feat: add permissions for id-token and attestations in release build (#1181)

Build the CC/CXX/AR/LD/RANLIB map once and hand it to shell()->setEnv()
so the configure/make invocations don't have to repeat the same prefix
on every line. For the sudo make-install path the env still needs to
be on the command line (sudo strips the parent env), so the same map
is rendered into $envFlags and prepended there. Also adds RANLIB,
which the upstream Makefile honours.

.github/workflows/release-build.yml

@@ -38,6 +38,9 @@ jobs:
           - name: "windows-x64"
             os: "ubuntu-latest"
             filename: "spc-windows-x64.exe"
+    permissions:
+      id-token: write
+      attestations: write
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v5"
@@ -105,6 +108,12 @@ jobs:
             fi
           fi
 
+      - name: "Generate build provenance attestation"
+        if: github.event_name != 'pull_request'
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: "${{ github.workspace }}/${{ matrix.operating-system.name == 'windows-x64' && 'spc.exe' || 'spc' }}"
+
       - name: "Copy file"
         run: |
           if [ "${{ matrix.operating-system.name }}" != "windows-x64" ]; then

config/pkg/target/llvm-tools.yml

@@ -1,6 +0,0 @@
-llvm-tools:
-  type: target
-  artifact:
-    binary: custom
-  depends:
-    - zig

