Part of #611. Difficulty: medium. Audit baseline: master 3950416e (2026-09-12).
Current evidence
x.py uses MinGW objdump or objdump, returning [] both when no inspector exists and when inspection fails. x.py and is_binary_for_target also accept files when the external file command cannot describe them. This can make an unverified Windows package look dependency-complete or architecture-correct.
Scope
Use a deterministic native-capable PE inspector (for example the provisioned LLVM tools) and distinguish inspection failure from a successful empty import table. Traverse non-system dependencies for the compiler and bundled tools, validate architecture, and resolve runtime DLLs without depending on MinGW search directories. Keep Windows system/API-set handling explicit and do not classify redistributables as universally present OS files.
Completion criteria
Tests cover an absent inspector, nonzero subprocess exit, malformed/truncated PE, wrong-machine dependency, transitive imports, duplicate/cyclic dependencies, a known system/API-set import and a missing non-system DLL. Every uninspectable required file fails staging with its path and cause. A native MSVC archive inspection succeeds without GNU tools installed.
Dependencies and boundaries
#621; reuse existing archive architecture checks rather than adding a second inconsistent authority.
Part of #611. Difficulty: medium. Audit baseline: master
3950416e(2026-09-12).Current evidence
x.py uses MinGW objdump or objdump, returning [] both when no inspector exists and when inspection fails. x.py and is_binary_for_target also accept files when the external file command cannot describe them. This can make an unverified Windows package look dependency-complete or architecture-correct.
Scope
Use a deterministic native-capable PE inspector (for example the provisioned LLVM tools) and distinguish inspection failure from a successful empty import table. Traverse non-system dependencies for the compiler and bundled tools, validate architecture, and resolve runtime DLLs without depending on MinGW search directories. Keep Windows system/API-set handling explicit and do not classify redistributables as universally present OS files.
Completion criteria
Tests cover an absent inspector, nonzero subprocess exit, malformed/truncated PE, wrong-machine dependency, transitive imports, duplicate/cyclic dependencies, a known system/API-set import and a missing non-system DLL. Every uninspectable required file fails staging with its path and cause. A native MSVC archive inspection succeeds without GNU tools installed.
Dependencies and boundaries
#621; reuse existing archive architecture checks rather than adding a second inconsistent authority.