Verify C++ binaries run with right stdlib

nikobockerman · nikobockerman · commit e091b2b28ce3 · 2026-07-02T22:41:15.000+03:00
diff --git a/.github/workflows/cpp-build-test-run.yaml b/.github/workflows/cpp-build-test-run.yaml
@@ -145,6 +145,32 @@ jobs:
           cmakeListsTxtPath: solvers/cpp/CMakeLists.txt
           workflowPreset: ${{ steps.preset-name.outputs.name }}
 
+      - name: Verify runtime C++ standard library
+        env:
+          MATRIX_CXXLIB: ${{ matrix.cxxLib }}
+          MATRIX_BUILDTYPE: ${{ matrix.buildType }}
+        run: |
+          case "${MATRIX_CXXLIB}" in
+            libstdc++)
+              stdlib=libstdc++
+              expectedPrefix="${HOMEBREW_PREFIX}/opt/gcc@${GCC_MAJOR_VERSION}"
+              ;;
+            libc++)
+              stdlib=libc++
+              if [[ "${MATRIX_BUILDTYPE}" == "hardened" ]]; then
+                expectedPrefix="${HARDENED_LIBCXX_DIR}"
+              else
+                expectedPrefix="${HOMEBREW_PREFIX}/opt/llvm@${LLVM_MAJOR_VERSION}"
+              fi
+              ;;
+            *)
+              echo "::error::Unknown cxxLib: ${MATRIX_CXXLIB}"
+              exit 1
+              ;;
+          esac
+          mise run cpp:verify-runtime-stdlib -- solvers/cpp/build "${stdlib}" "${expectedPrefix}"
+        shell: bash
+
       - name: Restore aoc-main uv project
         uses: ./.github/actions/uv-project-setup
         with:
diff --git a/mise-tasks/cpp/verify-runtime-stdlib.py b/mise-tasks/cpp/verify-runtime-stdlib.py
@@ -0,0 +1,205 @@
+#!/usr/bin/env python3
+# [MISE] description="Verify binaries load the intended libstdc++/libc++ at runtime"
+# [USAGE] arg "<build_dir>" help="CMake build directory to scan"
+# [USAGE] arg "<stdlib>" help="Intended C++ standard library" {
+# [USAGE]   choices "libstdc++" "libc++"
+# [USAGE] }
+# [USAGE] arg "<expected_prefix>" help="Prefix the runtime libraries must load from"
+#
+# Why this exists: -stdlib=... / -L... only affect the *static* link. At runtime the
+# loader resolves the bare SONAME (e.g. libstdc++.so.6) via its own search, which can
+# silently land on a *system* library that happens to be ABI-compatible. Running the
+# tests does not catch that. This task inspects the actual loader resolution of every
+# built binary and asserts the intended library loads from <expected_prefix>.
+import logging
+import os
+import platform
+import subprocess
+import sys
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+_logger = logging.getLogger(os.environ.get("MISE_TASK_NAME", __name__))
+
+# Sentinel: the binary depends on the SONAME but the loader cannot resolve it.
+_NOT_FOUND = "<not-found>"
+
+# Runtime libraries whose load path is pinned, per (stdlib, platform). For libc++ we
+# also pin libunwind (LLVM's unwinder, linked via -lunwind).
+_SONAMES: dict[tuple[str, str], list[str]] = {
+    ("libstdc++", "Linux"): ["libstdc++.so.6"],
+    ("libstdc++", "Darwin"): ["libstdc++.6.dylib"],
+    ("libc++", "Linux"): ["libc++.so.1", "libunwind.so.1"],
+    ("libc++", "Darwin"): ["libc++.1.dylib", "libunwind.1.dylib"],
+}
+
+# MIME types (per `file --mime-type`) of the artifacts we inspect: ELF executables
+# (position-independent or not), shared libraries, and Mach-O images. Objects,
+# archives and text files report other types and are skipped.
+_BINARY_MIME_TYPES = frozenset(
+    {
+        "application/x-executable",
+        "application/x-pie-executable",
+        "application/x-sharedlib",
+        "application/x-mach-binary",
+    }
+)
+
+
+def _run(args: list[str]) -> str:
+    return subprocess.run(  # noqa: S603
+        args,
+        check=False,
+        text=True,
+        stdin=subprocess.DEVNULL,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.DEVNULL,
+    ).stdout
+
+
+def _is_binary(path: Path) -> bool:
+    mime = _run(["file", "--brief", "--mime-type", str(path)]).strip()
+    return mime in _BINARY_MIME_TYPES
+
+
+def _iter_binaries(build_dir: Path) -> Iterator[Path]:
+    for path in sorted(build_dir.rglob("*")):
+        if "CMakeFiles" in path.parts or not path.is_file():
+            continue
+        if _is_binary(path):
+            yield path
+
+
+def _resolved_libs_linux(binary: Path) -> dict[str, str]:
+    # One ldd call yields "SONAME => /resolved/path" (or "=> not found") per dependency.