src/Package/Artifact/llvm_tools.php

@@ -1,162 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Package\Artifact;
-
-use StaticPHP\Artifact\ArtifactDownloader;
-use StaticPHP\Artifact\Downloader\DownloadResult;
-use StaticPHP\Artifact\Downloader\Type\CheckUpdateResult;
-use StaticPHP\Artifact\Downloader\Type\GitHubTokenSetupTrait;
-use StaticPHP\Attribute\Artifact\AfterBinaryExtract;
-use StaticPHP\Attribute\Artifact\CustomBinary;
-use StaticPHP\Attribute\Artifact\CustomBinaryCheckUpdate;
-use StaticPHP\DI\ApplicationContext;
-use StaticPHP\Exception\BuildFailureException;
-use StaticPHP\Exception\DownloaderException;
-use StaticPHP\Package\PackageBuilder;
-
-class llvm_tools
-{
-    use GitHubTokenSetupTrait;
-
-    public const array TOOLS = ['llvm-objcopy', 'llvm-strip', 'llvm-profdata'];
-
-    /** Install prefix for the locally-built llvm-tools. */
-    public static function path(): string
-    {
-        return PKG_ROOT_PATH . '/llvm-tools';
-    }
-
-    /** Path to a binary under llvm-tools/bin (llvm-objcopy, llvm-strip, llvm-profdata, …). */
-    public static function binary(string $name = 'llvm-strip'): string
-    {
-        return self::path() . '/bin/' . $name;
-    }
-
-    /** True when every required TOOLS binary is present and executable. */
-    public static function isInstalled(): bool
-    {
-        foreach (self::TOOLS as $t) {
-            $p = self::binary($t);
-            if (!is_file($p) || !is_executable($p)) {
-                return false;
-            }
-        }
-        return true;
-    }
-
-    #[CustomBinary('llvm-tools', [
-        'linux-x86_64',
-        'linux-aarch64',
-        'macos-x86_64',
-        'macos-aarch64',
-    ])]
-    public function downBinary(ArtifactDownloader $downloader): DownloadResult
-    {
-        $llvmVersion = $this->detectLlvmVersion()
-            ?? throw new DownloaderException('Could not detect a clang version on host; install zig or clang first');
-        $tarball = "llvm-project-{$llvmVersion}.src.tar.xz";
-        $url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-{$llvmVersion}/{$tarball}";
-        $tarballPath = DOWNLOAD_PATH . '/' . $tarball;
-        default_shell()->executeCurlDownload($url, $tarballPath, headers: $this->getGitHubTokenHeaders(), retries: $downloader->getRetry());
-        return DownloadResult::archive($tarball, ['url' => $url, 'version' => $llvmVersion], extract: '{source_path}/llvm-tools', verified: false, version: $llvmVersion);
-    }
-
-    #[CustomBinaryCheckUpdate('llvm-tools', [
-        'linux-x86_64',
-        'linux-aarch64',
-        'macos-x86_64',
-        'macos-aarch64',
-    ])]
-    public function checkUpdateBinary(?string $old_version, ArtifactDownloader $downloader): CheckUpdateResult
-    {
-        $llvmVersion = $this->detectLlvmVersion()
-            ?? throw new DownloaderException('Could not detect a clang version on host; install zig or clang first');
-        return new CheckUpdateResult(
-            old: $old_version,
-            new: $llvmVersion,
-            needUpdate: $old_version === null || $llvmVersion !== $old_version,
-        );
-    }
-
-    #[AfterBinaryExtract('llvm-tools', [
-        'linux-x86_64',
-        'linux-aarch64',
-        'macos-x86_64',
-        'macos-aarch64',
-    ])]
-    public function postExtract(string $target_path): void
-    {
-        $this->buildForHost($target_path);
-    }
-
-    public function buildForHost(?string $sourceRoot = null): void
-    {
-        $sourceRoot ??= SOURCE_PATH . '/llvm-tools';
-        if (self::isInstalled()) {
-            return;
-        }
-        $llvmDir = "{$sourceRoot}/llvm";
-        if (!is_dir($llvmDir)) {
-            throw new BuildFailureException("llvm-tools: missing source at {$llvmDir} (extraction layout changed?)");
-        }
-        $buildDir = "{$sourceRoot}/build";
-        $installDir = self::path();
-        $binDir = self::path() . '/bin';
-        f_mkdir($buildDir, recursive: true);
-        f_mkdir($binDir, recursive: true);
-
-        $cmakeArgs = implode(' ', array_map('escapeshellarg', [
-            '-S', $llvmDir,
-            '-B', $buildDir,
-            '-DCMAKE_BUILD_TYPE=Release',
-            '-DLLVM_ENABLE_PROJECTS=',
-            '-DLLVM_TARGETS_TO_BUILD=',
-            '-DLLVM_INCLUDE_BENCHMARKS=OFF',
-            '-DLLVM_INCLUDE_TESTS=OFF',
-            '-DLLVM_INCLUDE_EXAMPLES=OFF',
-            '-DLLVM_INCLUDE_DOCS=OFF',
-            '-DLLVM_ENABLE_ZLIB=OFF',
-            '-DLLVM_ENABLE_ZSTD=OFF',
-            '-DLLVM_ENABLE_LIBXML2=OFF',
-            '-DLLVM_ENABLE_TERMINFO=OFF',
-            '-DLLVM_ENABLE_LIBEDIT=OFF',
-            '-DLLVM_ENABLE_LIBPFM=OFF',
-            '-DLLVM_BUILD_LLVM_DYLIB=OFF',
-            '-DLLVM_LINK_LLVM_DYLIB=OFF',
-            '-DBUILD_SHARED_LIBS=OFF',
-            '-DCMAKE_C_COMPILER=' . zig::binary('zig-cc'),
-            '-DCMAKE_CXX_COMPILER=' . zig::binary('zig-c++'),
-            '-DCMAKE_INSTALL_PREFIX=' . $installDir,
-        ]));
-        $jobs = ApplicationContext::get(PackageBuilder::class)->concurrency;
-        $targetArgs = implode(' ', array_map(fn ($t) => '--target ' . escapeshellarg($t), self::TOOLS));
-
-        shell()
-            ->setEnv(['SPC_TARGET' => GNU_ARCH . '-linux-musl'])
-            ->exec('cmake ' . $cmakeArgs)
-            ->exec('cmake --build ' . escapeshellarg($buildDir) . ' ' . $targetArgs . " -j {$jobs}");
-
-        foreach (self::TOOLS as $t) {
-            $built = "{$buildDir}/bin/{$t}";
-            if (!is_file($built)) {
-                throw new BuildFailureException("llvm-tools: missing build output {$built}");
-            }
-            copy($built, self::binary($t));
-            chmod(self::binary($t), 0755);
-        }
-    }
-
-    private function detectLlvmVersion(): ?string
-    {
-        if (!zig::isInstalled()) {
-            return null;
-        }
-        [$rc, $out] = shell()->execWithResult(escapeshellarg(zig::binary()) . ' cc --version', false);
-        if ($rc !== 0) {
-            return null;
-        }
-        return preg_match('/clang version (\d+\.\d+\.\d+)/', implode("\n", $out), $m) ? $m[1] : null;
-    }
-}

src/Package/Artifact/zig.php

@@ -15,23 +15,6 @@ use StaticPHP\Runtime\SystemTarget;
 
 class zig
 {
-    /** Directory zig extracts into. */
-    public static function path(): string
-    {
-        return PKG_ROOT_PATH . '/zig';
-    }
-
-    /** Path to a binary inside the zig install dir (zig, zig-cc, zig-c++, zig-ar, …). */
-    public static function binary(string $name = 'zig'): string
-    {
-        return self::path() . '/' . $name;
-    }
-
-    public static function isInstalled(): bool
-    {
-        return is_file(self::binary());
-    }
-
     #[CustomBinary('zig', [
         'linux-x86_64',
         'linux-aarch64',

src/StaticPHP/DI/ApplicationContext.php

@@ -98,25 +98,6 @@ class ApplicationContext
         return self::getContainer()->has($id);
     }
 
