Harden mesa package for Ubuntu and Debian targets

.gitea/workflows/build.yml

@@ -0,0 +1,201 @@
+name: build-mesa-git
+
+on:
+  schedule:
+    - cron: "0 3 */3 * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  build-deb:
+    runs-on: ubuntu-latest
+    container:
+      image: ubuntu:24.04
+    steps:
+      - name: Install build dependencies
+        run: |
+          apt-get update
+          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+            build-essential \
+            ca-certificates \
+            cbindgen \
+            cmake \
+            curl \
+            dpkg-dev \
+            file \
+            git \
+            glslang-tools \
+            meson \
+            ninja-build \
+            pkg-config \
+            python3 \
+            python3-pip \
+            python3-mako \
+            python3-ply \
+            python3-yaml \
+            bison \
+            flex \
+            gettext \
+            libdisplay-info-dev \
+            libdrm-dev \
+            libelf-dev \
+            libexpat1-dev \
+            libgbm-dev \
+            libclang-19-dev \
+            libglvnd-dev \
+            libgles2-mesa-dev \
+            libclc-19 \
+            libclc-19-dev \
+            libllvmspirvlib-19-dev \
+            libpciaccess-dev \
+            libva-dev \
+            libudev-dev \
+            libvulkan-dev \
+            libwayland-dev \
+            libwayland-egl-backend-dev \
+            libx11-dev \
+            libx11-xcb-dev \
+            libxcb-dri2-0-dev \
+            libxcb-dri3-dev \
+            libxcb-glx0-dev \
+            libxcb-keysyms1-dev \
+            libxcb-present-dev \
+            libxcb-randr0-dev \
+            libxcb-shm0-dev \
+            libxcb-sync-dev \
+            libxcb-xfixes0-dev \
+            libxcb1-dev \
+            libxdamage-dev \
+            libxext-dev \
+            libxfixes-dev \
+            libxrandr-dev \
+            libxrender-dev \
+            libxshmfence-dev \
+            libxxf86vm-dev \
+            libzstd-dev \
+            llvm-19-dev \
+            wayland-protocols \
+            xz-utils \
+            zlib1g-dev
+          python3 -m pip install --break-system-packages 'meson>=1.4.0,<2'
+          curl https://sh.rustup.rs -sSf | sh -s -- -y --profile minimal --default-toolchain 1.85.0
+          . /root/.cargo/env
+          cargo install --locked bindgen-cli --version 0.71.1
+      - name: Checkout repository
+        run: |
+          git init .
+          git config --global --add safe.directory "$PWD"
+          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
+          git -c http.extraHeader="Authorization: token ${{ secrets.GITEA_TOKEN }}" fetch --depth 1 origin "${{ gitea.sha }}"
+          git checkout --detach FETCH_HEAD
+      - name: Build mesa-git package
+        env:
+          MESA_UPSTREAM_REF: main
+        run: |
+          . /root/.cargo/env
+          chmod +x scripts/build-mesa-opt.sh
+          ./scripts/build-mesa-opt.sh
+      - name: Generate release notes
+        env:
+          GITEA_SERVER_URL: ${{ gitea.server_url }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          . dist/package-info.env
+          chmod +x scripts/generate-release-notes.sh
+          RELEASE_TAG="${PACKAGE_NAME}-${PACKAGE_VERSION}" ./scripts/generate-release-notes.sh
+      - name: Generate apt repository
+        run: |
+          chmod +x scripts/generate-apt-repo.sh
+          ./scripts/generate-apt-repo.sh
+      - name: Verify generated apt repository
+        run: |
+          chmod +x scripts/verify-apt-repo.sh
+          ./scripts/verify-apt-repo.sh
+      - name: Upload deb package to Gitea release
+        run: |
+          . dist/package-info.env
+          RELEASE_TAG="${PACKAGE_NAME}-${PACKAGE_VERSION}"
+          RELEASE_TAG_URL="$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$RELEASE_TAG")"
+          PACKAGE_FILE_URL="$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$PACKAGE_FILE")"
+          RELEASE_API="${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases"
+
+          HTTP_CODE="$(curl -s -o /tmp/release.json -w '%{http_code}' \
+            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            "${RELEASE_API}/tags/${RELEASE_TAG_URL}")"
+
+          if [ "$HTTP_CODE" = "200" ]; then
+            RELEASE_ID="$(python3 -c 'import json; print(json.load(open("/tmp/release.json"))["id"])')"
+            python3 -c 'import json, pathlib, sys; pathlib.Path("/tmp/release-update.json").write_text(json.dumps({
+              "tag_name": sys.argv[1],
+              "target_commitish": sys.argv[2],
+              "name": sys.argv[1],
+              "body": pathlib.Path("dist/release-notes.md").read_text(),
+              "draft": False,
+              "prerelease": False,
+            }))' "$RELEASE_TAG" "$GITEA_SHA"
+            curl --fail-with-body \
+              -X PATCH \
+              -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+              -H "Content-Type: application/json" \
+              --data-binary @/tmp/release-update.json \
+              "${RELEASE_API}/${RELEASE_ID}" > /tmp/release.json
+          elif [ "$HTTP_CODE" = "404" ]; then
+            python3 -c 'import json, pathlib, sys; pathlib.Path("/tmp/release-create.json").write_text(json.dumps({
+              "tag_name": sys.argv[1],
+              "target_commitish": sys.argv[2],
+              "name": sys.argv[1],
+              "body": pathlib.Path("dist/release-notes.md").read_text(),
+              "draft": False,
+              "prerelease": False,
+            }))' "$RELEASE_TAG" "$GITEA_SHA"
+            curl --fail-with-body \
+              -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+              -H "Content-Type: application/json" \
+              --data-binary @/tmp/release-create.json \
+              "${RELEASE_API}" > /tmp/release.json
+            RELEASE_ID="$(python3 -c 'import json; print(json.load(open("/tmp/release.json"))["id"])')"
+          else
+            cat /tmp/release.json
+            exit 1
+          fi
+
+          curl --fail-with-body \
+            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            --data-binary @"dist/${PACKAGE_FILE}" \
+            "${RELEASE_API}/${RELEASE_ID}/assets?name=${PACKAGE_FILE_URL}"
+      - name: Publish apt repository branch
+        run: |
+          APT_BRANCH="apt"
+          APT_WORKTREE="/tmp/apt-branch"
+
+          rm -rf "${APT_WORKTREE}"
+          git init "${APT_WORKTREE}"
+          git -C "${APT_WORKTREE}" config user.name "gitea-actions"
+          git -C "${APT_WORKTREE}" config user.email "actions@local"
+          git -C "${APT_WORKTREE}" remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
+
+          if git -C "${APT_WORKTREE}" -c http.extraHeader="Authorization: token ${{ secrets.GITEA_TOKEN }}" fetch --depth 1 origin "${APT_BRANCH}"; then
+            git -C "${APT_WORKTREE}" checkout -B "${APT_BRANCH}" FETCH_HEAD
+          else
+            git -C "${APT_WORKTREE}" checkout --orphan "${APT_BRANCH}"
+          fi
+
+          find "${APT_WORKTREE}" -mindepth 1 -maxdepth 1 ! -name .git -exec rm -rf {} +
+          cp -a dist/aptrepo/. "${APT_WORKTREE}/"
+
+          git -C "${APT_WORKTREE}" add .
+          if git -C "${APT_WORKTREE}" diff --cached --quiet; then
+            echo "apt repository branch already up to date"
+          else
+            git -C "${APT_WORKTREE}" commit -m "Publish apt repository for ${GITEA_SHA}"
+            git -C "${APT_WORKTREE}" -c http.extraHeader="Authorization: token ${{ secrets.GITEA_TOKEN }}" push --force origin "${APT_BRANCH}"
+          fi
+        env:
+          GITEA_SHA: ${{ gitea.sha }}
+      - name: Verify published apt endpoint
+        run: |
+          chmod +x scripts/verify-apt-repo.sh
+          ./scripts/verify-apt-repo.sh --remote

