tar: add GNU Tar with Gzip archive support

[brandonpayton]

Purpose

Add GNU Tar 1.35 as a first-class Kandelo Homebrew CLI with normal archive workflows, real Gzip subprocesses, and the matching upstream rmt executable.

Formula contract

• Build the official GNU source through Kandelo's wasm32 SDK, sysroot, configure wrapper, and SDK-owned target facts.
• Disable undeclared NLS, SELinux, ACL, and xattr integrations.
• Declare Dash and Gzip as direct runtime dependencies because Tar launches compressors through /bin/sh -c.
• Require the complete fork-continuation contract for tar while keeping rmt fork-free.
• Compile the stable guest /home/linuxbrew/.linuxbrew/opt/tar/libexec/rmt path.
• Use upstream installation so the executables, man pages, Info pages, and project documentation are present.
• Test uncompressed and Gzip create/list/extract workflows through a writable /work mount.
• Stage exact Dash and Gzip executables and require one successful compressor-shell descendant in every compressed workflow.

The Formula promises and tests Gzip. Other compressors remain optional peer capabilities rather than undeclared hard dependencies.

Current review

The branch is history-only rebased onto tap main 1b0af6f993cbc90da028cf637e26aea1d9eb76dd; exact head is 211ab10c466e1f8f7c74b8182f60cfc87e9b8cbe.

Formula/tar.rb remained byte-identical across the rebase:

• Git blob: f448fc2934663a3aedf76891925864b782120ed5
• SHA-256: 0f07c36d9a440a78f3b53823ebf92ccf68e0da74b3ae43de8a25880668e8e647

Independent review found no Formula defect. Focused current-main validation through Kandelo's dev shell passed Ruby syntax, Homebrew style, Formula-support tests (45 runs / 340 assertions), the official GNU source checksum, and git diff --check.

The prior exact source builds and full Formula test covered rmt, all six uncompressed/Gzip workflows, and exact descendant counts. Those builds are historical evidence; no bottle or browser pour is claimed on this rebased head.

Source and publication order

The source-only Formula may merge now. Its next trusted source build waits for Automattic/kandelo#874 and #883 so SDK-owned Autoconf facts and Kandelo's musl identity are present on main. Automattic/kandelo#913 is not a Tar gate: Tar links direct objects before explicit libtar.a/libgnu.a archives and has no tap-library ordering edge.

Bottle publication remains separate and requires:

1. homebrew: publish and verify installable Kandelo bottles kandelo#936, tap PR ci: add thin tap workflows for bottle publishing and maintenance #22, and the tap security settings.
2. Published, provenance-verified Dash and Gzip bottles.
3. An exact merged-head current-ABI Tar rebuild with byte comparison and full Formula tests.
4. Stock Homebrew pours under Node and Chromium proving normal /bin/sh and Gzip resolution without test-harness mappings.

The PR contains no bottle block, archive, sidecar, receipt, provenance metadata, Wasm artifact, platform change, or Kandelo ABI change.

[brandonpayton]

Devil review of af85cb9 completed. I specifically checked for host/build path leakage, an unshipped default rmt, unnecessary/missing fork instrumentation, ambient compressor resolution, ABI drift, and Node/browser divergence. The review found and fixed two issues: tar previously embedded the maintainer Cellar libexec/rmt path while discarding the built rmt, and the first installed-test provenance assertion compared against an empty buildpath. The current head installs rmt, embeds the stable Kandelo guest opt path, preserves only tar's required fork instrumentation, and passes the evidence now recorded in the PR body. No tap-local blocker remains. I did not enable auto-merge because Automattic/kandelo#867, #873, and #874 are still open.

[brandonpayton]

Exact-head update after tap #70

This branch is now based directly on tap main 36df17ec5395fb4531fddc2d9ab769eb1e6c19ca and uses the merged fail-closed Wasm artifact validator. Current head: f77f619618b4a76fe6da2a5baa50f88578b44528.

Formula/tar.rb blob 4327ebb1, SHA-256 a5fbbe28...42d025ce.

Through Kandelo's dev shell, the combined eight-formula syntax/style pass is clean, the merged support suite passes 29/216, and branch diff checks pass. Exact-head devil review is in progress.

This supersedes the older restack head/base/hash paragraph in the PR body. Source materialization remains gated on Automattic/kandelo#882; no bottle, sidecar, receipt, provenance, or poured-install claim is made by this update.

[brandonpayton]

Independent devil review: ACCEPT at corrected exact head 49bfa5a03631924c91be087e3c44d0ac52edfa1a on base 36df17ec5395fb4531fddc2d9ab769eb1e6c19ca.

The correction exactly matches the independently proven install path. Configure/build still compiles /home/linuxbrew/.linuxbrew/opt/tar/libexec/rmt into the validated Tar artifact; the command-line DEFAULT_RMT_DIR=#{libexec} override changes only upstream rmt's install destination. Exact ABI 18 integration showed upstream install preserved both validated executable hashes while installing bin/tar, libexec/rmt, tar.1, rmt.8, and tar.info{,-1,-2,-3}. The current test asserts all six documents, the stable guest path, and absence of the host prefix.

