fix(cli): atomically publish fat archive cache

[zxs1633079383]

Summary

• treat libdeps-<hash>.a, rlibs-<hash>.txt, and a versioned manifest as one cache transaction protected by a per-hash OS file lock
• link a newly staged archive before publishing it, and publish the transaction only after the fat linker succeeds
• reject missing, incomplete, mismatched, empty, malformed, truncated, or content-modified cache transactions and rebuild them automatically
• perform a bounded ar structural scan before invoking the ar crate, then require every ordinary member to be a non-empty .rcgu.o or .obj

Link and transaction lifecycle

All readers and writers for the same hash acquire .fat-cache-<hash>.lock, and the lock remains held through cache validation, fat linking, and any subsequent commit. Rebuilds link the staged archive directly. Only a successful linker run may commit it; linker selection, response-file creation, process execution, or nonzero exit failures remove and sync the manifest marker while still holding the lock.

This also keeps debug rebuilds serialized and prevents them from replacing an archive another process is currently linking. Startup removes only the locked hash's uniquely named staging files, which cleans up interrupted writes without deleting an active writer's files.

Publication and durability

The manifest is the commit marker. Publication order is:

1. rename the sidecar
2. rename the archive
3. sync the parent directory on Unix
4. rename the manifest marker
5. sync the parent directory again on Unix

Readers accept the transaction only when the manifest's lengths and hashes match both payloads. The v2 manifest binds the complete archive SHA-256 in addition to its structural fingerprint. This deliberately makes cache-hit validation O(archive bytes) I/O, with O(1) streaming memory, in exchange for detecting same-layout content replacement.

On Unix, the directory syncs preserve the intended payload-before-marker ordering across process interruption and power loss, subject to the filesystem's guarantees. On Windows, publication still provides atomic visibility/process-interruption recovery through same-directory replacement and the last-published marker, but this PR does not claim general power-loss durability because parent-directory fsync is unavailable here.

Bounded archive validation

Before ar::Archive sees the file, the scanner validates the global header, every 60-byte member header, decimal size, BSD extended-name size, GNU name-table reference, member body, and padding. All offsets use checked arithmetic and must remain within the actual file length, preventing a tiny forged archive from triggering a huge allocation in the parser.

The semantic pass rejects zero-length objects, wrong ordinary member types, and GNU/BSD symbol- or name-table-only archives. It accepts valid common, BSD long-name, and GNU long-name archives.

Darwin ranlib

Darwin ranlib runs on the staged archive before linking. Because it may replace the inode, dx reopens the staged path and syncs that inode instead of relying on the pre-ranlib NamedTempFile handle. A macOS test builds a real object archive, runs the system ranlib, reopens/syncs it, and validates the result.

Tests

• cargo test -p dioxus-cli build::link::tests (23 passed)
• cargo test -p dioxus-cli (182 passed)
• cargo clippy -p dioxus-cli --tests -- -D warnings
• cargo fmt --check
• git diff --check

Fixes #5684

[zxs1633079383]

I found several cache-transaction and validation edge cases during a deeper review, so I am moving this back to draft while I strengthen the implementation. I am working on transactional archive/sidecar publication, bounded ar parsing, explicit concurrency ownership, Darwin ranlib durability, stale staging cleanup, and failure-injection/concurrency tests. I will keep the PR draft until those invariants are covered and revalidated.

[zxs1633079383]

The transaction/validation hardening is now pushed in 5b08652ae. The cache is serialized by a per-hash OS lock and committed with a manifest marker after the sidecar and archive; partial publication is rejected by matching both fingerprints. Validation now performs checked, file-bounded ar scanning before the parser and enforces non-empty Rust object members. Persist errors propagate, debug rebuilds cannot reuse stale state, same-hash SIGKILL staging is cleaned under the lock, and Darwin ranlib is followed by path reopen/sync plus parent-directory sync.

The focused suite now has 21 tests covering transaction failure injection, concurrency, persist failure, stale staging, bounded GNU/BSD parsing, special-table-only archives, zero/wrong members, and real macOS ranlib behavior. Full CLI tests (180) and clippy with -D warnings pass.

[zxs1633079383]

A second review found two remaining durability/lifecycle gaps, so I am moving the PR back to draft again. I am tightening the publish ordering and archive identity, and extending the per-hash lock through linker completion so a failed fat link cannot leave a committed cache transaction or race with a debug rebuild. I will also narrow the documented guarantee to atomic visibility/process interruption rather than claiming cross-platform power-loss durability.

[zxs1633079383]

The second-review lifecycle and durability follow-up is now pushed in efd65f49d.

New archives are linked from their staged path and are committed only after the fat linker succeeds. The per-hash OS lock now remains held through linking and commit; linker selection, response-file creation, process execution, and nonzero exit failures invalidate the manifest marker under that lock. Publication is ordered as payload renames, Unix parent-directory sync, manifest rename, then a second directory sync.

The v2 manifest now binds a streaming SHA-256 of the complete archive, so cache-hit validation deliberately costs O(archive bytes) I/O with O(1) memory. Documentation now limits the Windows guarantee to atomic visibility/process-interruption recovery and does not claim general power-loss durability.

Focused link tests pass 23/23, the full dioxus-cli suite passes 182/182, clippy passes with -D warnings, and fmt/diff checks pass. I am marking the PR ready for review.