README.md

@@ -0,0 +1,178 @@
+# mesa-repo
+
+Dieses Repo baut per Gitea Actions ein eigenständiges `mesa-git`-Paket als `.deb`.
+Das Paket installiert Mesa separat unter `/opt/mesa-git`, damit es parallel zur
+System-Mesa genutzt werden kann.
+
+Ziel ist ein Paket, das auf `Debian 13+` sowie `Ubuntu 24.04` bis `26.x`
+installierbar bleibt.
+
+## Was gebaut wird
+
+- Paketname: `mesa-git`
+- Installationspfad: `/opt/mesa-git`
+- Wrapper: `/usr/bin/mesa-git-env`
+- Ausgabe: `mesa-git_<version>_amd64.deb`
+- Versionsschema: `<mesa-version>+r<mesa-commit-count>.<mesa-sha>-<debian-revision>`
+
+## Build-Profil
+
+Standardmäßig baut das Repo Mesa für:
+
+- `x11`
+- `wayland`
+
+Und mit diesem Treiberprofil:
+
+- AMD: `radeonsi`, `r300`, `r600`
+- Intel: `iris`, `crocus`
+- NVIDIA nouveau: `nouveau`
+- Fallback: `zink`, `llvmpipe`, `softpipe`
+- Vulkan: `amd`, `intel`, `intel_hasvk`, `nouveau`, `swrast`
+
+Das Profil ist damit besser für Steam, Proton und Xwayland geeignet als ein
+hartes Wayland-only-Build.
+
+Zusammen mit einem aktuellen `libdrm`-Snapshot, damit neue Mesa-Stände nicht an
+zu alten Distributionspaketen scheitern.
+
+Gebaut wird absichtlich gegen `Ubuntu 24.04` als älteste unterstützte
+Ubuntu-Basis. Zusätzlich bündelt das Paket ausgewählte Laufzeitbibliotheken
+unterhalb von `/opt/mesa-git`, damit neuere Mesa-Builds auch auf leicht
+abweichenden Debian-/Ubuntu-Systemständen starten können.
+
+## Ablauf
+
+1. Gitea Actions startet auf dem `act_runner`.
+2. `scripts/build-mesa-opt.sh` klont `libdrm` und Mesa direkt von Upstream.
+3. `libdrm` wird zuerst gebaut und in das spätere Prefix vorbereitet.
+4. Mesa wird danach mit Meson/Ninja gebaut.
+5. Das Ergebnis wird als `.deb` paketiert.
+6. Ein Gitea Release wird erstellt oder aktualisiert.
+7. Das `.deb` wird als Release-Asset hochgeladen.
+8. Die Release-Notes werden automatisch aus der Mesa-Upstream-History erzeugt.
+9. Ein apt-kompatibler Repo-Baum wird auf den Branch `apt` veröffentlicht.
+
+## Release-Notes
+
+Die Release-Notes werden automatisch erzeugt und enthalten:
+
+- eigene Repo-Commits für dieses Release
+- den verwendeten Mesa-Upstream-Commit
+- das gebaute Paket
+- die Mesa-Commits seit dem vorherigen `mesa-git`-Release
+
+Die beiden Bereiche werden getrennt dargestellt:
+
+- `Repo Changes`
+- `Mesa Upstream`
+
+Wenn kein vorheriger passender Release-Vergleich gefunden wird, nutzt der Workflow
+als Fallback die jüngsten Upstream-Commits.
+
+## Trigger
+
+Der Workflow läuft bei:
+
+- manuellem Start per `workflow_dispatch`
+- automatischem Zeitplan alle 3 Tage
+
+Releases werden als normale Releases angelegt, nicht als Pre-Releases.
+
+## APT-Einbindung
+
+Der Workflow veröffentlicht zusätzlich einen einfachen Debian-Repo-Baum auf
+dem Branch `apt`.
+
+Wichtig: APT braucht anonym erreichbare HTTP-Dateien wie `dists/stable/Release`
+und `pool/...deb`. Ein funktionierendes `git ls-remote` reicht dafür nicht aus.
+
+Auf dieser Gitea-Instanz war die bisher dokumentierte Raw-URL für anonyme
+HTTP-Clients nicht erreichbar und lieferte `404`. Genau daran scheitert dann
+`apt update` auf Ubuntu, obwohl der `apt`-Branch in Git existiert.
+
+Deshalb gilt:
+
+- nutze für Clients nur eine wirklich öffentlich erreichbare statische HTTP-URL
+- setze diese Basis-URL in `config/mesa-opt.conf` als `APT_PUBLIC_BASE_URL`
+- der Workflow prüft dann nach dem Publish, ob `Release`, `Packages` und das
+  referenzierte `.deb` anonym abrufbar sind
+
+Beispiel für die Konfiguration:
+
+```bash
+APT_SUITE="stable"
+APT_COMPONENT="main"
+APT_PUBLIC_BASE_URL="https://packages.example.tld/mesa-repo"
+```
+
+Die Einbindung auf dem Client sieht dann so aus:
+
+```text
+deb [trusted=yes] https://packages.example.tld/mesa-repo stable main
+```
+
+Danach:
+
+```bash
+sudo apt update
+sudo apt install mesa-git
+```
+
+Hinweis:
+
+- das Repo ist aktuell unsigniert
+- für APT wird deshalb hier `trusted=yes` verwendet
+- `scripts/verify-apt-repo.sh --remote` prüft, ob die öffentliche URL wirklich
+  APT-tauglich ist
+- wenn du willst, kann ich als nächsten Schritt auch noch Release-Signierung mit GPG einbauen
+
+## Wichtige Dateien
+
+- `config/mesa-opt.conf`: Paketname, Prefix, Plattformen und Treiberprofil
+- `scripts/build-mesa-opt.sh`: Build und Paketierung
+- `scripts/generate-release-notes.sh`: automatische Release-Notes aus Mesa-Commits
+- `scripts/generate-apt-repo.sh`: erzeugt den APT-Repo-Baum
+- `scripts/verify-apt-repo.sh`: prüft Repo-Struktur und optional den öffentlichen APT-Endpunkt
+- `.gitea/workflows/build.yml`: Gitea-Workflow
+
+## Benutzung
+
+Nach der Installation kann das Paket über den Wrapper genutzt werden:
+
+```bash
+mesa-git-env glxinfo
+mesa-git-env vkcube
+```
+
+Der Wrapper setzt die nötigen Mesa-Pfade für `LD_LIBRARY_PATH`,
+`LIBGL_DRIVERS_PATH`, `VK_LAYER_PATH` und `VK_ICD_FILENAMES`.
+Vorhandene Vulkan-ICDs aus dem Paket werden dabei automatisch eingesammelt.
+
+Wichtig: Prüfungen für die isolierte Installation sollten ebenfalls über
+`mesa-git-env` laufen. Ein rohes `ldd` direkt auf Bibliotheken unter
+`/opt/mesa-git` kann sonst fälschlich fehlende Abhängigkeiten zeigen, obwohl
+der Wrapper die Laufzeitpfade korrekt setzt.
+
+## Lokaler Test
+
+Mit installierten Build-Abhängigkeiten:
+
+```bash
+./scripts/build-mesa-opt.sh
+```
+
+Für einen sauberen Kompatibilitätstest lohnt sich ein isolierter Container oder
+eine `distrobox` mit eigenem temporären `HOME`, damit Build-Artefakte,
+Paketquellen und Caches danach vollständig wieder entfernt werden können.
+
+## Anpassen
+
+Die wichtigsten Schalter liegen in `config/mesa-opt.conf`:
+
+- `UPSTREAM_GIT_REF`
+- `INSTALL_PREFIX`
+- `PLATFORMS`
+- `GALLIUM_DRIVERS`
+- `VULKAN_DRIVERS`
+- `VULKAN_LAYERS`

