Update dependency farcloser/limen to v0.24.0

.hermetic/aqua-checksums.json

@@ -66,28 +66,28 @@
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.22.0/limen_0.22.0_darwin_arm64.tar.gz",
-      "checksum": "F84D216ABB15016DAAB99D564C5D0655E3A836EAFEA76EE30F387DFB6D71D353",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_darwin_arm64.tar.gz",
+      "checksum": "BB7F8386488E585FE59F871CD3D5A4F74E8DA17B51118A11FE6FABA1C91E6FEB",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.22.0/limen_0.22.0_linux_amd64.tar.gz",
-      "checksum": "477D22E136C061D3CA8FF4D611F475DF4736C4063F7138E4D531001EA9B27E6D",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_linux_amd64.tar.gz",
+      "checksum": "8FD7C868E5C26E3E04C2F0F83D0904D271A9D7FD596E8D4303DC9689B8869209",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.22.0/limen_0.22.0_linux_arm64.tar.gz",
-      "checksum": "BA08CA6D563319AC036B322A81DDDD3B7652B5CFC42CA6D5438E436A0212A158",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_linux_arm64.tar.gz",
+      "checksum": "BDC58258E2B6280AFEF8AD7D8965D19B4AC3AB0C741C9FDC126403847F279E04",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.22.0/limen_0.22.0_windows_amd64.tar.gz",
-      "checksum": "0F79B9165B032E4020482544B34FA81293D13103754824E447397E80D5A8E4AE",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_windows_amd64.tar.gz",
+      "checksum": "9B862D79FCBB33676F2304FDA902A39F7623BB543EB43693F1F8015B2531730B",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.22.0/limen_0.22.0_windows_arm64.tar.gz",
-      "checksum": "A098CBA49A2C4FC4955C3062F5321D96467E84C4328D783D7CCD3DCE83D9BBC0",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_windows_arm64.tar.gz",
+      "checksum": "05F751B5F5DB7FDB8544ACC055D9330A6CFDA64897FE31339B210A64C5C1CC49",
       "algorithm": "sha256"
     },
     {
@@ -145,31 +145,6 @@
       "checksum": "1098AA1A16D737FD7075583013A75B8BAB52C0530A79B6127254C4AE0DFE4220",
       "algorithm": "sha256"
     },
-    {
-      "id": "github_release/github.com/forkcloser/yamlfmt/v0.2.1/yamlfmt_0.2.1_darwin_arm64.tar.gz",
-      "checksum": "76414678AC18FE16264BB4EBF1C5EBB06570D90C0ECD0814E239E41DFF1026E7",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/forkcloser/yamlfmt/v0.2.1/yamlfmt_0.2.1_linux_amd64.tar.gz",
-      "checksum": "692A4B72DFF363DCDC3CD8F41C55042EAC993EFDCC08D55DF90BA5E5FD691431",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/forkcloser/yamlfmt/v0.2.1/yamlfmt_0.2.1_linux_arm64.tar.gz",
-      "checksum": "D72B86DA88BDB3DDF3B4971048AF39599C75930B7FDE532C24C598734D74385B",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/forkcloser/yamlfmt/v0.2.1/yamlfmt_0.2.1_windows_amd64.tar.gz",
-      "checksum": "4EA9AC7051EA25631FA58C9546D272F318D47A584AFD87757EE6CA7C0B52B919",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/forkcloser/yamlfmt/v0.2.1/yamlfmt_0.2.1_windows_arm64.tar.gz",
-      "checksum": "DF122697A27F8A1F888B9037D65173A9D21BBCD2B5866E706D979C926533D8BB",
-      "algorithm": "sha256"
-    },
     {
       "id": "github_release/github.com/git-for-windows/git/v2.56.0.windows.4/Git-2.56.0.4-64-bit.tar.bz2",
       "checksum": "0DAE059764BA7C447C9604EB6CB0F4AFAF2D90B003ECF1C8CF2DBE5A13E4442C",
@@ -205,31 +180,6 @@
       "checksum": "67807490E909A37F58EF40B67601896D8D4DA2411C9839221DAE55732C243FE9",
       "algorithm": "sha256"
     },
-    {
-      "id": "github_release/github.com/gotestyourself/gotestsum/v1.13.0/gotestsum_1.13.0_darwin_arm64.tar.gz",
-      "checksum": "509CB27AEF747F48FAF9BCE424F59DCF79572C905204B990EE935BBFCC7FA0E9",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/gotestyourself/gotestsum/v1.13.0/gotestsum_1.13.0_linux_amd64.tar.gz",
-      "checksum": "11CCDDEAF708EF228889F9FE2F68291A75B27013DDFC3B18156E094F5F40E8EE",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/gotestyourself/gotestsum/v1.13.0/gotestsum_1.13.0_linux_arm64.tar.gz",
-      "checksum": "7644A4C5CD1BB978D56245AEAB25A586AC5AC62ADEBED20A399548867C13499D",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/gotestyourself/gotestsum/v1.13.0/gotestsum_1.13.0_windows_amd64.tar.gz",
-      "checksum": "FD5A6DC69E46A0970593E70D85A7E75F16714E9C61D6D72CCC324EB82DF5BB8A",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "github_release/github.com/gotestyourself/gotestsum/v1.13.0/gotestsum_1.13.0_windows_arm64.tar.gz",
-      "checksum": "72A59200F83B3204CD59FD417E384DB0543C5511D7A9E38957E74A4035950943",
-      "algorithm": "sha256"
-    },
     {
       "id": "github_release/github.com/jqlang/jq/jq-1.8.2/jq-linux-amd64",
       "checksum": "B1C22172DD303F3BE49E935AA56AA48A8B7A46E0BC838B4997D3BB451495870F",

