switch (tag) {

case SearchPathTag::None: return "none";

case SearchPathTag::Rpath: return "DT_RPATH";

case SearchPathTag::Runpath: return "DT_RUNPATH";

case SearchPathTag::Both: return "DT_RPATH+DT_RUNPATH";

}

return "none";

std::filesystem::path artifact;

std::uint16_t elfType = 0;

std::string interp;

std::string soname;

std::vector<std::string> runpaths;

SearchPathTag searchPathTag = SearchPathTag::None;

std::vector<std::string> needed;

std::vector<std::string> requiredGlibcVersions;

std::vector<std::string> definedGlibcVersions;

std::filesystem::path resolvedLibc;

std::vector<std::filesystem::path> resolvedObjects;

// "Is this an executable" is PT_INTERP, not ET_EXEC: a PIE executable is

// ET_DYN and therefore indistinguishable from a shared library by type

// alone. The loader-tag contract splits exactly along this line, so the

// predicate lives with the facts rather than in each caller.

bool is_executable() const { return !interp.empty(); }

ElfRuntimeFacts artifact;

std::vector<ElfRuntimeFacts> objects;

std::vector<std::filesystem::path> resolvedLibcs;

// Everything that stopped the walk, as human-readable text. A mixed bag on

// purpose: an object that could not be parsed, a closure that hit the size

// cap, and a SONAME nothing provides all belong in the report.

std::vector<std::string> unresolved;

// The strict subset that means "a DT_NEEDED nothing on the search path

// provides". SEPARATE because only this one is PROVABLE.

//

// `unresolved` also collects "I could not read this file" and "I stopped

// after 512 objects", which are statements about the CHECK, not about the

// artifact. Treating the whole bag as proof made a cross-built PE fail its

// build: `crosswin.exe` is not ELF, that fact landed in `unresolved`, and a

// "you are missing a library" verdict was issued for a file with no

// DT_NEEDED at all. Caught by CI, not by reading.

std::vector<std::string> unresolvedSonames;

// Did the artifact itself parse as ELF? False ⇒ the ELF rules do not apply

// to it, whatever the binding says. The binding describes the HOST; a cross

// build's artifact is a different format entirely.

bool artifactIsElf = false;

// FOUR-VALUED, and the third one is this round's addition.

//

// Pass every rule that applies was checked and held

// ProvenMismatch two runtime payloads are being mixed

// Unresolvable a DT_NEEDED cannot be found anywhere the artifact's

// loader will look — the artifact provably cannot start

// Inconclusive a rule that applies could not be evaluated

//

// `Unresolvable` used to be folded into `Inconclusive`, which reports a

// PROVEN failure as "not checked". Under a hermetic binding the artifact's

// PT_INTERP names a private loader whose search path mcpp computes in

// full, so "not found" is a measurement, not an absence of one.

enum class Status { Pass, ProvenMismatch, Unresolvable, Inconclusive };

Status status = Status::Pass;

std::vector<std::string> diagnostics;

// Does this verdict mean the artifact is known-bad? Both blocking states

// spelled once, so a caller cannot check for one and silently accept the

// other.

bool blocking() const {

return status == Status::ProvenMismatch || status == Status::Unresolvable;

}

std::string explain() const {

std::string out;

for (auto const& diagnostic : diagnostics) {

if (!out.empty()) out.push_back('\n');

out += diagnostic;

}

return out;

}

std::string name;

// STT_FUNC (or STT_GNU_IFUNC). Load-bearing rather than informational: a

// copy relocation moves DATA out of a shared library into the image that

// links it, so it is never a function. A defined FUNC in an executable's

// dynamic symbol table therefore has exactly one cause — the linker

// exported it so that some shared object's reference would bind to it.

bool isFunc = false;

std::uint64_t value = 0; // st_value; the key a copy relocation matches

// GLOBAL/WEAK entries with st_shndx != SHN_UNDEF.

std::vector<DynamicSymbol> defined;

// The whole table, including undefined imports. This is the DENOMINATOR a

// report quotes: "0 of 217" and "not measured" must not read the same.

std::size_t total = 0;

// Addresses named by an R_<machine>_COPY relocation.

