Harden mesa package for Ubuntu and Debian targets

.gitea/workflows/build.yml

@@ -12,14 +12,13 @@ jobs:
   build-deb:
     runs-on: ubuntu-latest
     container:
-      image: debian:trixie
+      image: ubuntu:24.04
     steps:
       - name: Install build dependencies
         run: |
           apt-get update
           DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
             build-essential \
-            bindgen \
             ca-certificates \
             cbindgen \
             cmake \
@@ -31,12 +30,11 @@ jobs:
             meson \
             ninja-build \
             pkg-config \
-            cargo \
             python3 \
+            python3-pip \
             python3-mako \
             python3-ply \
             python3-yaml \
-            rustc \
             bison \
             flex \
             gettext \
@@ -45,6 +43,7 @@ jobs:
             libelf-dev \
             libexpat1-dev \
             libgbm-dev \
+            libclang-19-dev \
             libglvnd-dev \
             libgles2-mesa-dev \
             libclc-19 \
@@ -76,10 +75,14 @@ jobs:
             libxshmfence-dev \
             libxxf86vm-dev \
             libzstd-dev \
-            llvm-dev \
+            llvm-19-dev \
             wayland-protocols \
             xz-utils \
             zlib1g-dev
+          python3 -m pip install --break-system-packages 'meson>=1.4.0,<2'
+          curl https://sh.rustup.rs -sSf | sh -s -- -y --profile minimal --default-toolchain 1.85.0
+          . /root/.cargo/env
+          cargo install --locked bindgen-cli --version 0.71.1
       - name: Checkout repository
         run: |
           git init .
@@ -91,6 +94,7 @@ jobs:
         env:
           MESA_UPSTREAM_REF: main
         run: |
+          . /root/.cargo/env
           chmod +x scripts/build-mesa-opt.sh
           ./scripts/build-mesa-opt.sh
       - name: Generate release notes
@@ -106,6 +110,10 @@ jobs:
         run: |
           chmod +x scripts/generate-apt-repo.sh
           ./scripts/generate-apt-repo.sh
+      - name: Verify generated apt repository
+        run: |
+          chmod +x scripts/verify-apt-repo.sh
+          ./scripts/verify-apt-repo.sh
       - name: Upload deb package to Gitea release
         run: |
           . dist/package-info.env
@@ -187,3 +195,7 @@ jobs:
           fi
         env:
           GITEA_SHA: ${{ gitea.sha }}
+      - name: Verify published apt endpoint
+        run: |
+          chmod +x scripts/verify-apt-repo.sh
+          ./scripts/verify-apt-repo.sh --remote

README.md

@@ -4,12 +4,16 @@ Dieses Repo baut per Gitea Actions ein eigenständiges `mesa-git`-Paket als `.de
 Das Paket installiert Mesa separat unter `/opt/mesa-git`, damit es parallel zur
 System-Mesa genutzt werden kann.
 
+Ziel ist ein Paket, das auf `Debian 13+` sowie `Ubuntu 24.04` bis `26.x`
+installierbar bleibt.
+
 ## Was gebaut wird
 
 - Paketname: `mesa-git`
 - Installationspfad: `/opt/mesa-git`
 - Wrapper: `/usr/bin/mesa-git-env`
 - Ausgabe: `mesa-git_<version>_amd64.deb`
+- Versionsschema: `<mesa-version>+r<mesa-commit-count>.<mesa-sha>-<debian-revision>`
 
 ## Build-Profil
 
@@ -32,6 +36,11 @@ hartes Wayland-only-Build.
 Zusammen mit einem aktuellen `libdrm`-Snapshot, damit neue Mesa-Stände nicht an
 zu alten Distributionspaketen scheitern.
 
+Gebaut wird absichtlich gegen `Ubuntu 24.04` als älteste unterstützte
+Ubuntu-Basis. Zusätzlich bündelt das Paket ausgewählte Laufzeitbibliotheken
+unterhalb von `/opt/mesa-git`, damit neuere Mesa-Builds auch auf leicht
+abweichenden Debian-/Ubuntu-Systemständen starten können.
+
 ## Ablauf
 
 1. Gitea Actions startet auf dem `act_runner`.
@@ -75,10 +84,32 @@ Releases werden als normale Releases angelegt, nicht als Pre-Releases.
 Der Workflow veröffentlicht zusätzlich einen einfachen Debian-Repo-Baum auf
 dem Branch `apt`.
 
