Invalidate nettle and GnuTLS when the GMP provider changes

build_samba4x_nettle() hardcoded "system-gmp" in its stamp name, so a tree
that switched from the adopted target GMP to the bundled one still found the
old stamp and both libraries in place, reported "already built" and reused
them. The libgmp.a underneath had been replaced; nettle and GnuTLS had not.
GnuTLS is affected through the same route, linking -lhogweed -lnettle -lgmp.

Both stamps now carry the provider and version of the GMP they were built
against, so selecting a different one no longer matches an existing stamp.
The version the adopted GMP is recorded with moves into a variable shared
with gmp.pc, which is where it was already written.

The same slot problem applies to GMP itself: both providers install to the
same deps/lib/libgmp.a, which is all the bundled stamp checks for. Adopting
the target GMP now retires that stamp, so a later rejection rebuilds the
bundled GMP instead of reusing the archive the adopt left behind.

The __gmpn_zero_p probe now matches the symbol class, since nm also lists
"U __gmpn_zero_p" for members that merely reference it.

Tests cover a usable target GMP, a missing __gmpn_zero_p, an undefined
reference to it, an nm that cannot be run, a stale downstream stamp, and a
retired GMP stamp. The fake toolchain gains an nm, without which the symbol
probe was skipped in every test. Dependency downloads now point at missing
file:// URLs, so a stamp name that stops matching fails at once instead of
fetching from ftp.gnu.org.

MKCOMPAT joins build/.env.example alongside NO_PTHREADS.

Existing build trees rebuild nettle and GnuTLS once.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: artem-from-ua

build/.env.example

@@ -53,6 +53,10 @@ HOST_CFLAGS='-O -fcommon -fgnu89-inline'
 HOST_CXXFLAGS='-O -fcommon -fgnu89-inline'
 HOST_CPPFLAGS='-D__GNUC_GNU_INLINE__ -D__STDC_WANT_LIB_EXT1__=1'
 NO_PTHREADS='1'
+# Compat libraries are not needed to link one static earmv4 smbd, and building
+# them breaks the distribution phase on a from-scratch tree. Set to 'yes' to
+# build them anyway.
+MKCOMPAT='no'
 
 # Samba 4 netbsd7 lane
 SAMBA4_VERSION='4.8.12'

build/_samba4x.sh

@@ -761,6 +761,15 @@ find_samba4x_gmp_header() {
     return 1
 }
 
+# The GMP in the NetBSD tree reports itself as 6.1.0. Keep that in one place so
+# gmp.pc and the dependency stamps cannot drift apart.
+SAMBA4X_TARGET_GMP_VERSION="6.1.0"
+
+# Records which GMP the nettle and GnuTLS artifacts were built against. Both are
+# linked to libgmp, so replacing it has to invalidate them rather than let them
+# be reused. Each GMP path below sets this, and the stamps interpolate it.
+SAMBA4X_GMP_STAMP_ID="unknown-gmp"
+
 install_samba4x_target_gmp() {
     gmp_lib="$OBJ/external/lgpl3/gmp/lib/libgmp/libgmp.a"
     if ! gmp_header="$(find_samba4x_gmp_header)"; then
@@ -776,9 +785,13 @@ install_samba4x_target_gmp() {
     # build our own GMP instead of adopting the one from the NetBSD tree.
     # Only reject on a successful nm run, so a missing or renamed nm leaves
     # the existing behaviour untouched.
+    # Match the symbol class rather than the bare name: nm also lists
+    # "U __gmpn_zero_p" for members that only reference it, which would read as
+    # a definition. Grepping for a defined class avoids nm --defined-only,
+    # which is not portable across the nm builds this toolchain ships.
     if gmp_syms="$("$TOOLDIR/bin/$TRIPLE-nm" "$gmp_lib" 2>/dev/null)"; then
         case "$gmp_syms" in
-            *__gmpn_zero_p*) ;;
+            *[TDRtdrBb]" __gmpn_zero_p"*) ;;
             *)
                 echo "NetBSD target libgmp.a lacks __gmpn_zero_p; nettle would"
                 echo "build without public-key support."
@@ -788,13 +801,23 @@ install_samba4x_target_gmp() {
     fi
 
