Repository navigation
Agent: bundle the python tool's CPython in Linux packages - #1414
Draft
AnthonyRonning wants to merge 1 commit into
Draft
AnthonyRonning wants to merge 1 commit into
AnthonyRonning wants to merge 1 commit into
Conversation
AnthonyRonning
changed the title
The AppDir stages the hash-pinned x86_64 runtime into usr/share/maple-agent/python, where the app's package resolver looks, before the runtime audit is recorded. The audit gives its ELF files their own branch: the host loader and glibc libraries, $ORIGIN paths that stay inside the runtime, and the 2.31 glibc floor. It records them as `python_runtime_elves` (audit schema 4). The Docker check imports the interpreter's native modules on the stock Ubuntu images. Every prepared runtime now leaves out Tcl/Tk, tkinter, IDLE and turtledemo. The worker has no use for Tk GUIs, and Python Build Standalone's Linux Tcl/Tk libraries carry an absolute build-host RPATH (/tools/deps/lib) that the audit rightly refuses. The Nix package copies the locked nixpkgs python314, which matches the pinned 3.14.7, into share/maple-agent/python (#897's derivation). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AnthonyRonning
force-pushed
the
agent/python-packaging-linux
branch
from
November 2, 2026 01:20
1bf983a to
fc22c56
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fourth layer of the CodeMode catch-up stack, on PR #1412 (macOS packaging). Linux tar bundles and the Nix package now carry the CPython runtime the
pythontool runs.What changed
scripts/linux-release-appimage.py): staging puts the hash-pinnedx86_64-unknown-linux-gnuruntime inusr/share/maple-agent/python, where the app's package resolver looks besideusr/bin. Hard links are copied as files and symlinks are kept.python314. Its version must equal the pin (3.14.7 on both sides), andpostInstallcopies it intoshare/maple-agent/python. The Intel-macOS dev shell input from Port bundled CPython and ordered CodeMode into Maple Agent #897 is gone with Intel macOS.prepare-python.py. Python Build Standalone's Linuxlibtcl9.0.soandlibtcl9tk9.0.socarry an absolute build-hostRPATH(/tools/deps/lib). That path would let anyone who can create that directory inject libraries. The worker has no use for Tk GUIs. Pruning saves 10.6 MB / 323 files on Linux, and the macOS runtime drops from 69 MB to 59 MB. The pruned paths are part of a prepared runtime's identity, so stale trees re-prepare.What the Linux runtime looks like
Inspected from the pinned archive:
libpython.bin/python3.14uses/lib64/ld-linux-x86-64.so.2withRPATH $ORIGIN/../lib.GLIBC_2.17.libpython3.sonames its dependency as$ORIGIN/../lib/libpython3.14.so.1.0, which resolves inside the runtime.Rebased onto master's simplified release tooling. That tooling no longer audits AppDir ELF files or runs the Docker check, so the audit branch and stock-Ubuntu probe an earlier revision added went with them. Before the rebase, the
ci:packageLinux rehearsal passed with them on both pinned Ubuntu images: it staged the runtime, audited its ELF files, and imported its native modules.Validation
just python-test(prepare-script tests, including pruning, and the worker suite) and themaple-code-modetests pass against the pruned macOS runtime.nix evalofpackages.{x86_64,aarch64}-linux.python-runtimeandpackages.x86_64-linux.defaultsucceeds, version assertion included. No lane builds the Agent's Nix package; that build was not run here (this machine has no Linux builder).ci:packagere-runs the Linux package rehearsal on the rebased branch.🤖 Generated with Claude Code