, …). */
+    public static function binary(string $name = 'zig'): string
+    {
+        return self::path() . '/' . $name;
+    }
+
+    public static function isInstalled(): bool
+    {
+        return is_file(self::binary());
+    }
+
     #[CustomBinary('zig', [
         'linux-x86_64',
         'linux-aarch64',

src/Package/Extension/clickhouse.php

@@ -4,29 +4,14 @@ declare(strict_types=1);
 
 namespace Package\Extension;
 
-use Package\Target\php;
-use StaticPHP\Attribute\Package\BeforeStage;
 use StaticPHP\Attribute\Package\CustomPhpConfigureArg;
 use StaticPHP\Attribute\Package\Extension;
-use StaticPHP\Attribute\PatchDescription;
 use StaticPHP\Package\PackageInstaller;
 use StaticPHP\Package\PhpExtensionPackage;
-use StaticPHP\Util\FileSystem;
 
 #[Extension('clickhouse')]
 class clickhouse extends PhpExtensionPackage
 {
-    #[BeforeStage('php', [php::class, 'buildconfForUnix'], 'ext-clickhouse')]
-    #[PatchDescription('Replace THIS_DIR=`dirname $0` with PHP_EXT_SRCDIR() in config.m4 so include paths resolve to the ext source dir during PHP main configure (dirname $0 returns "." when run from php-src root).')]
-    public function patchBeforeBuildconfUnix(): void
-    {
-        FileSystem::replaceFileRegex(
-            "{$this->getSourceDir()}/config.m4",
-            '/^(\s*)THIS_DIR=.*/m',
-            '$1THIS_DIR=PHP_EXT_SRCDIR()',
-        );
-    }
-
     #[CustomPhpConfigureArg('Darwin')]
     #[CustomPhpConfigureArg('Linux')]
     public function getUnixConfigureArg(bool $shared, PackageInstaller $installer): string

src/Package/Extension/mongodb.php

@@ -16,6 +16,14 @@ use StaticPHP\Util\FileSystem;
 #[Extension('mongodb')]
 class mongodb extends PhpExtensionPackage
 {
+    #[BeforeStage('php', [php::class, 'configureForUnix'], 'ext-mongodb')]
+    #[PatchDescription('Export PHP_VERSION_ID so mongo-php-driver >= 2.3.3 skips its php-config lookup (in-tree builds have no php-config).')]
+    public function exportPhpVersionIdForUnix(): void
+    {
+        $id = php::getPHPVersionID();
+        f_putenv("PHP_VERSION_ID={$id}");
+    }
+
     #[BeforeStage('php', [php::class, 'buildconfForWindows'], 'ext-mongodb')]
     #[PatchDescription('Add /utf-8 flag to CFLAGS_MONGODB for Windows build to fix compilation error on non-English Windows.')]
     public function patchBeforeBuild(): void

src/Package/Extension/opcache.php

@@ -72,6 +72,10 @@ class opcache extends PhpExtensionPackage
         ) {
             $opcache_jit = ' --disable-opcache-jit';
         }
-        return '--enable-opcache' . ($shared ? '=shared' : '') . $opcache_jit;
+        // PHP 8.5+ has opcache built-in
+        if ($phpVersionID < 80500) {
+            return '--enable-opcache' . ($shared ? '=shared' : '') . $opcache_jit;
+        }
+        return trim($opcache_jit);
     }
 }

src/Package/Extension/password_argon2.php

@@ -27,7 +27,7 @@ class password_argon2 extends PhpExtensionPackage
     #[CustomPhpConfigureArg('Darwin')]
     public function getConfigureArg(PackageInstaller $installer, PackageBuilder $builder): string
     {
-        if ($installer->getLibraryPackage('openssl') !== null) {
+        if ($installer->getPhpExtensionPackage('openssl')?->isBuildStatic()) {
             if (php::getPHPVersionID() >= 80500 || (php::getPHPVersionID() >= 80400 && !$builder->getOption('enable-zts'))) {
                 return '--without-password-argon2'; // use --with-openssl-argon2 in openssl extension instead
             }

