Fix Store-rejected runtime symlinks and gate Snap uploads on review tools (#6)

* Bundle GCC runtimes and remove forbidden external gconv symlinks

* Require Canonical review evidence before exporting or publishing Snap

Author: Kanak234

.github/workflows/snap-publish.yml

@@ -7,7 +7,6 @@ on:
       build_run_id:
         description: Successful snap-strict build run to publish
         required: true
-        default: '39972678135'
       publish_to_store:
         description: Upload and release to Snap Store latest/stable
         type: boolean
@@ -21,7 +20,7 @@ jobs:
     timeout-minutes: 20
     env:
       GH_TOKEN: ${{ github.token }}
-      BUILD_RUN_ID: ${{ inputs.build_run_id || '39972678135' }}
+      BUILD_RUN_ID: ${{ inputs.build_run_id }}
     steps:
       - name: Require successful strict build
         id: source
@@ -57,6 +56,8 @@ jobs:
           assert metadata['confinement'] == 'strict'
           version = str(metadata['version'])
           assert re.fullmatch(r'[0-9]+\.[0-9]+\.[0-9]+', version)
+          reviews = list(pathlib.Path('package').rglob('snap-review.json'))
+          assert len(reviews) == 1 and reviews[0].stat().st_size > 0, 'Missing Canonical Store review evidence'
           evidence = list(pathlib.Path('package').rglob('gui-smoke.json'))
           assert len(evidence) == 1 and json.loads(evidence[0].read_text())['status'] == 'PASS'
           with open(os.environ['GITHUB_OUTPUT'], 'a') as f:

.github/workflows/snap.yml

@@ -2,7 +2,7 @@ name: snap-strict
 on:
   workflow_dispatch:
   push:
-    branches: [fix/snap-strict-release]
+    branches: [fix/snap-external-links]
 permissions:
   contents: read
 jobs:
@@ -14,6 +14,14 @@ jobs:
       - name: Build strict snap
         uses: snapcore/action-build@v1
         id: build
+      - name: Check package with Canonical Store review tools
+        env:
+          SNAP_FILE: ${{ steps.build.outputs.snap }}
+        run: |
+          sudo snap install review-tools
+          mkdir -p "$HOME/snap/review-tools/common"
+          cp "$SNAP_FILE" "$HOME/snap/review-tools/common/medha.snap"
+          review-tools.snap-review "$HOME/snap/review-tools/common/medha.snap" --json > snap-review.json
       - name: Verify confinement and install test package
         env:
           SNAP_FILE: ${{ steps.build.outputs.snap }}
@@ -29,11 +37,20 @@ jobs:
           export MEDHA_SMOKE_RESULT="$HOME/snap/medha-ide/common/gui-smoke.json"
           timeout 180 snap run medha-ide --smoke-gui
           python3 -c 'import json,os; assert json.load(open(os.environ["MEDHA_SMOKE_RESULT"]))["status"] == "PASS"'
+      - name: Test C++ shared runtime inside confinement
+        run: |
+          cat > "$HOME/snap/medha-ide/common/cpp-runtime.cpp" <<'CPP'
+          #include <iostream>
+          #include <stdexcept>
+          int main() { try { throw std::runtime_error("CPP_RUNTIME_PASS"); } catch (const std::exception& e) { std::cout << e.what() << std::endl; } }
+          CPP
+          snap run --shell medha-ide -c '"$SNAP/toolwrap/g++" "$SNAP_USER_COMMON/cpp-runtime.cpp" -o "$SNAP_USER_COMMON/cpp-runtime" && "$SNAP_USER_COMMON/cpp-runtime"' | tee cpp-runtime.log
+          grep -qx CPP_RUNTIME_PASS cpp-runtime.log
       - name: Collect test evidence
         if: always()
         run: |
           mkdir -p snap-evidence
-          cp snap-metadata.yaml snap-evidence/ 2>/dev/null || true
+          cp snap-metadata.yaml snap-review.json cpp-runtime.log snap-evidence/ 2>/dev/null || true
           cp "$HOME"/snap/medha-ide/common/gui-smoke.* snap-evidence/ 2>/dev/null || true
       - uses: actions/upload-artifact@v4
         if: always()

snap/snapcraft.yaml

@@ -143,27 +143,32 @@ parts:
       - libstdc++6
       - make
 
-  # glibc runtime files are part of the core24 base, so snapcraft does NOT stage them.
-  # But `gcc --sysroot=$SNAP` makes the linker look for e.g. /lib/x86_64-linux-gnu/libm.so.6
-  # INSIDE $SNAP. WHAT this part does: for every runtime .so of libc6 / libgcc-s1 / libstdc++6
-  # that is not already in the snap, add an absolute symlink pointing to the same path.
-  # Inside the snap's mount namespace "/" IS core24, so the link resolves to the base's copy.
-  # (Verified: C + C++ compile and run with host headers hidden, only the sysroot visible.)
+  # GCC's sysroot needs the core24 libc linker targets. Only libc runtime
+  # targets may point into the base. Bundle GCC/C++ runtimes, and omit gconv
+  # module aliases (the running libc already loads those from the base).
   libc-links:
     plugin: nil
-    # Prime the Python venv first: it creates lib64 -> lib. Creating a real
-    # lib64 directory before that makes python-deps fail with IsADirectoryError.
+    # The Python venv must prime lib64 -> lib before these linker aliases.
     after: [compilers, python-deps]
     override-prime: |
       craftctl default
       for pkg in libc6 libgcc-s1 libstdc++6; do
         dpkg -L "$pkg" 2>/dev/null | grep -E '^/(usr/)?lib(64)?/.*\.so[.0-9]*$' | while read -r f; do
-          # WHY both paths: noble ships glibc in /usr/lib, but libc6-dev's linker scripts
-          # (libc.so, libm.so) still name /lib/x86_64-linux-gnu/... and /lib64/ld-linux...
+          case "$f" in */gconv/*) continue ;; esac
+          if [ "$pkg" != libc6 ] && [ ! -e "$CRAFT_PRIME$f" ]; then
+            mkdir -p "$(dirname "$CRAFT_PRIME$f")"
+            cp -L "$f" "$CRAFT_PRIME$f"
+          fi
+          # Noble uses /usr/lib; glibc linker scripts also reference /lib.
           for t in "$f" "${f#/usr}"; do
             [ -e "$CRAFT_PRIME$t" ] || [ -L "$CRAFT_PRIME$t" ] && continue
             mkdir -p "$(dirname "$CRAFT_PRIME$t")"
-            ln -s "$f" "$CRAFT_PRIME$t"
+            if [ "$pkg" = libc6 ]; then
+              ln -s "$f" "$CRAFT_PRIME$t"
+            else
+              target=$(realpath --relative-to="$(dirname "$CRAFT_PRIME$t")" "$CRAFT_PRIME$f")
+              ln -s "$target" "$CRAFT_PRIME$t"
+            fi
           done
         done
       done