wget: retrieve HTTPS URLs through Kandelo networking

[brandonpayton]

Purpose

Add GNU Wget 1.25.0 as a first-class Kandelo Homebrew Formula. The Formula builds through Kandelo's normal SDK and sysroot path, links against the tap's OpenSSL and zlib libraries, and exercises real HTTPS, compression, connection-refusal, and background-process behavior.

What this Formula does

• Downloads and verifies the official GNU Wget 1.25.0 source archive.
• Declares the tap's OpenSSL and zlib Formulae as direct target dependencies.
• Cross-compiles with stable guest paths instead of embedding host build, SDK, dependency-keg, or Cellar paths.
• Fork-instruments the final wget executable so --background follows Kandelo's normal process model.
• Installs the upstream sample wgetrc, Info manual, and wget(1) manual page.
• Runs the shared Wasm ABI, continuation, retired-Asyncify, and host-path artifact checks.
• Tests certificate-verified HTTPS with gzip decoding against nghttp2.org.
• Tests a real background child, including the reported PID, exact downloaded bytes, completed log, and successful descendant status.
• Tests a real guest-loopback connection refusal at 127.0.0.1:1.

The background test intentionally does not start a host Ruby TCP server. Kandelo guest loopback is not host loopback, so using a host listener would test the wrong network topology.

Rebase and source evidence

Current base: ac0a8f6986bb378fd230563da53ad4cb61cd640b

Prepared head: 406bb59fad373048512231697d9204d6f0ccda24

Formula/wget.rb is byte-identical before and after the history-only rebase:

• Git blob: b706d02f91714fe72a477ee797de6ddf861ebcc4
• SHA-256: 1a1cf3a0e2ba6c74b7177dc47bc1fbd7d95ae739b127c25556884f245ac6c79b

The only conflict was the README Formula inventory. Its resolution keeps current main and adds the Wget entry after GNU Tar. The final PR diff remains one new Formula and one README line.

These exact Formula bytes previously produced a source-built bin/wget with SHA-256 beginning c089b19d and a Homebrew receipt recording built_as_bottle=false and poured_from_bottle=false. The final Formula test then passed and proved HTTPS gzip decoding, successful background-child completion, a positive parent-reported PID, byte-exact output, a completed log, and the expected connection-refusal failure.

That earlier runtime result is historical source evidence, not evidence for a current-ABI bottle. The official Wget source archive was rechecked against the Formula's complete SHA-256, 766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784.

Current static validation through Kandelo's canonical dev shell:

• Ruby syntax: pass.
• brew style Formula/wget.rb: 1 file inspected, no offenses.
• Shared Formula support tests: 45 runs, 340 assertions, 0 failures, 0 errors.
• Fork-descendant helper tests: 10 tests passed.
• PR #936 direct runtime-closure parser: pass, with only the declared OpenSSL and zlib runtime dependencies.
• git diff --check origin/main...HEAD: pass.
• Worktree: clean.

Independent devil's-advocate review accepted the exact prepared head with no blocking Formula or source-merge finding. A Wget source build and runtime test were not rerun for this history-only rebase; those are required from the exact merged source during current-ABI bottle production.

Merge and publication gates

This source-only Formula has passed rebased exact-head static review. The old ABI 18, #871, and #882 gates no longer apply.

Producing the final bottle is a later, dependency-first step. It waits for:

• sdk: centralize cross-compile function availability kandelo#874, followed by #883, plus #913 and the ABI current at rebuild time.
• homebrew: publish and verify installable Kandelo bottles kandelo#936, tap PR ci: add thin tap workflows for bottle publishing and maintenance #22, and the approved tap security settings.
• Published and successfully poured zlib and OpenSSL bottles built by the trusted publisher.
• A fresh build and Formula test from the exact merged Wget source.
• A successful Wget bottle pour and stock-guest validation on Node.js and Chromium.

This PR contains no bottle block, sidecar, archive, receipt, provenance metadata, Wasm binary, Kandelo platform change, or ABI change.

[brandonpayton]

Independent devil's-advocate review completed at tap head 609a242.

Finding fixed:

• The original formula copied only src/wget, even though wget --version advertised a system wgetrc path and upstream ships a standard sample configuration and generated man page. The advertised file did not exist. The formula now compiles SYSTEM_WGETRC against Homebrew etc, installs the exact upstream sample.wgetrc, installs wget(1), and tests both resource presence and config parsing.

Review disposition:

• OpenSSL and zlib are the complete linked target-library set. Optional IRI/PSL/NLS/PCRE/xattr/Metalink/UUID integrations are explicitly disabled and now documented; no transitive target dependency is hidden.
• The CA bundle is correctly platform-owned host/VFS state. Default certificate verification succeeded on Node and Chromium without --no-check-certificate.
• The rebuilt artifact exports ABI 18, imports kernel_fork, has all five wpk_fork_* exports, has no Asyncify names, and retains both zlib inflate and OpenSSL verification code.
• wget --background executed a real fork: parent status 0, child pid reported, kernel fork counter exactly 1.
• Exact-byte Chromium HTTPS and refusal paths passed through #880/#875.
• Strict online audit, style, syntax, diff checks, isolated source rebuild, and literal Homebrew tests passed.

Known boundary: wget.info remains uninstalled because Homebrew's info linker requires install-info; Kandelo has no first-class texinfo package yet. Adding a native-host dependency would violate the package model. This is documentation-only and does not affect Wget runtime behavior.

The PR remains intentionally unmerged. The main PR gates in the description are still open, and trusted bottle CI must additionally prove .bottle/etc/wgetrc capture, canonical guest-prefix behavior, pour, and Node/Chromium execution. No bottle was published during this review.

