fp-stability: install Verrou from prebuilt artifact (verrou-dist), build as fallback

verrou.sh now downloads a pinned, hash-verified prebuilt from sbryngelson/verrou-dist@v1 (seconds) and falls back to the ~20-min source build; idempotency check sources env.sh so a relocated prebuilt isn't re-fetched. fp_stability sets VALGRIND_LIB (via _verrou_env, reused by _dd_env) so a relocated tree's valgrind/verrou_dd_* calls resolve — harmless for source builds. CI installs zstd and sources env.sh before verifying.

Author: sbryngelson

.github/workflows/fp-stability.yml

@@ -68,22 +68,26 @@ jobs:
         uses: actions/cache@v4
         with:
           path: ~/.local/verrou
-          # Keep these versions in sync with toolchain/bootstrap/verrou.sh (the builder).
+          # Keep these versions in sync with toolchain/bootstrap/verrou.sh (the installer).
           key: verrou-a58d434-valgrind-3.26.0-${{ runner.os }}
 
       - name: Install system dependencies
         run: |
           sudo apt-get update -y
           sudo apt-get install -y \
             build-essential automake python3 python3-numpy libc6-dbg \
-            cmake gfortran
+            cmake gfortran zstd
 
-      - name: Build Verrou
+      - name: Install Verrou (prebuilt artifact, or source build as fallback)
         if: steps.cache-verrou.outputs.cache-hit != 'true'
         run: bash toolchain/bootstrap/verrou.sh
 
       - name: Verify Verrou
-        run: ~/.local/verrou/bin/valgrind --tool=verrou --version
+        # Source env.sh first: a prebuilt (relocated) tree needs VALGRIND_LIB; a
+        # source build works either way. (fp-stability sets this itself at runtime.)
+        run: |
+          [ -f ~/.local/verrou/env.sh ] && . ~/.local/verrou/env.sh
+          ~/.local/verrou/bin/valgrind --tool=verrou --version
 
       - name: Build MFC (debug, serial)
         # FFLAGS=-fno-inline prevents gfortran from inlining small functions into

toolchain/bootstrap/verrou.sh

@@ -2,26 +2,34 @@
 #
 # Opt-in installer for Verrou (the Valgrind FP-perturbation tool used by
 # `./mfc.sh fp-stability`). Verrou is NOT a Python/pip package — it is a fork of
-# Valgrind that must be compiled from source (~20 min), so this is a deliberate,
-# explicit step rather than something `fp-stability` does silently.
+# Valgrind. By default this downloads a prebuilt, hash-verified artifact (seconds);
+# if none is available for this tag/arch it falls back to a source build (~20 min).
+# Either way it's a deliberate, explicit step, not something fp-stability does silently.
 #
-#   bash toolchain/bootstrap/verrou.sh            # build into $HOME/.local/verrou
+#   bash toolchain/bootstrap/verrou.sh            # install into $HOME/.local/verrou
 #   VERROU_HOME=/path bash toolchain/bootstrap/verrou.sh
-#   bash toolchain/bootstrap/verrou.sh --force    # rebuild even if present
+#   bash toolchain/bootstrap/verrou.sh --force    # reinstall even if present
+#   VERROU_BUILD_FROM_SOURCE=1 bash toolchain/bootstrap/verrou.sh   # skip the prebuilt
 #
 # Versions are pinned to match the fp-stability CI workflow.
 
 set -euo pipefail
 
 VALGRIND_VERSION="3.26.0"
 VERROU_COMMIT="a58d434"
+# Prebuilt artifacts (built once per arch) live in a small companion repo. The tag
+# pins to the (valgrind, verrou) pair above — bump all three together.
+VERROU_DIST_REPO="${VERROU_DIST_REPO:-sbryngelson/verrou-dist}"
+VERROU_DIST_TAG="${VERROU_DIST_TAG:-v1}"
 PREFIX="${VERROU_HOME:-$HOME/.local/verrou}"
 FORCE="${1:-}"
 
 echo "==> Verrou bootstrap (Valgrind ${VALGRIND_VERSION} + edf-hpc/verrou@${VERROU_COMMIT}) -> ${PREFIX}"
 
-# Idempotent: skip if already installed and working.
-if [ "$FORCE" != "--force" ] && [ -x "${PREFIX}/bin/valgrind" ] && "${PREFIX}/bin/valgrind" --tool=verrou --version >/dev/null 2>&1; then
+# Idempotent: skip if already installed and working. Source env.sh first if present
+# (a prebuilt tree needs VALGRIND_LIB to run; a source build works either way).
+if [ "$FORCE" != "--force" ] && [ -x "${PREFIX}/bin/valgrind" ] \
+   && ( [ -f "${PREFIX}/env.sh" ] && . "${PREFIX}/env.sh"; "${PREFIX}/bin/valgrind" --tool=verrou --version >/dev/null 2>&1 ); then
     echo "==> Verrou already installed at ${PREFIX} (use --force to rebuild). Nothing to do."
     exit 0
 fi
@@ -31,9 +39,11 @@ if [ "$(uname -s)" != "Linux" ]; then
     echo "ERROR: Verrou requires Linux (Valgrind does not support modern macOS, incl. Apple Silicon)." >&2
     exit 1
 fi
+arch_tag=""
 case "$(uname -m)" in
-    x86_64) ;;
+    x86_64) arch_tag="x86_64" ;;
     aarch64|arm64)
+        arch_tag="aarch64"
         echo "WARNING: $(uname -m) detected. Valgrind builds here, but Verrou's FP backends are" >&2
         echo "         best-validated on x86_64 — treat results as experimental on this arch." >&2
         ;;
@@ -42,6 +52,59 @@ case "$(uname -m)" in
         ;;
 esac
 
