Harden mesa package for Ubuntu and Debian targets

.gitea/workflows/build.yml

@@ -12,14 +12,13 @@ jobs:
   build-deb:
     runs-on: ubuntu-latest
     container:
-      image: debian:trixie
+      image: ubuntu:24.04
     steps:
       - name: Install build dependencies
         run: |
           apt-get update
           DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
             build-essential \
-            bindgen \
             ca-certificates \
             cbindgen \
             cmake \
@@ -31,12 +30,11 @@ jobs:
             meson \
             ninja-build \
             pkg-config \
-            cargo \
             python3 \
+            python3-pip \
             python3-mako \
             python3-ply \
             python3-yaml \
-            rustc \
             bison \
             flex \
             gettext \
@@ -45,6 +43,7 @@ jobs:
             libelf-dev \
             libexpat1-dev \
             libgbm-dev \
+            libclang-19-dev \
             libglvnd-dev \
             libgles2-mesa-dev \
             libclc-19 \
@@ -76,10 +75,14 @@ jobs:
             libxshmfence-dev \
             libxxf86vm-dev \
             libzstd-dev \
-            llvm-dev \
+            llvm-19-dev \
             wayland-protocols \
             xz-utils \
             zlib1g-dev
+          python3 -m pip install --break-system-packages 'meson>=1.4.0,<2'
+          curl https://sh.rustup.rs -sSf | sh -s -- -y --profile minimal --default-toolchain 1.85.0
+          . /root/.cargo/env
+          cargo install --locked bindgen-cli --version 0.71.1
       - name: Checkout repository
         run: |
           git init .
@@ -91,6 +94,7 @@ jobs:
         env:
           MESA_UPSTREAM_REF: main
         run: |
+          . /root/.cargo/env
           chmod +x scripts/build-mesa-opt.sh
           ./scripts/build-mesa-opt.sh
       - name: Generate release notes

README.md

@@ -4,6 +4,9 @@ Dieses Repo baut per Gitea Actions ein eigenständiges `mesa-git`-Paket als `.de
 Das Paket installiert Mesa separat unter `/opt/mesa-git`, damit es parallel zur
 System-Mesa genutzt werden kann.
 
+Ziel ist ein Paket, das auf `Debian 13+` sowie `Ubuntu 24.04` bis `26.x`
+installierbar bleibt.
+
 ## Was gebaut wird
 
 - Paketname: `mesa-git`
@@ -33,6 +36,11 @@ hartes Wayland-only-Build.
 Zusammen mit einem aktuellen `libdrm`-Snapshot, damit neue Mesa-Stände nicht an
 zu alten Distributionspaketen scheitern.
 
+Gebaut wird absichtlich gegen `Ubuntu 24.04` als älteste unterstützte
+Ubuntu-Basis. Zusätzlich bündelt das Paket ausgewählte Laufzeitbibliotheken
+unterhalb von `/opt/mesa-git`, damit neuere Mesa-Builds auch auf leicht
+abweichenden Debian-/Ubuntu-Systemständen starten können.
+
 ## Ablauf
 
 1. Gitea Actions startet auf dem `act_runner`.
@@ -141,6 +149,11 @@ Der Wrapper setzt die nötigen Mesa-Pfade für `LD_LIBRARY_PATH`,
 `LIBGL_DRIVERS_PATH`, `VK_LAYER_PATH` und `VK_ICD_FILENAMES`.
 Vorhandene Vulkan-ICDs aus dem Paket werden dabei automatisch eingesammelt.
 