-Die Einbindung ist dann über die Raw-URL des Branches möglich, zum Beispiel:
+Wichtig: APT braucht anonym erreichbare HTTP-Dateien wie `dists/stable/Release`
+und `pool/...deb`. Ein funktionierendes `git ls-remote` reicht dafür nicht aus.
+
+Auf dieser Gitea-Instanz war die bisher dokumentierte Raw-URL für anonyme
+HTTP-Clients nicht erreichbar und lieferte `404`. Genau daran scheitert dann
+`apt update` auf Ubuntu, obwohl der `apt`-Branch in Git existiert.
+
+Deshalb gilt:
+
+- nutze für Clients nur eine wirklich öffentlich erreichbare statische HTTP-URL
+- setze diese Basis-URL in `config/mesa-opt.conf` als `APT_PUBLIC_BASE_URL`
+- der Workflow prüft dann nach dem Publish, ob `Release`, `Packages` und das
+  referenzierte `.deb` anonym abrufbar sind
+
+Beispiel für die Konfiguration:
+
+```bash
+APT_SUITE="stable"
+APT_COMPONENT="main"
+APT_PUBLIC_BASE_URL="https://packages.example.tld/mesa-repo"
+```
+
+Die Einbindung auf dem Client sieht dann so aus:
 
 ```text
-deb [trusted=yes] https://git.mp-mueller.de/magges/mesa-repo/raw/branch/apt stable main
+deb [trusted=yes] https://packages.example.tld/mesa-repo stable main
 ```
 
 Danach:
@@ -92,6 +123,8 @@ Hinweis:
 
 - das Repo ist aktuell unsigniert
 - für APT wird deshalb hier `trusted=yes` verwendet
+- `scripts/verify-apt-repo.sh --remote` prüft, ob die öffentliche URL wirklich
+  APT-tauglich ist
 - wenn du willst, kann ich als nächsten Schritt auch noch Release-Signierung mit GPG einbauen
 
 ## Wichtige Dateien
@@ -100,6 +133,7 @@ Hinweis:
 - `scripts/build-mesa-opt.sh`: Build und Paketierung
 - `scripts/generate-release-notes.sh`: automatische Release-Notes aus Mesa-Commits
 - `scripts/generate-apt-repo.sh`: erzeugt den APT-Repo-Baum
+- `scripts/verify-apt-repo.sh`: prüft Repo-Struktur und optional den öffentlichen APT-Endpunkt
 - `.gitea/workflows/build.yml`: Gitea-Workflow
 
 ## Benutzung
@@ -115,6 +149,11 @@ Der Wrapper setzt die nötigen Mesa-Pfade für `LD_LIBRARY_PATH`,
 `LIBGL_DRIVERS_PATH`, `VK_LAYER_PATH` und `VK_ICD_FILENAMES`.
 Vorhandene Vulkan-ICDs aus dem Paket werden dabei automatisch eingesammelt.
 
+Wichtig: Prüfungen für die isolierte Installation sollten ebenfalls über
+`mesa-git-env` laufen. Ein rohes `ldd` direkt auf Bibliotheken unter
+`/opt/mesa-git` kann sonst fälschlich fehlende Abhängigkeiten zeigen, obwohl
+der Wrapper die Laufzeitpfade korrekt setzt.
+
 ## Lokaler Test
 
