[zatkins-dev]

Purpose:

Add ABI checking CI job.

LLM/GenAI Disclosure:

None

[github-actions]

⚠️ abicheck — Compatibility risk — review recommended

Head 38a38fe vs old · strict_abi · libceed.so

0 breaking · 226 needs review · 5 safe

📊 Audit: 266 detected · 0 gating · 231 non gating, 35 out of contract · 7 detector(s) not evaluated

⚠️ Needs review (226)

Change	Symbol	Detail
imported_symbol_added	readdir	New imported symbol: readdir@GLIBC_2.2.5 Impact: The binary gained an undefined (imported) symbol — a new obligation the consumer's link environment must satisfy at load time. If none of the loaded dependencies provide it, the dynamic linker fails with an unresolved-symbol error. Weak imports are exempt (they resolve to null instead of failing).
symbol_leaked_from_dependency_changed, exported_not_public	std::__cxx11::basic_string std (8)	std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::operator+<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&&), std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::operator+<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&&, char const*), std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::operator+<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&), std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::operator+<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&&), std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::operator+<char, std::char_traits<char>, std::allocator<char> >(char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&&), std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::operator+<char, std::char_traits<char>, std::allocator<char> >(char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&), std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::operator+<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&&), std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::operator+<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, char const*)
exported_not_public	CeedBuildConfiguration	Symbol 'CeedBuildConfiguration' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedCheckFilePath	Symbol 'CeedCheckFilePath' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedErrorFormat	Symbol 'CeedErrorFormat' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedErrorTypesShifted	Symbol 'CeedErrorTypesShifted' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedGetEnvJitErrorOnFailure	Symbol 'CeedGetEnvJitErrorOnFailure' is exported by the binary but declared in no public header (declared as function 'CeedGetEnvJitErrorOnFailure' in a non-public header). It is accidental ABI surface — hide it (visibility/version script) or document it. · libCEED/include/ceed/ceed-env-list.h:33 Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedGetIsSetJitErrorOnFailure	Symbol 'CeedGetIsSetJitErrorOnFailure' is exported by the binary but declared in no public header (declared as function 'CeedGetIsSetJitErrorOnFailure' in a non-public header). It is accidental ABI surface — hide it (visibility/version script) or document it. · libCEED/include/ceed/ceed-env-list.h:33 Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedGetJitAbsolutePath	Symbol 'CeedGetJitAbsolutePath' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedGetJitErrorOnFailure	Symbol 'CeedGetJitErrorOnFailure' is exported by the binary but declared in no public header (declared as function 'CeedGetJitErrorOnFailure' in a non-public header). It is accidental ABI surface — hide it (visibility/version script) or document it. · libCEED/include/ceed/ceed-env-list.h:33 Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedGetJitRelativePath	Symbol 'CeedGetJitRelativePath' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedGitVersion	Symbol 'CeedGitVersion' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedJitCxxDefault	Symbol 'CeedJitCxxDefault' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedOperatorAssembleSingleBlock	Symbol 'CeedOperatorAssembleSingleBlock' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedOperatorCreateAtPoints_Cpu_Gen	Symbol 'CeedOperatorCreateAtPoints_Cpu_Gen' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedOperatorSingleView	Symbol 'CeedOperatorSingleView' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedPermutePadCurlOrients	Symbol 'CeedPermutePadCurlOrients' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedPermutePadOffsets	Symbol 'CeedPermutePadOffsets' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedPermutePadOrients	Symbol 'CeedPermutePadOrients' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedQFunctionContextGetFieldIndex	Symbol 'CeedQFunctionContextGetFieldIndex' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedQFunctionContextRegisterGeneric	Symbol 'CeedQFunctionContextRegisterGeneric' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedSetEnableDebug	Symbol 'CeedSetEnableDebug' is exported by the binary but declared in no public header. It is accidental ABI surface — hide it (visibility/version script) or document it. Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	CeedSetJitErrorOnFailure	Symbol 'CeedSetJitErrorOnFailure' is exported by the binary but declared in no public header (declared as function 'CeedSetJitErrorOnFailure' in a non-public header). It is accidental ABI surface — hide it (visibility/version script) or document it. · libCEED/include/ceed/ceed-env-list.h:33 Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	std::__str_hash_base<char, std::allocator<char>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::operator()(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const	Symbol 'ZNKSt15__str_hash_baseIcSaIcENSt7__cxx1112basic_stringIcSt11char_traitsIcES0_EEEclERKS5' is exported by the binary but originates from an external dependency (libstdc++.so.6) statically linked and re-exported — not part of this library's API. Hide it (visibility/version script) or link the dependency dynamically; a differing dependency version on another host makes the leaked symbol an ODR/compatibility hazard. (libstdc++.so.6 → ZNKSt15__str_hash_baseIcSaIcENSt7__cxx1112basic_stringIcSt11char_traitsIcES0_EEEclERKS5) linker: _ZNKSt15__str_hash_baseIcSaIcENSt7__cxx1112basic_stringIcSt11char_traitsIcES0_EEEclERKS5_ Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
exported_not_public	std::random_device::~random_device()	Symbol '_ZNSt13random_deviceD2Ev' is exported by the binary but originates from an external dependency (libstdc++.so.6) statically linked and re-exported — not part of this library's API. Hide it (visibility/version script) or link the dependency dynamically; a differing dependency version on another host makes the leaked symbol an ODR/compatibility hazard. (libstdc++.so.6 → _ZNSt13random_deviceD2Ev) linker: _ZNSt13random_deviceD2Ev Impact: A symbol is exported by the binary but no public header declares it (EXPORT_ONLY provenance). It is reachable ABI surface that consumers can link against yet was never promised by the API, so it is easy to change or remove by accident — and equally a sign of a missing visibility annotation. Hide it (ˋ-fvisibility=hiddenˋ / a version script) or document it; respects the ABI-relevant-symbol filter and public-surface scoping so intentional internal exports can be suppressed.
…	…	172 more

➕ Public API additions (4)

Change	Symbol	Detail
func_added	CeedGetEnvJitErrorOnFailure	New public function: CeedGetEnvJitErrorOnFailure · libCEED/include/ceed/ceed-env-list.h:33 Impact: New function available; existing binaries are unaffected.
func_added	CeedGetJitErrorOnFailure	New public function: CeedGetJitErrorOnFailure · libCEED/include/ceed/ceed-env-list.h:33 Impact: New function available; existing binaries are unaffected.
func_added	CeedGetIsSetJitErrorOnFailure	New public function: CeedGetIsSetJitErrorOnFailure · libCEED/include/ceed/ceed-env-list.h:33 Impact: New function available; existing binaries are unaffected.
func_added	CeedSetJitErrorOnFailure	New public function: CeedSetJitErrorOnFailure · libCEED/include/ceed/ceed-env-list.h:33 Impact: New function available; existing binaries are unaffected.

ℹ️ Informational findings (1)

public_surface_grew: <surface>

_{Updated 2026-10-28 17:53 UTC · run #46 · commit 38a38fe · full report}

[jeremylt]

seems like a bunch of stuff isn't quite internal correctly

[zatkins-dev]

I think a lot of it is in ceed/backend.h. I'm still figuring out which headers need to be marked.