config/mesa-opt.conf

@@ -0,0 +1,23 @@
+PACKAGE_NAME="mesa-git"
+PACKAGE_VERSION_PREFIX=""
+PACKAGE_RELEASE="1"
+PACKAGE_ARCH="amd64"
+APT_SUITE="stable"
+APT_COMPONENT="main"
+# Public static HTTP base URL for the generated apt tree, without trailing slash.
+# Leave empty if the repo is only generated locally or published elsewhere.
+APT_PUBLIC_BASE_URL=""
+
+UPSTREAM_GIT_URL="https://gitlab.freedesktop.org/mesa/mesa.git"
+UPSTREAM_GIT_REF="main"
+LIBDRM_GIT_URL="https://gitlab.freedesktop.org/mesa/drm.git"
+LIBDRM_GIT_REF="main"
+
+INSTALL_PREFIX="/opt/mesa-git"
+BUILD_TYPE="release"
+PLATFORMS="x11,wayland"
+
+# Broad desktop profile: AMD, Intel, NVIDIA nouveau plus software fallback.
+GALLIUM_DRIVERS="radeonsi,r300,r600,iris,crocus,nouveau,zink,llvmpipe,softpipe"
+VULKAN_DRIVERS="amd,intel,intel_hasvk,nouveau,swrast"
+VULKAN_LAYERS="device-select,overlay"

dists/stable/Release

@@ -1,17 +0,0 @@
-Origin: mesa-git
-Label: mesa-git
-Suite: stable
-Codename: stable
-Architectures: amd64
-Components: main
-Description: Mesa git apt repository
-Date: Fri, 07 Aug 2026 03:07:26 +0000
-MD5Sum:
- 7388d36717cf627cd56825c3747435ad              758 main/binary-amd64/Packages
- 29679b0e072be914b70bc72d218384e5              484 main/binary-amd64/Packages.gz
-SHA256:
- b9f4d22c031f70c201fa703852baf32fc4712ba86a9e53c00e8dc5bc0e0e28b4              758 main/binary-amd64/Packages
- 0a02d85677df3996b9999b8048ba3828ac8361a7b0bd3994dcc95d985659060e              484 main/binary-amd64/Packages.gz
-SHA512:
- d31082c2ab2fbd918ca7a23dd7b3b11e08fe98001c0fe35e66b071c76a9aa8706245d65c520a3f97978b7bd591c6e16b9f949237078246529f748499fb2be324              758 main/binary-amd64/Packages
- 0a06de60c5e26cc34acdd6f65062c9f17edce70ce3e0788972ea0216b24f7599fa1800333f7ddd9a7e2f0e75dc5687782760ffd24bccea7cb09db7d7536ecaa8              484 main/binary-amd64/Packages.gz