     mkdir -p "$SAMBA4X_DEPS/lib" "$SAMBA4X_DEPS/include" "$SAMBA4X_DEPS/lib/pkgconfig"
+    # Both providers install to the same libgmp.a, and the bundled stamp treats
+    # that file as proof of its own build. Drop the stamp while overwriting the
+    # archive, so a later run that rejects this GMP rebuilds the bundled one
+    # instead of adopting what is left here.
+    rm -f "$SAMBA4X_DEPS/.stamp-gmp-$SAMBA4X_GMP_VERSION"
     cp "$gmp_lib" "$SAMBA4X_DEPS/lib/libgmp.a"
     cp "$gmp_header" "$SAMBA4X_DEPS/include/gmp.h"
     gmp_mparam="$(dirname "$gmp_header")/gmp-mparam.h"
     if [ -f "$gmp_mparam" ]; then
         cp "$gmp_mparam" "$SAMBA4X_DEPS/include/gmp-mparam.h"
     fi
-    write_samba4x_gmp_pc "6.1.0"
+    # Claim the stamp id only here, past every rejection above: a function called
+    # as an if condition runs in the current shell, so an assignment made before
+    # a "return 1" would still reach the caller and mislabel the downstream
+    # stamps as system when the bundled GMP is what actually gets used.
+    SAMBA4X_GMP_STAMP_ID="system-$SAMBA4X_TARGET_GMP_VERSION"
+    write_samba4x_gmp_pc "$SAMBA4X_TARGET_GMP_VERSION"
 }
 
 write_samba4x_gmp_pc() {
@@ -814,6 +837,9 @@ EOF
 }
 
 build_samba4x_gmp() {
+    # Set before the early return below so a cached bundled GMP labels the
+    # downstream stamps the same way a freshly built one does.
+    SAMBA4X_GMP_STAMP_ID="bundled-$SAMBA4X_GMP_VERSION"
     stamp="$SAMBA4X_DEPS/.stamp-gmp-$SAMBA4X_GMP_VERSION"
     if [ -f "$stamp" ] && [ -f "$SAMBA4X_DEPS/lib/libgmp.a" ]; then
         echo "GMP $SAMBA4X_GMP_VERSION already built."
@@ -859,7 +885,7 @@ EOF
 }
 
 build_samba4x_nettle() {
-    stamp="$SAMBA4X_DEPS/.stamp-nettle-$SAMBA4X_NETTLE_VERSION-system-gmp"
+    stamp="$SAMBA4X_DEPS/.stamp-nettle-$SAMBA4X_NETTLE_VERSION-$SAMBA4X_GMP_STAMP_ID"
     if [ -f "$stamp" ] &&
        [ -f "$SAMBA4X_DEPS/lib/libnettle.a" ] &&
        [ -f "$SAMBA4X_DEPS/lib/libhogweed.a" ]; then
@@ -935,7 +961,9 @@ rewrite_samba4x_gnutls_pc() {
 }
 
 build_samba4x_gnutls() {
-    gnutls_stamp_suffix="system-nettle-oaep-no-thread-local"
+    # GnuTLS links -lhogweed -lnettle -lgmp, so a different GMP invalidates it
+    # just as it invalidates nettle.
+    gnutls_stamp_suffix="system-nettle-oaep-no-thread-local-$SAMBA4X_GMP_STAMP_ID"
     stamp="$SAMBA4X_DEPS/.stamp-gnutls-$SAMBA4X_GNUTLS_VERSION-$gnutls_stamp_suffix"
     if [ -f "$stamp" ] && [ -f "$SAMBA4X_DEPS/lib/libgnutls.a" ]; then
         echo "GnuTLS $SAMBA4X_GNUTLS_VERSION already built."

