Make Windows package dependency inspection fail on missing tools and unreadable PE files
- Dominant language
- Rust
- Stars
- 53
- Forks
- 16
- Avg merge
- 4h 22m
- Merged PRs (30d)
- 46
Description
Part of #611. Difficulty: **medium**. Audit baseline: master `3950416e` (2026-09-12).
## Current evidence
[x.py](https://github.com/wavefnd/Wave/blob/3950416efc55cbc5ae7d54535e5a4e8699394ff0/x.py#L921) uses MinGW objdump or objdump, returning [] both when no inspector exists and when inspection fails. [x.py](https://github.com/wavefnd/Wave/blob/3950416efc55cbc5ae7d54535e5a4e8699394ff0/x.py#L478) and is_binary_for_target also accept files when the external file command cannot describe them. This can make an unverified Windows package look dependency-complete or architecture-correct.
## Scope
Use a deterministic native-capable PE inspector (for example the provisioned LLVM tools) and distinguish inspection failure from a successful empty import table. Traverse non-system dependencies for the compiler and bundled tools, validate architecture, and resolve runtime DLLs without depending on MinGW search directories. Keep Windows system/API-set handling explicit and do not classify redistributables as universally present OS files.
## Completion criteria
Tests cover an absent inspector, nonzero subprocess exit, malformed/truncated PE, wrong-machine dependency, transitive imports, duplicate/cyclic dependencies, a known system/API-set import and a missing non-system DLL. Every uninspectable required file fails staging with its path and cause. A native MSVC archive inspection succeeds without GNU tools installed.
## Dependencies and boundaries
#621; reuse existing archive architecture checks rather than adding a second inconsistent authority.
Contributor guide
Research direction
Start in x.py around the package inspection code at lines 921 and 478, including is_binary_for_target, and review issue #621 plus the existing archive architecture checks. Trace the current subprocess and dependency-resolution paths before adding focused coverage for the listed failure and traversal cases. Done means every uninspectable or missing required DLL fails staging with its path and cause, while native MSVC archives work without GNU tools.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- build-system, operating-systems, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100