 Mit installierten Build-Abhängigkeiten:
@@ -123,6 +162,10 @@ Mit installierten Build-Abhängigkeiten:
 ./scripts/build-mesa-opt.sh
 ```
 
+Für einen sauberen Kompatibilitätstest lohnt sich ein isolierter Container oder
+eine `distrobox` mit eigenem temporären `HOME`, damit Build-Artefakte,
+Paketquellen und Caches danach vollständig wieder entfernt werden können.
+
 ## Anpassen
 
 Die wichtigsten Schalter liegen in `config/mesa-opt.conf`:

config/mesa-opt.conf

@@ -2,6 +2,11 @@ PACKAGE_NAME="mesa-git"
 PACKAGE_VERSION_PREFIX=""
 PACKAGE_RELEASE="1"
 PACKAGE_ARCH="amd64"
+APT_SUITE="stable"
+APT_COMPONENT="main"
+# Public static HTTP base URL for the generated apt tree, without trailing slash.
+# Leave empty if the repo is only generated locally or published elsewhere.
+APT_PUBLIC_BASE_URL=""
 
 UPSTREAM_GIT_URL="https://gitlab.freedesktop.org/mesa/mesa.git"
 UPSTREAM_GIT_REF="main"

scripts/build-mesa-opt.sh

@@ -24,7 +24,7 @@ require_cmd() {
   done
 }
 
-require_cmd dpkg-deb git meson ninja python3
+require_cmd dpkg-deb git ldd meson ninja pkg-config python3 readlink
 
 WORK_DIR="${ROOT_DIR}/work"
 LIBDRM_SRC_DIR="${WORK_DIR}/libdrm"
@@ -42,7 +42,7 @@ mkdir -p "${PKG_DIR}"
 UPSTREAM_REF="${MESA_UPSTREAM_REF:-${UPSTREAM_GIT_REF}}"
 LIBDRM_REF="${LIBDRM_UPSTREAM_REF:-${LIBDRM_GIT_REF}}"
 
-git clone --depth 1 --branch "${LIBDRM_REF}" "${LIBDRM_GIT_URL}" "${LIBDRM_SRC_DIR}"
+git clone --depth 1 --single-branch --branch "${LIBDRM_REF}" "${LIBDRM_GIT_URL}" "${LIBDRM_SRC_DIR}"
 
 meson setup "${LIBDRM_BUILD_DIR}" "${LIBDRM_SRC_DIR}" \
   --buildtype="${BUILD_TYPE}" \
@@ -67,7 +67,10 @@ cp -a "${PREREQ_DIR}${INSTALL_PREFIX}/." "${INSTALL_PREFIX}/"
 export PKG_CONFIG_PATH="${PREREQ_DIR}${INSTALL_PREFIX}/lib/x86_64-linux-gnu/pkgconfig:${PREREQ_DIR}${INSTALL_PREFIX}/lib/pkgconfig:${PKG_CONFIG_PATH:-}"
 export LD_LIBRARY_PATH="${PREREQ_DIR}${INSTALL_PREFIX}/lib/x86_64-linux-gnu:${PREREQ_DIR}${INSTALL_PREFIX}/lib:${LD_LIBRARY_PATH:-}"
 
-git clone --depth 1 --branch "${UPSTREAM_REF}" "${UPSTREAM_GIT_URL}" "${SRC_DIR}"
+# The apt version and release notes rely on the upstream commit count being
+# monotonic across builds. Clone the full branch history instead of repairing a
+# shallow clone afterwards, which is more fragile in CI and local container runs.
+git clone --single-branch --branch "${UPSTREAM_REF}" "${UPSTREAM_GIT_URL}" "${SRC_DIR}"
 
 detect_upstream_version() {
   local source_dir="${1}"
@@ -81,13 +84,88 @@ detect_upstream_version() {
     "${source_dir}/meson.build"
 }
 
+configure_llvm_toolchain() {
+  local spirv_version
+  local spirv_major
+
+  if [[ -n "${LLVM_CONFIG:-}" ]]; then
+    return
+  fi
+
+  if ! pkg-config --exists LLVMSPIRVLib; then
+    return
+  fi
+
+  spirv_version="$(pkg-config --modversion LLVMSPIRVLib)"
+  spirv_major="${spirv_version%%.*}"
+