dists/stable/main/binary-amd64/Packages

@@ -1,16 +0,0 @@
-Package: mesa-git
-Version: 26.3.0-devel+r227503.ea1f62447af3-1
-Architecture: amd64
-Maintainer: magges <magges@local>
-Depends: libc6, libexpat1, libgcc-s1, libgl1, libstdc++6, libvulkan1, libwayland-client0, libx11-6, zlib1g
-Filename: pool/main/m/mesa-git/mesa-git_26.3.0-devel+r227503.ea1f62447af3-1_amd64.deb
-Size: 63387734
-MD5sum: b85950eefbe6a011c3cbe09888f13990
-SHA1: 43f0c6281613d8d023b7b759940d9c71014d78e1
-SHA256: e1d3e2ff040dfe17b130fc2036b40033b9e63029cebc90291d1d2e499448fc9d
-Section: libs
-Priority: optional
-Description: Mesa snapshot build installed below /opt/mesa-git
- Built from https://gitlab.freedesktop.org/mesa/mesa.git (main) with bundled libdrm from
- https://gitlab.freedesktop.org/mesa/drm.git (main) and installed into /opt/mesa-git.
-

scripts/build-mesa-opt.sh

@@ -0,0 +1,248 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+ROOT_DIR=$(cd -- "${SCRIPT_DIR}/.." && pwd)
+CONFIG_FILE="${ROOT_DIR}/config/mesa-opt.conf"
+
+if [[ ! -f "${CONFIG_FILE}" ]]; then
+  echo "missing config: ${CONFIG_FILE}" >&2
+  exit 1
+fi
+
+# shellcheck disable=SC1090
+source "${CONFIG_FILE}"
+
+require_cmd() {
+  local cmd
+  for cmd in "$@"; do
+    command -v "${cmd}" >/dev/null 2>&1 || {
+      echo "missing command: ${cmd}" >&2
+      exit 1
+    }
+  done
+}
+
+require_cmd dpkg-deb git ldd meson ninja pkg-config python3 readlink
+
+WORK_DIR="${ROOT_DIR}/work"
+LIBDRM_SRC_DIR="${WORK_DIR}/libdrm"
+LIBDRM_BUILD_DIR="${WORK_DIR}/build-libdrm"
+SRC_DIR="${WORK_DIR}/mesa"
+BUILD_DIR="${WORK_DIR}/build"
+PKG_DIR="${WORK_DIR}/pkg"
+PREREQ_DIR="${WORK_DIR}/prereq"
+DIST_DIR="${ROOT_DIR}/dist"
+
+mkdir -p "${WORK_DIR}" "${DIST_DIR}"
+rm -rf "${LIBDRM_SRC_DIR}" "${LIBDRM_BUILD_DIR}" "${SRC_DIR}" "${BUILD_DIR}" "${PKG_DIR}" "${PREREQ_DIR}"
+mkdir -p "${PKG_DIR}"
+
+UPSTREAM_REF="${MESA_UPSTREAM_REF:-${UPSTREAM_GIT_REF}}"
+LIBDRM_REF="${LIBDRM_UPSTREAM_REF:-${LIBDRM_GIT_REF}}"
+
+git clone --depth 1 --single-branch --branch "${LIBDRM_REF}" "${LIBDRM_GIT_URL}" "${LIBDRM_SRC_DIR}"
+
+meson setup "${LIBDRM_BUILD_DIR}" "${LIBDRM_SRC_DIR}" \
+  --buildtype="${BUILD_TYPE}" \
+  --prefix="${INSTALL_PREFIX}"
+
+ninja -C "${LIBDRM_BUILD_DIR}"
+DESTDIR="${PREREQ_DIR}" ninja -C "${LIBDRM_BUILD_DIR}" install
+
+# Debian's xf86drm.h includes <drm.h>, while newer libdrm installs it below
+# include/libdrm/. Mirror the headers into the prefix root so Mesa finds them.
+if [[ -d "${PREREQ_DIR}${INSTALL_PREFIX}/include/libdrm" ]]; then
+  ln -sf libdrm/drm.h "${PREREQ_DIR}${INSTALL_PREFIX}/include/drm.h"
+  ln -sf libdrm/drm_mode.h "${PREREQ_DIR}${INSTALL_PREFIX}/include/drm_mode.h"
+  ln -sf libdrm/libsync.h "${PREREQ_DIR}${INSTALL_PREFIX}/include/libsync.h"
+fi
+
+# libdrm's pkg-config metadata points to the real prefix path. Mirror the staged
+# files there during the Mesa build so compiler and linker can resolve them.
+mkdir -p "${INSTALL_PREFIX}"
+cp -a "${PREREQ_DIR}${INSTALL_PREFIX}/." "${INSTALL_PREFIX}/"
+
+export PKG_CONFIG_PATH="${PREREQ_DIR}${INSTALL_PREFIX}/lib/x86_64-linux-gnu/pkgconfig:${PREREQ_DIR}${INSTALL_PREFIX}/lib/pkgconfig:${PKG_CONFIG_PATH:-}"
+export LD_LIBRARY_PATH="${PREREQ_DIR}${INSTALL_PREFIX}/lib/x86_64-linux-gnu:${PREREQ_DIR}${INSTALL_PREFIX}/lib:${LD_LIBRARY_PATH:-}"
+
+# The apt version and release notes rely on the upstream commit count being
+# monotonic across builds. Clone the full branch history instead of repairing a
+# shallow clone afterwards, which is more fragile in CI and local container runs.
+git clone --single-branch --branch "${UPSTREAM_REF}" "${UPSTREAM_GIT_URL}" "${SRC_DIR}"
+
+detect_upstream_version() {
+  local source_dir="${1}"
+
+  if [[ -f "${source_dir}/VERSION" ]]; then
+    sed -n '1p' "${source_dir}/VERSION"
+    return
+  fi
+
+  awk -F"'" '/project\(/ { for (i = 1; i <= NF; ++i) if ($i ~ /^[0-9][0-9A-Za-z.+~:-]*$/) { print $i; exit } }' \
+    "${source_dir}/meson.build"
+}
+
+configure_llvm_toolchain() {
+  local spirv_version
+  local spirv_major
+
+  if [[ -n "${LLVM_CONFIG:-}" ]]; then
+    return
+  fi
+
+  if ! pkg-config --exists LLVMSPIRVLib; then
+    return
+  fi
+
+  spirv_version="$(pkg-config --modversion LLVMSPIRVLib)"
+  spirv_major="${spirv_version%%.*}"
+
+  if command -v "llvm-config-${spirv_major}" >/dev/null 2>&1; then
+    export LLVM_CONFIG="llvm-config-${spirv_major}"
+  fi
+}
+
+should_bundle_runtime_lib() {
+  local base_name="${1}"
+
+  case "${base_name}" in
+    libLLVM.so.*|libdisplay-info.so.*|libwayland-client.so.*|libwayland-cursor.so.*|libwayland-egl.so.*|libwayland-server.so.*|libxcb-keysyms.so.*)
+      return 0
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+bundle_runtime_libraries() {
