Harden mesa package for Ubuntu and Debian targets
This commit is contained in:
+83
-12
@@ -24,7 +24,7 @@ require_cmd() {
|
||||
done
|
||||
}
|
||||
|
||||
require_cmd dpkg-deb git meson ninja python3
|
||||
require_cmd dpkg-deb git ldd meson ninja pkg-config python3 readlink
|
||||
|
||||
WORK_DIR="${ROOT_DIR}/work"
|
||||
LIBDRM_SRC_DIR="${WORK_DIR}/libdrm"
|
||||
@@ -42,7 +42,7 @@ mkdir -p "${PKG_DIR}"
|
||||
UPSTREAM_REF="${MESA_UPSTREAM_REF:-${UPSTREAM_GIT_REF}}"
|
||||
LIBDRM_REF="${LIBDRM_UPSTREAM_REF:-${LIBDRM_GIT_REF}}"
|
||||
|
||||
git clone --depth 1 --branch "${LIBDRM_REF}" "${LIBDRM_GIT_URL}" "${LIBDRM_SRC_DIR}"
|
||||
git clone --depth 1 --single-branch --branch "${LIBDRM_REF}" "${LIBDRM_GIT_URL}" "${LIBDRM_SRC_DIR}"
|
||||
|
||||
meson setup "${LIBDRM_BUILD_DIR}" "${LIBDRM_SRC_DIR}" \
|
||||
--buildtype="${BUILD_TYPE}" \
|
||||
@@ -67,15 +67,10 @@ cp -a "${PREREQ_DIR}${INSTALL_PREFIX}/." "${INSTALL_PREFIX}/"
|
||||
export PKG_CONFIG_PATH="${PREREQ_DIR}${INSTALL_PREFIX}/lib/x86_64-linux-gnu/pkgconfig:${PREREQ_DIR}${INSTALL_PREFIX}/lib/pkgconfig:${PKG_CONFIG_PATH:-}"
|
||||
export LD_LIBRARY_PATH="${PREREQ_DIR}${INSTALL_PREFIX}/lib/x86_64-linux-gnu:${PREREQ_DIR}${INSTALL_PREFIX}/lib:${LD_LIBRARY_PATH:-}"
|
||||
|
||||
git clone --depth 1 --branch "${UPSTREAM_REF}" "${UPSTREAM_GIT_URL}" "${SRC_DIR}"
|
||||
|
||||
# The apt version and release notes need more than a shallow HEAD. Expand the
|
||||
# clone so commit counts and previous-release comparisons are monotonic.
|
||||
if [[ "$(git -C "${SRC_DIR}" rev-parse --is-shallow-repository)" == "true" ]]; then
|
||||
git -C "${SRC_DIR}" fetch --unshallow --tags
|
||||
else
|
||||
git -C "${SRC_DIR}" fetch --tags
|
||||
fi
|
||||
# The apt version and release notes rely on the upstream commit count being
|
||||
# monotonic across builds. Clone the full branch history instead of repairing a
|
||||
# shallow clone afterwards, which is more fragile in CI and local container runs.
|
||||
git clone --single-branch --branch "${UPSTREAM_REF}" "${UPSTREAM_GIT_URL}" "${SRC_DIR}"
|
||||
|
||||
detect_upstream_version() {
|
||||
local source_dir="${1}"
|
||||
@@ -89,6 +84,79 @@ detect_upstream_version() {
|
||||
"${source_dir}/meson.build"
|
||||
}
|
||||
|
||||
configure_llvm_toolchain() {
|
||||
local spirv_version
|
||||
local spirv_major
|
||||
|
||||
if [[ -n "${LLVM_CONFIG:-}" ]]; then
|
||||
return
|
||||
fi
|
||||
|
||||
if ! pkg-config --exists LLVMSPIRVLib; then
|
||||
return
|
||||
fi
|
||||
|
||||
spirv_version="$(pkg-config --modversion LLVMSPIRVLib)"
|
||||
spirv_major="${spirv_version%%.*}"
|
||||
|
||||
if command -v "llvm-config-${spirv_major}" >/dev/null 2>&1; then
|
||||
export LLVM_CONFIG="llvm-config-${spirv_major}"
|
||||
fi
|
||||
}
|
||||
|
||||
should_bundle_runtime_lib() {
|
||||
local base_name="${1}"
|
||||
|
||||
case "${base_name}" in
|
||||
libLLVM.so.*|libdisplay-info.so.*|libwayland-client.so.*|libwayland-cursor.so.*|libwayland-egl.so.*|libwayland-server.so.*|libxcb-keysyms.so.*)