+  if command -v "llvm-config-${spirv_major}" >/dev/null 2>&1; then
+    export LLVM_CONFIG="llvm-config-${spirv_major}"
+  fi
+}
+
+should_bundle_runtime_lib() {
+  local base_name="${1}"
+
+  case "${base_name}" in
+    libLLVM.so.*|libdisplay-info.so.*|libwayland-client.so.*|libwayland-cursor.so.*|libwayland-egl.so.*|libwayland-server.so.*|libxcb-keysyms.so.*)
+      return 0
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+bundle_runtime_libraries() {
+  local package_lib_dir="${PKG_DIR}${INSTALL_PREFIX}/lib/x86_64-linux-gnu"
+  local source_path
+  local resolved_path
+  local base_name
+  local bundled_any=1
+
+  mkdir -p "${package_lib_dir}"
+
+  while (( bundled_any != 0 )); do
+    bundled_any=0
+
+    while IFS= read -r source_path; do
+      [[ -n "${source_path}" ]] || continue
+
+      base_name="$(basename "${source_path}")"
+      if ! should_bundle_runtime_lib "${base_name}"; then
+        continue
+      fi
+
+      resolved_path="$(readlink -f "${source_path}")"
+      if [[ -f "${package_lib_dir}/$(basename "${resolved_path}")" ]]; then
+        continue
+      fi
+
+      install -m 0644 "${resolved_path}" "${package_lib_dir}/$(basename "${resolved_path}")"
+      if [[ "${base_name}" != "$(basename "${resolved_path}")" ]]; then
+        ln -sf "$(basename "${resolved_path}")" "${package_lib_dir}/${base_name}"
+      fi
+
+      bundled_any=1
+    done < <(
+      find "${PKG_DIR}${INSTALL_PREFIX}" -type f \( -name '*.so' -o -name '*.so.*' \) -print0 \
+        | xargs -0 -r ldd 2>/dev/null \
+        | awk '/=> \// { print $3 }' \
+        | sort -u
+    )
+  done
+}
+
 GIT_SHA=$(git -C "${SRC_DIR}" rev-parse --short=12 HEAD)
 GIT_SHA_FULL=$(git -C "${SRC_DIR}" rev-parse HEAD)
+UPSTREAM_COMMIT_COUNT=$(git -C "${SRC_DIR}" rev-list --count HEAD)
 UPSTREAM_VERSION="${PACKAGE_VERSION_PREFIX:-$(detect_upstream_version "${SRC_DIR}")}"
-UPSTREAM_SERIES="$(printf '%s' "${UPSTREAM_VERSION}" | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')"
+PACKAGE_VERSION="${UPSTREAM_VERSION}+r${UPSTREAM_COMMIT_COUNT}.${GIT_SHA}-${PACKAGE_RELEASE}"
-PACKAGE_VERSION="${UPSTREAM_SERIES}+git${GIT_SHA}-${PACKAGE_RELEASE}"
 OUTPUT_DEB="${DIST_DIR}/${PACKAGE_NAME}_${PACKAGE_VERSION}_${PACKAGE_ARCH}.deb"
 
+configure_llvm_toolchain
+
 meson setup "${BUILD_DIR}" "${SRC_DIR}" \
   --buildtype="${BUILD_TYPE}" \
   --prefix="${INSTALL_PREFIX}" \
@@ -102,6 +180,7 @@ meson setup "${BUILD_DIR}" "${SRC_DIR}" \
 ninja -C "${BUILD_DIR}"
 cp -a "${PREREQ_DIR}/." "${PKG_DIR}/"
 DESTDIR="${PKG_DIR}" ninja -C "${BUILD_DIR}" install
+bundle_runtime_libraries
 
 mkdir -p \
   "${PKG_DIR}/DEBIAN" \
@@ -115,7 +194,7 @@ Section: libs
 Priority: optional
 Architecture: ${PACKAGE_ARCH}
 Maintainer: magges <magges@local>