src/Package/Extension/pgsql.php

@@ -20,7 +20,7 @@ class pgsql extends PhpExtensionPackage
     public function getUnixConfigureArg(bool $shared, PackageBuilder $builder, PackageInstaller $installer): string
     {
         if (php::getPHPVersionID() >= 80400) {
-            $libfiles = new SPCConfigUtil(['libs_only_deps' => true, 'absolute_libs' => true])->getPackageDepsConfig('postgresql', array_keys($installer->getResolvedPackages()), $builder->getOption('with-suggests'))['libs'];
+            $libfiles = new SPCConfigUtil(['libs_only_deps' => true, 'absolute_libs' => true])->getPackageDepsConfig('postgresql', array_keys($installer->getResolvedPackages()))['libs'];
             $libfiles = str_replace("{$builder->getLibDir()}/lib", '-l', $libfiles);
             $libfiles = str_replace('.a', '', $libfiles);
             return '--with-pgsql' . ($shared ? '=shared' : '') .

src/Package/Extension/spx.php

@@ -6,14 +6,27 @@ namespace Package\Extension;
 
 use Package\Target\php;
 use StaticPHP\Attribute\Package\BeforeStage;
+use StaticPHP\Attribute\Package\CustomPhpConfigureArg;
 use StaticPHP\Attribute\Package\Extension;
 use StaticPHP\Attribute\PatchDescription;
+use StaticPHP\Package\PackageInstaller;
 use StaticPHP\Package\PhpExtensionPackage;
 use StaticPHP\Util\FileSystem;
 
 #[Extension('spx')]
 class spx extends PhpExtensionPackage
 {
+    #[CustomPhpConfigureArg('Linux')]
+    #[CustomPhpConfigureArg('Darwin')]
+    public function getUnixConfigureArg(bool $shared, PackageInstaller $installer): string
+    {
+        $arg = '--enable-SPX' . ($shared ? '=shared' : '');
+        if ($installer->getLibraryPackage('zlib') !== null) {
+            $arg .= ' --with-zlib-dir=' . BUILD_ROOT_PATH;
+        }
+        return $arg;
+    }
+
     #[BeforeStage('php', [php::class, 'buildconfForUnix'], 'ext-spx')]
     #[PatchDescription('Fix spx extension compile error when building as static')]
     public function patchBeforeBuildconf(): bool

src/Package/Extension/xlswriter.php

@@ -11,7 +11,6 @@ use StaticPHP\Attribute\Package\Extension;
 use StaticPHP\Attribute\PatchDescription;
 use StaticPHP\Package\PackageInstaller;
 use StaticPHP\Package\PhpExtensionPackage;
-use StaticPHP\Util\GlobalEnvManager;
 use StaticPHP\Util\SourcePatcher;
 
 #[Extension('xlswriter')]
@@ -21,20 +20,14 @@ class xlswriter extends PhpExtensionPackage
     #[CustomPhpConfigureArg('Linux')]
     public function getUnixConfigureArg(bool $shared, PackageInstaller $installer): string
     {
-        $arg = '--with-xlswriter --enable-reader';
+        $shared = $shared ? '=shared' : '';
+        $arg = "--with-xlswriter{$shared} --enable-reader";
         if ($installer->getLibraryPackage('openssl')) {
             $arg .= ' --with-openssl=' . $installer->getLibraryPackage('openssl')->getBuildRootPath();
         }
         return $arg;
     }
 