+    libs: dict[str, str] = {}
+    for line in _run(["ldd", str(binary)]).splitlines():
+        fields = line.split()
+        if "=>" not in fields:
+            continue
+        target = fields[fields.index("=>") + 1]
+        libs[fields[0]] = _NOT_FOUND if target == "not" else target
+    return libs
+
+
+def _macos_rpaths(binary: Path) -> Iterator[str]:
+    lines = _run(["otool", "-l", str(binary)]).splitlines()
+    loader = str(binary.parent)
+    for index, line in enumerate(lines):
+        if line.strip() != "cmd LC_RPATH":
+            continue
+        for follow in lines[index + 1 : index + 4]:
+            stripped = follow.strip()
+            if stripped.startswith("path "):
+                raw = stripped.split(" ", 2)[1]
+                for placeholder in ("@loader_path", "@executable_path"):
+                    raw = raw.replace(placeholder, loader)
+                yield raw
+                break
+
+
+def _resolve_install_name(binary: Path, name: str, rpaths: list[str]) -> str:
+    if name.startswith("/"):
+        return name  # absolute install name: dyld uses it verbatim
+    if name.startswith(("@loader_path/", "@executable_path/")):
+        candidate = binary.parent / name.split("/", 1)[1]
+        return str(candidate) if candidate.exists() else _NOT_FOUND
+    if name.startswith("@rpath/"):
+        suffix = name[len("@rpath/") :]
+        for rpath in rpaths:
+            candidate = Path(rpath) / suffix
+            if candidate.exists():
+                return str(candidate)
+    return _NOT_FOUND
+
+
+def _resolved_libs_macos(binary: Path) -> dict[str, str]:
+    # One otool -L call lists every dependency's install name; resolve each statically.
+    lines = _run(["otool", "-L", str(binary)]).splitlines()[1:]
+    names = [name for name in (line.strip().split(" ", 1)[0] for line in lines) if name]
+    has_rpath = any(name.startswith("@rpath/") for name in names)
+    rpaths = list(_macos_rpaths(binary)) if has_rpath else []
+    libs: dict[str, str] = {}
+    for name in names:
+        libs[name.rsplit("/", 1)[-1]] = _resolve_install_name(binary, name, rpaths)
+    return libs
+
+
+def _resolved_libs(binary: Path) -> dict[str, str]:
+    if platform.system() == "Darwin":
+        return _resolved_libs_macos(binary)
+    return _resolved_libs_linux(binary)
+
+
+def _under_prefix(path: str, prefix: str) -> bool:
+    # Resolve both sides so a Homebrew opt/... prefix matches its Cellar real path.
+    real_path = Path(path).resolve()
+    real_prefix = Path(prefix).resolve()
+    return real_path == real_prefix or real_prefix in real_path.parents
+
+
+def _check(
+    name: str, libs: dict[str, str], soname: str, expected_prefix: str
+) -> bool | None:
+    # None: the binary does not depend on `soname`. True/False: pass/fail (logged).
+    path = libs.get(soname)
+    if path is None:
+        return None
+    if path == _NOT_FOUND:
+        _logger.error("FAIL  %s: %s not found at runtime", name, soname)
+        return False
+    if _under_prefix(path, expected_prefix):
+        _logger.info("ok    %s: %s => %s", name, soname, path)
+        return True
+    msg = "FAIL  %s: %s => %s (want under %s)"
+    _logger.error(msg, name, soname, path, expected_prefix)
+    return False
+
+
+def _verify(binaries: list[Path], sonames: list[str], expected_prefix: str) -> bool:
+    ok = True
+    seen: set[str] = set()
+    for binary in binaries:
+        libs = _resolved_libs(binary)
+        for soname in sonames:
+            result = _check(binary.name, libs, soname, expected_prefix)
+            if result is None:
+                continue
+            seen.add(soname)
+            ok = ok and result
+    # Guard against silently verifying nothing (wrong build dir or unexpected linkage).
+    for soname in sonames:
+        if soname not in seen:
+            _logger.error("FAIL  no binary depends on %s; nothing verified", soname)
+            ok = False
+    return ok
+
+
+def main() -> bool:
+    logging.basicConfig(level=logging.INFO, format="%(message)s")
+
+    build_dir = Path(os.environ["usage_build_dir"])  # noqa: SIM112
+    stdlib = os.environ["usage_stdlib"]  # noqa: SIM112
+    expected_prefix = os.environ["usage_expected_prefix"].rstrip("/")  # noqa: SIM112
+
+    sonames = _SONAMES.get((stdlib, platform.system()))
+    if sonames is None:
+        _logger.error("Unsupported: stdlib=%s platform=%s", stdlib, platform.system())
+        return False
+    binaries = list(_iter_binaries(build_dir))
+    if not binaries:
+        _logger.error("No binaries found under %s", build_dir)
+        return False
+
+    if not _verify(binaries, sonames, expected_prefix):
+        return False
+    _logger.info("runtime-stdlib OK: %s loads from %s", stdlib, expected_prefix)
+    return True
+
+
+if __name__ == "__main__":
+    if not main():
+        sys.exit(1)
