fix(nix): use C-only Wuffs dependency mirror

[akbash-bot]

Issue

A Nix installation on macOS fails hash verification when ESET deletes an artificial malformed JPEG from the Wuffs dependency. This blocks darwin-rebuild switch for configurations that include Herdr.

Problem

Herdr fetched the full Wuffs source archive even though libghostty-vt only compiles its released C sources. That archive includes a test JPEG which ESET identifies and removes before Nix verifies the restored output.

How did we fix it?

Herdr now fetches Wuffs' pinned C-only release mirror. The Zig manifest and generated Nix cache metadata use the same commit and hashes. The backport is tracked as a local libghostty-vt patch until the next vendor update includes the merged upstream change.

Verification

The regression test failed against the old full-archive entries and passes with the C-only pin. A clean Zig fetch produced the expected package hash, included release/c/wuffs-v0.4.c, and excluded the flagged JPEG. Vendor tests, maintenance checks, Linux and Windows lint, and 3,271 of 3,274 Rust tests passed. Three unrelated host-sensitive tests still fail under this root Herdr harness: one permission test and two live-handoff tests.

refs #3737

[kangal-bot]

@coderabbitai review
@greptileai

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: cab45414-439d-4c60-80e1-bb353fdb6d99

📥 Commits

Reviewing files that changed from the base of the PR and between 9e01168 and 5324e20.

📒 Files selected for processing (7)

• scripts/test_vendor_libghostty_vt.py
• vendor/libghostty-vt.patches.md
• vendor/libghostty-vt/build.zig.zon.json
• vendor/libghostty-vt/build.zig.zon.nix
• vendor/libghostty-vt/build.zig.zon.txt
• vendor/libghostty-vt/pkg/wuffs/build.zig.zon
• vendor/patches/libghostty-vt/0003-use-c-only-wuffs-mirror.patch

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The vendored Wuffs dependency now uses the pinned wuffs-mirror-release-c Git revision instead of the previous archive. JSON, Nix, text, and package manifests contain the updated source, hashes, dependency key, and unpack setting. A patch-tracking entry documents the change. A test verifies the mirror URL, new hashes, removed archive data, and generated Nix fields.

Suggested reviewers: ogulcancelik

Merge Risk: ⚪ Minimal · up to 5324e

This updates the vendored Wuffs source to a pinned C-only mirror and synchronizes its dependency metadata and validation, addressing archive realization failures without an identified remaining merge risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. (6 skipped: 6 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: using the C-only Wuffs dependency mirror for Nix.
Description check	✅ Passed	The description explains the macOS Nix hash failure, the C-only Wuffs mirror fix, the local patch, and verification results. It is directly related to the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. (6 skipped: 6 unsupported.)

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

@kangal-bot I will review pull request #3741.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[greptile-apps]

Greptile Summary

This PR replaces libghostty-vt’s full Wuffs source archive with a commit-pinned C-only release mirror, synchronizes the Zig and Nix dependency metadata, and records the change as a removable local vendor patch.

• Updates the Wuffs URL and Zig/Nix hashes consistently across the package manifest and generated dependency metadata.
• Changes Nix handling from an archive artifact to the established Git dependency path.
• Adds regression coverage preventing restoration of the problematic full-source archive.
• Documents the patch’s origin, verification procedure, and removal criteria.

Confidence Score: 5/5

The PR appears safe to merge; the dependency metadata is internally consistent and the established Nix build path validates the pinned Git source.

No actionable correctness, security, or repository-rule violations remain after checking the fetch implementation, Wuffs build layout, patch maintenance workflow, and regression coverage.

Important Files Changed

Filename	Overview
scripts/test_vendor_libghostty_vt.py	Adds consistency checks ensuring all Wuffs metadata uses the pinned C-only mirror and updated hashes.
vendor/libghostty-vt/pkg/wuffs/build.zig.zon	Replaces the full Wuffs archive dependency with the commit-pinned C-release mirror.
vendor/libghostty-vt/build.zig.zon.nix	Updates generated Nix metadata to fetch and verify the Wuffs Git checkout.
vendor/libghostty-vt/build.zig.zon.json	Synchronizes the generated dependency URL, Zig package identity, and Nix content hash.
vendor/patches/libghostty-vt/0003-use-c-only-wuffs-mirror.patch	Captures the dependency migration as a reproducible local vendor patch.
vendor/libghostty-vt.patches.md	Documents the patch rationale, upstream status, verification commands, and removal condition.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  M[pkg/wuffs/build.zig.zon] --> G[Generated Zig and Nix metadata]
  G --> F[fetchgit at pinned commit]
  F --> H[Nix content-hash verification]
  H --> Z[Zig package-hash verification]
  Z --> C[Compile release/c/wuffs-v0.4.c]

Loading

_{Reviews (1): Last reviewed commit: "fix(nix): use C-only Wuffs dependency mi..." | Re-trigger Greptile}

[ogulcancelik]

superseded by #3906