+Wichtig: Prüfungen für die isolierte Installation sollten ebenfalls über
+`mesa-git-env` laufen. Ein rohes `ldd` direkt auf Bibliotheken unter
+`/opt/mesa-git` kann sonst fälschlich fehlende Abhängigkeiten zeigen, obwohl
+der Wrapper die Laufzeitpfade korrekt setzt.
+
 ## Lokaler Test
 
 Mit installierten Build-Abhängigkeiten:
@@ -149,6 +162,10 @@ Mit installierten Build-Abhängigkeiten:
 ./scripts/build-mesa-opt.sh
 ```
 
+Für einen sauberen Kompatibilitätstest lohnt sich ein isolierter Container oder
+eine `distrobox` mit eigenem temporären `HOME`, damit Build-Artefakte,
+Paketquellen und Caches danach vollständig wieder entfernt werden können.
+
 ## Anpassen
 
 Die wichtigsten Schalter liegen in `config/mesa-opt.conf`:

scripts/build-mesa-opt.sh

@@ -24,7 +24,7 @@ require_cmd() {
   done
 }
 
-require_cmd dpkg-deb git meson ninja python3
+require_cmd dpkg-deb git ldd meson ninja pkg-config python3 readlink
 
 WORK_DIR="${ROOT_DIR}/work"
 LIBDRM_SRC_DIR="${WORK_DIR}/libdrm"
@@ -42,7 +42,7 @@ mkdir -p "${PKG_DIR}"
 UPSTREAM_REF="${MESA_UPSTREAM_REF:-${UPSTREAM_GIT_REF}}"
 LIBDRM_REF="${LIBDRM_UPSTREAM_REF:-${LIBDRM_GIT_REF}}"
 
-git clone --depth 1 --branch "${LIBDRM_REF}" "${LIBDRM_GIT_URL}" "${LIBDRM_SRC_DIR}"
+git clone --depth 1 --single-branch --branch "${LIBDRM_REF}" "${LIBDRM_GIT_URL}" "${LIBDRM_SRC_DIR}"
 
 meson setup "${LIBDRM_BUILD_DIR}" "${LIBDRM_SRC_DIR}" \
   --buildtype="${BUILD_TYPE}" \
@@ -67,7 +67,10 @@ cp -a "${PREREQ_DIR}${INSTALL_PREFIX}/." "${INSTALL_PREFIX}/"
 export PKG_CONFIG_PATH="${PREREQ_DIR}${INSTALL_PREFIX}/lib/x86_64-linux-gnu/pkgconfig:${PREREQ_DIR}${INSTALL_PREFIX}/lib/pkgconfig:${PKG_CONFIG_PATH:-}"
 export LD_LIBRARY_PATH="${PREREQ_DIR}${INSTALL_PREFIX}/lib/x86_64-linux-gnu:${PREREQ_DIR}${INSTALL_PREFIX}/lib:${LD_LIBRARY_PATH:-}"
 
-git clone --depth 1 --branch "${UPSTREAM_REF}" "${UPSTREAM_GIT_URL}" "${SRC_DIR}"
+# The apt version and release notes rely on the upstream commit count being
+# monotonic across builds. Clone the full branch history instead of repairing a
+# shallow clone afterwards, which is more fragile in CI and local container runs.
+git clone --single-branch --branch "${UPSTREAM_REF}" "${UPSTREAM_GIT_URL}" "${SRC_DIR}"
 
 detect_upstream_version() {
   local source_dir="${1}"
@@ -81,6 +84,79 @@ detect_upstream_version() {
     "${source_dir}/meson.build"
 }
 
+configure_llvm_toolchain() {
+  local spirv_version
+  local spirv_major
+
+  if [[ -n "${LLVM_CONFIG:-}" ]]; then
+    return
+  fi
+
+  if ! pkg-config --exists LLVMSPIRVLib; then
+    return
+  fi
+
+  spirv_version="$(pkg-config --modversion LLVMSPIRVLib)"
+  spirv_major="${spirv_version%%.*}"
+
+  if command -v "llvm-config-${spirv_major}" >/dev/null 2>&1; then
+    export LLVM_CONFIG="llvm-config-${spirv_major}"
+  fi
+}
+
+should_bundle_runtime_lib() {
+  local base_name="${1}"
+