-    /**
-     * Resolve $id, returning null if it can't be constructed.
-     * PHP-DI's has() returns true for any autowirable class even when get()
-     * would throw on missing scalar args — for "is this resolvable right now"
-     * semantics use this.
-     *
-     * @template T
-     * @param  class-string<T> $id
-     * @return null|T
-     */
-    public static function tryGet(string $id): mixed
-    {
-        try {
-            return self::getContainer()->get($id);
-        } catch (\Throwable) {
-            return null;
-        }
-    }
-
     /**
      * Set a service in the container.
      * Use sparingly - prefer configuration-based definitions.

src/StaticPHP/Doctor/Item/LinuxMuslCheck.php

@@ -73,13 +73,20 @@ class LinuxMuslCheck
             $prefix = 'sudo ';
             logger()->warning('Current user is not root, using sudo for running command');
         }
+        $sysEnv = ['CC' => 'gcc', 'CXX' => 'g++', 'AR' => 'ar', 'LD' => 'ld', 'RANLIB' => 'ranlib'];
+        $envFlags = '';
+        foreach ($sysEnv as $k => $v) {
+            $envFlags .= "{$k}={$v} ";
+        }
+        $envFlags = rtrim($envFlags);
         $shell = shell()->cd(SOURCE_PATH . '/musl-wrapper')
-            ->exec('CC=gcc CXX=g++ AR=ar LD=ld ./configure --disable-gcc-wrapper')
-            ->exec('CC=gcc CXX=g++ AR=ar LD=ld make -j');
+            ->setEnv($sysEnv)
+            ->exec('./configure --disable-gcc-wrapper')
+            ->exec('make -j');
         if ($prefix !== '') {
-            f_passthru('cd ' . SOURCE_PATH . "/musl-wrapper && CC=gcc CXX=g++ AR=ar LD=ld {$prefix}make install");
+            f_passthru('cd ' . SOURCE_PATH . "/musl-wrapper && {$envFlags} {$prefix}make install");
         } else {
-            $shell->exec("CC=gcc CXX=g++ AR=ar LD=ld {$prefix}make install");
+            $shell->exec("{$prefix}make install");
         }
         return true;
     }

src/StaticPHP/Doctor/Item/LlvmToolsCheck.php

@@ -1,44 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace StaticPHP\Doctor\Item;
-
-use Package\Artifact\llvm_tools;
-use StaticPHP\Attribute\Doctor\CheckItem;
-use StaticPHP\Attribute\Doctor\FixItem;
-use StaticPHP\Attribute\Doctor\OptionalCheck;
-use StaticPHP\DI\ApplicationContext;
-use StaticPHP\Doctor\CheckResult;
-use StaticPHP\Package\PackageInstaller;
-use StaticPHP\Toolchain\Interface\ToolchainInterface;
-use StaticPHP\Toolchain\ZigToolchain;
-
-#[OptionalCheck([self::class, 'optionalCheck'])]
-class LlvmToolsCheck
-{
-    public static function optionalCheck(): bool
-    {
-        return ApplicationContext::get(ToolchainInterface::class) instanceof ZigToolchain;
-    }
-
-    /** @noinspection PhpUnused */
-    #[CheckItem('if llvm-tools (objcopy/strip/profdata) are built', level: 798)]
-    public function checkLlvmTools(): CheckResult
-    {
-        if (llvm_tools::isInstalled()) {
-            return CheckResult::ok(llvm_tools::path() . '/bin');
-        }
-        return CheckResult::fail('llvm-tools are not built', 'build-llvm-tools');
-    }
-
-    #[FixItem('build-llvm-tools')]
-    public function fixLlvmTools(): bool
-    {
-        $installer = new PackageInstaller(interactive: false);
-        $installer->addInstallPackage('llvm-tools');
-        $installer->run(true);
-        new llvm_tools()->buildForHost();
-        return llvm_tools::isInstalled();
-    }
-}

src/StaticPHP/Package/PackageBuilder.php

@@ -4,7 +4,6 @@ declare(strict_types=1);
 
 namespace StaticPHP\Package;
 
