Resolve undefined symbols across the executable's global scope

[mariotaku]

Problem

ipk-verify flags hundreds of false "undefined symbol" errors for libraries whose imports are actually provided by a sibling library the executable also loads.

This surfaced on apps-repo PR #190 (org.webosbrew.bridge-64to32): the compat check reports required lib libEGL.so.1 as :x: on every firmware, with ~275 gl* symbols (glActiveTexture, glBindBuffer, …) listed as undefined — while libGLESv2.so.2 passes.

Root cause

Analysing the bundled binaries:

• The bridge's libEGL.so.1 is a thin EGL shim with 275 undefined gl* imports and a DT_NEEDED of only libgles_bridge_core.so + libc.so.6 — it does not list libGLESv2.so.2.
• Those gl* functions are defined by the sibling bundled libGLESv2.so.2.
• The app executable DT_NEEDEDs both libs (with RPATH=$ORIGIN/lib), so at runtime the loader places both into one global symbol scope and libEGL's gl* references bind to libGLESv2. It works.

But verify checked each bundled library in isolation: it only struck off symbols reachable through that library's own DT_NEEDED chain (recursive_resolve_symbols follows lib.needed). Since libEGL doesn't directly depend on libGLESv2, the gl* imports were never resolved → false "undefined" reports. The stock firmware libEGL.so.1 only ever exported egl*, so matching against firmware failed too.

Fix

After resolving each bundled library against its own DT_NEEDED chain, also resolve any remaining undefined symbols against the executable's global scope — the dependency closure rooted at the executable's DT_NEEDED — mirroring the real dynamic loader (common/verify/src/ipk/component.rs). Genuinely missing libraries and symbols are still reported.

Verification

Ran the rebuilt webosbrew-ipk-verify against the real org.webosbrew.bridge-64to32 IPK across all 13 firmware datasets:

Row	Before	After
required lib libEGL.so.1	❌ ×13	✅
required lib libwayland-egl.so.1	❌	✅
required lib libpulse.so.0 / libpulse-simple.so.0	❌	❌ (genuine — bundled libpulsecommon-15.0.so is in a lib/pulse-15.0/ subdir that isn't on the search path)

The fix is surgical: it clears the sibling-scope false positives while leaving real missing-library/missing-symbol problems intact.

Added regression tests in packages/ipk-verify/tests/global_scope.rs (sibling-provided symbol passes; truly-missing symbol still fails). Existing tests unaffected.

Bumps verify-lib 0.1.2 → 0.1.3 and ipk-verify 0.1.4 → 0.1.5.

🤖 Generated with Claude Code

---

Generated by Claude Code