|
||||
return 0
|
||||
;;
|
||||
*)
|
||||
return 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
bundle_runtime_libraries() {
|
||||
local package_lib_dir="${PKG_DIR}${INSTALL_PREFIX}/lib/x86_64-linux-gnu"
|
||||
local source_path
|
||||
local resolved_path
|
||||
local base_name
|
||||
local bundled_any=1
|
||||
|
||||
mkdir -p "${package_lib_dir}"
|
||||
|
||||
while (( bundled_any != 0 )); do
|
||||
bundled_any=0
|
||||
|
||||
while IFS= read -r source_path; do
|
||||
[[ -n "${source_path}" ]] || continue
|
||||
|
||||
base_name="$(basename "${source_path}")"
|
||||
if ! should_bundle_runtime_lib "${base_name}"; then
|
||||
continue
|
||||
fi
|
||||
|
||||
resolved_path="$(readlink -f "${source_path}")"
|
||||
if [[ -f "${package_lib_dir}/$(basename "${resolved_path}")" ]]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
install -m 0644 "${resolved_path}" "${package_lib_dir}/$(basename "${resolved_path}")"
|
||||
if [[ "${base_name}" != "$(basename "${resolved_path}")" ]]; then
|
||||
ln -sf "$(basename "${resolved_path}")" "${package_lib_dir}/${base_name}"
|
||||
fi
|
||||
|
||||
bundled_any=1
|
||||
done < <(
|
||||
find "${PKG_DIR}${INSTALL_PREFIX}" -type f \( -name '*.so' -o -name '*.so.*' \) -print0 \
|
||||
| xargs -0 -r ldd 2>/dev/null \
|
||||
| awk '/=> \// { print $3 }' \
|
||||
| sort -u
|
||||
)
|
||||
done
|
||||
}
|
||||
|
||||
GIT_SHA=$(git -C "${SRC_DIR}" rev-parse --short=12 HEAD)
|
||||
GIT_SHA_FULL=$(git -C "${SRC_DIR}" rev-parse HEAD)
|
||||
UPSTREAM_COMMIT_COUNT=$(git -C "${SRC_DIR}" rev-list --count HEAD)
|
||||
@@ -96,6 +164,8 @@ UPSTREAM_VERSION="${PACKAGE_VERSION_PREFIX:-$(detect_upstream_version "${SRC_DIR
|
||||
PACKAGE_VERSION="${UPSTREAM_VERSION}+r${UPSTREAM_COMMIT_COUNT}.${GIT_SHA}-${PACKAGE_RELEASE}"
|
||||
OUTPUT_DEB="${DIST_DIR}/${PACKAGE_NAME}_${PACKAGE_VERSION}_${PACKAGE_ARCH}.deb"
|
||||
|
||||
configure_llvm_toolchain
|
||||
|
||||
meson setup "${BUILD_DIR}" "${SRC_DIR}" \
|
||||
--buildtype="${BUILD_TYPE}" \
|
||||
--prefix="${INSTALL_PREFIX}" \
|
||||
@@ -110,6 +180,7 @@ meson setup "${BUILD_DIR}" "${SRC_DIR}" \
|
||||
ninja -C "${BUILD_DIR}"
|
||||
cp -a "${PREREQ_DIR}/." "${PKG_DIR}/"
|
||||
DESTDIR="${PKG_DIR}" ninja -C "${BUILD_DIR}" install
|
||||
bundle_runtime_libraries
|
||||
|
||||
mkdir -p \
|
||||
"${PKG_DIR}/DEBIAN" \
|
||||
@@ -123,7 +194,7 @@ Section: libs
|
||||
Priority: optional
|
||||
Architecture: ${PACKAGE_ARCH}
|
||||
Maintainer: magges <magges@local>
|
||||
Depends: libc6, libexpat1, libgcc-s1, libgl1, libllvm${LLVM_RUNTIME_VERSION:-19}, libstdc++6, libvulkan1, libwayland-client0, libx11-6, zlib1g
|
||||
Depends: libc6, libexpat1, libgcc-s1, libgl1, libstdc++6, libvulkan1, libwayland-client0, libx11-6, zlib1g
|
||||
Description: Mesa snapshot build installed below ${INSTALL_PREFIX}
|
||||
Built from ${UPSTREAM_GIT_URL} (${UPSTREAM_REF}) with bundled libdrm from
|
||||
${LIBDRM_GIT_URL} (${LIBDRM_REF}) and installed into ${INSTALL_PREFIX}.
|
||||
|
||||
Reference in New Issue
Block a user