release: make bootstrap and archive smoke reproducible

Author: Moonbot-Tech

.github/workflows/devil-mutation.yml

@@ -22,12 +22,16 @@ jobs:
           fetch-depth: 0
       - name: Install FPC 3.2.2 bootstrap
         shell: powershell
-        run: choco install freepascal --version=3.2.2 -y --no-progress
+        run: |
+          .\scripts\Install-FpcBootstrap.ps1 `
+            -Destination "$env:RUNNER_TEMP\fpc-3.2.2"
       - name: Create disposable mutation clone
         shell: powershell
         run: git clone --no-local . ..\mooncompiler-mutation
       - name: Measure Devil mutation strength
         shell: powershell
+        env:
+          MOONBOT_BOOTSTRAP_FPC: ${{ runner.temp }}\fpc-3.2.2\bin\i386-win32\fpc.exe
         run: |
           python .\qualification\suite\scripts\run_devil_mutation.py `
             --repo ..\mooncompiler-mutation `

.github/workflows/qualification.yml

@@ -90,12 +90,14 @@ jobs:
       - uses: actions/checkout@v4
       - name: Install FPC 3.2.2 bootstrap
         shell: powershell
-        run: choco install freepascal --version=3.2.2 -y --no-progress
+        run: |
+          .\scripts\Install-FpcBootstrap.ps1 `
+            -Destination "$env:RUNNER_TEMP\fpc-3.2.2"
       - name: Build product toolchain
         shell: powershell
         run: |
           .\build.ps1 compiler `
-            -Bootstrap C:\tools\freepascal\bin\i386-win32\fpc.exe
+            -Bootstrap "$env:RUNNER_TEMP\fpc-3.2.2\bin\i386-win32\fpc.exe"
       - name: Run platform contracts
         shell: powershell
         run: |

.github/workflows/release.yml

@@ -88,12 +88,14 @@ jobs:
       - uses: actions/checkout@v4
       - name: Install FPC 3.2.2 bootstrap
         shell: powershell
-        run: choco install freepascal --version=3.2.2 -y --no-progress
+        run: |
+          .\scripts\Install-FpcBootstrap.ps1 `
+            -Destination "$env:RUNNER_TEMP\fpc-3.2.2"
       - name: Build toolchain
         shell: powershell
         run: |
           .\build.ps1 compiler `
-            -Bootstrap C:\tools\freepascal\bin\i386-win32\fpc.exe
+            -Bootstrap "$env:RUNNER_TEMP\fpc-3.2.2\bin\i386-win32\fpc.exe"
       - name: Pack toolchain
         shell: powershell
         run: |
@@ -139,6 +141,7 @@ jobs:
       artifact-metadata: write
     env:
       GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
       RELEASE_TAG: ${{ needs.validate-tag.outputs.tag }}
       RELEASE_VERSION: ${{ needs.validate-tag.outputs.version }}
     steps:

build

@@ -162,7 +162,8 @@ install_toolchain() {
   # Reject archive entries that could escape the transactional staging tree.
   while IFS= read -r member; do
     member=${member#./}
-    [[ -z "$member" || "$member" == /* ||
+    [[ -z "$member" ]] && continue
+    [[ "$member" == /* ||
        "$member" == .. || "$member" == ../* || "$member" == */../* ||
        "$member" == */.. ]] && {
       echo "unsafe path in toolchain archive: $member" >&2

doc/SETUP.md

@@ -78,14 +78,19 @@ If `fpc.exe` is already on `PATH`, `-Bootstrap` is unnecessary. If `make.exe`
 is installed separately, pass its path with `-Make` or the `MOONBOT_MAKE`
 environment variable.
 
-On a clean GitHub Windows runner, install the bootstrap compiler with
-Chocolatey:
+The repository includes a helper that downloads the official combined Win32
+and Win64 FPC distribution, verifies its checksum, and installs a complete
+bootstrap into an isolated directory:
 
 ```powershell
-choco install freepascal --version=3.2.2 -y --no-progress
-.\build.ps1 compiler -Bootstrap C:\tools\freepascal\bin\i386-win32\fpc.exe
+$Bootstrap = .\scripts\Install-FpcBootstrap.ps1
+.\build.ps1 compiler -Bootstrap $Bootstrap
 ```
 
+The combined distribution matters: a Win32-only installation can compile the
+bootstrap stages but does not contain the Win64 target binutils needed by the
+published toolchain.
+
 Python 3 is needed only for qualification. If it is not on `PATH`, set its full
 path in `$env:PYTHON`.
 

scripts/Install-FpcBootstrap.ps1

@@ -0,0 +1,70 @@
+[CmdletBinding()]
+param(
+  [string]$Destination = (Join-Path $env:LOCALAPPDATA `
+      'MoonCompiler\bootstrap\3.2.2')
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+$Version = '3.2.2'
+$Url = 'https://downloads.freepascal.org/fpc/dist/3.2.2/i386-win32/' + `
+  'fpc-3.2.2.win32.and.win64.exe'
+$ExpectedSha256 = `
+  '8C255390544B051388B577EB61C6191A04883264AFE0E3369B3600A56DAF7BDE'
+$Bin = Join-Path $Destination 'bin\i386-win32'
+$Bootstrap = Join-Path $Bin 'fpc.exe'
+$RequiredTools = @(
+  'make.exe',
+  'fpcmkcfg.exe',
+  'x86_64-win64-ar.exe',
+  'x86_64-win64-as.exe',
+  'x86_64-win64-ld.exe',
+  'x86_64-win64-nm.exe',
+  'x86_64-win64-objcopy.exe',
+  'x86_64-win64-objdump.exe',
+  'x86_64-win64-strip.exe',
+  'x86_64-win64-windres.exe'
+)
+
+function Test-Bootstrap {
+  If (-not (Test-Path -LiteralPath $Bootstrap)) {
+    return $false
+  }
+  foreach ($Tool in $RequiredTools) {
+    If (-not (Test-Path -LiteralPath (Join-Path $Bin $Tool))) {
+      return $false
+    }
+  }
+  return ((& $Bootstrap -iV).Trim() -eq $Version)
+}
+
+If (-not (Test-Bootstrap)) {
+  $Installer = Join-Path ([IO.Path]::GetTempPath()) `
+    'fpc-3.2.2.win32.and.win64.exe'
+  $Download = $true
+  If (Test-Path -LiteralPath $Installer) {
+    $Actual = (Get-FileHash -LiteralPath $Installer -Algorithm SHA256).Hash
+    $Download = ($Actual -ne $ExpectedSha256)
+  }
+  If ($Download) {
+    Invoke-WebRequest -UseBasicParsing -Uri $Url -OutFile $Installer
+  }
+  $Actual = (Get-FileHash -LiteralPath $Installer -Algorithm SHA256).Hash
+  If ($Actual -ne $ExpectedSha256) {
+    throw "FPC installer checksum mismatch: $Actual"
+  }
+
+  New-Item -ItemType Directory -Force -Path $Destination | Out-Null
+  $Process = Start-Process -FilePath $Installer -ArgumentList @(
+      '/verysilent', '/norestart', "/dir=`"$Destination`"") `
+    -Wait -PassThru -WindowStyle Hidden
+  If ($Process.ExitCode -ne 0) {
+    throw "FPC installer failed with exit code $($Process.ExitCode)"
+  }
+  If (-not (Test-Bootstrap)) {
+    throw "FPC $Version bootstrap installation is incomplete: $Destination"
+  }
+}
+
+Write-Output $Bootstrap