-Depends: libc6, libexpat1, libgcc-s1, libgl1, libllvm${LLVM_RUNTIME_VERSION:-19}, libstdc++6, libvulkan1, libwayland-client0, libx11-6, zlib1g
+Depends: libc6, libexpat1, libgcc-s1, libgl1, libstdc++6, libvulkan1, libwayland-client0, libx11-6, zlib1g
 Description: Mesa snapshot build installed below ${INSTALL_PREFIX}
  Built from ${UPSTREAM_GIT_URL} (${UPSTREAM_REF}) with bundled libdrm from
  ${LIBDRM_GIT_URL} (${LIBDRM_REF}) and installed into ${INSTALL_PREFIX}.
@@ -156,6 +235,11 @@ cat > "${DIST_DIR}/package-info.env" <<EOF
 PACKAGE_NAME=${PACKAGE_NAME}
 PACKAGE_VERSION=${PACKAGE_VERSION}
 PACKAGE_FILE=$(basename "${OUTPUT_DEB}")
+PACKAGE_ARCH=${PACKAGE_ARCH}
+UPSTREAM_COMMIT_COUNT=${UPSTREAM_COMMIT_COUNT}
+APT_SUITE=${APT_SUITE:-stable}
+APT_COMPONENT=${APT_COMPONENT:-main}
+APT_PUBLIC_BASE_URL=${APT_PUBLIC_BASE_URL:-}
 UPSTREAM_GIT_URL=${UPSTREAM_GIT_URL}
 UPSTREAM_GIT_REF=${UPSTREAM_REF}
 UPSTREAM_GIT_SHA=${GIT_SHA_FULL}

scripts/generate-apt-repo.sh

@@ -4,10 +4,16 @@ set -euo pipefail
 
 SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 ROOT_DIR=$(cd -- "${SCRIPT_DIR}/.." && pwd)
+CONFIG_FILE="${ROOT_DIR}/config/mesa-opt.conf"
 DIST_DIR="${ROOT_DIR}/dist"
 APT_DIR="${DIST_DIR}/aptrepo"
 DIST_ENV="${DIST_DIR}/package-info.env"
 
+if [[ -f "${CONFIG_FILE}" ]]; then
+  # shellcheck disable=SC1090
+  source "${CONFIG_FILE}"
+fi
+
 if [[ ! -f "${DIST_ENV}" ]]; then
   echo "missing dist metadata: ${DIST_ENV}" >&2
   exit 1
@@ -87,3 +93,11 @@ append_checksum_block() {
 append_checksum_block "MD5Sum" md5sum
 append_checksum_block "SHA256" sha256sum
 append_checksum_block "SHA512" sha512sum
+
+if [[ -n "${APT_PUBLIC_BASE_URL:-}" ]]; then
+  printf 'deb [trusted=yes] %s %s %s\n' \
+    "${APT_PUBLIC_BASE_URL%/}" \
+    "${APT_SUITE}" \
+    "${APT_COMPONENT}" \
+    > "${APT_DIR}/${PACKAGE_NAME}-${APT_SUITE}.list"
+fi

scripts/generate-release-notes.sh

@@ -51,13 +51,14 @@ import sys
 releases = json.loads(sys.argv[1])
 current_tag = sys.argv[2]
 package_name = sys.argv[3]
-pattern = re.compile(rf"^{re.escape(package_name)}-.*\+git([0-9a-f]{{12}})-")
+tag_prefix = f"{package_name}-"
+pattern = re.compile(r"([0-9a-f]{7,40})-\d+$")
 
 for release in releases:
     tag = release.get("tag_name", "")
-    if tag == current_tag:
+    if tag == current_tag or not tag.startswith(tag_prefix):
         continue
-    match = pattern.match(tag)
+    match = pattern.search(tag)
     if match:
         print(match.group(1))
         print(release.get("target_commitish", ""))

scripts/verify-apt-repo.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+ROOT_DIR=$(cd -- "${SCRIPT_DIR}/.." && pwd)
+CONFIG_FILE="${ROOT_DIR}/config/mesa-opt.conf"
+DIST_DIR="${ROOT_DIR}/dist"
+APT_DIR="${DIST_DIR}/aptrepo"
+DIST_ENV="${DIST_DIR}/package-info.env"
+CHECK_REMOTE=0
+
+usage() {
+  cat <<'EOF'
+Usage: verify-apt-repo.sh [--remote]
+