//

// ADDRESS, not name, and that distinction is measured rather than

// reasoned: glibc's `environ` is a WEAK alias of `__environ` at the same

// address, and only `__environ` appears in the relocation table. Matching

// by name reports `environ` as a hijacked symbol in every single

// dynamically linked executable.

std::set<std::uint64_t> copyRelocations;

// Did we recognise this object's machine well enough to know its COPY

// relocation type? False means the copy-relocation set above is EMPTY

// BECAUSE IT WAS NOT COMPUTED, not because there are none — a caller must

// report "not evaluated" rather than "clean".

bool copyRelocationsKnown = false;

// Does this object have a dynamic symbol table at all? A fully static

// link has none, and "nothing to check" is a different answer from

// "checked and found nothing".

bool present = false;

switch (machine) {

case 3: return 5; // EM_386 R_386_COPY

case 20: return 19; // EM_PPC R_PPC_COPY

case 21: return 19; // EM_PPC64 R_PPC64_COPY

case 22: return 9; // EM_S390 R_390_COPY

case 40: return 20; // EM_ARM R_ARM_COPY

case 62: return 5; // EM_X86_64 R_X86_64_COPY

case 183: return 1024; // EM_AARCH64 R_AARCH64_COPY

case 243: return 4; // EM_RISCV R_RISCV_COPY

case 258: return 4; // EM_LOONGARCH R_LARCH_COPY

default: return std::nullopt;

}

std::vector<unsigned char> bytes;

bool range(std::uint64_t off, std::uint64_t size) const {

return off <= bytes.size() && size <= bytes.size() - off;

}

std::optional<std::uint16_t> u16(std::uint64_t off) const {

if (!range(off, 2)) return std::nullopt;

return static_cast<std::uint16_t>(bytes[off])

| static_cast<std::uint16_t>(bytes[off + 1] << 8);

}

std::optional<std::uint32_t> u32(std::uint64_t off) const {

if (!range(off, 4)) return std::nullopt;

std::uint32_t value = 0;

for (int i = 3; i >= 0; --i)

value = (value << 8) | bytes[off + static_cast<std::uint64_t>(i)];

return value;

}

std::optional<std::uint64_t> u64(std::uint64_t off) const {

if (!range(off, 8)) return std::nullopt;

std::uint64_t value = 0;

for (int i = 7; i >= 0; --i)

value = (value << 8) | bytes[off + static_cast<std::uint64_t>(i)];

return value;

}

std::optional<std::string> cstr(std::uint64_t off,

std::uint64_t limit) const {

if (!range(off, 1) || limit == 0) return std::nullopt;

const auto end = std::min<std::uint64_t>(bytes.size(), off + limit);

std::string out;

for (auto p = off; p < end; ++p) {

if (bytes[p] == 0) return out;

out.push_back(static_cast<char>(bytes[p]));

}

return std::nullopt;

}

std::uint32_t type = 0;

std::uint64_t offset = 0;

std::uint64_t vaddr = 0;

std::uint64_t filesz = 0;

std::uint64_t address,

std::uint64_t size = 1) {

for (auto const& segment : segments) {

if (segment.type != kPtLoad || address < segment.vaddr) continue;

auto delta = address - segment.vaddr;

if (delta <= segment.filesz && size <= segment.filesz - delta)

return segment.offset + delta;

}

return std::nullopt;

std::vector<std::string> out;

for (auto& value : values) {

if (std::ranges::find(out, value) == out.end())

out.push_back(std::move(value));

}

values = std::move(out);

for (std::size_t start = 0; start <= value.size();) {

auto end = value.find(':', start);

auto item = value.substr(start, end == std::string_view::npos

? std::string_view::npos : end - start);

if (!item.empty()) out.emplace_back(item);

if (end == std::string_view::npos) break;

start = end + 1;

}

if (path.empty()) return {};

std::error_code ec;

auto canonical = std::filesystem::weakly_canonical(path, ec);

return ec ? path.lexically_normal() : canonical;

const std::filesystem::path& rhs) {

return !lhs.empty() && !rhs.empty()

&& comparable_path(lhs) == comparable_path(rhs);

const std::filesystem::path& object) {

const auto origin = object.parent_path().generic_string();

for (auto token : {std::string_view("${ORIGIN}"), std::string_view("$ORIGIN")}) {

for (auto pos = value.find(token); pos != std::string::npos;

pos = value.find(token, pos + origin.size()))

value.replace(pos, token.size(), origin);