-use Package\Artifact\llvm_tools;
 use StaticPHP\Config\PackageConfig;
 use StaticPHP\DI\ApplicationContext;
 use StaticPHP\Exception\SPCException;
@@ -12,8 +11,6 @@ use StaticPHP\Exception\SPCInternalException;
 use StaticPHP\Exception\WrongUsageException;
 use StaticPHP\Runtime\Shell\Shell;
 use StaticPHP\Runtime\SystemTarget;
-use StaticPHP\Toolchain\Interface\ToolchainInterface;
-use StaticPHP\Toolchain\ZigToolchain;
 use StaticPHP\Util\FileSystem;
 use StaticPHP\Util\GlobalPathTrait;
 use StaticPHP\Util\InteractiveTerm;
@@ -181,18 +178,14 @@ class PackageBuilder
         if (SystemTarget::getTargetOS() === 'Darwin') {
             shell()->exec("dsymutil -f {$binary_path} -o {$debug_file}");
         } elseif (SystemTarget::getTargetOS() === 'Linux') {
-            $objcopy = getenv('OBJCOPY')
-                ?: (ApplicationContext::tryGet(ToolchainInterface::class) instanceof ZigToolchain
-                    ? llvm_tools::binary('llvm-objcopy')
-                    : 'objcopy');
             if ($eu_strip = LinuxUtil::findCommand('eu-strip')) {
                 shell()
                     ->exec("{$eu_strip} -f {$debug_file} {$binary_path}")
-                    ->exec("{$objcopy} --add-gnu-debuglink={$debug_file} {$binary_path}");
+                    ->exec("objcopy --add-gnu-debuglink={$debug_file} {$binary_path}");
             } else {
                 shell()
-                    ->exec("{$objcopy} --only-keep-debug {$binary_path} {$debug_file}")
-                    ->exec("{$objcopy} --add-gnu-debuglink={$debug_file} {$binary_path}");
+                    ->exec("objcopy --only-keep-debug {$binary_path} {$debug_file}")
+                    ->exec("objcopy --add-gnu-debuglink={$debug_file} {$binary_path}");
             }
         } else {
             logger()->debug('extractDebugInfo is only supported on Linux and macOS');
@@ -206,12 +199,9 @@ class PackageBuilder
      */
     public function stripBinary(string $binary_path): void
     {
-        $strip = ApplicationContext::tryGet(ToolchainInterface::class) instanceof ZigToolchain
-            ? llvm_tools::binary('llvm-strip')
-            : 'strip';
         shell()->exec(match (SystemTarget::getTargetOS()) {
-            'Darwin' => "{$strip} -S {$binary_path}",
-            'Linux' => "{$strip} --strip-unneeded {$binary_path}",
+            'Darwin' => "strip -S {$binary_path}",
+            'Linux' => "strip --strip-unneeded {$binary_path}",
             'Windows' => 'echo "Skip strip on Windows"', // Windows strip is not available for now
             default => throw new SPCInternalException('stripBinary is only supported on Linux and macOS'),
         });

src/StaticPHP/Runtime/Executor/UnixCMakeExecutor.php

@@ -302,9 +302,12 @@ set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY)
 set(CMAKE_C_STANDARD_INCLUDE_DIRECTORIES "{$include}")
 set(CMAKE_CXX_STANDARD_INCLUDE_DIRECTORIES "{$include}")
 CMAKE;
-        // Whoops, linux may need CMAKE_AR sometimes
+        // pin AR/RANLIB so cmake uses zig-ar/zig-ranlib instead of system /usr/bin/ranlib (zig archives need it)
         if (PHP_OS_FAMILY === 'Linux') {
-            $toolchain .= "\nSET(CMAKE_AR \"ar\")";
+            $ar = getenv('SPC_DEFAULT_AR') ?: getenv('AR') ?: 'ar';
+            $ranlib = getenv('SPC_DEFAULT_RANLIB') ?: (getenv('RANLIB') ?: 'ranlib');
+            $toolchain .= "\nSET(CMAKE_AR \"{$ar}\")";
+            $toolchain .= "\nSET(CMAKE_RANLIB \"{$ranlib}\")";
         }
         FileSystem::writeFile(SOURCE_PATH . '/toolchain.cmake', $toolchain);
         return $created = realpath(SOURCE_PATH . '/toolchain.cmake');