tests/test_build_samba4x.py

@@ -11,6 +11,15 @@
 
 REPO_ROOT = Path(__file__).resolve().parent.parent
 
+# The dependency stamps carry the GMP the artifact was built against, so these
+# have to match what _samba4x.sh computes. A mismatch makes the build scripts
+# treat every dependency as unbuilt and try to download it.
+NETTLE_SYSTEM_GMP_STAMP = ".stamp-nettle-3.10.1-system-6.1.0"
+NETTLE_BUNDLED_GMP_STAMP = ".stamp-nettle-3.10.1-bundled-6.3.0"
+GNUTLS_SYSTEM_GMP_STAMP = (
+    ".stamp-gnutls-3.8.5-system-nettle-oaep-no-thread-local-system-6.1.0"
+)
+
 
 class Samba4XBuildScriptTests(unittest.TestCase):
     def make_executable(self, path: Path, text: str) -> None:
@@ -94,6 +103,26 @@ def prepare_fake_toolchain(self, out: Path, triple: str) -> None:
                 """
             ),
         )
+        # nm drives the __gmpn_zero_p probe that decides whether the GMP in the
+        # NetBSD tree is usable. It cannot join the loop below: those exit 0
+        # without printing, which would read as a GMP missing every symbol.
+        self.make_executable(
+            tools / f"{triple}-nm",
+            textwrap.dedent(
+                """\
+                #!/bin/sh
+                if [ "${TEST_NM_RC:-0}" != "0" ]; then
+                    exit "$TEST_NM_RC"
+                fi
+                printf '0000 T __gmpn_add_n\\n'
+                case "${TEST_NM_ZERO_P:-1}" in
+                    1) printf '0000 T __gmpn_zero_p\\n' ;;
+                    undefined) printf '         U __gmpn_zero_p\\n' ;;
+                esac
+                exit 0
+                """
+            ),
+        )
         for name in ("ar", "ranlib", "readelf", "strip"):
             self.make_executable(tools / f"{triple}-{name}", "#!/bin/sh\nexit 0\n")
 
@@ -222,12 +251,12 @@ def prepare_fake_netbsd_inputs(self, root: Path, *, lane: str) -> dict[str, Path
         self.make_file(build_src / "external" / "lgpl3" / "gmp" / "lib" / "libgmp" / "arch" / gmp_arch / "gmp.h")
 
         deps = samba_build / "deps"
-        self.make_file(deps / ".stamp-nettle-3.10.1-system-gmp")
+        self.make_file(deps / NETTLE_SYSTEM_GMP_STAMP)
         self.make_file(deps / "lib" / "libnettle.a")
         self.make_file(deps / "lib" / "libhogweed.a")
         self.make_file(deps / ".stamp-libtasn1-4.20.0")
         self.make_file(deps / "lib" / "libtasn1.a")
-        self.make_file(deps / ".stamp-gnutls-3.8.5-system-nettle-oaep-no-thread-local")
+        self.make_file(deps / GNUTLS_SYSTEM_GMP_STAMP)
         self.make_file(deps / "lib" / "libgnutls.a")
         self.make_file(deps / "lib" / "pkgconfig" / "gnutls.pc", "Libs: -L${libdir} -lgnutls\n")
 
@@ -239,9 +268,25 @@ def prepare_fake_netbsd_inputs(self, root: Path, *, lane: str) -> dict[str, Path
             "samba_stage": samba_stage,
         }
 
