Release wsjtx-lib 2.1.1

Author: boybook

.github/workflows/build.yml

@@ -41,6 +41,13 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y cmake build-essential gfortran libfftw3-dev libboost-all-dev pkg-config patchelf
+          printf '%s\n' \
+            'subroutine trampoline_check' \
+            'end subroutine trampoline_check' \
+            > /tmp/trampoline-check.f90
+          if gfortran -Wtrampolines -Werror=trampolines -c /tmp/trampoline-check.f90 -o /tmp/trampoline-check.o; then
+            echo "FFLAGS=-Wtrampolines -Werror=trampolines" >> "$GITHUB_ENV"
+          fi
 
       # macOS dependencies
       - name: Install dependencies (macOS)
@@ -135,16 +142,35 @@ jobs:
           cp build/Release/libwsjtx_core.so "$TARGET_DIR/" 2>/dev/null || true
 
           # Bundle runtime shared libraries
-          ldd "$NODE_FILE" | awk '{print $3}' | while read lib; do
-            if [ -f "$lib" ] && [[ "$lib" == *libfftw* || "$lib" == *libgfortran* || "$lib" == *libgcc* || "$lib" == *libquadmath* || "$lib" == *libstdc++* ]]; then
-              cp -n "$lib" "$TARGET_DIR/" 2>/dev/null || true
-            fi
+          for binary in "$NODE_FILE" "$TARGET_DIR/libwsjtx_core.so"; do
+            [ -f "$binary" ] || continue
+            ldd "$binary" | awk '{print $3}' | while read lib; do
+              if [ -f "$lib" ] && [[ "$lib" == *libfftw* || "$lib" == *libgfortran* || "$lib" == *libgcc* || "$lib" == *libquadmath* || "$lib" == *libstdc++* ]]; then
+                cp -n "$lib" "$TARGET_DIR/" 2>/dev/null || true
+              fi
+            done
           done
           patchelf --set-rpath '$ORIGIN' "$NODE_FILE" || true
           patchelf --set-rpath '$ORIGIN' "$TARGET_DIR/libwsjtx_core.so" 2>/dev/null || true
 
-          echo '{}' | jq --arg p "${{ matrix.platform }}" --arg a "${{ matrix.arch }}" \
-            '{platform: $p, arch: $a, build_time: now | todate}' > "$TARGET_DIR/build-info.json"
+          stack_report=""
+          for elf in "$NODE_FILE" "$TARGET_DIR/libwsjtx_core.so"; do
+            [ -f "$elf" ] || continue
+            flags=$(readelf -W -l "$elf" | awk '/GNU_STACK/ {print $(NF-1)}')
+            echo "GNU_STACK $(basename "$elf"): ${flags:-missing}"
+            stack_report="$stack_report $(basename "$elf")=${flags:-missing}"
+            if [ -z "$flags" ]; then
+              echo "Missing GNU_STACK program header in Linux prebuild: $elf" >&2
+              exit 1
+            fi
+            if [[ "$flags" == *E* ]]; then
+              echo "Executable stack is not allowed in Linux prebuilds: $elf ($flags)" >&2
+              exit 1
+            fi
+          done
+
+          echo '{}' | jq --arg p "${{ matrix.platform }}" --arg a "${{ matrix.arch }}" --arg stack "$stack_report" \
+            '{platform: $p, arch: $a, build_time: now | todate, requires_executable_stack: false, gnu_stack: ($stack | ltrimstr(" "))}' > "$TARGET_DIR/build-info.json"
           ls -la "$TARGET_DIR"
 
       - name: Package prebuilds (macOS)
@@ -166,6 +192,43 @@ jobs:
           # dylibbundler follows transitive deps: .node → libwsjtx_core.dylib → fftw, gfortran, etc.
           dylibbundler -x "$NODE_FILE" -d "$TARGET_DIR" -p "@loader_path/" $SP_ARGS -b -of
 