}

return value;

std::filesystem::path path) {

if (path.empty()) return;

path = path.lexically_normal();

if (std::ranges::find(out, path) == out.end()) out.push_back(std::move(path));

std::vector<std::filesystem::path> out;

const auto arch = std::string(mcpp::platform::host_arch);

std::string triple;

if (arch == "x86_64") triple = "x86_64-linux-gnu";

else if (arch == "aarch64") triple = "aarch64-linux-gnu";

if (!triple.empty()) {

out.emplace_back(std::filesystem::path("/lib") / triple);

out.emplace_back(std::filesystem::path("/usr/lib") / triple);

}

out.emplace_back("/lib64");

out.emplace_back("/usr/lib64");

out.emplace_back("/lib");

out.emplace_back("/usr/lib");

return out;

std::string_view soname,

const ElfRuntimeFacts& requester,

const mcpp::platform::runtime::RuntimeBinding& binding,

std::span<const std::filesystem::path> additionalSearchDirs) {

std::filesystem::path named(soname);

std::error_code ec;

if (named.has_parent_path()) {

auto candidate = named.is_absolute()

? named : requester.artifact.parent_path() / named;

if (std::filesystem::is_regular_file(candidate, ec))

return comparable_path(candidate);

return std::nullopt;

}

std::vector<std::filesystem::path> dirs;

for (auto const& raw : requester.runpaths)

append_unique_path(dirs, expand_origin(raw, requester.artifact));

for (auto const& dir : additionalSearchDirs) append_unique_path(dirs, dir);

for (auto const& dir : binding.libraryDirs) append_unique_path(dirs, dir);

// NOTE: the SubOS farm is NOT read from the binding here.

//

// It reaches this function through `additionalSearchDirs`, which the caller

// builds from the PLAN — and the plan is where the guards live (no farm for

// a cross target, none for a non-ELF format). Reading `binding.searchDirs`

// directly would put this host's x86_64 farm on the search path of an

// aarch64 artifact that has no such entry in its DT_RPATH, and report a

// pass the target machine will not honour. The model must look exactly

// where the artifact looks, no wider.

//

// The host loader's built-in defaults — ONLY when the artifact runs under

// the host loader.

//

// A hermetic artifact's PT_INTERP names a private loader compiled with a

// different default path, so adding /usr/lib here models the wrong loader.

// Measured: a GL program that cannot start was reported `validation: pass`

// because the HOST happened to have libGL.so.1 and the model found it

// there. When the model and the artifact disagree about which loader runs,

// the model wins the report and the artifact wins reality.

if (!binding.hermetic())

for (auto const& dir : host_library_dirs()) append_unique_path(dirs, dir);

for (auto const& dir : dirs) {

auto candidate = dir / named;

ec.clear();

if (std::filesystem::is_regular_file(candidate, ec))

return comparable_path(candidate);

}

return std::nullopt;

constexpr std::string_view prefix = "GLIBC_";

if (!value.starts_with(prefix)) return std::nullopt;

value.remove_prefix(prefix.size());

if (value.empty()) return std::nullopt;

std::vector<unsigned> parts;

for (std::size_t start = 0; start <= value.size();) {

auto end = value.find('.', start);

auto part = value.substr(start, end == std::string_view::npos

? std::string_view::npos : end - start);

if (part.empty() || !std::ranges::all_of(part, [](unsigned char c) {

return std::isdigit(c) != 0;

}))

return std::nullopt;

try {

parts.push_back(static_cast<unsigned>(std::stoul(std::string(part))));

} catch (...) {

return std::nullopt;

}

if (end == std::string_view::npos) break;

start = end + 1;

}

return parts;

std::span<const unsigned> rhs) {

const auto count = std::max(lhs.size(), rhs.size());

for (std::size_t i = 0; i < count; ++i) {

auto a = i < lhs.size() ? lhs[i] : 0;

auto b = i < rhs.size() ? rhs[i] : 0;

if (a < b) return -1;

if (a > b) return 1;

}

return 0;

const Reader& reader, std::uint64_t hashOffset) {

// struct { uint32 nbucket; uint32 nchain; ... } — nchain IS the symbol

// count, because every symbol occupies one chain slot.

auto nchain = reader.u32(hashOffset + 4);

if (!nchain) return std::nullopt;

return *nchain;

const Reader& reader, std::uint64_t hashOffset) {

auto nbuckets = reader.u32(hashOffset);

auto symoffset = reader.u32(hashOffset + 4);

auto bloomSize = reader.u32(hashOffset + 8);

if (!nbuckets || !symoffset || !bloomSize) return std::nullopt;

if (*nbuckets > (1u << 24) || *bloomSize > (1u << 24)) return std::nullopt;