+  case "${base_name}" in
+    libLLVM.so.*|libdisplay-info.so.*|libwayland-client.so.*|libwayland-cursor.so.*|libwayland-egl.so.*|libwayland-server.so.*|libxcb-keysyms.so.*)
+      return 0
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+bundle_runtime_libraries() {
+  local package_lib_dir="${PKG_DIR}${INSTALL_PREFIX}/lib/x86_64-linux-gnu"
+  local source_path
+  local resolved_path
+  local base_name
+  local bundled_any=1
+
+  mkdir -p "${package_lib_dir}"
+
+  while (( bundled_any != 0 )); do
+    bundled_any=0
+
+    while IFS= read -r source_path; do
+      [[ -n "${source_path}" ]] || continue
+
+      base_name="$(basename "${source_path}")"
+      if ! should_bundle_runtime_lib "${base_name}"; then
+        continue
+      fi
+
+      resolved_path="$(readlink -f "${source_path}")"
+      if [[ -f "${package_lib_dir}/$(basename "${resolved_path}")" ]]; then
+        continue
+      fi
+
+      install -m 0644 "${resolved_path}" "${package_lib_dir}/$(basename "${resolved_path}")"
+      if [[ "${base_name}" != "$(basename "${resolved_path}")" ]]; then
+        ln -sf "$(basename "${resolved_path}")" "${package_lib_dir}/${base_name}"
+      fi
+
+      bundled_any=1
+    done < <(
+      find "${PKG_DIR}${INSTALL_PREFIX}" -type f \( -name '*.so' -o -name '*.so.*' \) -print0 \
+        | xargs -0 -r ldd 2>/dev/null \
+        | awk '/=> \// { print $3 }' \
+        | sort -u
+    )
+  done
+}
+
 GIT_SHA=$(git -C "${SRC_DIR}" rev-parse --short=12 HEAD)
 GIT_SHA_FULL=$(git -C "${SRC_DIR}" rev-parse HEAD)
 UPSTREAM_COMMIT_COUNT=$(git -C "${SRC_DIR}" rev-list --count HEAD)
@@ -88,6 +164,8 @@ UPSTREAM_VERSION="${PACKAGE_VERSION_PREFIX:-$(detect_upstream_version "${SRC_DIR
 PACKAGE_VERSION="${UPSTREAM_VERSION}+r${UPSTREAM_COMMIT_COUNT}.${GIT_SHA}-${PACKAGE_RELEASE}"
 OUTPUT_DEB="${DIST_DIR}/${PACKAGE_NAME}_${PACKAGE_VERSION}_${PACKAGE_ARCH}.deb"
 
+configure_llvm_toolchain
+
 meson setup "${BUILD_DIR}" "${SRC_DIR}" \
   --buildtype="${BUILD_TYPE}" \
   --prefix="${INSTALL_PREFIX}" \
@@ -102,6 +180,7 @@ meson setup "${BUILD_DIR}" "${SRC_DIR}" \
 ninja -C "${BUILD_DIR}"
 cp -a "${PREREQ_DIR}/." "${PKG_DIR}/"
 DESTDIR="${PKG_DIR}" ninja -C "${BUILD_DIR}" install
+bundle_runtime_libraries
 
 mkdir -p \
   "${PKG_DIR}/DEBIAN" \
@@ -115,7 +194,7 @@ Section: libs
 Priority: optional
 Architecture: ${PACKAGE_ARCH}
 Maintainer: magges <magges@local>
-Depends: libc6, libexpat1, libgcc-s1, libgl1, libllvm${LLVM_RUNTIME_VERSION:-19}, libstdc++6, libvulkan1, libwayland-client0, libx11-6, zlib1g
+Depends: libc6, libexpat1, libgcc-s1, libgl1, libstdc++6, libvulkan1, libwayland-client0, libx11-6, zlib1g
 Description: Mesa snapshot build installed below ${INSTALL_PREFIX}
  Built from ${UPSTREAM_GIT_URL} (${UPSTREAM_REF}) with bundled libdrm from
  ${LIBDRM_GIT_URL} (${LIBDRM_REF}) and installed into ${INSTALL_PREFIX}.