+          # dylibbundler can append the same LC_RPATH more than once when
+          # transitive dependencies already carry matching rpaths. Keep the
+          # packaged Mach-O files deterministic and easy to re-sign downstream.
+          python3 - <<'PY'
+          import subprocess
+          from pathlib import Path
+
+          target = Path("prebuilds/${{ matrix.platform }}-${{ matrix.arch }}")
+          files = [target / "wsjtx_lib_nodejs.node", *sorted(target.glob("*.dylib"))]
+
+          def rpaths(path):
+              out = subprocess.check_output(["otool", "-l", str(path)], text=True)
+              paths = []
+              lines = out.splitlines()
+              for i, line in enumerate(lines):
+                  if line.strip() == "cmd LC_RPATH":
+                      for j in range(i, min(i + 8, len(lines))):
+                          s = lines[j].strip()
+                          if s.startswith("path "):
+                              paths.append(s.split(" ", 2)[1])
+              return paths
+
+          for file in files:
+              while file.exists():
+                  paths = rpaths(file)
+                  duplicate = next((p for p in paths if paths.count(p) > 1), None)
+                  if duplicate is None:
+                      break
+                  print(f"Deleting duplicate LC_RPATH {duplicate} from {file}")
+                  subprocess.check_call(["install_name_tool", "-delete_rpath", duplicate, str(file)])
+          PY
+
+          for f in "$NODE_FILE" "$TARGET_DIR"/*.dylib; do
+            [ -f "$f" ] || continue
+            codesign --force --deep --preserve-metadata=entitlements,requirements,flags,runtime --sign - "$f"
+          done
+
           echo '{}' | jq --arg p "${{ matrix.platform }}" --arg a "${{ matrix.arch }}" \
             '{platform: $p, arch: $a, build_time: now | todate}' > "$TARGET_DIR/build-info.json"
           ls -la "$TARGET_DIR"
@@ -255,6 +318,19 @@ jobs:
           for p in linux-x64 linux-arm64 darwin-arm64 darwin-x64 win32-x64; do
             test -f "prebuilds/$p/wsjtx_lib_nodejs.node" || { echo "Missing: $p"; exit 1; }
           done
+          for elf in prebuilds/linux-*/wsjtx_lib_nodejs.node prebuilds/linux-*/libwsjtx_core.so; do
+            test -f "$elf" || { echo "Missing Linux ELF: $elf"; exit 1; }
+            flags=$(readelf -W -l "$elf" | awk '/GNU_STACK/ {print $(NF-1)}')
+            echo "GNU_STACK $elf: ${flags:-missing}"
+            if [ -z "$flags" ]; then
+              echo "Missing GNU_STACK program header in Linux prebuild: $elf" >&2
+              exit 1
+            fi
+            if [[ "$flags" == *E* ]]; then
+              echo "Executable stack is not allowed in Linux prebuilds: $elf ($flags)" >&2
+              exit 1
+            fi
+          done
           echo "All 5 platform prebuilds verified."
 
       - run: npm publish

README.md

@@ -47,6 +47,11 @@ Runtime binary loading uses `node-gyp-build` with prebuildify layout
 (`prebuilds/<platform>-<arch>/*.node`), and falls back to
 `build/Release/*.node` for local development builds.
 
+Linux prebuilds are built and checked so neither `wsjtx_lib_nodejs.node` nor
+`libwsjtx_core.so` requires an executable stack. Downstreams should not patch
+`PT_GNU_STACK` or require `GLIBC_TUNABLES=glibc.rtld.execstack=2`; if that
+condition appears, treat it as a source/build regression.
+
 ### Building from Source
 
 Only needed if prebuilt binaries are not available for your platform.

docs/prebuilt-bundling.md

@@ -22,6 +22,7 @@
   - Linux：设置（或覆盖）RPATH/RUNPATH 为 `$ORIGIN`（同级目录）。
   - Windows：无需 rpath，DLL 与 `.node` 同级即可被加载器找到。
 - 验证：在 CI 中使用 `otool -L`（macOS）、`ldd`（Linux）、`objdump -p`（Windows）输出检查结果，确保无绝对路径残留且依赖可解析。
+- Linux 预构建必须原生不要求 executable stack。Fortran callback 结构不得依赖 gfortran stack trampoline；下游不应通过清理 ELF `PT_GNU_STACK` 标记来掩盖源码问题。
 
 平台做法与所用工具
 
@@ -49,13 +50,14 @@ dylibbundler \
 - 验证：
 ```
 otool -L prebuilds/darwin-arm64/wsjtx_lib_nodejs.node
+otool -l prebuilds/darwin-arm64/wsjtx_lib_nodejs.node | grep -A2 LC_RPATH
 ```
-应看到 `@loader_path/libfftw3f.3.dylib` 等（同级目录），无 Homebrew 绝对路径。
+应看到 `@loader_path/libfftw3f.3.dylib` 等（同级目录），无 Homebrew 绝对路径，且同一个 `LC_RPATH` 不应重复出现。
 