Fresh exact-head checks through scripts/dev-shell.sh: Ruby syntax/load, Homebrew style, 29 support tests / 216 assertions, and diff check pass. Formula hash, PR metadata, source-only scope, clean worktree, and exact merge tree all match the PR body.

Accepted for source merge once Automattic/kandelo#882 lands. Bottle publication remains dependency-first behind a published gzip bottle and the documented platform gates; no publication claim is made.

[brandonpayton]

Devil's-advocate disposition at exact head 49bfa5a03631924c91be087e3c44d0ac52edfa1a: ACCEPT for the explicitly gzip-scoped source Formula after #882. The review found that GNU tar exposes additional external compressor commands; the PR now states the boundary rather than implying they are closure-owned. Gzip is the one hard compressed-workflow dependency and is exercised create/list/extract. Bzip2, xz/lzma, and zstd remain normal optional PATH-resolved peer Formulae; lzip/lzop are not claimed, and no wrapper or silent-success behavior is added. Formula source/hash, final validator ordering, fork policy, stable rmt path, installed documentation, syntax/style, and 29/216 support evidence otherwise remain coherent. Full exact-head build/pour was not rerun; #882 and the publication gates remain binding.

[brandonpayton]

Exact-head devil review after the history-only restack: APPROVE for source merge after Automattic/kandelo#882 at 9ed71f1c6ea64531c91ddbab2f6ddaa8b5295647.

The Formula blob is exactly 5c8f85b3f399e52acf0ca1c9af92c5a4eb325f4d, byte-identical to independently accepted corrected head 49bfa5a03631924c91be087e3c44d0ac52edfa1a; Formula SHA-256 is e067d686c739939b71a626c3f4638e2f944c6a35b84654655d665990be779044. The current diff adds only that proven Formula plus its README catalog entry. Fresh checks through Kandelo's dev shell: Homebrew style inspected 1 file with no offenses; the shared support suite passed 30 runs / 221 assertions; Ruby syntax and git diff --check pass; the worktree is clean.

The source contract remains appropriately scoped to gzip as the hard Homebrew dependency, with bzip2/xz/zstd as truthful optional PATH peers. This is not bottle approval: gzip must be poured first and exact merged-head build/pour receipts and dependency provenance remain required.

[brandonpayton]

Independent history-only restack review: APPROVE exact head a3856d3. Formula blob and SHA-256 remain byte-identical to the accepted candidate; the README delta is only the Tar row; exact syntax, diff, and style checks pass. Source merge remains gated on Automattic/kandelo#882; dependency publication, #888/#890, and final Gzip-first Node/Chromium evidence remain required.

[brandonpayton]

Exact-head devil review: APPROVE 9c090190de66e6708652d04dae32cd6f5eba90c8. Clean builds are byte-identical; tar is correctly fork-instrumented, rmt correctly remains fork-free, and the full installed documentation surface is present. The literal test proves upstream compressor execution through declared tap Dash at /bin/sh and Gzip at /bin/gzip, with one real successful descendant for create/list/extract. Source gates remain main #874/#882/#883/#888-on-#889; #903 is not required. Final publication still requires the consolidated ABI, dependency-first Dash/Gzip bottles, trusted provenance, and stock Node/Chromium pours.

[brandonpayton]

Independent exact-head formula review: ACCEPT for 6b9f2894ce36c5786e7f0c38eb1e4be0a6d15b85.

The review verified the 7/7 unchanged range-diff, current tap-main ancestry, exact Dash/Gzip Cellar staging, six real archive workflows, one observed descendant per compressed invocation, ABI/fork policy for both linked executables, two-build byte reproducibility, complete installed documentation, support tests, style, strict audit, readall, and diff checks.

The reviewer found one PR metadata omission before push: main #873 is a real source-build gate because on-demand fork-tool discovery otherwise runs Cargo from Homebrew's source directory. The refreshed body now includes #873. It correctly excludes #903 and #905. No source blocker remains; publication gates remain explicit.

[brandonpayton]

Current exact-head audit: ACCEPT source as-is at 6b9f2894ce36c5786e7f0c38eb1e4be0a6d15b85 / tree 9bd3b78990cbfdbca7f02dad2bd2ec94bbe02d95 on tap main c5705667a90b05754d2244a362f3f7fc95d2f9c3. No Formula amendment is needed.

Fresh Ruby syntax, Homebrew style, shared Formula-support tests (37 runs/279 assertions), source checksum, and diff checks pass. The retained exact Formula artifacts remain structurally valid: tar is 1,863,905 bytes with fork import, complete continuation exports, no Asyncify, and only its canonical guest rmt path; rmt is fork-free. Separate immutable ABI 39 registry artifacts passed Node uncompressed and Gzip create/list/extract with one observed compressor descendant each, plus Chromium create/list/-xO extraction with real guest Dash and Gzip.

Those ABI 39 runs are platform evidence only, not a tap source, bottle, or pour claim. Final validation remains: two exact merged-head ABI 39 tap source builds with byte comparison, artifact/path/docs checks, final Dash and Gzip bottles first, Tar bottle creation, stock guest Homebrew pour, and Node+Chromium execution from the poured bottle/dependency closure. The PR body has been corrected from #871 to #907 and to the current publisher ordering through #910.