[brandonpayton]

Exact-head update after tap #70

This branch is now based directly on tap main 36df17ec5395fb4531fddc2d9ab769eb1e6c19ca and uses the merged fail-closed Wasm artifact validator. Current head: e94104020d91fb5820dc0d38ef9498b09dfbcc5e.

Formula/wget.rb blob beafc30e, SHA-256 d034d5a0...37a4a587.

Through Kandelo's dev shell, the combined eight-formula syntax/style pass is clean, the merged support suite passes 29/216, and branch diff checks pass. A fresh exact-head devil review is still required.

This supersedes the older restack head/base/hash paragraph in the PR body. Source materialization remains gated on Automattic/kandelo#882; no bottle, sidecar, receipt, provenance, or poured-install claim is made by this update.

[brandonpayton]

Follow-up to the #70 restack: current exact head is 810037eedfb5ef3ea6b68228f3776889542e3982; formula blob 0384407f, SHA-256 88dcc06d4d48d3fed0252112a0db80e8f75134da7a0ffd514f67cc63f5cde3b3.

The shared-validator call now rejects only path-map sources that differ from their stable guest destinations. This avoids falsely rejecting Linux-builder opt/etc paths that are already the intended /home/linuxbrew/.linuxbrew/... runtime identities, while still rejecting build, checkout, Cellar, and host-only dependency paths. Ruby syntax, style, and diff checks pass. Exact-head devil review and #882 remain required; no bottle claim is made.

[brandonpayton]

Independent devil review: ACCEPT at corrected exact head f4339d343c85391674957075b88d881664a14617 on base 36df17ec5395fb4531fddc2d9ab769eb1e6c19ca.

The source/destination assertions now mirror the shared validator: every intended guest identity is required, while a source path is rejected only when it differs. This accepts canonical trusted-Linux /home/linuxbrew/.linuxbrew paths and still rejects Darwin, temporary, worktree, Nix, and custom-prefix builder identities. The reviewed ABI 18 artifact contains all four intended guest mappings, imports kernel_fork, exports all five continuation functions, and contains no retired Asyncify.

The review also independently verified official source/license, OpenSSL and zlib target dependencies, feature exclusions, SDK-vs-package cache ownership, and install completeness. The release doc/wget.info is shipped current and does not require Texinfo. Live Node HTTPS gzip/refusal, Chromium certificate-verified HTTPS/refusal, and a background fork probe all passed; the background run exited 0 with one fork and child pid 101.

Fresh exact-head syntax/load, Homebrew style, 29 support tests / 216 assertions, diff check, source-only scope, formula hash, PR metadata, clean worktree, and exact merge tree pass.

Accepted for source merge once Automattic/kandelo#882 lands. Dependency bottles and stock-guest pours remain separate publication gates; no bottle claim is made.

[brandonpayton]

Exact-head devil review: ACCEPT for source merge after #882 at 216e05944592a8dc6022e366e37018de1712ae2f. The shared lifecycle behavior is now independently reviewed and merged as tap #73, leaving #20 with a Formula/README-only diff. The test uses a loopback server and writable guest mount, invokes real wget --background, requires at least one kernel-reported fork descendant and zero exit for every observed fork descendant, then verifies the parent PID message, exact downloaded bytes, and the child log. It has no sleep, wrapper, synthetic output, or premature host teardown. The rebase preserves the prior Formula implementation; only the durable test and merged helper keyword differ from reviewed head 1430452. Fresh dev-shell evidence: Ruby syntax, Homebrew style, 30/221 shared support assertions, and diff check pass. No exact Wget rebuild or runtime is claimed; #882 and publication gates remain binding.

[brandonpayton]

Independent devil's-advocate review: APPROVE this source-only PR at exact head 216e05944592a8dc6022e366e37018de1712ae2f, after Automattic/kandelo#882 lands.

The review found no blocker: the formula builds official Wget 1.25.0 through the ABI 18 SDK, declares its actual tap OpenSSL and zlib target dependencies, keeps native tools scoped to validation, final-relinks before fork instrumentation, and validates ABI/fork/Asyncify/path integrity. Its tests exercise HTTPS+gzip, connection refusal, and a real background fork descendant with loopback I/O, bounded cleanup, byte-exact output, and log assertions. The worktree is clean; formula/source hashes, Ruby syntax, and git diff --check were independently rechecked.

This approves source merge only. Bottle publication still requires exact merged-head build/pour evidence and Homebrew dependency receipts/provenance.

[brandonpayton]

Independent history-only restack review: APPROVE exact head b197892. Formula blob and SHA-256 remain byte-identical; the README delta is only the Wget row; exact syntax, diff, and style checks pass. This is restack approval only: fresh exact source, Node, and Chromium acceptance is still required, with #874/#882 as source gates and dependency-first #888/#890 publication gates preserved.

[brandonpayton]

Independent exact-head devil's-advocate review: ACCEPT at 7e99e35e225aa53257c5b9f4443091ae83bf8e4f.

The reviewer independently reran literal brew test --verbose review/wget/wget successfully and verified the source-built artifact/receipt, ABI 18 evidence, required fork continuation surface, absence of retired Asyncify, certificate-verified HTTPS with real gzip decode, enforced background-descendant completion/status, exact payload/PID/log assertions, and truthful guest-loopback refusal.

Merge remains intentionally held while Automattic/kandelo#874 and #882 are open. Bottle publication also remains gated on the consolidated ABI outcome owned by the PR #871 worktree.