+    def offline_dependency_urls(self, root: Path) -> dict[str, str]:
+        """Point every dependency download at a file that does not exist.
+
+        The fixture pre-creates the dependency stamps so nothing is downloaded,
+        but a stamp name that stops matching what the build scripts compute
+        would silently turn these tests into real fetches from ftp.gnu.org. A
+        missing file:// URL fails curl at once instead.
+        """
+        return {
+            "SAMBA4X_GMP_URL": f"file://{root / 'no-such-gmp.tar.xz'}",
+            "SAMBA4X_NETTLE_URL": f"file://{root / 'no-such-nettle.tar.gz'}",
+            "SAMBA4X_LIBTASN1_URL": f"file://{root / 'no-such-libtasn1.tar.gz'}",
+            "SAMBA4X_GNUTLS_URL": f"file://{root / 'no-such-gnutls.tar.xz'}",
+        }
+
     def env_for_lane(self, root: Path, lane: str, capture: Path) -> dict[str, str]:
         paths = self.prepare_fake_netbsd_inputs(root, lane=lane)
         env = os.environ.copy()
+        env.update(self.offline_dependency_urls(root))
         env.update(
             {
                 "TC_ENV_FILE": "/dev/null",
@@ -724,6 +769,139 @@ def test_generation_fails_when_independent_probe_disagrees(self) -> None:
             )
             self.assertFalse((output_dir / "samba4x-4.24.3-netbsd4be.answers").exists())
 
