feat(libexec): bklibcvenv — extract glibc wrapper-script pattern

Extracts the recipe-side hermetic libc-bundling pattern @jhheider
just validated inline in pkgxdev/pantry@5354c73f. Recipes that ship
their own libc (glibc today; musl, custom libcs tomorrow) get a
~one-line call:

  - bklibcvenv seal {{prefix}} glibc-{{version.marketing}}

instead of the ~20-line inline wrapper-installer that's currently
duplicated in the glibc recipe.

## Shape

Mirror of libexec/bkpyvenv (Python venv → relocatable stubs):

  libexec/bklibcvenv                 — the helper script
  share/brewkit/libcvenv-wrapper.sh  — the POSIX sh wrapper template

The helper:
  1. takes `<prefix> <libdir-name>` as args
  2. auto-detects LDSO from `uname -m` (overridable via LDSO env)
  3. for each ELF in <prefix>/{bin,sbin}/* with a PT_INTERP:
       - moves it to <prefix>/libexec/<libc-name>-<dir>/
       - replaces it with a sed-templated sh wrapper
  4. wrapper does `cd $(dirname $0)/..` to compute prefix at
     runtime, then `exec $libdir/$ldso --library-path $libdir
     $libexec_path "$@"`

`<libc-name>` (libdir-name up to first '-') prefixes the libexec
subdir so multiple libc bottles can coexist (glibc + musl):
  - libexec/glibc-bin/
  - libexec/glibc-sbin/

## Why this is useful

- **Fully relocatable** — bottle extracted at `/opt`, `~/.pkgx`, or
  any other path works the same; no absolute paths baked in.
- **Sidesteps PT_INTERP** — invoking ld.so explicitly via wrapper
  ignores the ELF's PT_INTERP. brewkit's fix-elf currently can't
  rewrite PT_INTERP anyway (#345) and the bottle's
  own ld.so suffers from fix-elf's RPATH pollution when not
  `build.skip: fix-patchelf`'d.
- **Reusable** — same shape works for musl, dietlibc, or any
  alternate libc anyone packages.

## Connection to bkwinvenv (#347)

The Windows analog (`bkwinvenv`, sketched at #347) uses the same
seal-into-libexec + emit-wrapper-script structure, just with `.cmd`
wrappers + Windows DLL search-order semantics (no explicit loader
invocation; co-location with the inner .exe is enough). Validating
this Linux pattern empirically (which @jhheider's commit does)
validates the Windows design too.

## Migration

Once this lands, pkgxdev/pantry's glibc recipe can shrink its
inline wrapper-installer block (currently ~20 lines + a prop:
template) to one line. Same for any future libc recipe.

Refs: #344 (this RFC), #347
(bkwinvenv sibling), pkgxdev/pantry@5354c73f (origin of pattern).