// GNU_HASH omits the first `symoffset` symbols (the undefined ones), so

// with no hashed symbol at all the table is exactly that long.

const auto bucketsAt = hashOffset + 16

+ static_cast<std::uint64_t>(*bloomSize) * 8;

std::uint32_t maxIndex = 0;

for (std::uint32_t i = 0; i < *nbuckets; ++i) {

auto bucket = reader.u32(bucketsAt + static_cast<std::uint64_t>(i) * 4);

if (!bucket) return std::nullopt;

maxIndex = std::max(maxIndex, *bucket);

}

if (maxIndex < *symoffset) return *symoffset;

// Walk the chain of the highest bucket to its terminator (low bit set).

const auto chainAt = bucketsAt + static_cast<std::uint64_t>(*nbuckets) * 4;

std::uint32_t index = maxIndex;

for (std::uint32_t guard = 0; guard < (1u << 24); ++guard) {

auto word = reader.u32(chainAt

+ static_cast<std::uint64_t>(index - *symoffset) * 4);

if (!word) return std::nullopt;

if (*word & 1u) return static_cast<std::uint64_t>(index) + 1;

++index;

}

return std::nullopt;

detail::Reader reader;

std::ifstream input(object, std::ios::binary);

if (!input) return std::unexpected(std::format(

"cannot open ELF object '{}'", object.string()));

reader.bytes.assign(std::istreambuf_iterator<char>(input), {});

if (reader.bytes.size() < 0x40

|| reader.bytes[0] != 0x7f || reader.bytes[1] != 'E'

|| reader.bytes[2] != 'L' || reader.bytes[3] != 'F')

return std::unexpected(std::format(

"object '{}' is not ELF", object.string()));

if (reader.bytes[4] != 2 || reader.bytes[5] != 1)

return std::unexpected(std::format(

"object '{}' is not ELF64 little-endian", object.string()));

auto machine = reader.u16(0x12);

auto phoff = reader.u64(0x20);

auto phentsize = reader.u16(0x36);

auto phnum = reader.u16(0x38);

if (!machine || !phoff || !phentsize || !phnum || *phentsize < 0x38

|| *phnum > 4096

|| !reader.range(*phoff, static_cast<std::uint64_t>(*phentsize) * *phnum))

return std::unexpected(std::format(

"object '{}' has a truncated ELF program table", object.string()));

DynamicSymbols out;

std::vector<detail::Segment> segments;

std::optional<detail::Segment> dynamic;

for (std::uint16_t i = 0; i < *phnum; ++i) {

auto off = *phoff + static_cast<std::uint64_t>(i) * *phentsize;

auto ptype = reader.u32(off);

auto poff = reader.u64(off + 0x08);

auto pvaddr = reader.u64(off + 0x10);

auto pfilesz = reader.u64(off + 0x20);

if (!ptype || !poff || !pvaddr || !pfilesz

|| !reader.range(*poff, *pfilesz))

return std::unexpected(std::format(

"object '{}' has a truncated ELF segment", object.string()));

segments.push_back(detail::Segment{*ptype, *poff, *pvaddr, *pfilesz});

if (*ptype == detail::kPtDynamic)

dynamic = segments.back();

}

// No PT_DYNAMIC: a fully static link, or a relocatable object. There is no

// dynamic symbol table to read, and `present` stays false so the caller

// reports "not applicable" rather than "clean".

if (!dynamic || dynamic->filesz % 16 != 0) return out;

std::vector<std::pair<std::uint64_t, std::uint64_t>> entries;

for (std::uint64_t off = dynamic->offset;

off + 16 <= dynamic->offset + dynamic->filesz; off += 16) {

auto tag = reader.u64(off);

auto value = reader.u64(off + 8);

if (!tag || !value) return std::unexpected(std::format(

"object '{}' has a truncated dynamic entry", object.string()));

if (*tag == detail::kDtNull) break;

entries.emplace_back(*tag, *value);

}

auto first = [&](std::uint64_t tag) -> std::optional<std::uint64_t> {

for (auto const& [candidate, value] : entries)

if (candidate == tag) return value;

return std::nullopt;