-    #[BeforeStage('php', [php::class, 'makeForUnix'], 'ext-xlswriter')]
-    #[PatchDescription('Fix Unix build: add -std=gnu17 to CFLAGS to fix build errors on older GCC versions')]
-    public function patchBeforeUnixMake(): void
-    {
-        GlobalEnvManager::putenv('SPC_CMD_VAR_PHP_MAKE_EXTRA_CFLAGS=' . getenv('SPC_CMD_VAR_PHP_MAKE_EXTRA_CFLAGS') . ' -std=gnu17');
-    }
-
     #[BeforeStage('php', [php::class, 'makeForWindows'], 'ext-xlswriter')]
     #[PatchDescription('Fix Windows build: apply win32 patch and add UTF-8 BOM to theme.c')]
     public function patchBeforeMakeForWindows(): void
@@ -47,11 +40,4 @@ class xlswriter extends PhpExtensionPackage
             file_put_contents($this->getSourceDir() . '/library/libxlsxwriter/src/theme.c', $bom . $content);
         }
     }
-
-    public function getSharedExtensionEnv(): array
-    {
-        $parent = parent::getSharedExtensionEnv();
-        $parent['CFLAGS'] .= ' -std=gnu17';
-        return $parent;
-    }
 }

src/Package/Library/imagemagick.php

@@ -42,6 +42,9 @@ class imagemagick
             ->addConfigureArgs(
                 '--disable-openmp',
                 '--without-x',
+                // implicit --with-gcc-arch
+                // bleeds host cpu features into built binaries
+                '--without-gcc-arch',
             );
 
         // special: linux-static target needs `-static`

src/Package/Library/watcher.php

@@ -20,9 +20,8 @@ class watcher extends LibraryPackage
         if (stripos($cflags, '-fpic') === false) {
             $cflags .= ' -fPIC';
         }
-        $ldflags = $this->getLibExtraLdFlags() ? ' ' . $this->getLibExtraLdFlags() : '';
         shell()->cd("{$this->getSourceDir()}/watcher-c")
-            ->exec(getenv('CXX') . " -c -o libwatcher-c.o ./src/watcher-c.cpp -I ./include -I ../include -std=c++17 -Wall -Wextra {$cflags}{$ldflags}")
+            ->exec(getenv('CXX') . " -c -o libwatcher-c.o ./src/watcher-c.cpp -I ./include -I ../include -std=c++17 -Wall -Wextra {$cflags}")
             ->exec(getenv('AR') . ' rcs libwatcher-c.a libwatcher-c.o');
 
         copy("{$this->getSourceDir()}/watcher-c/libwatcher-c.a", "{$this->getLibDir()}/libwatcher-c.a");

src/Package/Target/curl.php

@@ -39,7 +39,7 @@ class curl
             ->optionalPackage('zstd', ...cmake_boolean_args('CURL_ZSTD'))
             ->optionalPackage('brotli', ...cmake_boolean_args('CURL_BROTLI'))
             ->addConfigureArgs(
-                '-DBUILD_CURL_EXE=OFF',
+                '-DBUILD_CURL_EXE=ON',
                 '-DZSTD_LIBRARY=zstd_static.lib',
                 '-DBUILD_TESTING=OFF',
                 '-DBUILD_EXAMPLES=OFF',
@@ -81,6 +81,7 @@ class curl
             ->addConfigureArgs(
                 '-DBUILD_CURL_EXE=ON',
                 '-DBUILD_LIBCURL_DOCS=OFF',
+                '-DOPENSSL_ROOT_DIR=' . BUILD_ROOT_PATH,
             )
             ->build();
 
@@ -92,6 +93,9 @@ class curl
         if (str_contains(FileSystem::readFile($pc_path), '-lgssapi_krb5')) {
             FileSystem::replaceFileRegex($pc_path, '/-lcom_err$/m', '-lcom_err -lkrb5support');
         }
+        // FindThreads can put '-lpthread' into INTERFACE_LINK_LIBRARIES; curl's pc generator
+        // prepends '-l' to each entry, producing '-l-lpthread'. Strip the extra '-l'.
+        FileSystem::replaceFileRegex($pc_path, '/-l(-l\S+)/', '$1');
         shell()->cd("{$lib->getLibDir()}/cmake/CURL/")
             ->exec("sed -ie 's|\"/lib/libcurl.a\"|\"{$lib->getLibDir()}/libcurl.a\"|g' CURLTargets-release.cmake");
 