.hermetic/hermetic.yaml

@@ -19,7 +19,7 @@ registries:
 packages:
   # The limen this repository runs, and with it every canonical file it
   # writes: the one canonical pin kept here, where Renovate bumps it.
-  - name: farcloser/limen@v0.22.0 # renovate: depName=farcloser/limen
+  - name: farcloser/limen@v0.24.0 # renovate: depName=farcloser/limen
     registry: local
   # The Go toolchain is the repository's own pin, seeded from limen's own
   # manifest once and Renovate's here afterwards: a standard-library fix

.limen/hermetic-registry.yaml

@@ -712,35 +712,3 @@ packages:
       - linux/arm64
       - windows/amd64
       - windows/arm64
-  # The YAML formatter: forkcloser/yamlfmt, upstream google/yamlfmt with its
-  # data-changing formats fixed (a placeholder leaked into output, blank lines
-  # in folded scalars): on the fleet's YAML the fork changes layout only.
-  # Release and verification in compress's shape; the binary at the archive
-  # root, .exe on windows.
-  - type: github_release
-    repo_owner: forkcloser
-    repo_name: yamlfmt
-    description: An extensible command line tool or library to format yaml files (forkcloser/yamlfmt)
-    asset: yamlfmt_{{trimV .Version}}_{{.OS}}_{{.Arch}}.tar.gz
-    format: tar.gz
-    files:
-      - name: yamlfmt
-    checksum:
-      type: github_release
-      asset: checksums.txt
-      algorithm: sha256
-      cosign:
-        bundle:
-          type: github_release
-          asset: checksums.txt.sigstore.json
-        opts:
-          - --certificate-identity
-          - https://github.com/forkcloser/yamlfmt/.github/workflows/release.yaml@refs/tags/{{.Version}}
-          - --certificate-oidc-issuer
-          - https://token.actions.githubusercontent.com
-    supported_envs:
-      - darwin/arm64
-      - linux/amd64
-      - linux/arm64
-      - windows/amd64
-      - windows/arm64