+  local package_lib_dir="${PKG_DIR}${INSTALL_PREFIX}/lib/x86_64-linux-gnu"
+  local source_path
+  local resolved_path
+  local base_name
+  local bundled_any=1
+
+  mkdir -p "${package_lib_dir}"
+
+  while (( bundled_any != 0 )); do
+    bundled_any=0
+
+    while IFS= read -r source_path; do
+      [[ -n "${source_path}" ]] || continue
+
+      base_name="$(basename "${source_path}")"
+      if ! should_bundle_runtime_lib "${base_name}"; then
+        continue
+      fi
+
+      resolved_path="$(readlink -f "${source_path}")"
+      if [[ -f "${package_lib_dir}/$(basename "${resolved_path}")" ]]; then
+        continue
+      fi
+
+      install -m 0644 "${resolved_path}" "${package_lib_dir}/$(basename "${resolved_path}")"
+      if [[ "${base_name}" != "$(basename "${resolved_path}")" ]]; then
+        ln -sf "$(basename "${resolved_path}")" "${package_lib_dir}/${base_name}"
+      fi
+
+      bundled_any=1
+    done < <(
+      find "${PKG_DIR}${INSTALL_PREFIX}" -type f \( -name '*.so' -o -name '*.so.*' \) -print0 \
+        | xargs -0 -r ldd 2>/dev/null \
+        | awk '/=> \// { print $3 }' \
+        | sort -u
+    )
+  done
+}
+
+GIT_SHA=$(git -C "${SRC_DIR}" rev-parse --short=12 HEAD)
+GIT_SHA_FULL=$(git -C "${SRC_DIR}" rev-parse HEAD)
+UPSTREAM_COMMIT_COUNT=$(git -C "${SRC_DIR}" rev-list --count HEAD)
+UPSTREAM_VERSION="${PACKAGE_VERSION_PREFIX:-$(detect_upstream_version "${SRC_DIR}")}"
+PACKAGE_VERSION="${UPSTREAM_VERSION}+r${UPSTREAM_COMMIT_COUNT}.${GIT_SHA}-${PACKAGE_RELEASE}"
+OUTPUT_DEB="${DIST_DIR}/${PACKAGE_NAME}_${PACKAGE_VERSION}_${PACKAGE_ARCH}.deb"
+
+configure_llvm_toolchain
+
+meson setup "${BUILD_DIR}" "${SRC_DIR}" \
+  --buildtype="${BUILD_TYPE}" \
+  --prefix="${INSTALL_PREFIX}" \
+  -Dplatforms="${PLATFORMS}" \
+  -Dgallium-drivers="${GALLIUM_DRIVERS}" \
+  -Dvulkan-drivers="${VULKAN_DRIVERS}" \
+  -Dvulkan-layers="${VULKAN_LAYERS}" \
+  -Dglx=dri \
+  -Dllvm=enabled \
+  -Dshared-glapi=enabled
+
+ninja -C "${BUILD_DIR}"
+cp -a "${PREREQ_DIR}/." "${PKG_DIR}/"
+DESTDIR="${PKG_DIR}" ninja -C "${BUILD_DIR}" install
+bundle_runtime_libraries
+
+mkdir -p \
+  "${PKG_DIR}/DEBIAN" \
+  "${PKG_DIR}/usr/share/doc/${PACKAGE_NAME}" \
+  "${PKG_DIR}/usr/bin"
+
+cat > "${PKG_DIR}/DEBIAN/control" <<EOF
+Package: ${PACKAGE_NAME}
+Version: ${PACKAGE_VERSION}
+Section: libs
+Priority: optional
+Architecture: ${PACKAGE_ARCH}
+Maintainer: magges <magges@local>
+Depends: libc6, libexpat1, libgcc-s1, libgl1, libstdc++6, libvulkan1, libwayland-client0, libx11-6, zlib1g
+Description: Mesa snapshot build installed below ${INSTALL_PREFIX}
+ Built from ${UPSTREAM_GIT_URL} (${UPSTREAM_REF}) with bundled libdrm from
+ ${LIBDRM_GIT_URL} (${LIBDRM_REF}) and installed into ${INSTALL_PREFIX}.
+EOF
+
+cat > "${PKG_DIR}/usr/share/doc/${PACKAGE_NAME}/README.Debian" <<EOF
+This package installs a standalone Mesa snapshot in ${INSTALL_PREFIX}.
+
+Use it with:
+  export LD_LIBRARY_PATH=${INSTALL_PREFIX}/lib/x86_64-linux-gnu:${INSTALL_PREFIX}/lib:\$LD_LIBRARY_PATH
+  export LIBGL_DRIVERS_PATH=${INSTALL_PREFIX}/lib/x86_64-linux-gnu/dri
+  export VK_LAYER_PATH=${INSTALL_PREFIX}/share/vulkan/explicit_layer.d
+  export VK_ICD_FILENAMES=\$(printf '%s:' ${INSTALL_PREFIX}/share/vulkan/icd.d/*.json | sed 's/:$//')
+EOF
+
+cat > "${PKG_DIR}/usr/bin/${PACKAGE_NAME}-env" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+export LD_LIBRARY_PATH="${INSTALL_PREFIX}/lib/x86_64-linux-gnu:${INSTALL_PREFIX}/lib:\${LD_LIBRARY_PATH:-}"
+export LIBGL_DRIVERS_PATH="${INSTALL_PREFIX}/lib/x86_64-linux-gnu/dri"
+export VK_LAYER_PATH="${INSTALL_PREFIX}/share/vulkan/explicit_layer.d"
+if compgen -G "${INSTALL_PREFIX}/share/vulkan/icd.d/*.json" >/dev/null; then
+  icd_files=(${INSTALL_PREFIX}/share/vulkan/icd.d/*.json)
+  icd_joined=\$(printf '%s:' "\${icd_files[@]}")
+  export VK_ICD_FILENAMES="\${icd_joined%:}"
+  export VK_DRIVER_FILES="\${VK_ICD_FILENAMES}"
+fi
+exec "\$@"
+EOF
+chmod 0755 "${PKG_DIR}/usr/bin/${PACKAGE_NAME}-env"
+
+find "${PKG_DIR}" -type d -exec chmod 0755 {} +
+find "${PKG_DIR}" -path "${PKG_DIR}/DEBIAN" -prune -o -type f -exec chmod 0644 {} +
+chmod 0755 "${PKG_DIR}/usr/bin/${PACKAGE_NAME}-env"
+
+dpkg-deb --build "${PKG_DIR}" "${OUTPUT_DEB}"
+cat > "${DIST_DIR}/package-info.env" <<EOF
+PACKAGE_NAME=${PACKAGE_NAME}
+PACKAGE_VERSION=${PACKAGE_VERSION}
+PACKAGE_FILE=$(basename "${OUTPUT_DEB}")
+PACKAGE_ARCH=${PACKAGE_ARCH}
+UPSTREAM_COMMIT_COUNT=${UPSTREAM_COMMIT_COUNT}
+APT_SUITE=${APT_SUITE:-stable}
+APT_COMPONENT=${APT_COMPONENT:-main}
+APT_PUBLIC_BASE_URL=${APT_PUBLIC_BASE_URL:-}
+UPSTREAM_GIT_URL=${UPSTREAM_GIT_URL}
+UPSTREAM_GIT_REF=${UPSTREAM_REF}
+UPSTREAM_GIT_SHA=${GIT_SHA_FULL}
+UPSTREAM_GIT_SHA_SHORT=${GIT_SHA}
+EOF
+echo "built ${OUTPUT_DEB}"