src/StaticPHP/Artifact/Artifact.php

@@ -327,7 +327,7 @@ class Artifact
     public function getSourceRoot(): string
     {
         if (isset($this->config['metadata']['source-root'])) {
-            return $this->getSourceDir() . '/' . ltrim($this->config['metadata']['source-root'], '/');
+            return FileSystem::convertPath($this->getSourceDir() . '/' . ltrim($this->config['metadata']['source-root'], '/'));
         }
         return $this->getSourceDir();
     }

src/StaticPHP/Artifact/ArtifactCache.php

@@ -223,8 +223,8 @@ class ArtifactCache
     public function getCacheFullPath(array $cache_info): string
     {
         return match ($cache_info['cache_type']) {
-            'archive', 'file' => DOWNLOAD_PATH . '/' . $cache_info['filename'],
-            'git' => DOWNLOAD_PATH . '/' . $cache_info['dirname'],
+            'archive', 'file' => FileSystem::convertPath(DOWNLOAD_PATH . '/' . $cache_info['filename']),
+            'git' => FileSystem::convertPath(DOWNLOAD_PATH . '/' . $cache_info['dirname']),
             'local' => $cache_info['dirname'], // local dirname is absolute path
             default => throw new SPCInternalException("Unknown cache type: {$cache_info['cache_type']}"),
         };

src/StaticPHP/Artifact/Downloader/Type/GitHubTokenSetupTrait.php

@@ -16,8 +16,9 @@ trait GitHubTokenSetupTrait
         // GITHUB_TOKEN support
         if (($token = getenv('GITHUB_TOKEN')) !== false && ($user = getenv('GITHUB_USER')) !== false) {
             logger()->debug("Using 'GITHUB_TOKEN' with user {$user} for authentication");
-            spc_add_log_filter([$user, $token]);
-            return ['Authorization: Basic ' . base64_encode("{$user}:{$token}")];
+            $encoded = base64_encode("{$user}:{$token}");
+            spc_add_log_filter([$user, $token, $encoded]);
+            return ["Authorization: Basic {$encoded}"];
         }
         if (($token = getenv('GITHUB_TOKEN')) !== false) {
             logger()->debug("Using 'GITHUB_TOKEN' for authentication");

src/StaticPHP/DI/ApplicationContext.php

@@ -98,6 +98,25 @@ class ApplicationContext
         return self::getContainer()->has($id);
     }
 
+    /**
+     * Resolve $id, returning null if it can't be constructed.
+     * PHP-DI's has() returns true for any autowirable class even when get()
+     * would throw on missing scalar args — for "is this resolvable right now"
+     * semantics use this.
+     *
+     * @template T
+     * @param  class-string<T> $id
+     * @return null|T
+     */
+    public static function tryGet(string $id): mixed
+    {
+        try {
+            return self::getContainer()->get($id);
+        } catch (\Throwable) {
+            return null;
+        }
+    }
+
     /**
      * Set a service in the container.
      * Use sparingly - prefer configuration-based definitions.