};

auto strtabAddr = first(detail::kDtStrtab);

auto strtabSize = first(detail::kDtStrsz);

auto symtabAddr = first(detail::kDtSymtab);

if (!strtabAddr || !strtabSize || !symtabAddr) return out;

auto strtab = detail::vaddr_to_offset(segments, *strtabAddr, *strtabSize);

if (!strtab || !reader.range(*strtab, *strtabSize))

return std::unexpected(std::format(

"object '{}' has an unmappable dynamic string table", object.string()));

const auto symEntrySize = first(detail::kDtSyment).value_or(detail::kSymEntrySize);

if (symEntrySize < detail::kSymEntrySize) return std::unexpected(std::format(

"object '{}' declares a {}-byte dynamic symbol entry", object.string(),

symEntrySize));

std::optional<std::uint64_t> count;

if (auto hash = first(detail::kDtHash)) {

if (auto at = detail::vaddr_to_offset(segments, *hash, 8))

count = detail::dynsym_count_from_sysv_hash(reader, *at);

}

if (!count) {

if (auto hash = first(detail::kDtGnuHash)) {

if (auto at = detail::vaddr_to_offset(segments, *hash, 16))

count = detail::dynsym_count_from_gnu_hash(reader, *at);

}

}

// Neither hash table was readable. Refuse rather than guess a table

// length: a short guess reports a clean image, which is the failure mode

// this whole area is about.

if (!count) return std::unexpected(std::format(

"object '{}' has a dynamic symbol table whose length cannot be "

"determined (neither DT_HASH nor DT_GNU_HASH is usable)",

object.string()));

if (*count > (1u << 24)) return std::unexpected(std::format(

"object '{}' declares {} dynamic symbols", object.string(), *count));

auto symtab = detail::vaddr_to_offset(segments, *symtabAddr,

symEntrySize * *count);

if (!symtab || !reader.range(*symtab, symEntrySize * *count))

return std::unexpected(std::format(

"object '{}' has an unmappable dynamic symbol table", object.string()));

out.present = true;

out.total = static_cast<std::size_t>(*count);

for (std::uint64_t i = 0; i < *count; ++i) {

const auto at = *symtab + i * symEntrySize;

auto nameOffset = reader.u32(at);

auto shndx = reader.u16(at + 6);

auto value = reader.u64(at + 8);

if (!nameOffset || !shndx || !value) return std::unexpected(std::format(

"object '{}' has a truncated dynamic symbol", object.string()));

if (*shndx == 0) continue; // SHN_UNDEF — imported

const unsigned char info = reader.bytes[at + 4];

const unsigned char bind = static_cast<unsigned char>(info >> 4);

const unsigned char type = static_cast<unsigned char>(info & 0x0f);

if (bind == detail::kStbLocal) continue; // not participating

if (type != detail::kSttObject && type != detail::kSttFunc

&& type != detail::kSttGnuIfunc) continue; // sections, files, TLS

auto name = *nameOffset < *strtabSize

? reader.cstr(*strtab + *nameOffset, *strtabSize - *nameOffset)

: std::nullopt;

if (!name || name->empty()) continue;

out.defined.push_back(DynamicSymbol{

.name = std::move(*name),

.isFunc = (type == detail::kSttFunc || type == detail::kSttGnuIfunc),

.value = *value,

});

}

// Copy relocations. Absent DT_RELA simply means there are none, which is a

// real answer — unlike an unrecognised machine, which is not.

if (auto type = detail::copy_relocation_type(*machine)) {

out.copyRelocationsKnown = true;

auto relaAddr = first(detail::kDtRela);

auto relaSize = first(detail::kDtRelasz);

if (relaAddr && relaSize) {

auto rela = detail::vaddr_to_offset(segments, *relaAddr, *relaSize);

if (!rela || !reader.range(*rela, *relaSize))

return std::unexpected(std::format(

"object '{}' has an unmappable relocation table", object.string()));

for (std::uint64_t off = 0;

off + detail::kRelaEntrySize <= *relaSize;

off += detail::kRelaEntrySize) {

auto offset = reader.u64(*rela + off);

auto info = reader.u64(*rela + off + 8);

if (!offset || !info) return std::unexpected(std::format(

"object '{}' has a truncated relocation", object.string()));

if (static_cast<std::uint32_t>(*info & 0xffffffffull) == *type)

out.copyRelocations.insert(*offset);