scripts/generate-apt-repo.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+ROOT_DIR=$(cd -- "${SCRIPT_DIR}/.." && pwd)
+CONFIG_FILE="${ROOT_DIR}/config/mesa-opt.conf"
+DIST_DIR="${ROOT_DIR}/dist"
+APT_DIR="${DIST_DIR}/aptrepo"
+DIST_ENV="${DIST_DIR}/package-info.env"
+
+if [[ -f "${CONFIG_FILE}" ]]; then
+  # shellcheck disable=SC1090
+  source "${CONFIG_FILE}"
+fi
+
+if [[ ! -f "${DIST_ENV}" ]]; then
+  echo "missing dist metadata: ${DIST_ENV}" >&2
+  exit 1
+fi
+
+# shellcheck disable=SC1090
+source "${DIST_ENV}"
+
+require_cmd() {
+  local cmd
+  for cmd in "$@"; do
+    command -v "${cmd}" >/dev/null 2>&1 || {
+      echo "missing command: ${cmd}" >&2
+      exit 1
+    }
+  done
+}
+
+require_cmd dpkg-scanpackages gzip md5sum sha256sum sha512sum stat date
+
+PACKAGE_ARCH="$(dpkg-deb -f "${DIST_DIR}/${PACKAGE_FILE}" Architecture)"
+
+APT_SUITE="${APT_SUITE:-stable}"
+APT_COMPONENT="${APT_COMPONENT:-main}"
+APT_ARCH="${APT_ARCH:-${PACKAGE_ARCH}}"
+APT_ORIGIN="${APT_ORIGIN:-mesa-git}"
+APT_LABEL="${APT_LABEL:-mesa-git}"
+APT_DESCRIPTION="${APT_DESCRIPTION:-Mesa git apt repository}"
+
+POOL_DIR="${APT_DIR}/pool/${APT_COMPONENT}/m/${PACKAGE_NAME}"
+BINARY_DIR="${APT_DIR}/dists/${APT_SUITE}/${APT_COMPONENT}/binary-${APT_ARCH}"
+PACKAGE_PATH="${POOL_DIR}/${PACKAGE_FILE}"
+
+rm -rf "${APT_DIR}"
+mkdir -p "${POOL_DIR}" "${BINARY_DIR}"
+
+cp "${DIST_DIR}/${PACKAGE_FILE}" "${PACKAGE_PATH}"
+
+(
+  cd "${APT_DIR}"
+  dpkg-scanpackages --arch "${APT_ARCH}" "pool" > "${BINARY_DIR#${APT_DIR}/}/Packages"
+)
+
+gzip -kf "${BINARY_DIR}/Packages"
+
+cat > "${APT_DIR}/dists/${APT_SUITE}/Release" <<EOF
+Origin: ${APT_ORIGIN}
+Label: ${APT_LABEL}
+Suite: ${APT_SUITE}
+Codename: ${APT_SUITE}
+Architectures: ${APT_ARCH}
+Components: ${APT_COMPONENT}
+Description: ${APT_DESCRIPTION}
+Date: $(date -Ru)
+EOF
+
+append_checksum_block() {
+  local label="${1}"
+  local checksum_cmd="${2}"
+  local release_file="${APT_DIR}/dists/${APT_SUITE}/Release"
+  local rel_dir="${APT_DIR}/dists/${APT_SUITE}"
+  local file
+  local sum
+  local size
+  local rel_path
+
+  printf '%s:\n' "${label}" >> "${release_file}"
+
+  while IFS= read -r -d '' file; do
+    rel_path="${file#${rel_dir}/}"
+    sum="$(${checksum_cmd} "${file}" | awk '{print $1}')"
+    size="$(stat -c '%s' "${file}")"
+    printf ' %s %16s %s\n' "${sum}" "${size}" "${rel_path}" >> "${release_file}"
+  done < <(find "${rel_dir}" -type f ! -name Release -print0 | sort -z)
+}
+
+append_checksum_block "MD5Sum" md5sum
+append_checksum_block "SHA256" sha256sum
+append_checksum_block "SHA512" sha512sum
+
+if [[ -n "${APT_PUBLIC_BASE_URL:-}" ]]; then
+  printf 'deb [trusted=yes] %s %s %s\n' \
+    "${APT_PUBLIC_BASE_URL%/}" \
+    "${APT_SUITE}" \
+    "${APT_COMPONENT}" \
+    > "${APT_DIR}/${PACKAGE_NAME}-${APT_SUITE}.list"
+fi