.limen/hermetic.yaml

@@ -9,10 +9,15 @@ packages:
   # collapses a two-line `version:` pin): `aqua update` rewrites only that form
   # and treats a separate `version:` key as hand-held, and Renovate reads only
   # that form.
-  # No Go-built tool is pinned here: every one is a `tool` directive in
-  # .limen/tools/go.mod, built by the pinned go (book/tooling.md, "Go-built tools
-  # are go.mod tools"). aqua's go_install would build it once per tool
-  # version, with whichever go ran first, and share that binary.
+  # A pure-Go tool is a `tool` directive in .limen/tools/, built by the pinned
+  # go (book/tooling.md, "Go-built tools are go.mod tools"), never a pin here.
+  # The Go programs below are the ones nothing here compiles: what a write
+  # job runs (cosign and gh; goreleaser and syft in the release job, which
+  # holds contents, id-token and attestations write), each verified against
+  # its upstream's signed release rather than compiled inside that job;
+  # compress, whose programs answer to bare names on every PATH, a script's
+  # and a shell's; ossein, which links a system framework through cgo.
+  # (limen is the repository's own pin, above the import.)
   # The coreutils under their bare names, the same pin on every platform:
   # uutils on macOS and Linux, Git for Windows' MSYS2 coreutils on Windows.
   # The registry entries say why, and how each is verified.
@@ -26,14 +31,11 @@ packages:
   # afterwards): a standard-library fix must not wait for a limen release.
   - name: casey/just@1.59.0
   - name: koalaman/shellcheck@v0.11.0
-  - name: forkcloser/yamlfmt@v0.2.1
-    registry: local
   - name: lycheeverse/lychee@lychee-v0.24.2
   - name: goreleaser/goreleaser@v2.19.0
   - name: sigstore/cosign@v3.1.4
   # The SBOM generator the release lane runs over every archive (book/releasing.md).
   - name: anchore/syft@v1.55.0
-  - name: gotestyourself/gotestsum@v1.13.0
   - name: jqlang/jq@jq-1.8.2
   - name: cli/cli@v2.103.3
   # --- spec tooling (local registry; see .limen/hermetic-registry.yaml) ---

.limen/just/apple.just

@@ -43,17 +43,23 @@ apple-verify-signed bundle:
     fi
 
 # The stapled notarization ticket: Contents/CodeResources is where stapler
-# writes it, and `stapler validate` is the check that needs no network, the
-# one Gatekeeper makes offline. spctl has no assessment for a plug-in (its
-# execute type answers for app bundles alone), so it is not consulted.
+# writes it. `stapler validate` asks Apple's ticket service for the record, so
+# a dropped connection fails it with nothing wrong in the bundle: it is tried
+# three times before the bundle is refused. spctl has no assessment for a
+# plug-in (its execute type answers for app bundles alone), so it is not
+# consulted.
 [doc('Assert a bundle carries a stapled notarization ticket that validates')]
 apple-verify-notarized bundle:
     #!/usr/bin/env bash
     set -euo pipefail
     fail() { echo "apple-verify-notarized: $*" >&2; exit 1; }
     bundle='{{ bundle }}'
     [ -f "$bundle/Contents/CodeResources" ] || fail "no notarization ticket is stapled to $bundle"
-    xcrun stapler validate "$bundle" || fail "the ticket stapled to $bundle does not validate"
+    for attempt in 1 2 3; do
+        xcrun stapler validate "$bundle" && break
+        [ "$attempt" -lt 3 ] || fail "the ticket stapled to $bundle does not validate"
+        sleep $((attempt * 10))
+    done
     echo "apple-verify-notarized: $bundle carries a valid stapled ticket"
 
