Implement researched Guix package outcome for #46: [Guix packaging] larsbrinkhoff/kbredir #608

New issue

Closed

opened 2026-08-25 13:49:34 +00:00 by htayj · 2 comments

htayj commented

2026-08-25 13:49:34 +00:00

(Migrated from github.com)

Context

This delivery ticket was created from research issue #46 ([Guix packaging] larsbrinkhoff/kbredir).

The host-validated research finding follows:

Canonical upstream is https://github.com/larsbrinkhoff/kbredir at fixed commit 9b82cf66a60842a97a5b6ffac219e59bcd9f069a; upstream configure.in identifies version 0.9, the commit is the only master history entry and has no release tag, so use upstream version 0.9 with Guix revision 0 and that commit. The pinned tree contains a pre-generated Autotools configure/Makefile and six C CLI outputs: read_vt220, read_linux_console, read_xev, write_vt220, write_xsendevent, and write_xtest. COPYING begins GNU General Public License Version 2, June 1991, and the local source snapshot at tay/packages/larsbrinkhoff-g-m.scm:32 records license:gpl2; this is a confirmed GPL-2.0-only, source-redistributable project with no vendored or non-free dependency. A gnu-build-system package is technically viable, but its recipe must patch src/Makefile.in (the generated source also contains the same stale setting) to remove -L/usr/X11R6/lib before configure, then run the existing configure/install targets; disable the empty/non-device-dependent upstream check phase rather than opening a real console. Use a new module (tay packages kbredir), inheriting the exact larsbrinkhoff-kbredir-source origin from the local channel, with libx11 and libxtst as target inputs for X11/XTest headers and libraries and linux-libre-headers for linux/kd.h, linux/vt.h, and linux/keyboard.h; the standard C compiler, libc, and make inputs are otherwise sufficient, and no pkg-config or X server belongs in the runtime closure. The local channel has only larsbrinkhoff-kbredir-source, which preserves bytes under share/larsbrinkhoff/projects/kbredir and is not an installed executable equivalent. Guix search confirms overlapping but non-equivalent xdotool and xautomation packages; neither provides this stdin protocol plus VT220/Linux-console/xev readers, and no package with this upstream origin was found in the checked channels. Install all six upstream binaries directly under $out/bin; do not add setuid, capabilities, udev rules, a privileged service, or an environment wrapper. The tools use a line protocol of ' down'/' up'; write_xtest and write_xsendevent require an authorized DISPLAY and optionally --display/--window, while read_linux_console reads file descriptor 0, requires a controlling console tty, changes it to K_MEDIUMRAW, and may issue VT_ACTIVATE, so document that boundary and never exercise it against a host tty. The pinned upstream has no conventional help implementation: read_vt220, read_linux_console, read_xev, and write_vt220 reject arguments with ' takes no options'; the X writers accept only their display/window parsing and then consume stdin. Acceptance must therefore run those exact safe no-option probes rather than claim a nonexistent help UI; if conventional --help output is mandatory, an explicit upstream or wrapper change is a prerequisite. After the package definition exists, require guix lint -L. kbredir and guix build -L. kbredir. For the isolated smoke proof, run in a temporary network-disabled/container-like environment with a fresh XDG/runtime directory, start Xvfb on a private display with +extension XTEST and -nolisten tcp, create/focus a temporary Xlib receiver window that records KeyPress and KeyRelease events, pipe 'a down\na up\n' to $out/bin/write_xtest --display :99 --window , and assert the receiver records the ordered press/release pair; also run the four no-options probes with stdin closed and never invoke read_linux_console on a real tty or open /dev/input. This is a delivery brief, not package proof.

Acceptance criteria

Implement the viable package change identified in the host-validated research finding.
Preserve Guix source provenance, licensing, and deterministic build requirements recorded in the finding.
Add and pass a package-specific safe smoke proof using isolated HOME/XDG state before closure.

Imported from GitHub issue/PR. Originally posted by htayj on 2026-08-25T13:49:34Z.