src/StaticPHP/Doctor/Item/LlvmToolsCheck.php

@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace StaticPHP\Doctor\Item;
+
+use Package\Artifact\llvm_tools;
+use StaticPHP\Attribute\Doctor\CheckItem;
+use StaticPHP\Attribute\Doctor\FixItem;
+use StaticPHP\Attribute\Doctor\OptionalCheck;
+use StaticPHP\DI\ApplicationContext;
+use StaticPHP\Doctor\CheckResult;
+use StaticPHP\Package\PackageInstaller;
+use StaticPHP\Toolchain\Interface\ToolchainInterface;
+use StaticPHP\Toolchain\ZigToolchain;
+
+#[OptionalCheck([self::class, 'optionalCheck'])]
+class LlvmToolsCheck
+{
+    public static function optionalCheck(): bool
+    {
+        return ApplicationContext::get(ToolchainInterface::class) instanceof ZigToolchain;
+    }
+
+    /** @noinspection PhpUnused */
+    #[CheckItem('if llvm-tools (objcopy/strip/profdata) are built', level: 798)]
+    public function checkLlvmTools(): CheckResult
+    {
+        if (llvm_tools::isInstalled()) {
+            return CheckResult::ok(llvm_tools::path() . '/bin');
+        }
+        return CheckResult::fail('llvm-tools are not built', 'build-llvm-tools');
+    }
+
+    #[FixItem('build-llvm-tools')]
+    public function fixLlvmTools(): bool
+    {
+        $installer = new PackageInstaller(interactive: false);
+        $installer->addInstallPackage('llvm-tools');
+        $installer->run(true);
+        new llvm_tools()->buildForHost();
+        return llvm_tools::isInstalled();
+    }
+}

src/StaticPHP/Package/PackageBuilder.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace StaticPHP\Package;
 
+use Package\Artifact\llvm_tools;
 use StaticPHP\Config\PackageConfig;
 use StaticPHP\DI\ApplicationContext;
 use StaticPHP\Exception\SPCException;
@@ -11,6 +12,8 @@ use StaticPHP\Exception\SPCInternalException;
 use StaticPHP\Exception\WrongUsageException;
 use StaticPHP\Runtime\Shell\Shell;
 use StaticPHP\Runtime\SystemTarget;
+use StaticPHP\Toolchain\Interface\ToolchainInterface;
+use StaticPHP\Toolchain\ZigToolchain;
 use StaticPHP\Util\FileSystem;
 use StaticPHP\Util\GlobalPathTrait;
 use StaticPHP\Util\InteractiveTerm;
@@ -178,14 +181,18 @@ class PackageBuilder
         if (SystemTarget::getTargetOS() === 'Darwin') {
             shell()->exec("dsymutil -f {$binary_path} -o {$debug_file}");
         } elseif (SystemTarget::getTargetOS() === 'Linux') {
+            $objcopy = getenv('OBJCOPY')
+                ?: (ApplicationContext::tryGet(ToolchainInterface::class) instanceof ZigToolchain
+                    ? llvm_tools::binary('llvm-objcopy')
+                    : 'objcopy');
             if ($eu_strip = LinuxUtil::findCommand('eu-strip')) {
                 shell()
                     ->exec("{$eu_strip} -f {$debug_file} {$binary_path}")
-                    ->exec("objcopy --add-gnu-debuglink={$debug_file} {$binary_path}");
+                    ->exec("{$objcopy} --add-gnu-debuglink={$debug_file} {$binary_path}");
             } else {
                 shell()
-                    ->exec("objcopy --only-keep-debug {$binary_path} {$debug_file}")
-                    ->exec("objcopy --add-gnu-debuglink={$debug_file} {$binary_path}");
+                    ->exec("{$objcopy} --only-keep-debug {$binary_path} {$debug_file}")
+                    ->exec("{$objcopy} --add-gnu-debuglink={$debug_file} {$binary_path}");
             }
         } else {
             logger()->debug('extractDebugInfo is only supported on Linux and macOS');
@@ -199,9 +206,12 @@ class PackageBuilder
      */
     public function stripBinary(string $binary_path): void
     {
+        $strip = ApplicationContext::tryGet(ToolchainInterface::class) instanceof ZigToolchain
+            ? llvm_tools::binary('llvm-strip')
+            : 'strip';
         shell()->exec(match (SystemTarget::getTargetOS()) {
-            'Darwin' => "strip -S {$binary_path}",
-            'Linux' => "strip --strip-unneeded {$binary_path}",
+            'Darwin' => "{$strip} -S {$binary_path}",
+            'Linux' => "{$strip} --strip-unneeded {$binary_path}",
             'Windows' => 'echo "Skip strip on Windows"', // Windows strip is not available for now
             default => throw new SPCInternalException('stripBinary is only supported on Linux and macOS'),
         });