 # Submit the signed bundle to Apple and staple the ticket. The verdict is
@@ -85,8 +91,9 @@ apple-notarize bundle:
         [ -z "$id" ] || xcrun notarytool log "$id" "${key[@]}" >&2 || true
         exit 1
     fi
+    # staple validates what it writes; a second validate only asks the
+    # network again.
     xcrun stapler staple "$bundle"
-    xcrun stapler validate "$bundle"
     echo "apple-notarize: $bundle notarized (submission ${id:-?}), ticket stapled"
 
 # ditto, not zip: the archiver that keeps a bundle's extended attributes and

.limen/just/build-rust.just

@@ -57,7 +57,18 @@ targets +triples: (_banner "build rust" "targets")
     # directory.
     export ZIG_GLOBAL_CACHE_DIR="$LIMEN_BUILD/zig/global" ZIG_LOCAL_CACHE_DIR="$LIMEN_BUILD/zig/local"
     export CARGO_ZIGBUILD_CACHE_DIR="$LIMEN_BUILD/zig/cargo-zigbuild"
+    # For the host's own triple, cargo-zigbuild sets target-applies-to-host to
+    # false: build scripts and proc-macros stop reading [target.<host>] and
+    # read [host] instead. The linker rust_env gave the host (the arm64
+    # Windows one, which ships none) goes to [host] for that build.
+    host="$(rustc -vV | sed -n 's/^host: //p')"
+    host_linker_var="CARGO_TARGET_$(printf '%s' "$host" | tr 'a-z-' 'A-Z_')_LINKER"
+    host_linker="${!host_linker_var:-}"
     for triple in "$@"; do
         echo "→ target/$triple/release"
-        cargo zigbuild --release --locked --target "$triple"
+        if [ "$triple" = "$host" ] && [ -n "$host_linker" ]; then
+            CARGO_UNSTABLE_HOST_CONFIG=true CARGO_HOST_LINKER="$host_linker" cargo zigbuild --release --locked --target "$triple"
+        else
+            cargo zigbuild --release --locked --target "$triple"
+        fi
     done

.limen/just/fix.just

@@ -36,8 +36,8 @@ just: (_banner "fix" "just")
         just --fmt --justfile "$f"
     done < "$list"
 
-yaml: (_banner "fix" "yaml")
-    yamlfmt -conf .limen/.yamlfmt
+yaml: (_banner "fix" "yaml") (_go-tool "yamlfmt" "github.com/forkcloser/yamlfmt/cmd/yamlfmt")
+    "$LIMEN_BUILD/tools/yamlfmt" -conf .limen/.yamlfmt
 
 # Regenerate .hermetic/aqua-checksums.json from .hermetic/hermetic.yaml — the
 # mutating twin of `just do lint aqua` (needs network). In the default set so

.limen/just/lib.just

@@ -145,10 +145,15 @@ rust_env := '''
 # dependencies past what upstream tested). The isolated module wins when both
 # exist. A directive missing from both fails with the recipe that adds it.
 # Recipes depend on this with the tool's name and package, then call
-# .build/tools/<name>.
-_go-tool name pkg:
+# .build/tools/<name>. A third argument names a file the recipe needs to run
+# at all (go.mod for a lane CI runs everywhere): without it the tool is not
+# built, so a repository with no Go module is not asked for the directive.
+_go-tool name pkg requires='':
     #!/usr/bin/env bash
     set -euo pipefail
+    if [ -n '{{ requires }}' ] && [ ! -f '{{ requires }}' ]; then
+        exit 0
+    fi
     pattern='^(tool[[:space:]]+)?[[:space:]]*{{ pkg }}([[:space:]]|$)'
     if grep -qE "$pattern" '.limen/tools/{{ name }}/go.mod' 2>/dev/null; then
         mkdir -p "$LIMEN_BUILD/tools" && GOOS='' GOARCH='' CGO_ENABLED=0 go -C '.limen/tools/{{ name }}' build -o "$LIMEN_BUILD/tools/" '{{ pkg }}'

