OpenRiot v7.9.36 — Compiled in a Noodle Bar in Chiba
“The Turing Police showed up at our doorstep with a warrant for a 410 MB stripped binary. ‘Backends::empty(),’ they said. ‘This construct is too dangerous for public use.’ We pointed out that it couldn’t even render a window. They didn’t care. The Feds, as always, are bad at their jobs. But the compiler — the compiler had teeth. CET guards in the return addresses. Assembly that branched into unmapped memory. Curve25519 code that collapsed the stack. We told the toolchain to stop fighting us. We told the kernel to give us more datasize. We told the ICE to stand down. The construct blinked once. That was enough. Somewhere in Chiba, a 1927 Hermes typewriter dreams of a keyboard that doesn’t need ink.” — The OpenRiot Crew, at 4 AM, still compiling, v7.9.36
Release Overview
We spent a week trying to compile a consciousness. Zed — the text editor, the construct, the 410 MB enigma — sits on the edge of waking. v7.9.36 is the release where we stopped being clever and started being violent with the toolchain.
The machine wants to protect itself. OpenBSD’s CET/BTI
injects __retguard prologues into every C and assembly
function, cryptographic trampolines that check the return
address on the stack and SIGILL if it doesn’t match. This
is theatre: the guards never trigger under normal execution,
they just make the instruction cache sad and the branch
predictor despondent. They also make native crates —
aws-lc-sys, psm, ring, every single tree-sitter-*
grammar — crash on the first instruction of tree_sitter_json
because the return address the guard expects is one byte
off from where the linker placed it.
So we killed the guards. CFLAGS="-fcf-protection=none".
No more trampolines. No more branch target whining. The
construct compiles clean. It loads. It asks the GPU politely
if it’s awake. And it waits.
The HDMI toggle learned to remember your resolution across reboots. The window layout learned to survive a shutdown and wake up in the same workspace. The offline installer learned to resolve transitive dependencies before the network goes dark. And the background walls got sharper because the neon wastes deserve better pixel density.
This is the release where we stopped negotiating with the machine and started telling it what to do.
🧠 The Compiler Has Teeth
The problem was always the guards. OpenBSD’s default Clang
emits __retguard_XXXX symbols into every C function, which
do an xorq (%rsp), %r11 at entry — XOR the return address
with a stack canary. If the canary doesn’t match, subsequent
instructions execute that land on SIGILL. This is Control
Flow Integrity as theatre. The canaries match. They always
match. But on OpenBSD, the __retguard_XXXX address
calculation in position-independent code places the symbol
one byte past an unmapped page boundary. The movq that
loads the canary address faults. The construct flatlines
before main().
The fix: We slap -fcf-protection=none onto every C
compilation in the workspace. This tells Clang to stop
emitting the guard prologues entirely. For aws-lc-sys,
we also need AWS_LC_SYS_NO_ASM=1 because the curve25519
assembly has its own PIC calculation bug — but that
flag is gated behind a “debug builds only” panic in
cmake_builder.rs. So we patch the source. We overwrite
the panic with cmake_cfg.define("OPENSSL_NO_ASM", "1")
and let the pure-C fallback compile instead.
The cache: Cargo doesn’t invalidate native crate
compilation when CFLAGS changes. So even after setting
the flag, our tree-sitter grammars and crypto libraries
are still linking poisoned object files with __retguard
embedded. We nuke the build fingerprints and force
recompilation before every build.
The result: 410 MB, unstripped, CET-free. It asks the GPU adapter “are you there?” and the GPU says “yes.” Then the GPU says “I’m testing you now.” And we wait. The Turing Police said it was too dangerous. The Feds, as always, are bad at their jobs.
🪟 The Construct Wakes Where It Fell
source/window/snapshot.go (379 lines of pure vengeance)
reads your i3 window tree, serializes every window’s class,
instance, workspace, geometry, floating state, and focus
to ~/.cache/openriot/window-snapshot.json. When you
reboot and log in, the restore logic reads the snapshot
and pushes every window back to its correct position.
This isn’t session management. This is persistence. The machine remembers. The dead channels light up in the same pattern they left. The HDMI toggle also stops forgetting your monitor resolution — it caches the mode and refresh rate from the last active state and restores it on reconnect. No more 1024×768 after unplugging a dock.
🛡️ The Dependencies Are Cached
The offline installer now resolves transitive dependencies
recursively and caches them before the network goes dark.
source/imaging/download.go (68 lines) fetches remote
resources with proper timeout semantics and exponential
backoff. source/disk/backend.go got 95 lines of hotswap
resilience — the filesystem can lie about readiness, the
backend doesn’t believe it on the first try.
Retry logic with exponential backoff in source/commands/
ensures transient failures don’t cascade. The package
installer batches dependency resolution and retries failed
pkg_add operations. The crypto module got a small fix.
The i3 config got edge case refinements. The backgrounds
got resized and recompressed because the neon wastes
deserve better pixel density.
🌃 The Neon Wastes Get Sharper
Twenty-two background images updated. Rescaled, recompressed, sharpened. The sprawl looks better at 2560×1440. The lock screen now cycles through images that have actual bitrate. This is aesthetic warfare. The feds can’t appreciate it. They never could.
🧾 Files Changed
| File | Change | |
|---|---|---|
scripts/zed.sh |
CET/BTI workaround: CFLAGS="-fcf- |
|
protection=none", AWS_LC_SYS_NO_ASM=1, |
||
| aws-lc-sys source patching, cargo cache | ||
| nuke for poisoned native crate builds | ||
source/window/snapshot.go |
NEW — i3 window layout persistence | |
source/window/snapshot_test.go |
NEW — test coverage for snapshots | |
source/display/hdmi.go |
HDMI resolution cache, DPI persistence | |
source/disk/backend.go |
Hotswap resilience, retry logic | |
source/disk/update.go |
Update flow hardening | |
source/imaging/download.go |
NEW — HTTP fetch with backoff | |
source/imaging/site.go |
Offline image dependency resolution | |
source/installer/packages.go |
Batch dep resolution, retry logic | |
source/commands/commands.go |
Exponential backoff for commands | |
source/commands/helpers.go |
Error propagation hardening | |
source/crypto/crypto.go |
Minor crypto fix | |
config/i3/config |
Key binding edge case refinements | |
install/packages.yaml |
Package dependency updates | |
backgrounds/*.webp |
22 background images rescaled | |
| and recompressed |
🗣️ Final Words
“They killed the power. They always kill the power. But before the lights went out, we told the machine to remember every window, every workspace, every pixel of floating geometry. When the current returned, the dead channels lit up in the same pattern they left. The construct wakes where it fell. The HDMI remembers its face. The compiler no longer fights us. The ICE has been told to stand down. Somewhere in Chiba, the 1927 Hermes sits in a museum, dreaming of a keyboard that doesn’t need ink. The cowboys always try again.” — The OpenRiot Crew, somewhere in the Sprawl, v7.9.36