From 1bd05babc7c92f590edd3362351bde1ae4125412 Mon Sep 17 00:00:00 2001
From: sakompella <87831937+sakompella@users.noreply.github.com>
Date: Sat, 25 Jul 2026 01:41:20 -0400
Subject: [PATCH 1/4] fix(toolchain): avoid bash4 mapfile builtin

bash versions under 4 lack `mapfile`. In particular, this means any
macOS machines will break (especially as `#!` points to `/bin/bash`
rather than using `#!/usr/bin/env bash`).
---
 toolchain/scripts/patch-wasi-libc.sh | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/toolchain/scripts/patch-wasi-libc.sh b/toolchain/scripts/patch-wasi-libc.sh
index dc04d9dc59..9e6f1ab271 100755
--- a/toolchain/scripts/patch-wasi-libc.sh
+++ b/toolchain/scripts/patch-wasi-libc.sh
@@ -124,11 +124,16 @@ if [ "$MODE" = "apply" ] || [ "$MODE" = "check" ]; then
 fi
 
 # Find patch files
-if [ "$MODE" = "reverse" ]; then
-    mapfile -t PATCH_FILES < <(find "$PATCHES_DIR" -name '*.patch' -type f 2>/dev/null | sort -r)
-else
-    mapfile -t PATCH_FILES < <(find "$PATCHES_DIR" -name '*.patch' -type f 2>/dev/null | sort)
-fi
+PATCH_FILES=()
+while IFS= read -r patch; do
+    PATCH_FILES+=("$patch")
+done < <(
+    if [ "$MODE" = "reverse" ]; then
+        find "$PATCHES_DIR" -name '*.patch' -type f 2>/dev/null | sort -r
+    else
+        find "$PATCHES_DIR" -name '*.patch' -type f 2>/dev/null | sort
+    fi
+)
 
 if [ "${#PATCH_FILES[@]}" -eq 0 ]; then
     echo "No patch files found in $PATCHES_DIR"

From d00d5a84863e7f34b79b28e330dbfad4bd794b0d Mon Sep 17 00:00:00 2001
From: sakompella <87831937+sakompella@users.noreply.github.com>
Date: Sat, 25 Jul 2026 02:35:54 -0400
Subject: [PATCH 2/4] fix(toolchain): fall back to shasum when sha256sum is
 unavailable

Not every environment ships GNU coreutils' sha256sum. In particular,
macOS ships only `shasum -a 256` by default. Resolve the digest
command once into an array (needed so it still composes with the
xargs pipeline, since xargs execs external commands, not shell
functions), matching the same command -v fallback already used in
build-openssl-upstream.sh and build-ssh-upstream.sh.
---
 toolchain/scripts/clone-and-build-codex-wasi.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/toolchain/scripts/clone-and-build-codex-wasi.sh b/toolchain/scripts/clone-and-build-codex-wasi.sh
index dce357e58b..7fea79943b 100755
--- a/toolchain/scripts/clone-and-build-codex-wasi.sh
+++ b/toolchain/scripts/clone-and-build-codex-wasi.sh
@@ -63,6 +63,15 @@ STOP_AFTER="${STOP_AFTER:-}"
 }
 command -v cargo >/dev/null 2>&1 || { echo "ERROR: cargo not on PATH" >&2; exit 1; }
 
+if command -v sha256sum >/dev/null 2>&1; then
+	SHA256=(sha256sum)
+elif command -v shasum >/dev/null 2>&1; then
+	SHA256=(shasum -a 256)
+else
+	echo "ERROR: neither sha256sum nor shasum is available" >&2
+	exit 1
+fi
+
 # --- 1. parse the pin --------------------------------------------------------
 REF="$(tr -d '[:space:]' < "$CODEX_REF_FILE")"
 REPO="${REF%@*}"      # owner/repo
@@ -70,7 +79,7 @@ SHA="${REF#*@}"       # commit sha
 [ -n "$REPO" ] && [ -n "$SHA" ] && [ "$REPO" != "$SHA" ] || {
 	echo "ERROR: malformed codex-ref '$REF' (expected '<owner>/<repo>@<sha>')" >&2; exit 1; }
 URL="$CODEX_GIT_BASE/$REPO.git"
-PATCH_DIGEST="$({ find "$CODEX_PATCH_DIR" -maxdepth 1 -type f -name '*.patch' -print0 | sort -z | xargs -0 sha256sum; } | sha256sum | cut -d ' ' -f1)"
+PATCH_DIGEST="$({ find "$CODEX_PATCH_DIR" -maxdepth 1 -type f -name '*.patch' -print0 | sort -z | xargs -0 "${SHA256[@]}"; } | "${SHA256[@]}" | cut -d ' ' -f1)"
 EXPECTED_STAMP="$SHA:$PATCH_DIGEST"
 
 echo "== codex-ref: $REPO @ $SHA =="

From 3703b748d0c393bf782779acff379caca7d4e4a0 Mon Sep 17 00:00:00 2001
From: sakompella <87831937+sakompella@users.noreply.github.com>
Date: Sat, 25 Jul 2026 02:37:48 -0400
Subject: [PATCH 3/4] fix(toolchain): make llvm-project patch detection
 deterministic across GNU/BSD patch

Some non-GNU patch implementations auto-answer their interactive
"Ignore -R?" prompt's "[y]" default non-deterministically when stdin
isn't a tty. In particular, BSD/Apple patch -- as shipped by macOS --
does this, which can make a reverse dry-run falsely report "already
applied" on a genuinely unpatched tree, skipping the real patch
application and causing later compile errors (e.g. libunwind's
wasm-exception-support patch).