scripts/generate-release-notes.sh

@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+ROOT_DIR=$(cd -- "${SCRIPT_DIR}/.." && pwd)
+DIST_ENV="${ROOT_DIR}/dist/package-info.env"
+MESA_SRC_DIR="${ROOT_DIR}/work/mesa"
+REPO_SRC_DIR="${ROOT_DIR}"
+
+if [[ ! -f "${DIST_ENV}" ]]; then
+  echo "missing dist metadata: ${DIST_ENV}" >&2
+  exit 1
+fi
+
+if [[ ! -d "${MESA_SRC_DIR}/.git" ]]; then
+  echo "missing mesa source checkout: ${MESA_SRC_DIR}" >&2
+  exit 1
+fi
+
+if [[ ! -d "${REPO_SRC_DIR}/.git" ]]; then
+  echo "missing repo checkout: ${REPO_SRC_DIR}" >&2
+  exit 1
+fi
+
+# shellcheck disable=SC1090
+source "${DIST_ENV}"
+
+require_env() {
+  local name
+  for name in "$@"; do
+    if [[ -z "${!name:-}" ]]; then
+      echo "missing environment variable: ${name}" >&2
+      exit 1
+    fi
+  done
+}
+
+require_env GITEA_SERVER_URL GITEA_REPOSITORY GITEA_TOKEN RELEASE_TAG
+
+RELEASES_JSON="$(curl -fsS \
+  -H "Authorization: token ${GITEA_TOKEN}" \
+  "${GITEA_SERVER_URL}/api/v1/repos/${GITEA_REPOSITORY}/releases?limit=20")"
+
+PREVIOUS_VALUES="$(
+  python3 - "${RELEASES_JSON}" "${RELEASE_TAG}" "${PACKAGE_NAME}" <<'PY'
+import json
+import re
+import sys
+
+releases = json.loads(sys.argv[1])
+current_tag = sys.argv[2]
+package_name = sys.argv[3]
+tag_prefix = f"{package_name}-"
+pattern = re.compile(r"([0-9a-f]{7,40})-\d+$")
+
+for release in releases:
+    tag = release.get("tag_name", "")
+    if tag == current_tag or not tag.startswith(tag_prefix):
+        continue
+    match = pattern.search(tag)
+    if match:
+        print(match.group(1))
+        print(release.get("target_commitish", ""))
+        break
+PY
+)"
+
+PREVIOUS_MESA_SHA="$(printf '%s\n' "${PREVIOUS_VALUES}" | sed -n '1p')"
+PREVIOUS_REPO_SHA="$(printf '%s\n' "${PREVIOUS_VALUES}" | sed -n '2p')"
+
+CURRENT_REPO_SHA="$(git -C "${REPO_SRC_DIR}" rev-parse HEAD)"
+REPO_COMMITS_TRUNCATED=0
+REPO_COMMIT_LIMIT=20
+MESA_COMMITS_TRUNCATED=0
+MESA_COMMIT_LIMIT=50
+
+if [[ -n "${PREVIOUS_REPO_SHA}" ]] && git -C "${REPO_SRC_DIR}" rev-parse --verify --quiet "${PREVIOUS_REPO_SHA}^{commit}" >/dev/null; then
+  REPO_COMPARE_RANGE="${PREVIOUS_REPO_SHA}..${CURRENT_REPO_SHA}"
+  mapfile -t REPO_COMMITS < <(git -C "${REPO_SRC_DIR}" log --no-merges --format='- %h %s' "${REPO_COMPARE_RANGE}")
+  REPO_RANGE_LABEL="Repo changes since \`${PREVIOUS_REPO_SHA}\`"
+else
+  REPO_COMPARE_RANGE="${CURRENT_REPO_SHA}"
+  mapfile -t REPO_COMMITS < <(git -C "${REPO_SRC_DIR}" log --no-merges -n "${REPO_COMMIT_LIMIT}" --format='- %h %s' "${REPO_COMPARE_RANGE}")
+  REPO_RANGE_LABEL="Recent repo commits"
+fi
+
+if (( ${#REPO_COMMITS[@]} > REPO_COMMIT_LIMIT )); then
+  REPO_COMMITS=( "${REPO_COMMITS[@]:0:${REPO_COMMIT_LIMIT}}" )
+  REPO_COMMITS_TRUNCATED=1
+fi
+
+if [[ -n "${PREVIOUS_MESA_SHA}" ]] && git -C "${MESA_SRC_DIR}" rev-parse --verify --quiet "${PREVIOUS_MESA_SHA}^{commit}" >/dev/null; then
+  MESA_COMPARE_RANGE="${PREVIOUS_MESA_SHA}..${UPSTREAM_GIT_SHA}"
+  mapfile -t MESA_COMMITS < <(git -C "${MESA_SRC_DIR}" log --no-merges --format='- %h %s' "${MESA_COMPARE_RANGE}")
+  MESA_RANGE_LABEL="Mesa upstream changes since \`${PREVIOUS_MESA_SHA}\`"
+else
+  MESA_COMPARE_RANGE="${UPSTREAM_GIT_SHA}"
+  mapfile -t MESA_COMMITS < <(git -C "${MESA_SRC_DIR}" log --no-merges -n "${MESA_COMMIT_LIMIT}" --format='- %h %s' "${MESA_COMPARE_RANGE}")
+  MESA_RANGE_LABEL="Recent Mesa upstream commits"
+fi
+
+if (( ${#MESA_COMMITS[@]} > MESA_COMMIT_LIMIT )); then
+  MESA_COMMITS=( "${MESA_COMMITS[@]:0:${MESA_COMMIT_LIMIT}}" )
+  MESA_COMMITS_TRUNCATED=1
+fi
+
+{
+  printf '## Repo Changes\n\n'
+  printf -- '- Repo commit: `%s`\n' "${CURRENT_REPO_SHA}"
+  printf -- '- Release tag: `%s`\n\n' "${RELEASE_TAG}"
+  printf '### %s\n\n' "${REPO_RANGE_LABEL}"
+
+  if (( ${#REPO_COMMITS[@]} == 0 )); then
+    printf -- '- No repo changes found for this release.\n'
+  else
+    printf '%s\n' "${REPO_COMMITS[@]}"
+  fi
+
+  if (( REPO_COMMITS_TRUNCATED == 1 )); then
+    printf '\n_Repo changes truncated to the first %d commits._\n' "${REPO_COMMIT_LIMIT}"
+  fi
+
+  printf '\n## Mesa Upstream\n\n'
+  printf -- '- Upstream: `%s`\n' "${UPSTREAM_GIT_URL}"
+  printf -- '- Ref: `%s`\n' "${UPSTREAM_GIT_REF}"
+  printf -- '- Commit: `%s`\n' "${UPSTREAM_GIT_SHA_SHORT}"
+  printf -- '- Package: `%s`\n\n' "${PACKAGE_FILE}"
+  printf '### %s\n\n' "${MESA_RANGE_LABEL}"
+
+  if (( ${#MESA_COMMITS[@]} == 0 )); then
+    printf -- '- No new upstream commits found for this release.\n'
+  else
+    printf '%s\n' "${MESA_COMMITS[@]}"
+  fi
+
+  if (( MESA_COMMITS_TRUNCATED == 1 )); then
+    printf '\n_Mesa upstream changes truncated to the first %d commits._\n' "${MESA_COMMIT_LIMIT}"
+  fi
+} > "${ROOT_DIR}/dist/release-notes.md"

