Vendored OCCT release linkage

VernierCAD development builds deliberately use the host OCCT packages through the explicit Cargo feature system-occt. Release builds omit that feature and fail closed unless VERNIER_OCCT_STATIC_ROOT names a complete prepared static tree.

Immutable source

Official repository: https://github.com/Open-Cascade-SAS/OCCT.git
Upstream tag: V7_9_3
Annotated tag target: a016080bf6738d6aeae020badee4e888ad1540a5
Submodule: vendor/occt, detached at that exact commit

The gitlink is the authority. The build script also checks the source worktree is unmodified and that HEAD equals the recorded commit. A floating tag or branch is never used after initialization.

Static build contract

Prepare the tree once:

git submodule update --init -- vendor/occt
scripts/build-vendored-occt.sh target/vendored-occt

The script configures OCCT with CMake/Ninja as Release, static, C++17, PIC, and with samples, inspector, overview documentation, Draw, Tcl/Tk, OpenGL/Xlib, and optional third-party integrations disabled. SOURCE_DATE_EPOCH comes from the pinned source commit; GNU archive deterministic mode and source/debug prefix maps remove checkout-path and timestamp inputs.

Only these façade toolkits are direct inputs:

TKernel TKMath TKG2d TKG3d TKGeomBase TKGeomAlgo TKBRep TKTopAlgo
TKPrim TKBO TKShHealing TKMesh TKFillet TKOffset TKDESTEP TKDE TKXSBase

OCCT's src/<toolkit>/EXTERNLIB files determine the transitive closure. For 7.9.3 the sorted 26-toolkit closure is:

TKBO TKBRep TKBool TKCAF TKCDF TKDE TKDESTEP TKFillet TKG2d TKG3d
TKGeomAlgo TKGeomBase TKHLR TKLCAF TKMath TKMesh TKOffset TKPrim
TKService TKShHealing TKTopAlgo TKV3d TKVCAF TKXCAF TKXSBase TKernel

The prepared tree records the source revision, direct set, recomputed closure, platform libraries, CMake/compiler configuration, and completion marker under share/vernier/. It installs headers under include/opencascade, all 26 archives under lib, runtime resources under resources, and the LGPL 2.1 license plus OCCT exception under licenses.

Fail-closed release link

Build the two shipped binaries without system-occt:

VERNIER_OCCT_STATIC_ROOT="$PWD/target/vendored-occt" \
  cargo build --locked --release -p vernier-app \
  --bin vernier-app --bin vernier-worker

Before compiling the façade, vernier-occt-sys/build.rs independently checks the root and completion marker, exact source revision, direct set, platform set, closure recomputed from the pinned source, required headers and licenses, every non-empty archive, and named non-empty runtime resources: SHMessage/SHAPE.us, XSMessage/XSTEP.us, XSTEPResource/{STEP,IGES}, and StdResource/{Standard,XCAF}. Any missing or mismatched input stops the build by name; DEP_OCCT_ROOT is ignored in this mode. GNU ld's archive group/rescan facility resolves OCCT's cyclic static references, after which only pthread, rt, stdc++, and dl are linked dynamically.

Check the result with:

scripts/check-static-occt.sh \
  target/release/vernier-app target/release/vernier-worker

The checker rejects any libTK* DT_NEEDED row and any libTK* library resolved by ldd from the host.

Runtime resources

Packaged launchers must set OCCT resource variables relative to their own resource root. At minimum STEP operation uses:

export CASROOT=/path/to/occt-root
export CSF_OCCTResourcePath="$CASROOT/resources"
export CSF_SHMessage="$CASROOT/resources/SHMessage"
export CSF_XSMessage="$CASROOT/resources/XSMessage"
export CSF_STEPDefaults="$CASROOT/resources/XSTEPResource"
export CSF_IGESDefaults="$CASROOT/resources/XSTEPResource"
export CSF_StandardDefaults="$CASROOT/resources/StdResource"
export CSF_XCAFDefaults="$CASROOT/resources/StdResource"

The AppImage lane owns setting the complete installed resource environment. Task 14 verified the native workflow with every OCCT resource variable pointed at this prepared tree; it did not certify relocation or an AppImage.

Recorded Task 14 evidence

The pre-change checker returned exit 1 for both dynamic binaries and named their host libTK*.so.7.9 dependencies. The one prepared-tree build completed all 4,545 Ninja steps. The one locked Rust release build completed in 25.39 s. The post-link checker returned exit 0; vernier-worker retained only libstdc++, libgcc_s, libm, libc, and the ELF loader as dynamic needs.

The representative local-linux-release workflow passed on AMD Radeon RX 7800 XT (RADV NAVI32): 236 steps, 402 frames, deterministic in two separate processes, with save/reopen and STEP/STL exports. This is focused Task 14 evidence, not the complete acceptance gate; Task 16 owns the one final full gate.

4.7 KiB Raw Permalink Blame History