}

}

}

return out;

detail::Reader reader;

std::ifstream input(artifact, std::ios::binary);

if (!input) return std::unexpected(std::format(

"cannot open ELF artifact '{}'", artifact.string()));

reader.bytes.assign(std::istreambuf_iterator<char>(input), {});

if (reader.bytes.size() < 0x40

|| reader.bytes[0] != 0x7f || reader.bytes[1] != 'E'

|| reader.bytes[2] != 'L' || reader.bytes[3] != 'F')

return std::unexpected(std::format(

"artifact '{}' is not ELF", artifact.string()));

if (reader.bytes[4] != 2 || reader.bytes[5] != 1)

return std::unexpected(std::format(

"artifact '{}' is not ELF64 little-endian", artifact.string()));

auto type = reader.u16(0x10);

auto phoff = reader.u64(0x20);

auto phentsize = reader.u16(0x36);

auto phnum = reader.u16(0x38);

if (!type || !phoff || !phentsize || !phnum || *phentsize < 0x38

|| *phnum > 4096

|| !reader.range(*phoff, static_cast<std::uint64_t>(*phentsize) * *phnum))

return std::unexpected(std::format(

"artifact '{}' has a truncated ELF program table", artifact.string()));

ElfRuntimeFacts out;

out.artifact = artifact;

out.elfType = *type;

std::vector<detail::Segment> segments;

std::optional<detail::Segment> dynamic;

for (std::uint16_t i = 0; i < *phnum; ++i) {

auto off = *phoff + static_cast<std::uint64_t>(i) * *phentsize;

auto ptype = reader.u32(off);

auto poff = reader.u64(off + 0x08);

auto pvaddr = reader.u64(off + 0x10);

auto pfilesz = reader.u64(off + 0x20);

if (!ptype || !poff || !pvaddr || !pfilesz

|| !reader.range(*poff, *pfilesz))

return std::unexpected(std::format(

"artifact '{}' has a truncated ELF segment", artifact.string()));

detail::Segment segment{*ptype, *poff, *pvaddr, *pfilesz};

segments.push_back(segment);

if (*ptype == detail::kPtDynamic) dynamic = segment;

if (*ptype == detail::kPtInterp) {

auto value = reader.cstr(*poff, *pfilesz);

if (!value || value->empty()) return std::unexpected(std::format(

"artifact '{}' has an invalid PT_INTERP", artifact.string()));

out.interp = std::move(*value);

}

}

if (!dynamic) return out; // static ELF or relocatable object

if (dynamic->filesz % 16 != 0) return std::unexpected(std::format(

"artifact '{}' has a malformed PT_DYNAMIC", artifact.string()));

std::vector<std::pair<std::uint64_t, std::uint64_t>> entries;

for (std::uint64_t off = dynamic->offset;

off + 16 <= dynamic->offset + dynamic->filesz; off += 16) {

auto tag = reader.u64(off);

auto value = reader.u64(off + 8);

if (!tag || !value) return std::unexpected(std::format(

"artifact '{}' has a truncated dynamic entry", artifact.string()));

if (*tag == detail::kDtNull) break;

entries.emplace_back(*tag, *value);

}

auto first = [&](std::uint64_t tag) -> std::optional<std::uint64_t> {

for (auto const& [candidate, value] : entries)

if (candidate == tag) return value;

return std::nullopt;

};

auto strtabAddr = first(detail::kDtStrtab);

auto strtabSize = first(detail::kDtStrsz);

if (!strtabAddr || !strtabSize) return std::unexpected(std::format(

"artifact '{}' has no usable dynamic string table", artifact.string()));

auto strtab = detail::vaddr_to_offset(segments, *strtabAddr, *strtabSize);

if (!strtab || !reader.range(*strtab, *strtabSize))

return std::unexpected(std::format(

"artifact '{}' has an unmappable dynamic string table", artifact.string()));

auto dynstr = [&](std::uint64_t offset) -> std::optional<std::string> {

if (offset >= *strtabSize) return std::nullopt;

return reader.cstr(*strtab + offset, *strtabSize - offset);

};

std::vector<std::string> legacyRpaths;

std::vector<std::string> modernRunpaths;

for (auto const& [tag, value] : entries) {

if (tag == detail::kDtNeeded) {

auto name = dynstr(value);

if (!name || name->empty()) return std::unexpected(std::format(

"artifact '{}' has an invalid DT_NEEDED", artifact.string()));

out.needed.push_back(std::move(*name));

} else if (tag == detail::kDtSoname) {

auto name = dynstr(value);

if (!name || name->empty()) return std::unexpected(std::format(

"artifact '{}' has an invalid DT_SONAME", artifact.string()));

out.soname = std::move(*name);

