GlidePath Money AppImage runtime corresponding source

This archive corresponds only to the uruntime launcher and its embedded
squashfuse/unsquashfs helpers in the AppImage named in SOURCE-MANIFEST.json.
The manifest identifies the exact AppImage SHA-256 and each source file.
Builder recipes are in source/squashfuse-static and
source/squashfs-tools-static. Their full pinned dependency trees, the
other pinned source trees, and LF-normalized UTF-8 source text,
Alpine musl recipe, musl 1.2.6 tarball, local patches, and complete
locked Cargo vendor sources are included. Set TARGET_ARCH=x86_64 and
use the pinned Alpine image digest in build-record/appimage-xz-
source-closure.json when rebuilding the static helpers. The source
builder recipes clone remote pinned commits by default. To use
these archived copies, change each recipe's git clone URL to a
local Git repository containing the copy and its checked-in
changes, then change that recipe's *_COMMIT value to the new
commit. Merely editing the archived directory does not affect
the recipe: build.sh clones and checks out its own source. For the
static LGPL libfuse library, edit LIBFUSE_COMMIT and the libfuse
clone in source/squashfuse-static/build.sh. For LZO, edit
LZO_COMMIT and its clone in both helper build.sh files. Run
TARGET_ARCH=x86_64 ./build.sh inside the pinned Alpine image;
retain the musl-dev 1.2.6-r2 package or rebuild it from the
archived Alpine recipe, patches, and hash-checked tarball.
For a rootless container add -Duseroot=false to the libfuse
meson setup in the local squashfuse recipe so installation
does not try to create /dev/fuse. This does not change the
linked libfuse library.
The changed helpers appear in each recipe's release directory.
Build source/uruntime with target x86_64-unknown-linux-musl
and --no-default-features --features appimage,squashfs,lite --locked.
Append these pinned source tables to source/uruntime/.cargo/
config.toml, retaining its existing build settings. The
directory is relative to source/uruntime:
----- BEGIN CARGO SOURCE CONFIG -----
[source.crates-io]
replace-with = "vendored-sources"

[source."git+https://github.com/VHSgunzo/dotenv.git?rev=367085af80a8d29d2241c85cbfc25736486230c5"]
git = "https://github.com/VHSgunzo/dotenv.git"
rev = "367085af80a8d29d2241c85cbfc25736486230c5"
replace-with = "vendored-sources"

[source."git+https://github.com/VHSgunzo/memfd-exec.git?rev=2decf7d1cec3d183e55000526abd2e5bb6df40c5"]
git = "https://github.com/VHSgunzo/memfd-exec.git"
rev = "2decf7d1cec3d183e55000526abd2e5bb6df40c5"
replace-with = "vendored-sources"

[source.vendored-sources]
directory = "../../cargo-vendor"
----- END CARGO SOURCE CONFIG -----
The nightly build-std graph required by panic=immediate-abort
comes from the Rust toolchain, not uruntime's Cargo.lock.
Install nightly with rust-src and the musl target. From the
extracted archive root, cd source/uruntime. To build offline,
extend the existing archive-root cargo-vendor directory with
the nightly standard-library graph only:
cargo vendor --offline --no-delete --manifest-path <toolchain>/lib/rustlib/src/rust/library/std/Cargo.toml ../../cargo-vendor
This requires the toolchain graph in Cargo's local cache;
if missing, provision it before repeating the offline command.
Do not use --sync from source/uruntime here: cargo vendor
otherwise re-resolves uruntime's archived locked crates from
the cache, even with a vendored source mapping configured.
The final ../../cargo-vendor argument is required: omitting
it writes source/uruntime/vendor instead. The
squashfuse and unsquashfs helpers are separate executables
embedded by uruntime.
To embed modified helpers, update their x86_64 rows in
source/uruntime/checksums.txt to the rebuilt ELF SHA-256 and put
the files in source/uruntime/assets-x86_64/squashfuse-0.6.3.r2/
squashfuse and assets-x86_64/squashfs-tools-4.7.5.r2/unsquashfs.
build.rs verifies these cache entries against checksums.txt;
without them it downloads the original release helpers and
rejects mismatched hashes. Then rebuild uruntime with the Cargo
command above. For a modified AppImage, use the included
complete-ocr-appimage.ps1 package recipe with the new runtime
hash and reverify the final package. This is a modification
path; it will not reproduce the original binary SHA-256.
See the individual source trees for their license terms.

A reviewCandidate=true manifest is preparation evidence only.
