attrs: backfill source_provenance / binary_from (batch 1, 18 packages) by bryan-minimal · Pull Request #352 · gominimal/pkgs

bryan-minimal · 2026-07-04T02:04:43Z

Backfills provenance for 18 packages whose upstream is unambiguous. Values come from the package manager's resolver config — suggest-provenance returns 0 auto-candidates (every missing package fetches from a gs:// mirror that hides the real host, so inference can't fire). Metadata-only; no build changes; all 18 nickel-eval cleanly.

Added

category	packages
`GithubRepo` (repo verified live)	zig (ziglang/zig) · llvm-bootstrap (llvm/llvm-project) · alex (haskell/alex) · happy (haskell/happy) · less (gwsw/less)
`Sourceforge`	stm32flash · dfu-util · expect · libfdk-aac (opencore-amr)
`GnuProject`	findutils · gawk-bootstrap (gawk) · bash-bootstrap (bash)
`binary_from` (prebuilt, not source)	gcloud · android-sdk · edgedelta · ghc-bootstrap · maven · claude-code

PURL: already supported — the schema has upstream_purl / peer_purl attrs (with a PURL validator), but no package declares either; the PURL is derived from source_provenance at scan time. No action needed for PURL.

Left (not in this batch)

X.Org / freedesktop / GNOME (~25): the resolver knows the exact GitLab path (gitlab.freedesktop.org/xorg, gitlab.gnome.org, mesa, cairo, pixman, dbus, fontconfig, glib, pango, atk, at-spi2-core, …), but the schema has no GitLab category — they only fit Website, which yields no PURL/CPE (so it wouldn't turn on vuln matching without a paired cpe_remap). These want either a new GitLab source_provenance category or a provenance+cpe_remap pass.
Non-GitHub hosts / mirror-vs-canonical unconfirmed (~25): nss, nspr, freetype, elfutils, nasm, zsh, socat, dav1d, libx264, libaom, libx265, ghc, iproute2, procps-ng, graphviz, diffoscope, dnsutils, e2fsprogs, pasta, unzip, alsa-lib, man-db, acl, attr, libpipeline, emacs-config-dev1 — each needs the canonical origin confirmed before a category is assigned.
Internal / assembled (correctly no provenance): base, base-bootstrap, toolchain, ca-certificates, microvm-rootfs, resolver-quad8, minimal-sshd, virtio-kernel-raw.
Kernel: virtio-linux, virtio-linux-detonation (cdn.kernel.org).

Ref: https://minimal-dev.slack.com/archives/C091HGA43NC/p1783109351331609

Summary by CodeRabbit

New Features
- Added source provenance metadata for several packages, improving upstream source identification and traceability.
- Added explicit binary download source metadata for multiple packages to better document where prebuilt artifacts are obtained.
- Expanded package metadata coverage across build specifications without changing build behavior or dependencies.

Adds provenance to 18 packages whose upstream is unambiguous. Values determined from the package manager's resolver config, not inferred (suggest-provenance returns 0 auto-candidates — every missing package fetches from a gs:// mirror that hides the real host). Metadata-only; no build changes. GithubRepo (canonical repo verified live): zig ziglang/zig · llvm-bootstrap llvm/llvm-project · alex haskell/alex · happy haskell/happy · less gwsw/less Sourceforge: stm32flash · dfu-util · expect · libfdk-aac (opencore-amr) GnuProject: findutils · gawk-bootstrap (gawk) · bash-bootstrap (bash) binary_from (prebuilt, not built from source): gcloud · android-sdk · edgedelta · ghc-bootstrap · maven · claude-code Ref: https://minimal-dev.slack.com/archives/C091HGA43NC/p1783109351331609

coderabbitai · 2026-07-04T02:05:01Z

📝 Walkthrough

Walkthrough

This PR adds new metadata attributes to attrs blocks across 18 package build specs. Some packages gain a source_provenance object identifying upstream source category, owner/repo, or name; others gain a binary_from field recording the binary download base URL. No build logic, dependencies, or outputs change.