} else if (tag == detail::kDtRpath || tag == detail::kDtRunpath) {

auto path = dynstr(value);

if (!path) return std::unexpected(std::format(

"artifact '{}' has an invalid DT_RPATH/DT_RUNPATH", artifact.string()));

detail::append_path_list(

tag == detail::kDtRunpath ? modernRunpaths : legacyRpaths, *path);

}

}

// Record WHICH tag was present before collapsing the two lists -- the

// collapse below is lossy and the lost bit is the one the loader-tag

// contract is about (see SearchPathTag). Presence is keyed on the tag

// having been seen, so a DT_RPATH holding an empty string still counts as

// present: the loader saw the tag either way.

if (!legacyRpaths.empty() && !modernRunpaths.empty())

out.searchPathTag = SearchPathTag::Both;

else if (!modernRunpaths.empty())

out.searchPathTag = SearchPathTag::Runpath;

else if (!legacyRpaths.empty())

out.searchPathTag = SearchPathTag::Rpath;

// glibc ignores legacy DT_RPATH when DT_RUNPATH exists. Preserve that

// effective distinction while exposing one ordered search-path vector.

out.runpaths = modernRunpaths.empty()

? std::move(legacyRpaths) : std::move(modernRunpaths);

if (auto address = first(detail::kDtVerneed)) {

auto count = first(detail::kDtVerneednum).value_or(0);

auto table = detail::vaddr_to_offset(segments, *address, 16);

if (!table || count > 4096) return std::unexpected(std::format(

"artifact '{}' has an invalid GNU version-need table", artifact.string()));

auto current = *table;

for (std::uint64_t i = 0; i < count; ++i) {

auto auxCount = reader.u16(current + 2);

auto auxDelta = reader.u32(current + 8);

auto next = reader.u32(current + 12);

if (!auxCount || !auxDelta || !next || *auxCount > 4096

|| !reader.range(current, 16))

return std::unexpected(std::format(

"artifact '{}' has a truncated GNU version-need table",

artifact.string()));

auto aux = current + *auxDelta;

for (std::uint16_t j = 0; j < *auxCount; ++j) {

auto nameOffset = reader.u32(aux + 8);

auto auxNext = reader.u32(aux + 12);

if (!nameOffset || !auxNext || !reader.range(aux, 16))

return std::unexpected(std::format(

"artifact '{}' has a truncated GNU version requirement",

artifact.string()));

if (auto name = dynstr(*nameOffset); name && name->starts_with("GLIBC_"))

out.requiredGlibcVersions.push_back(std::move(*name));

if (j + 1 < *auxCount) {

if (*auxNext == 0) return std::unexpected(std::format(

"artifact '{}' has a broken GNU version requirement chain",

artifact.string()));

aux += *auxNext;

}

}

if (i + 1 < count) {

if (*next == 0) return std::unexpected(std::format(

"artifact '{}' has a broken GNU version-need chain",

artifact.string()));

current += *next;

}

}

}

if (auto address = first(detail::kDtVerdef)) {

auto count = first(detail::kDtVerdefnum).value_or(0);

auto table = detail::vaddr_to_offset(segments, *address, 20);

if (!table || count > 65536) return std::unexpected(std::format(

"artifact '{}' has an invalid GNU version-definition table",

artifact.string()));

auto current = *table;

for (std::uint64_t i = 0; i < count; ++i) {

auto auxDelta = reader.u32(current + 12);

auto next = reader.u32(current + 16);

if (!auxDelta || !next || !reader.range(current, 20))

return std::unexpected(std::format(

"artifact '{}' has a truncated GNU version-definition table",

artifact.string()));

auto nameOffset = reader.u32(current + *auxDelta);

if (!nameOffset || !reader.range(current + *auxDelta, 8))

return std::unexpected(std::format(

"artifact '{}' has a truncated GNU version definition",

artifact.string()));

if (auto name = dynstr(*nameOffset); name && name->starts_with("GLIBC_"))

out.definedGlibcVersions.push_back(std::move(*name));

if (i + 1 < count) {

if (*next == 0) return std::unexpected(std::format(

"artifact '{}' has a broken GNU version-definition chain",

artifact.string()));

current += *next;

}

}

}

// Search order is loader physics, not presentation: sorting RUNPATH would

// be capable of selecting a different libc than the process itself.