src/StaticPHP/Util/FileSystem.php

@@ -244,6 +244,7 @@ class FileSystem
      */
     public static function getClassesPsr4(string $dir, string $base_namespace, mixed $rule = null, bool|string $return_path_value = false, bool $auto_require = false): array
     {
+        $base_namespace = rtrim($base_namespace, '\\');
         $classes = [];
         $files = FileSystem::scanDirFiles($dir, true, true);
         if ($files === false) {

src/StaticPHP/Util/System/WindowsUtil.php

@@ -54,6 +54,7 @@ class WindowsUtil
         }
         $args = [
             '-latest',
+            '-products', '*',
             '-format', 'json',
             '-requires', 'Microsoft.VisualStudio.Component.VC.Tools.x86.x64',
         ];

src/bootstrap.php

@@ -33,6 +33,23 @@ ConsoleLogger::$date_format = 'H:i:s';
 ConsoleLogger::$format = '[%date% %level_long%] %body%';
 $ob_logger = new ConsoleLogger(LogLevel::WARNING);
 
+$ob_logger->addLogCallback(function ($level, &$output, &$message, &$context, bool $shouldLog) {
+    global $spc_log_filters;
+    if (!is_array($spc_log_filters)) {
+        $spc_log_filters = [];
+    }
+    // filter message and context
+    $output = str_replace($spc_log_filters, '***', $output);
+    $message = str_replace($spc_log_filters, '***', $message);
+    $context = array_map(function ($item) use ($spc_log_filters) {
+        if (is_string($item)) {
+            return str_replace($spc_log_filters, '***', $item);
+        }
+        return $item;
+    }, $context);
+    return true;
+});
+
 // setup log file
 if (filter_var(getenv('SPC_ENABLE_LOG_FILE'), FILTER_VALIDATE_BOOLEAN)) {
     // init spc log files
@@ -60,5 +77,9 @@ if (filter_var(getenv('SPC_ENABLE_LOG_FILE'), FILTER_VALIDATE_BOOLEAN)) {
 
 // load core registry
 Registry::loadRegistry(ROOT_DIR . '/spc.registry.yml');
+// in vendor mode, auto-load the local working directory registry if it exists
+if (spc_mode(SPC_MODE_VENDOR) && file_exists(WORKING_DIR . '/spc.registry.yml')) {
+    Registry::loadRegistry(WORKING_DIR . '/spc.registry.yml');
+}
 // load registries from environment variable SPC_REGISTRIES
 Registry::loadFromEnvOrOption();