+Checks that the generated apt repository is internally consistent.
+With --remote, also verifies that the configured public HTTP base URL serves
+the Release file, Packages index, and referenced package anonymously.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --remote)
+      CHECK_REMOTE=1
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "unknown argument: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ -f "${CONFIG_FILE}" ]]; then
+  # shellcheck disable=SC1090
+  source "${CONFIG_FILE}"
+fi
+
+if [[ ! -f "${DIST_ENV}" ]]; then
+  echo "missing dist metadata: ${DIST_ENV}" >&2
+  exit 1
+fi
+
+# shellcheck disable=SC1090
+source "${DIST_ENV}"
+
+APT_SUITE="${APT_SUITE:-stable}"
+APT_COMPONENT="${APT_COMPONENT:-main}"
+APT_ARCH="${APT_ARCH:-${PACKAGE_ARCH:-amd64}}"
+PACKAGES_FILE="${APT_DIR}/dists/${APT_SUITE}/${APT_COMPONENT}/binary-${APT_ARCH}/Packages"
+RELEASE_FILE="${APT_DIR}/dists/${APT_SUITE}/Release"
+
+require_cmd() {
+  local cmd
+  for cmd in "$@"; do
+    command -v "${cmd}" >/dev/null 2>&1 || {
+      echo "missing command: ${cmd}" >&2
+      exit 1
+    }
+  done
+}
+
+require_cmd awk curl grep gzip
+
+[[ -f "${RELEASE_FILE}" ]] || {
+  echo "missing Release file: ${RELEASE_FILE}" >&2
+  exit 1
+}
+
+[[ -f "${PACKAGES_FILE}" ]] || {
+  echo "missing Packages file: ${PACKAGES_FILE}" >&2
+  exit 1
+}
+
+[[ -f "${PACKAGES_FILE}.gz" ]] || {
+  echo "missing Packages.gz file: ${PACKAGES_FILE}.gz" >&2
+  exit 1
+}
+
+PACKAGE_RELATIVE_PATH="$(awk -F': ' '$1=="Filename" { print $2; exit }' "${PACKAGES_FILE}")"
+[[ -n "${PACKAGE_RELATIVE_PATH}" ]] || {
+  echo "missing Filename entry in ${PACKAGES_FILE}" >&2
+  exit 1
+}
+
+[[ -f "${APT_DIR}/${PACKAGE_RELATIVE_PATH}" ]] || {
+  echo "referenced package is missing: ${APT_DIR}/${PACKAGE_RELATIVE_PATH}" >&2
+  exit 1
+}
+
+grep -q " ${APT_COMPONENT}/binary-${APT_ARCH}/Packages\$" "${RELEASE_FILE}" || {
+  echo "Release file does not reference Packages index" >&2
+  exit 1
+}
+
+grep -q " ${APT_COMPONENT}/binary-${APT_ARCH}/Packages.gz\$" "${RELEASE_FILE}" || {
+  echo "Release file does not reference Packages.gz index" >&2
+  exit 1
+}
+
+gzip -t "${PACKAGES_FILE}.gz"
+echo "local apt repository structure looks valid"
+
+if [[ "${CHECK_REMOTE}" -eq 0 ]]; then
+  exit 0
+fi
+
+if [[ -z "${APT_PUBLIC_BASE_URL:-}" ]]; then
+  echo "APT_PUBLIC_BASE_URL is empty; skipping remote verification"
+  exit 0
+fi
+
+BASE_URL="${APT_PUBLIC_BASE_URL%/}"
+RELEASE_URL="${BASE_URL}/dists/${APT_SUITE}/Release"
+PACKAGES_URL="${BASE_URL}/dists/${APT_SUITE}/${APT_COMPONENT}/binary-${APT_ARCH}/Packages"
+PACKAGE_URL="${BASE_URL}/${PACKAGE_RELATIVE_PATH}"
+
+curl -fsSL "${RELEASE_URL}" >/dev/null
+curl -fsSL "${PACKAGES_URL}" >/dev/null
+curl -fsSLI "${PACKAGE_URL}" >/dev/null
+
+echo "remote apt repository is reachable anonymously via ${BASE_URL}"