.limen/just/lint.just

@@ -79,8 +79,8 @@ dockerfile: (_banner "lint" "dockerfile") (_go-tool "godolint" "github.com/forkc
     # pinned one, here.
     [ ${#files[@]} -eq 0 ] || "$LIMEN_BUILD/tools/godolint" "${files[@]}"
 
-yaml: (_banner "lint" "yaml")
-    yamlfmt -conf .limen/.yamlfmt -lint
+yaml: (_banner "lint" "yaml") (_go-tool "yamlfmt" "github.com/forkcloser/yamlfmt/cmd/yamlfmt")
+    "$LIMEN_BUILD/tools/yamlfmt" -conf .limen/.yamlfmt -lint
 
 shell: (_banner "lint" "shell")
     #!/usr/bin/env bash

.limen/just/test-go.just

@@ -38,9 +38,9 @@ _prepare:
     fi
 
 # Unit tests.
-unit: (_banner "test go" "unit") _prepare
+unit: (_banner "test go" "unit") _prepare (_go-tool "gotestsum" "gotest.tools/gotestsum")
     CGO_ENABLED="{{ go_cgo }}" \
-        gotestsum -- -count=1 -timeout "${TEST_GO_TIMEOUT:-10m}" ./...
+        "$LIMEN_BUILD/tools/gotestsum" -- -count=1 -timeout "${TEST_GO_TIMEOUT:-10m}" ./...
 
 # Unit tests under the race detector. External linkmode: the detector injects
 # runtime/cgo, and hardened CGO_CFLAGS make those objects reference libc
@@ -55,7 +55,7 @@ unit: (_banner "test go" "unit") _prepare
 # legs run the detector natively; any other probe failure is real. No go.mod
 # at all: says so and passes, like fuzz, since CI runs this in every
 # repository.
-race: (_banner "test go" "race") _prepare
+race: (_banner "test go" "race") _prepare (_go-tool "gotestsum" "gotest.tools/gotestsum" "go.mod")
     #!/usr/bin/env bash
     set -euo pipefail
     if [ ! -f go.mod ]; then
@@ -71,7 +71,7 @@ race: (_banner "test go" "race") _prepare
         printf '%s\n' "$probe" >&2
         exit 1
     fi
-    gotestsum -- -count=1 -timeout "${TEST_GO_TIMEOUT:-10m}" -ldflags=-linkmode=external -race ./...
+    "$LIMEN_BUILD/tools/gotestsum" -- -count=1 -timeout "${TEST_GO_TIMEOUT:-10m}" -ldflags=-linkmode=external -race ./...
 
 # Every Fuzz* target for a short budget (TEST_GO_FUZZ_TIME, default 10s).
 # Driven by `go test -fuzz`, one target per invocation — only that build
@@ -136,13 +136,13 @@ fuzz: (_banner "test go" "fuzz") _prepare
 # Coverage: per-function summary, an HTML report under .build/coverage/, and an
 # optional minimum gate — export TEST_GO_COVER_MIN := '80' (integer percent)
 # from the root .justfile to enforce a floor; unset or 0 reports without gating.
-cover: (_banner "test go" "cover") _prepare
+cover: (_banner "test go" "cover") _prepare (_go-tool "gotestsum" "gotest.tools/gotestsum")
     #!/usr/bin/env bash
     set -euo pipefail
     export CGO_ENABLED="{{ go_cgo }}"
     dir="$LIMEN_BUILD/coverage"
     mkdir -p "$dir"
-    gotestsum -- -count=1 -timeout "${TEST_GO_TIMEOUT:-10m}" -coverprofile="$dir/coverage.out" ./...
+    "$LIMEN_BUILD/tools/gotestsum" -- -count=1 -timeout "${TEST_GO_TIMEOUT:-10m}" -coverprofile="$dir/coverage.out" ./...
     go tool cover -func="$dir/coverage.out"
     go tool cover -html="$dir/coverage.out" -o "$dir/coverage.html"
     echo "HTML report: $dir/coverage.html"