 2) Linux（使用 `patchelf` + `ldd`）
 
 - 依赖：`apt-get install -y patchelf`（以及 `ldd`）
-- 复制依赖：用 `ldd` 列出 `.node` 的依赖，筛选并复制目标库到与 `.node` 同级目录：
+- 复制依赖：用 `ldd` 列出 `.node` 和 `libwsjtx_core.so` 的依赖，筛选并复制目标库到与 `.node` 同级目录：
   - 包括 `libfftw3f*`、`libgfortran*`、`libquadmath*`、`libgcc_s*`（可酌情包含 `libstdc++*`）。
   - 排除 glibc（`libc`, `libm`, `libpthread`, `ld-linux` 等）。
 - 设置 RPATH：
@@ -65,8 +67,11 @@ patchelf --set-rpath '$ORIGIN' prebuilds/linux-*/wsjtx_lib_nodejs.node
 - 验证：
 ```
 ldd prebuilds/linux-*/wsjtx_lib_nodejs.node | grep -v 'linux-vdso\|ld-linux\|libc\|libm\|libpthread\|libdl'
+ldd prebuilds/linux-*/libwsjtx_core.so | grep -v 'linux-vdso\|ld-linux\|libc\|libm\|libpthread\|libdl'
+readelf -W -l prebuilds/linux-*/wsjtx_lib_nodejs.node | grep GNU_STACK
+readelf -W -l prebuilds/linux-*/libwsjtx_core.so | grep GNU_STACK
 ```
-应无 "not found"，关键库解析到同目录。
+应无 "not found"，关键库解析到同目录；`GNU_STACK` flags 不得包含 `E`。
 
 3) Windows（MinGW/MSYS2 工具链）
 
@@ -79,20 +84,22 @@ CI 集成（简化、可重复）
 
 - **所有平台统一方案**：将依赖库与 `.node` 文件放在同级目录
 - macOS：用 `dylibbundler` 自动复制并改写到 `prebuilds/darwin-*/`；输出 `otool -L` 结果到日志。
-- Linux：安装 `patchelf`；复制 `ldd` 识别出的目标库到 `prebuilds/linux-*/` 并 `patchelf --set-rpath '$ORIGIN'`；输出 `ldd` 结果。
+- macOS：`dylibbundler` 后清理重复 `LC_RPATH` 并重新 ad-hoc codesign，避免下游 Electron/App 打包时再次遇到重复 rpath 或签名失效问题。
+- Linux：安装 `patchelf`；复制 `.node` 与 `libwsjtx_core.so` 经 `ldd` 识别出的目标库到 `prebuilds/linux-*/` 并 `patchelf --set-rpath '$ORIGIN'`；输出 `ldd` 结果。
 - Windows：用 `objdump` 枚举 DLL 并从 MinGW 目录复制到与 `.node` 同级；输出依赖列表。
 
 发布前校验
 
 - 生成 `prebuilds/*/` 后：
   - macOS：`otool -L` 检查路径应为 `@loader_path/<lib>.dylib`（同级目录）。
-  - Linux：`ldd` 无 "not found"，并且关键库解析到同目录。
+  - Linux：`ldd` 无 "not found"，并且关键库解析到同目录；`readelf -W -l` 检查 `.node` 与 `libwsjtx_core.so` 的 `GNU_STACK` 不含 execute flag。
   - Windows：`objdump -p` 的 DLL 在同级目录存在。
 
 注意事项
 
 - macOS 改写依赖会使原签名失效，dylibbundler 会进行 ad-hoc 签名；若集成到 Electron/App，需对最终产物统一签名/公证。
 - Linux 不要尝试捆绑或静态链接 glibc；可考虑 `-static-libstdc++ -static-libgcc` 减少 .so 数量。
+- Linux 不要发布需要 `GLIBC_TUNABLES=glibc.rtld.execstack=2` 的产物；如果 `readelf` 发现 `GNU_STACK` 含 `E`，应回到 Fortran 源码查找 internal procedure callback / trampoline，而不是对产物做 post-build patch。
 - **所有平台统一采用同级目录方案**，避免嵌套路径导致的 `@loader_path/native/native/` 等问题（详见下方"常见陷阱"）。
 
 ## 常见陷阱与解决方案

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "wsjtx-lib",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Node.js C++ extension for WSJTX digital radio protocol library",
   "type": "module",
   "main": "dist/src/index.js",