Author: tannevaled

libexec/bklibcvenv

@@ -0,0 +1,106 @@
+#!/usr/bin/env -S pkgx +nixos.org/patchelf bash
+# bklibcvenv — hermetic libc bundler for relocatable libc bottles.
+#
+# Mirror of libexec/bkpyvenv. Recipe-side helper that makes a libc
+# bottle (glibc, eventually musl etc.) ship its bin/* + sbin/* as
+# POSIX-sh wrappers that route through the bundled ld.so by relative
+# path, so the bottle is fully relocatable.
+#
+# Usage:
+#   bklibcvenv seal <prefix> <libdir-name>
+#
+# Where:
+#   <prefix>       install root (e.g. {{prefix}})
+#   <libdir-name>  subdir of <prefix>/lib/ containing libc.so.6 + ld.so
+#                  (e.g. "glibc-2.43"). The script derives:
+#                    LIBC_NAME = libdir-name up to the first '-'
+#                    (so "glibc-2.43" → "glibc")
+#                  LIBC_NAME is used as the libexec subdir prefix
+#                  (libexec/<LIBC_NAME>-bin/, libexec/<LIBC_NAME>-sbin/)
+#                  so multiple libc bottles can coexist without colliding.
+#
+# Effect: for each ELF in <prefix>/{bin,sbin}/* that has a PT_INTERP,
+#   - move it to <prefix>/libexec/<LIBC_NAME>-<dir>/
+#   - replace <prefix>/<dir>/<name> with a POSIX sh wrapper that:
+#     * resolves its own bindir (handles invocation by path or PATH)
+#     * climbs to prefix
+#     * invokes <prefix>/lib/<libdir-name>/<LDSO> --library-path …
+#       <prefix>/libexec/<LIBC_NAME>-<dir>/<name> "$@"
+#
+# LDSO is auto-detected from `uname -m`. Override via LDSO env var
+# if needed (cross-arch host, exotic loader name, etc.).
+#
+# Refs: pkgxdev/brewkit#344 (RFC), pkgxdev/pantry@5354c73f (the
+# inline-in-glibc-recipe origin of this pattern by @jhheider).
+
+set -eo pipefail
+
+CMD=$1; shift
+
+case "$CMD" in
+  seal)
+    if [ $# -lt 2 ]; then
+      echo "bklibcvenv seal: missing args" >&2
+      echo "usage: $0 seal <prefix> <libdir-name>" >&2
+      exit 64
+    fi
+
+    PREFIX=$1
+    LIBDIR_NAME=$2
+
+    # Auto-detect ld.so name from arch. Override-able via LDSO env.
+    if [ -z "${LDSO:-}" ]; then
+      case "$(uname -m)" in
+        x86_64)        LDSO=ld-linux-x86-64.so.2 ;;
+        aarch64|arm64) LDSO=ld-linux-aarch64.so.1 ;;
+        armv7*|armhf)  LDSO=ld-linux-armhf.so.3 ;;
+        i686|i386)     LDSO=ld-linux.so.2 ;;
+        *) echo "bklibcvenv: unsupported arch $(uname -m); set LDSO env" >&2; exit 1 ;;
+      esac
+    fi
+
+    # libc name from libdir's first dash-separated component.
+    LIBC_NAME=${LIBDIR_NAME%%-*}
+
+    # Locate the wrapper template (share/brewkit/libcvenv-wrapper.sh).
+    SELF_DIR=$(CDPATH= cd -- "$(dirname "$0")" && pwd)
+    TEMPLATE="$SELF_DIR/../share/brewkit/libcvenv-wrapper.sh"
+    if [ ! -f "$TEMPLATE" ]; then
+      echo "bklibcvenv: wrapper template not found at $TEMPLATE" >&2
+      exit 2
+    fi
+
+    set -x
+
+    for dir in bin sbin; do
+      [ -d "$PREFIX/$dir" ] || continue
+      mkdir -p "$PREFIX/libexec/$LIBC_NAME-$dir"
+
+      for f in "$PREFIX/$dir"/*; do
+        [ -f "$f" ] && [ ! -L "$f" ] || continue
+        # Skip non-ELF (shell scripts, etc.) — patchelf exits non-zero
+        # when the file isn't an ELF with a PT_INTERP.
+        patchelf --print-interpreter "$f" >/dev/null 2>&1 || continue
+
+        name=$(basename "$f")
+        mv "$f" "$PREFIX/libexec/$LIBC_NAME-$dir/"
+
+        sed \
+          -e "s|@LDSO@|$LDSO|g" \
+          -e "s|@LIBDIR@|$LIBDIR_NAME|g" \
+          -e "s|@LIBC_NAME@|$LIBC_NAME|g" \
+          -e "s|@DIR@|$dir|g" \
+          "$TEMPLATE" > "$f"
+        chmod 775 "$f"
+
+        echo "wrapped $f"
+      done
+    done
+    ;;
+
+  *)
+    echo "bklibcvenv: unknown subcommand '$CMD'" >&2
+    echo "usage: $0 seal <prefix> <libdir-name>" >&2
+    exit 64
+    ;;
+esac

share/brewkit/libcvenv-wrapper.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+# Template for bklibcvenv-generated wrappers.
+#
+# Replaced by `bklibcvenv seal`:
+#   @LDSO@      e.g. ld-linux-x86-64.so.2
+#   @LIBDIR@    e.g. glibc-2.43  (subdir of $prefix/lib/)
+#   @LIBC_NAME@ e.g. glibc       (prefix for libexec/<libc>-<dir>/)
+#   @DIR@       e.g. bin         (or sbin)
+
+case "$0" in
+  */*) bindir=${0%/*} ;;
+  *) bindir=$(command -v -- "$0"); bindir=${bindir%/*} ;;
+esac
+
+prefix=$(CDPATH= cd -- "$bindir/.." && pwd)
+libdir="$prefix/lib/@LIBDIR@"
+
+exec "$libdir/@LDSO@" --library-path "$libdir" "$prefix/libexec/@LIBC_NAME@-@DIR@/$(basename "$0")" "$@"