## Context This delivery ticket was created from research issue #46 ([Guix packaging] larsbrinkhoff/kbredir). The host-validated research finding follows: Canonical upstream is https://github.com/larsbrinkhoff/kbredir at fixed commit 9b82cf66a60842a97a5b6ffac219e59bcd9f069a; upstream configure.in identifies version 0.9, the commit is the only master history entry and has no release tag, so use upstream version 0.9 with Guix revision 0 and that commit. The pinned tree contains a pre-generated Autotools configure/Makefile and six C CLI outputs: read_vt220, read_linux_console, read_xev, write_vt220, write_xsendevent, and write_xtest. COPYING begins GNU General Public License Version 2, June 1991, and the local source snapshot at tay/packages/larsbrinkhoff-g-m.scm:32 records license:gpl2; this is a confirmed GPL-2.0-only, source-redistributable project with no vendored or non-free dependency. A gnu-build-system package is technically viable, but its recipe must patch src/Makefile.in (the generated source also contains the same stale setting) to remove -L/usr/X11R6/lib before configure, then run the existing configure/install targets; disable the empty/non-device-dependent upstream check phase rather than opening a real console. Use a new module (tay packages kbredir), inheriting the exact larsbrinkhoff-kbredir-source origin from the local channel, with libx11 and libxtst as target inputs for X11/XTest headers and libraries and linux-libre-headers for linux/kd.h, linux/vt.h, and linux/keyboard.h; the standard C compiler, libc, and make inputs are otherwise sufficient, and no pkg-config or X server belongs in the runtime closure. The local channel has only larsbrinkhoff-kbredir-source, which preserves bytes under share/larsbrinkhoff/projects/kbredir and is not an installed executable equivalent. Guix search confirms overlapping but non-equivalent xdotool and xautomation packages; neither provides this stdin protocol plus VT220/Linux-console/xev readers, and no package with this upstream origin was found in the checked channels. Install all six upstream binaries directly under $out/bin; do not add setuid, capabilities, udev rules, a privileged service, or an environment wrapper. The tools use a line protocol of '<key> down'/'<key> up'; write_xtest and write_xsendevent require an authorized DISPLAY and optionally --display/--window, while read_linux_console reads file descriptor 0, requires a controlling console tty, changes it to K_MEDIUMRAW, and may issue VT_ACTIVATE, so document that boundary and never exercise it against a host tty. The pinned upstream has no conventional help implementation: read_vt220, read_linux_console, read_xev, and write_vt220 reject arguments with '<program> takes no options'; the X writers accept only their display/window parsing and then consume stdin. Acceptance must therefore run those exact safe no-option probes rather than claim a nonexistent help UI; if conventional --help output is mandatory, an explicit upstream or wrapper change is a prerequisite. After the package definition exists, require guix lint -L. kbredir and guix build -L. kbredir. For the isolated smoke proof, run in a temporary network-disabled/container-like environment with a fresh XDG/runtime directory, start Xvfb on a private display with +extension XTEST and -nolisten tcp, create/focus a temporary Xlib receiver window that records KeyPress and KeyRelease events, pipe 'a down\na up\n' to $out/bin/write_xtest --display :99 --window <receiver-window>, and assert the receiver records the ordered press/release pair; also run the four no-options probes with stdin closed and never invoke read_linux_console on a real tty or open /dev/input. This is a delivery brief, not package proof. ## Acceptance criteria - Implement the viable package change identified in the host-validated research finding. - Preserve Guix source provenance, licensing, and deterministic build requirements recorded in the finding. - Add and pass a package-specific safe smoke proof using isolated HOME/XDG state before closure. --- Imported from [GitHub issue/PR](https://github.com/htayj/guix-channel/issues/608). Originally posted by [htayj](https://github.com/htayj) on 2026-08-25T13:49:34Z.

tay referenced this issue

2026-08-25 13:49:38 +00:00

[Guix packaging] larsbrinkhoff/kbredir #46

htayj commented

2026-08-25 22:27:52 +00:00

(Migrated from github.com)

Completed by Goocastle

Imported from GitHub comment. Originally posted by htayj on 2026-08-25T22:27:52Z.

Completed by Goocastle --- Imported from [GitHub comment](https://github.com/htayj/guix-channel/issues/608#issuecomment-5417698374). Originally posted by [htayj](https://github.com/htayj) on 2026-08-25T22:27:52Z.

tay commented

2026-09-30 19:33:54 +00:00

Owner

Published signed Guix-authenticated commit c2e982a030. Main independently passed local source build, --check reproducibility, offline lint and isolated runtime/integrated target. VT220 round trips and isolated XTEST/XSendEvent delivery; private filesystem and abstract X sockets; actual protocol screenshot608. Existing legacy compiler warnings remain disclosed in README. No physical keyboard/tape hardware, host display or deployed profile changed. PDP worker violated no-execution/no-Goocastle-renderer instructions on deleted temporary artifacts; none accepted as proof. All final gates and committed screenshots independently produced by Main without Goocastle execution.

Published signed Guix-authenticated commit c2e982a0303a49b2444ed22e9c1bd4edc7b92037. Main independently passed local source build, --check reproducibility, offline lint and isolated runtime/integrated target. VT220 round trips and isolated XTEST/XSendEvent delivery; private filesystem and abstract X sockets; actual protocol screenshot608. Existing legacy compiler warnings remain disclosed in README. No physical keyboard/tape hardware, host display or deployed profile changed. PDP worker violated no-execution/no-Goocastle-renderer instructions on deleted temporary artifacts; none accepted as proof. All final gates and committed screenshots independently produced by Main without Goocastle execution.