+    def test_usable_target_gmp_is_adopted_and_stamped_as_system(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            capture = root / "configure-args.txt"
+            env = self.env_for_lane(root, "netbsd7", capture)
+
+            result = self.run_wrapper("samba4x.sh", env)
+
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            log = Path(env["SAMBA4X_NETBSD7_LOG"]).read_text()
+            self.assertIn("Using NetBSD target GMP", log)
+            self.assertIn("nettle 3.10.1 already built.", log)
+            self.assertIn("GnuTLS 3.8.5 already built.", log)
+            deps = Path(env["SAMBA4X_NETBSD7_BUILD"]) / "deps"
+            self.assertTrue((deps / NETTLE_SYSTEM_GMP_STAMP).exists())
+            self.assertTrue((deps / GNUTLS_SYSTEM_GMP_STAMP).exists())
+            pc = (deps / "lib" / "pkgconfig" / "gmp.pc").read_text()
+            self.assertIn("Version: 6.1.0", pc)
+            self.assertNotIn("Version: 6.3.0", pc)
+
+    def test_target_gmp_without_zero_p_falls_back_to_bundled_gmp(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            capture = root / "configure-args.txt"
+            env = self.env_for_lane(root, "netbsd7", capture)
+            env["TEST_NM_ZERO_P"] = "0"
+
+            result = self.run_wrapper("samba4x.sh", env)
+
+            self.assertNotEqual(result.returncode, 0)
+            log = Path(env["SAMBA4X_NETBSD7_LOG"]).read_text()
+            self.assertIn("lacks __gmpn_zero_p", log)
+            self.assertIn("NetBSD target GMP is unavailable; building GMP 6.3.0.", log)
+            self.assertNotIn("Using NetBSD target GMP", log)
+            self.assertFalse(capture.exists())
+
+    def test_unusable_nm_leaves_target_gmp_adoption_untouched(self) -> None:
+        cases = ("nm exits nonzero", "nm missing")
+        for label in cases:
+            with self.subTest(label=label):
+                with tempfile.TemporaryDirectory() as tmp:
+                    root = Path(tmp)
+                    capture = root / "configure-args.txt"
+                    env = self.env_for_lane(root, "netbsd7", capture)
+                    if label == "nm exits nonzero":
+                        env["TEST_NM_RC"] = "1"
+                    else:
+                        tools = Path(env["BUILD_OUT"]) / "tools" / "bin"
+                        (tools / "arm--netbsdelf-nm").unlink()
+
+                    result = self.run_wrapper("samba4x.sh", env)
+
+                    self.assertEqual(
+                        result.returncode, 0, result.stdout + result.stderr
+                    )
+                    log = Path(env["SAMBA4X_NETBSD7_LOG"]).read_text()
+                    self.assertIn("Using NetBSD target GMP", log)
+                    self.assertNotIn("lacks __gmpn_zero_p", log)
+                    self.assertIn("nettle 3.10.1 already built.", log)
+
+    def test_switching_gmp_provider_invalidates_nettle_and_gnutls(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            capture = root / "configure-args.txt"
+            env = self.env_for_lane(root, "netbsd7", capture)
+            deps = Path(env["SAMBA4X_NETBSD7_BUILD"]) / "deps"
+            # The fixture is stamped for the adopted target GMP. Reject that GMP
+            # and present the bundled one as already built, so the run reaches
+            # the nettle decision with the other provider selected.
+            env["TEST_NM_ZERO_P"] = "0"
+            self.make_file(deps / ".stamp-gmp-6.3.0")
+            self.make_file(deps / "lib" / "libgmp.a")
+
+            result = self.run_wrapper("samba4x.sh", env)
+
+            self.assertNotEqual(result.returncode, 0)
+            log = Path(env["SAMBA4X_NETBSD7_LOG"]).read_text()
+            self.assertIn("GMP 6.3.0 already built.", log)
+            self.assertNotIn("nettle 3.10.1 already built.", log)
+            self.assertNotIn("GnuTLS 3.8.5 already built.", log)
+            self.assertTrue((deps / NETTLE_SYSTEM_GMP_STAMP).exists())
+            self.assertFalse((deps / NETTLE_BUNDLED_GMP_STAMP).exists())
+            self.assertFalse(capture.exists())
+
+    def test_undefined_zero_p_reference_does_not_count_as_a_definition(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            capture = root / "configure-args.txt"
+            env = self.env_for_lane(root, "netbsd7", capture)
+            # nm lists "U __gmpn_zero_p" for a member that only references the
+            # symbol. Matching the bare name would read that as a definition.
+            env["TEST_NM_ZERO_P"] = "undefined"
+
+            result = self.run_wrapper("samba4x.sh", env)
+
+            self.assertNotEqual(result.returncode, 0)
+            log = Path(env["SAMBA4X_NETBSD7_LOG"]).read_text()
+            self.assertIn("lacks __gmpn_zero_p", log)
+            self.assertNotIn("Using NetBSD target GMP", log)
+
+    def test_adopting_target_gmp_drops_the_bundled_gmp_stamp(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            capture = root / "configure-args.txt"
+            env = self.env_for_lane(root, "netbsd7", capture)
+            deps = Path(env["SAMBA4X_NETBSD7_BUILD"]) / "deps"
+            # An earlier run built the bundled GMP. Both providers install to
+            # the same libgmp.a, so adopting the target one has to retire that
+            # stamp; otherwise a later rejection reuses the adopted archive
+            # while calling it the bundled build.
+            self.make_file(deps / ".stamp-gmp-6.3.0")
+            self.make_file(deps / "lib" / "libgmp.a", "bundled gmp\n")
+
+            adopt = self.run_wrapper("samba4x.sh", env)
+
+            self.assertEqual(adopt.returncode, 0, adopt.stdout + adopt.stderr)
+            self.assertIn(
+                "Using NetBSD target GMP",
+                Path(env["SAMBA4X_NETBSD7_LOG"]).read_text(),
+            )
+            self.assertFalse((deps / ".stamp-gmp-6.3.0").exists())
+
+            # The target GMP is unusable from here on, so the bundled build has
+            # to run again rather than claim it is already done.
+            env["TEST_NM_ZERO_P"] = "0"
+
+            reject = self.run_wrapper("samba4x.sh", env)
+
+            self.assertNotEqual(reject.returncode, 0)
+            log = Path(env["SAMBA4X_NETBSD7_LOG"]).read_text()
+            self.assertIn("NetBSD target GMP is unavailable", log)
+            self.assertNotIn("GMP 6.3.0 already built.", log)
+
 
 if __name__ == "__main__":
     unittest.main()