detail::stable_unique(out.runpaths);

// DT_NEEDED order is loader semantics. Reordering it can change which

// payload wins when two dependency search paths contain the same SONAME.

detail::stable_unique(out.needed);

detail::sort_unique(out.requiredGlibcVersions);

detail::sort_unique(out.definedGlibcVersions);

return out;

const std::filesystem::path& artifact,

const mcpp::platform::runtime::RuntimeBinding& binding,

std::span<const std::filesystem::path> additionalSearchDirs) {

RuntimeResolution resolution;

auto root = inspect_elf_runtime(artifact);

if (!root) {

resolution.artifact.artifact = artifact;

resolution.unresolved.push_back(root.error());

return resolution;

}

resolution.artifact = std::move(*root);

resolution.artifactIsElf = true;

std::deque<ElfRuntimeFacts> queue;

queue.push_back(resolution.artifact);

std::set<std::filesystem::path> visited;

visited.insert(detail::comparable_path(artifact));

// The ELF loader maintains one process-global loaded-object namespace.

// Once a SONAME has been mapped, a later requester reuses that object;

// its own RUNPATH does not load a second file with the same SONAME.

std::map<std::string, std::filesystem::path> loadedBySoname;

if (!resolution.artifact.interp.empty()) {

auto interp = detail::comparable_path(resolution.artifact.interp);

loadedBySoname.emplace(interp.filename().string(), std::move(interp));

}

constexpr std::size_t kMaxClosureObjects = 512;

while (!queue.empty() && resolution.objects.size() < kMaxClosureObjects) {

auto requester = std::move(queue.front());

queue.pop_front();

for (auto const& soname : requester.needed) {

std::optional<std::filesystem::path> path;

if (auto loaded = loadedBySoname.find(soname);

loaded != loadedBySoname.end()) {

path = loaded->second;

} else {

path = detail::resolve_needed(

soname, requester, binding, additionalSearchDirs);

if (!path) {

resolution.unresolved.push_back(soname);

resolution.unresolvedSonames.push_back(soname);

continue;

}

loadedBySoname.emplace(soname, *path);

}

if (soname == "libc.so.6") {

if (resolution.artifact.resolvedLibc.empty())

resolution.artifact.resolvedLibc = *path;

if (std::ranges::find(resolution.resolvedLibcs, *path)

== resolution.resolvedLibcs.end())

resolution.resolvedLibcs.push_back(*path);

}

resolution.artifact.resolvedObjects.push_back(*path);

if (!visited.insert(*path).second) continue;

auto parsed = inspect_elf_runtime(*path);

if (!parsed) {

resolution.unresolved.push_back(std::format(

"{} ({})", soname, parsed.error()));

continue;

}

if (!parsed->soname.empty()) {

if (auto loaded = loadedBySoname.find(parsed->soname);

loaded != loadedBySoname.end()

&& !detail::same_path(loaded->second, *path)) {

// The file reached through this request aliases a SONAME

// that is already mapped. Model the loader's reuse and do

// not add a second closure object.

loadedBySoname[soname] = loaded->second;

continue;

}

loadedBySoname.emplace(parsed->soname, *path);

}

queue.push_back(*parsed);

resolution.objects.push_back(std::move(*parsed));

}

}

if (!queue.empty())

resolution.unresolved.push_back("runtime closure exceeds 512 ELF objects");

detail::sort_unique(resolution.unresolved);

detail::sort_unique(resolution.unresolvedSonames);

std::sort(resolution.artifact.resolvedObjects.begin(),

resolution.artifact.resolvedObjects.end());

resolution.artifact.resolvedObjects.erase(

std::unique(resolution.artifact.resolvedObjects.begin(),

resolution.artifact.resolvedObjects.end()),

resolution.artifact.resolvedObjects.end());

return resolution;

const std::filesystem::path& artifact,

const mcpp::platform::runtime::RuntimeBinding& binding,

const RuntimeResolution& resolution,

bool hostLibsAllowed) {

RuntimeVerdict verdict;

// Provider dispatch, not a prefix match. These are ELF/glibc physics —

// PT_INTERP, DT_RUNPATH, a private loader — and a `ucrt@…` identity is

// not a glibc that is missing, it is a different provider whose runtime

// this validator has no rules for.

const bool isGlibc =

mcpp::platform::runtime::runtime_provider(binding.runtimeId) == "glibc";

if constexpr (!mcpp::platform::is_linux) {