+# Fast path: download a prebuilt, hash-verified artifact and source its relocatable
+# env.sh, instead of building from source. Any failure (no asset for this arch/tag,
+# missing zstd/sha256sum, checksum mismatch, won't run) falls through to the build.
+try_prebuilt() {
+    [ -n "$arch_tag" ] || return 1
+    [ "${VERROU_BUILD_FROM_SOURCE:-}" = "1" ] && return 1
+    command -v sha256sum >/dev/null 2>&1 || return 1
+    tar --zstd --help >/dev/null 2>&1 || command -v zstd >/dev/null 2>&1 || return 1
+    command -v curl >/dev/null 2>&1 || command -v wget >/dev/null 2>&1 || return 1
+
+    local asset base dl
+    asset="verrou-${VERROU_COMMIT}-valgrind-${VALGRIND_VERSION}-linux-${arch_tag}.tar.zst"
+    base="https://github.com/${VERROU_DIST_REPO}/releases/download/${VERROU_DIST_TAG}/${asset}"
+    dl="$(mktemp -d)"
+
+    echo "==> Trying prebuilt ${VERROU_DIST_REPO}@${VERROU_DIST_TAG} (${asset})"
+    _fetch() {  # url dest
+        if command -v curl >/dev/null 2>&1; then curl -fsSL -o "$2" "$1"; else wget -q -O "$2" "$1"; fi
+    }
+    if ! _fetch "$base" "$dl/$asset" || ! _fetch "$base.sha256" "$dl/$asset.sha256"; then
+        echo "==> No prebuilt for this tag/arch — building from source instead."
+        rm -rf "$dl"; return 1
+    fi
+    if ! ( cd "$dl" && sha256sum -c "$asset.sha256" >/dev/null 2>&1 ); then
+        echo "WARNING: prebuilt checksum mismatch — building from source instead." >&2
+        rm -rf "$dl"; return 1
+    fi
+
+    mkdir -p "$PREFIX"
+    if tar --zstd --help >/dev/null 2>&1; then
+        tar -C "$PREFIX" --zstd -xf "$dl/$asset"
+    else
+        zstd -dc "$dl/$asset" | tar -C "$PREFIX" -xf -
+    fi
+    rm -rf "$dl"
+
+    # Valgrind bakes its build prefix into the binary; the artifact's env.sh sets
+    # VALGRIND_LIB relative to the extracted tree so the relocated install works.
+    if ! ( . "${PREFIX}/env.sh" && "${PREFIX}/bin/valgrind" --tool=verrou --version >/dev/null 2>&1 ); then
+        echo "WARNING: prebuilt did not run — building from source instead." >&2
+        return 1
+    fi
+    return 0
+}
+
+if try_prebuilt; then
+    echo "==> Verifying"
+    ( . "${PREFIX}/env.sh" && "${PREFIX}/bin/valgrind" --tool=verrou --version )
+    echo "==> Done (prebuilt). Verrou installed at ${PREFIX}"
+    echo "    Run:  ./mfc.sh fp-stability   (or set VERROU_HOME=${PREFIX} if you used a custom prefix)"
+    exit 0
+fi
+
 # Build dependencies.
 missing=""
 for tool in tar git make patch autoconf automake; do

toolchain/mfc/fp_stability_runners.py

@@ -60,6 +60,19 @@ def _verrou_pythonpath(verrou_bin: str) -> str:
     return matches[0] if matches else ""
 
 
+def _verrou_env(verrou_bin: str) -> dict:
+    """os.environ plus VALGRIND_LIB, so a relocated install tree (e.g. a prebuilt
+    artifact extracted to a new prefix) can locate its tool — Valgrind bakes its
+    build prefix into the binary otherwise. Harmless for a source-built tree, where
+    VALGRIND_LIB just equals the compiled-in path. A VALGRIND_LIB already in the
+    environment (user sourced env.sh) is left untouched."""
+    env = os.environ.copy()
+    libdir = os.path.join(os.path.dirname(os.path.dirname(verrou_bin)), "libexec", "valgrind")
+    if "VALGRIND_LIB" not in env and os.path.isdir(libdir):
+        env["VALGRIND_LIB"] = libdir
+    return env
+
+
 def _write_inp(params: dict, target_name: str, work_dir: str) -> None:
     """Write a Fortran namelist .inp file from a Python params dict."""
     from .run import case_dicts
@@ -107,7 +120,7 @@ def _run_simulation_verrou(
         cmd.append(sim_bin)
 
         with open(os.path.join(run_dir, "sim.out"), "w") as f:
-            result = subprocess.run(cmd, cwd=tmpdir, stdout=f, stderr=subprocess.STDOUT, check=False)
+            result = subprocess.run(cmd, cwd=tmpdir, env=_verrou_env(verrou_bin), stdout=f, stderr=subprocess.STDOUT, check=False)
 
         if result.returncode != 0:
             tag = rounding_mode or "vprec"
@@ -312,9 +325,10 @@ def _write_dd_cmp_py(path: str, compare_files: list, threshold: float):
 
 
 def _dd_env(verrou_bin: str) -> dict:
-    """Environment with PYTHONPATH set for verrou_dd_* imports."""
+    """Environment for verrou_dd_*: VALGRIND_LIB (so a relocated tree's inner valgrind
+    calls resolve) plus PYTHONPATH (for the verrou_dd_* imports)."""
     py_pkg = _verrou_pythonpath(verrou_bin)
-    env = os.environ.copy()
+    env = _verrou_env(verrou_bin)
     if py_pkg:
         existing = env.get("PYTHONPATH", "")
         env["PYTHONPATH"] = ":".join(filter(None, [py_pkg, existing]))