src/StaticPHP/Toolchain/ClangBrewToolchain.php

@@ -15,6 +15,7 @@ class ClangBrewToolchain extends ClangNativeToolchain
         GlobalEnvManager::putenv("SPC_DEFAULT_CC={$homebrew_prefix}/opt/llvm/bin/clang");
         GlobalEnvManager::putenv("SPC_DEFAULT_CXX={$homebrew_prefix}/opt/llvm/bin/clang++");
         GlobalEnvManager::putenv("SPC_DEFAULT_AR={$homebrew_prefix}/opt/llvm/bin/llvm-ar");
+        GlobalEnvManager::putenv("SPC_DEFAULT_RANLIB={$homebrew_prefix}/opt/llvm/bin/llvm-ranlib");
         GlobalEnvManager::putenv('SPC_DEFAULT_LD=ld');
         GlobalEnvManager::addPathIfNotExists("{$homebrew_prefix}/opt/llvm/bin");
     }

src/StaticPHP/Toolchain/ClangNativeToolchain.php

@@ -21,6 +21,7 @@ class ClangNativeToolchain implements UnixToolchainInterface
         GlobalEnvManager::putenv('SPC_DEFAULT_CC=clang');
         GlobalEnvManager::putenv('SPC_DEFAULT_CXX=clang++');
         GlobalEnvManager::putenv('SPC_DEFAULT_AR=ar');
+        GlobalEnvManager::putenv('SPC_DEFAULT_RANLIB=ranlib');
         GlobalEnvManager::putenv('SPC_DEFAULT_LD=ld');
     }
 

src/StaticPHP/Toolchain/GccNativeToolchain.php

@@ -18,6 +18,7 @@ class GccNativeToolchain implements UnixToolchainInterface
         GlobalEnvManager::putenv('SPC_DEFAULT_CC=gcc');
         GlobalEnvManager::putenv('SPC_DEFAULT_CXX=g++');
         GlobalEnvManager::putenv('SPC_DEFAULT_AR=ar');
+        GlobalEnvManager::putenv('SPC_DEFAULT_RANLIB=ranlib');
         GlobalEnvManager::putenv('SPC_DEFAULT_LD=ld');
     }
 

src/StaticPHP/Toolchain/ZigToolchain.php

@@ -16,6 +16,7 @@ class ZigToolchain implements UnixToolchainInterface
         GlobalEnvManager::putenv('SPC_DEFAULT_CC=zig-cc');
         GlobalEnvManager::putenv('SPC_DEFAULT_CXX=zig-c++');
         GlobalEnvManager::putenv('SPC_DEFAULT_AR=zig-ar');
+        GlobalEnvManager::putenv('SPC_DEFAULT_RANLIB=zig-ranlib');
         GlobalEnvManager::putenv('SPC_DEFAULT_LD=zig-ld.lld');
 
         // Generate additional objects needed for zig toolchain

src/globals/functions.php

@@ -256,10 +256,30 @@ function clean_spaces(string $string): string
  */
 function deduplicate_flags(string $flags): string
 {
-    $tokens = preg_split('/\s+/', trim($flags));
+    // Flags that take their value as a separate token.
+    static $paired = [
+        '-Xclang', '-Xpreprocessor', '-Xlinker', '-Xassembler',
+        '-framework', '-arch', '-target',
+        '-include', '-imacros', '-isystem', '-isysroot', '-iquote', '-idirafter',
+        '-MT', '-MF', '-MQ',
+    ];
+
+    $tokens = preg_split('/\s+/', trim($flags)) ?: [];
+
+    // Group paired flag+value into a single atom before dedup.
+    $atoms = [];
+    $n = count($tokens);
+    for ($i = 0; $i < $n; ++$i) {
+        if (in_array($tokens[$i], $paired, true) && $i + 1 < $n) {
+            $atoms[] = $tokens[$i] . ' ' . $tokens[$i + 1];
+            ++$i;
+        } else {
+            $atoms[] = $tokens[$i];
+        }
+    }
 
     // Reverse, unique, reverse back - keeps last occurrence of duplicates
-    $deduplicated = array_reverse(array_unique(array_reverse($tokens)));
+    $deduplicated = array_reverse(array_unique(array_reverse($atoms)));
 
     return implode(' ', $deduplicated);
 }