Reproduced directly: without -f, a reverse dry-run against an unpatched
tree reported false success; with -f, it correctly reports failure
(and still correctly reports success against an already-patched tree).
-f is a standard flag on both GNU and BSD patch, so this keeps the
forward/reverse detection deterministic regardless of which
implementation is on PATH.
---
 toolchain/c/scripts/build-llvm-runtimes.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/toolchain/c/scripts/build-llvm-runtimes.sh b/toolchain/c/scripts/build-llvm-runtimes.sh
index 918b26d55e..99951697b2 100644
--- a/toolchain/c/scripts/build-llvm-runtimes.sh
+++ b/toolchain/c/scripts/build-llvm-runtimes.sh
@@ -19,9 +19,11 @@ WASI_NM="$WASI_SDK_DIR/bin/llvm-nm"
 
 if [ -d "$PATCH_DIR" ]; then
   while IFS= read -r patch_file; do
-    if patch --dry-run -p1 -d "$LLVM_PROJECT_SRC_DIR" < "$patch_file" >/dev/null 2>&1; then
-      patch --no-backup-if-mismatch -p1 -d "$LLVM_PROJECT_SRC_DIR" < "$patch_file" >/dev/null
-    elif patch --dry-run -R -p1 -d "$LLVM_PROJECT_SRC_DIR" < "$patch_file" >/dev/null 2>&1; then
+    # -f/--force avoids a prompt some non-GNU patch impls (e.g. BSD/Apple
+    # patch) answer non-deterministically in non-interactive use.
+    if patch --dry-run -f -p1 -d "$LLVM_PROJECT_SRC_DIR" < "$patch_file" >/dev/null 2>&1; then
+      patch --no-backup-if-mismatch -f -p1 -d "$LLVM_PROJECT_SRC_DIR" < "$patch_file" >/dev/null
+    elif patch --dry-run -R -f -p1 -d "$LLVM_PROJECT_SRC_DIR" < "$patch_file" >/dev/null 2>&1; then
       :
     else
       echo "failed to apply llvm-project patch: $patch_file" >&2

From 4e0e5bb7ab8e84f691dc990937229e47dc78efd6 Mon Sep 17 00:00:00 2001
From: sakompella <87831937+sakompella@users.noreply.github.com>
Date: Sat, 25 Jul 2026 02:43:18 -0400
Subject: [PATCH 4/4] fix(toolchain): use env-relative bash shebangs across
 toolchain scripts

Matches the env-relative shebang convention already used by most other
scripts in the repo, and lets anyone with a newer bash earlier on PATH
opt in without needing bash-3.2-compatible rewrites as a fallback.

Left scripts/ralph/ralph-docker.sh, ralph-docker-per-iter.sh (docker
orchestration wrappers whose target environment is fixed by the
container image), scripts/ralph/ralph.sh, and the vendored upstream
software/vim/share/vim/vim92/macros/less.sh untouched.
---
 toolchain/c/scripts/build-duckdb.sh                      | 2 +-
 toolchain/c/scripts/build-llvm-runtimes.sh               | 2 +-
 toolchain/scripts/patch-std.sh                           | 2 +-
 toolchain/scripts/patch-vendor.sh                        | 2 +-
 toolchain/scripts/patch-wasi-libc.sh                     | 2 +-
 toolchain/std-patches/codex-source/build-codex-wasip1.sh | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/toolchain/c/scripts/build-duckdb.sh b/toolchain/c/scripts/build-duckdb.sh
index 0b1289dd77..ad07eaef29 100644
--- a/toolchain/c/scripts/build-duckdb.sh
+++ b/toolchain/c/scripts/build-duckdb.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Reference only:
diff --git a/toolchain/c/scripts/build-llvm-runtimes.sh b/toolchain/c/scripts/build-llvm-runtimes.sh
index 99951697b2..d697588747 100644
--- a/toolchain/c/scripts/build-llvm-runtimes.sh
+++ b/toolchain/c/scripts/build-llvm-runtimes.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Build the libc++/libc++abi/libunwind runtime set ourselves so C++ exception
diff --git a/toolchain/scripts/patch-std.sh b/toolchain/scripts/patch-std.sh
index c38437279b..eb392315d5 100755
--- a/toolchain/scripts/patch-std.sh
+++ b/toolchain/scripts/patch-std.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # patch-std.sh — Apply wasmVM patches to the Rust std source tree
 #
 # Patches modify the WASI platform implementation in std to support
diff --git a/toolchain/scripts/patch-vendor.sh b/toolchain/scripts/patch-vendor.sh
index 9aa075977a..c569082856 100755
--- a/toolchain/scripts/patch-vendor.sh
+++ b/toolchain/scripts/patch-vendor.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # patch-vendor.sh — Apply crate-level patches to vendored dependencies
 #
 # Iterates std-patches/crates/<crate-name>/*.patch, finds the matching
diff --git a/toolchain/scripts/patch-wasi-libc.sh b/toolchain/scripts/patch-wasi-libc.sh
index 9e6f1ab271..9efa6f626b 100755
--- a/toolchain/scripts/patch-wasi-libc.sh
+++ b/toolchain/scripts/patch-wasi-libc.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # patch-wasi-libc.sh — Vendor, patch, and build wasi-libc as a custom sysroot
 #
 # Clones wasi-libc at the commit pinned by wasi-sdk-25, applies patches from
diff --git a/toolchain/std-patches/codex-source/build-codex-wasip1.sh b/toolchain/std-patches/codex-source/build-codex-wasip1.sh
index 3bc9ce0144..b58eab177b 100755
--- a/toolchain/std-patches/codex-source/build-codex-wasip1.sh
+++ b/toolchain/std-patches/codex-source/build-codex-wasip1.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # build-codex-wasip1.sh — reproduce the codex-core wasm32-wasip1 build frontier.
 #
 # Captures every fix discovered while driving `cargo build -p codex-core