tests/GlobalsFunctionsTest.php

@@ -0,0 +1,104 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests;
+
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LogLevel;
+use ZM\Logger\ConsoleLogger;
+
+/**
+ * @internal
+ */
+class GlobalsFunctionsTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        $GLOBALS['spc_log_filters'] = null;
+    }
+
+    protected function tearDown(): void
+    {
+        $GLOBALS['spc_log_filters'] = null;
+    }
+
+    public function testAddLogFilterDeduplicates(): void
+    {
+        spc_add_log_filter('secret-value');
+        spc_add_log_filter('secret-value');
+        spc_add_log_filter(['secret-value', 'other']);
+
+        $this->assertSame(['secret-value', 'other'], $GLOBALS['spc_log_filters']);
+    }
+
+    public function testWriteLogMasksRegisteredValues(): void
+    {
+        spc_add_log_filter(['octocat', 'ghp_abcdef1234567890']);
+
+        $stream = fopen('php://memory', 'r+');
+        spc_write_log($stream, 'user=octocat token=ghp_abcdef1234567890');
+        rewind($stream);
+        $written = stream_get_contents($stream);
+        fclose($stream);
+
+        $this->assertSame('user=*** token=***', $written);
+    }
+
+    public function testLoggerCallbackMasksOutput(): void
+    {
+        $token = 'ghp_abcdef1234567890';
+        spc_add_log_filter($token);
+
+        $stream = fopen('php://memory', 'r+');
+        $logger = new ConsoleLogger(LogLevel::DEBUG, $stream, false);
+        $logger->addLogCallback(function ($level, &$output, &$message, &$context, bool $shouldLog) {
+            global $spc_log_filters;
+            if (!is_array($spc_log_filters)) {
+                $spc_log_filters = [];
+            }
+            $output = str_replace($spc_log_filters, '***', $output);
+            $message = str_replace($spc_log_filters, '***', $message);
+            $context = array_map(function ($item) use ($spc_log_filters) {
+                if (is_string($item)) {
+                    return str_replace($spc_log_filters, '***', $item);
+                }
+                return $item;
+            }, $context);
+            return true;
+        });
+
+        $logger->debug("[PASSTHRU] curl -H\"Authorization: Bearer {$token}\" https://api.github.com/x");
+
+        rewind($stream);
+        $written = stream_get_contents($stream);
+        fclose($stream);
+
+        $this->assertStringNotContainsString($token, $written);
+        $this->assertStringContainsString('***', $written);
+    }
+
+    public function testGitHubTokenTraitRegistersEncodedBasicAuthBlob(): void
+    {
+        $user = 'octocat';
+        $token = 'ghp_abcdef1234567890';
+        $original_token = getenv('GITHUB_TOKEN');
+        $original_user = getenv('GITHUB_USER');
+
+        putenv("GITHUB_TOKEN={$token}");
+        putenv("GITHUB_USER={$user}");
+
+        try {
+            $headers = \StaticPHP\Artifact\Downloader\Type\GitHubRelease::getGitHubTokenHeadersStatic();
+
+            $encoded = base64_encode("{$user}:{$token}");
+            $this->assertSame(["Authorization: Basic {$encoded}"], $headers);
+            $this->assertContains($user, $GLOBALS['spc_log_filters']);
+            $this->assertContains($token, $GLOBALS['spc_log_filters']);
+            $this->assertContains($encoded, $GLOBALS['spc_log_filters']);
+        } finally {
+            $original_token === false ? putenv('GITHUB_TOKEN') : putenv("GITHUB_TOKEN={$original_token}");
+            $original_user === false ? putenv('GITHUB_USER') : putenv("GITHUB_USER={$original_user}");
+        }
+    }
+}

tests/StaticPHP/Artifact/ArtifactTest.php

@@ -254,11 +254,16 @@ class ArtifactTest extends TestCase
         ApplicationContext::initialize();
         ApplicationContext::set(ArtifactCache::class, $cache);
 
+        // Use a platform-appropriate absolute path: a Unix-style /tmp/... isn't
+        // absolute on Windows (no drive letter), so the test would otherwise
+        // fall through into the SOURCE_PATH-prefixed branch on Windows.
+        $extract = DIRECTORY_SEPARATOR === '\\' ? 'C:\tmp\my-pkg-extract' : '/tmp/my-pkg-extract';
+
         $artifact = new Artifact('my-pkg', [
-            'source' => ['type' => 'url', 'url' => 'https://example.com/file.tar.gz', 'extract' => '/tmp/my-pkg-extract'],
+            'source' => ['type' => 'url', 'url' => 'https://example.com/file.tar.gz', 'extract' => $extract],
         ]);
 
-        $expected = str_replace(['/', '\\'], DIRECTORY_SEPARATOR, '/tmp/my-pkg-extract');
+        $expected = str_replace(['/', '\\'], DIRECTORY_SEPARATOR, $extract);
         $this->assertSame($expected, $artifact->getSourceDir());
     }
 
@@ -703,11 +708,7 @@ class ArtifactTest extends TestCase
             'Windows' => 'windows',
             default => 'linux',
         };
-        $arch = php_uname('m');
-        if ($arch === 'arm64') {
-            $arch = 'aarch64';
-        }
-        return "{$os}-{$arch}";
+        return "{$os}-" . arch2gnu(php_uname('m'));
     }
 
     private function injectArtifactConfig(string $name, array $config): void