Changes

Build metadata additions

Layer / File(s)	Summary
source_provenance with owner/repo `packages/alex/build.ncl`, `packages/happy/build.ncl`, `packages/less/build.ncl`, `packages/llvm-bootstrap/build.ncl`, `packages/zig/build.ncl`	Adds `source_provenance` with `category`, `owner`, and `repo` fields for GitHub-hosted upstream sources.
source_provenance with category/name `packages/bash-bootstrap/build.ncl`, `packages/dfu-util/build.ncl`, `packages/expect/build.ncl`, `packages/findutils/build.ncl`, `packages/gawk-bootstrap/build.ncl`, `packages/libfdk-aac/build.ncl`, `packages/stm32flash/build.ncl`	Adds `source_provenance` with `category` and `name` fields for GNU project, Sourceforge, and similar non-GitHub sources.
binary_from download URLs `packages/android-sdk/build.ncl`, `packages/claude-code/build.ncl`, `packages/edgedelta/build.ncl`, `packages/gcloud/build.ncl`, `packages/ghc-bootstrap/build.ncl`, `packages/maven/build.ncl`	Adds `binary_from` attribute pointing to the binary distribution base URL for each package.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

gominimal/pkgs#203: Introduces the alex build spec whose attrs.upstream_version is extended by this PR's source_provenance addition.
gominimal/pkgs#204: Adds source_provenance metadata to a new gemini-cli build spec, following the same attrs pattern applied here.
gominimal/pkgs#271: Adds similar upstream provenance metadata (attrs.source_provenance) to build.ncl files across packages.

Suggested reviewers: msample

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the metadata backfill and names the affected package batch.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch provenance-backfill-batch1

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

🧹 Nitpick comments (1)

packages/gcloud/build.ncl (1)
77-77: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Reference dl_base instead of duplicating the literal URL.

dl_base is already defined at Line 16 with this exact value and used for the actual download URLs. Hardcoding the same string again in binary_from risks drift if dl_base is ever updated.
♻️ Proposed fix
-      binary_from = "https://storage.googleapis.com/cloud-sdk-release",
+      binary_from = dl_base,
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/gcloud/build.ncl` at line 77, The `binary_from` value in the
`gcloud` build config duplicates the same download base URL already defined in
`dl_base`. Update the `binary_from` setting to reference `dl_base` directly so
`build.ncl` has a single source of truth and stays consistent if the base URL
changes.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@packages/gcloud/build.ncl`:
- Line 77: The `binary_from` value in the `gcloud` build config duplicates the
same download base URL already defined in `dl_base`. Update the `binary_from`
setting to reference `dl_base` directly so `build.ncl` has a single source of
truth and stays consistent if the base URL changes.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 09b0e4f3-95c4-4619-8dcf-c30b567879c4

📥 Commits

Reviewing files that changed from the base of the PR and between 1ad692c and 750dcb5.

📒 Files selected for processing (18)

packages/alex/build.ncl
packages/android-sdk/build.ncl
packages/bash-bootstrap/build.ncl
packages/claude-code/build.ncl
packages/dfu-util/build.ncl
packages/edgedelta/build.ncl
packages/expect/build.ncl
packages/findutils/build.ncl
packages/gawk-bootstrap/build.ncl
packages/gcloud/build.ncl
packages/ghc-bootstrap/build.ncl
packages/happy/build.ncl
packages/less/build.ncl
packages/libfdk-aac/build.ncl
packages/llvm-bootstrap/build.ncl
packages/maven/build.ncl
packages/stm32flash/build.ncl
packages/zig/build.ncl

…e failure)

coderabbitai Bot reviewed Jul 4, 2026

View reviewed changes

twitchyliquid64 approved these changes Jul 4, 2026

View reviewed changes

no-op: re-trigger build (transient instance/lease issue, not a packag…

cf75aab

…e failure)

bryan-minimal added this pull request to the merge queue Jul 4, 2026

Merged via the queue into main with commit 2274e5e Jul 4, 2026
6 checks passed

bryan-minimal deleted the provenance-backfill-batch1 branch July 4, 2026 19:22

Navigation Menu

Uh oh!

attrs: backfill source_provenance / binary_from (batch 1, 18 packages) - #352

attrs: backfill source_provenance / binary_from (batch 1, 18 packages)#352
bryan-minimal merged 2 commits into
mainfrom
provenance-backfill-batch1

bryan-minimal commented Jul 4, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 4, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

bryan-minimal commented Jul 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bryan-minimal commented Jul 4, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 4, 2026 •

edited

Loading