repomatic.release.verify module¶

Native header verification of compiled binaries.

The architecture and the minimum-OS floor of a binary are parsed straight from its ELF, Mach-O and PE headers, so no external tool is needed on runners or inside build containers.

Only verify-binary reads headers. This module is kept apart from the build roster in repomatic.release.binary, which metadata loads on every workflow run.

repomatic.release.verify.LC_VERSION_MIN_MACOSX: Final[int] = 36¶

Mach-O load command carrying the minimum macOS version (pre-10.14 SDKs).

repomatic.release.verify.LC_BUILD_VERSION: Final[int] = 50¶

Mach-O load command carrying the platform and minimum OS (10.14+ SDKs).

repomatic.release.verify.MACHO_PLATFORM_MACOS: Final[int] = 1¶

platform field value naming macOS inside an LC_BUILD_VERSION command.

repomatic.release.verify.SHT_GNU_VERNEED: Final[int] = 1879048190¶

Section type of .gnu.version_r, the table of symbol versions a file needs.

repomatic.release.verify.read_header(binary_format, path)[source]¶

Parse a binary’s headers into its machine set and measured floor.

The machines are the raw header integers of the format (the ELF e_machine code, Mach-O CPU types, the PE machine id or None when unparsable), matching what MACHINE_IDS records as the expectation. The floor is the measured requirement verify_binary_floor() compares against the declared one: always None on PE, whose headers record nothing enforceable.

Parameters:

  • binary_format (BinaryFormat) – The format the file was detected as.

  • path (Path) – Path to the binary file.

Return type:

tuple[frozenset[int | None], str | None]

Returns:

(machines, floor) as parsed from the headers.

repomatic.release.verify.verify_binary_arch(target, binary_path)[source]¶

Verify that a binary matches the expected architecture for a target.

Parses the executable’s own headers, so it needs no external tool and behaves identically on runner VMs and inside build containers.

Parameters:

  • target (BuildTarget) – The build target the binary was compiled for.

  • binary_path (Path) – Path to the binary file.

Raises:

ValueError – If binary format or architecture does not match.

Return type:

None

repomatic.release.verify.verify_binary_floor(target, binary_path, dist_dirs=())[source]¶

Verify the binary and its dist tree stay within the target’s OS floor.

Scans the onefile binary itself plus every native library of the given Nuitka dist directories (whose content the onefile payload repacks), and compares each file’s measured requirement to the target’s declared floor.

What the floor counts comes from the format, per floor_label:

  • ELF: the highest GLIBC_x.y version requirement of each file. A higher requirement means a compiled object picked up symbols newer than the build container provides for, and the binary would die at load time on the distributions the floor promises.

  • Mach-O: the minos of each file, against the deployment target the build exports as MACOSX_DEPLOYMENT_TARGET.

  • PE: nothing. Its version headers are nominal, so enforced_floor reports no floor and this returns early; the Windows floor is CPython’s own support policy, tracked in the docs.

Parameters:

  • target (BuildTarget) – The build target the binary was compiled for.

  • binary_path (Path) – Path to the binary file.

  • dist_dirs (Iterable[Path]) – Nuitka dist directories to include in the scan.

Raises:

ValueError – If any scanned file exceeds the declared floor.

Return type:

None