wavefnd / wavefnd/Wave

Make Windows package dependency inspection fail on missing tools and unreadable PE files

Open
#622 0 comments 0 reactions 0 assignees View on GitHub
bug build ci help wanted
Dominant language
Rust
Stars
53
Forks
16
Avg merge
4h 22m
Merged PRs (30d)
46

Description

Part of #611. Difficulty: **medium**. Audit baseline: master `3950416e` (2026-09-12).

## Current evidence

[x.py](https://github.com/wavefnd/Wave/blob/3950416efc55cbc5ae7d54535e5a4e8699394ff0/x.py#L921) uses MinGW objdump or objdump, returning [] both when no inspector exists and when inspection fails. [x.py](https://github.com/wavefnd/Wave/blob/3950416efc55cbc5ae7d54535e5a4e8699394ff0/x.py#L478) and is_binary_for_target also accept files when the external file command cannot describe them. This can make an unverified Windows package look dependency-complete or architecture-correct.

## Scope

Use a deterministic native-capable PE inspector (for example the provisioned LLVM tools) and distinguish inspection failure from a successful empty import table. Traverse non-system dependencies for the compiler and bundled tools, validate architecture, and resolve runtime DLLs without depending on MinGW search directories. Keep Windows system/API-set handling explicit and do not classify redistributables as universally present OS files.

## Completion criteria

Tests cover an absent inspector, nonzero subprocess exit, malformed/truncated PE, wrong-machine dependency, transitive imports, duplicate/cyclic dependencies, a known system/API-set import and a missing non-system DLL. Every uninspectable required file fails staging with its path and cause. A native MSVC archive inspection succeeds without GNU tools installed.

## Dependencies and boundaries

#621; reuse existing archive architecture checks rather than adding a second inconsistent authority.

Contributor guide

Open the contributing guide

Research direction

Start in x.py around the package inspection code at lines 921 and 478, including is_binary_for_target, and review issue #621 plus the existing archive architecture checks. Trace the current subprocess and dependency-resolution paths before adding focused coverage for the listed failure and traversal cases. Done means every uninspectable or missing required DLL fails staging with its path and cause, while native MSVC archives work without GNU tools.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
build-system, operating-systems, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.