scripts/verify-apt-repo.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+ROOT_DIR=$(cd -- "${SCRIPT_DIR}/.." && pwd)
+CONFIG_FILE="${ROOT_DIR}/config/mesa-opt.conf"
+DIST_DIR="${ROOT_DIR}/dist"
+APT_DIR="${DIST_DIR}/aptrepo"
+DIST_ENV="${DIST_DIR}/package-info.env"
+CHECK_REMOTE=0
+
+usage() {
+  cat <<'EOF'
+Usage: verify-apt-repo.sh [--remote]
+
+Checks that the generated apt repository is internally consistent.
+With --remote, also verifies that the configured public HTTP base URL serves
+the Release file, Packages index, and referenced package anonymously.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --remote)
+      CHECK_REMOTE=1
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "unknown argument: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ -f "${CONFIG_FILE}" ]]; then
+  # shellcheck disable=SC1090
+  source "${CONFIG_FILE}"
+fi
+
+if [[ ! -f "${DIST_ENV}" ]]; then
+  echo "missing dist metadata: ${DIST_ENV}" >&2
+  exit 1
+fi
+
+# shellcheck disable=SC1090
+source "${DIST_ENV}"
+
+APT_SUITE="${APT_SUITE:-stable}"
+APT_COMPONENT="${APT_COMPONENT:-main}"
+APT_ARCH="${APT_ARCH:-${PACKAGE_ARCH:-amd64}}"
+PACKAGES_FILE="${APT_DIR}/dists/${APT_SUITE}/${APT_COMPONENT}/binary-${APT_ARCH}/Packages"
+RELEASE_FILE="${APT_DIR}/dists/${APT_SUITE}/Release"
+
+require_cmd() {
+  local cmd
+  for cmd in "$@"; do
+    command -v "${cmd}" >/dev/null 2>&1 || {
+      echo "missing command: ${cmd}" >&2
+      exit 1
+    }
+  done
+}
+
+require_cmd awk curl grep gzip
+
+[[ -f "${RELEASE_FILE}" ]] || {
+  echo "missing Release file: ${RELEASE_FILE}" >&2
+  exit 1
+}
+
+[[ -f "${PACKAGES_FILE}" ]] || {
+  echo "missing Packages file: ${PACKAGES_FILE}" >&2
+  exit 1
+}
+
+[[ -f "${PACKAGES_FILE}.gz" ]] || {
+  echo "missing Packages.gz file: ${PACKAGES_FILE}.gz" >&2
+  exit 1
+}
+
+PACKAGE_RELATIVE_PATH="$(awk -F': ' '$1=="Filename" { print $2; exit }' "${PACKAGES_FILE}")"
+[[ -n "${PACKAGE_RELATIVE_PATH}" ]] || {
+  echo "missing Filename entry in ${PACKAGES_FILE}" >&2
+  exit 1
+}
+
+[[ -f "${APT_DIR}/${PACKAGE_RELATIVE_PATH}" ]] || {
+  echo "referenced package is missing: ${APT_DIR}/${PACKAGE_RELATIVE_PATH}" >&2
+  exit 1
+}
+
+grep -q " ${APT_COMPONENT}/binary-${APT_ARCH}/Packages\$" "${RELEASE_FILE}" || {
+  echo "Release file does not reference Packages index" >&2
+  exit 1
+}
+
+grep -q " ${APT_COMPONENT}/binary-${APT_ARCH}/Packages.gz\$" "${RELEASE_FILE}" || {
+  echo "Release file does not reference Packages.gz index" >&2
+  exit 1
+}
+
+gzip -t "${PACKAGES_FILE}.gz"
+echo "local apt repository structure looks valid"
+
+if [[ "${CHECK_REMOTE}" -eq 0 ]]; then
+  exit 0
+fi
+
+if [[ -z "${APT_PUBLIC_BASE_URL:-}" ]]; then
+  echo "APT_PUBLIC_BASE_URL is empty; skipping remote verification"
+  exit 0
+fi
+
+BASE_URL="${APT_PUBLIC_BASE_URL%/}"
+RELEASE_URL="${BASE_URL}/dists/${APT_SUITE}/Release"
+PACKAGES_URL="${BASE_URL}/dists/${APT_SUITE}/${APT_COMPONENT}/binary-${APT_ARCH}/Packages"
+PACKAGE_URL="${BASE_URL}/${PACKAGE_RELATIVE_PATH}"
+
+curl -fsSL "${RELEASE_URL}" >/dev/null
+curl -fsSL "${PACKAGES_URL}" >/dev/null
+curl -fsSLI "${PACKAGE_URL}" >/dev/null
+
+echo "remote apt repository is reachable anonymously via ${BASE_URL}"