edde746
e9a213807f
The plane added three runtime libraries that bundle-libs.sh deliberately does not bundle, so they have to be declared per distro by hand - and two hand-maintained lists drifting apart is the failure this guard exists to prevent. check_linux_package_deps.py parses the runner's CMake for every pkg-config module it links, follows target_link_libraries to prove each one actually reaches the binary, and requires a package name for it in every distro's depends list. It fails closed on the shapes a naive parser gets wrong: a pkg_check_modules call naming several modules, options preceding the module name, and version constraints like mpv>=0.40 that would otherwise be read as a package nobody ships. The smoke job builds the three packages and reads the dependencies back out of the artifacts, deriving what to expect from build-packages.py rather than restating it - so a library is declared once and verified everywhere. That job is off by default, which is exactly why it must not carry its own copy of the list. The Linux native job names libwayland-dev and libegl-dev instead of riding GTK's and epoxy's transitive dev dependencies, matching the CMake comment's own rationale. In CI the host-dependency guard runs once: the named step covers the staged bundle, and build-packages.py's internal run - which exists for by-hand packaging - is skipped. The smoke job also drops patchelf, which nothing invokes.
54 lines
3.3 KiB
JSON
54 lines
3.3 KiB
JSON
{
|
|
"formatVersion": 1,
|
|
"refreshContract": {
|
|
"rules": [
|
|
"Audit each new upstream release before changing its version, URL, ref, commit, or SHA-256.",
|
|
"For an archive, verify upstream release evidence first, hash the complete reviewed file, and update URL and SHA-256 together.",
|
|
"For Git, verify the upstream release-producing tag record, record the full dereferenced root commit, and review its dependency lock or gitlinks before updating.",
|
|
"Run python3 scripts/verify_runtime_inputs.py and bash linux/packaging/build-libmpv_test.sh before a Linux build.",
|
|
"Never derive an expected checksum from bytes inside the production build or verification command."
|
|
]
|
|
},
|
|
"inputs": {
|
|
"ffmpeg": {
|
|
"kind": "archive",
|
|
"version": "7.1",
|
|
"url": "https://ffmpeg.org/releases/ffmpeg-7.1.tar.xz",
|
|
"sha256": "40973d44970dbc83ef302b0609f2e74982be2d85916dd2ee7472d30678a7abe6",
|
|
"provenance": "FFmpeg release archive verified against ffmpeg-7.1.tar.xz.asc with the official ffmpeg-devel.asc full fingerprint FCF986EA15E6E293A5644F10B4322F04D67658D8 before recording this digest."
|
|
},
|
|
"shaderc": {
|
|
"kind": "git",
|
|
"version": "2024.4",
|
|
"url": "https://github.com/google/shaderc.git",
|
|
"ref": "v2024.4",
|
|
"commit": "caa54d9779d5605aca4e1a0c0c962a3d8f4aeb31",
|
|
"provenance": "Official GitHub annotated tag object 3cd72062f297df05e6a042f2616c42bc8956c326 dereferences to this root commit; its DEPS file pins synchronized dependencies by full commit."
|
|
},
|
|
"libplacebo": {
|
|
"kind": "git",
|
|
"version": "7.351.0",
|
|
"url": "https://code.videolan.org/videolan/libplacebo.git",
|
|
"mirror": "https://github.com/haasn/libplacebo.git",
|
|
"ref": "v7.351.0",
|
|
"commit": "3188549fba13bbdf3a5a98de2a38c2e71f04e21e",
|
|
"provenance": "Official VideoLAN GitLab tag record v7.351.0 contains a PGP-signed release message and dereferences to this root commit; its gitlinks pin recursive submodules. The mirror is upstream's own author repository (haasn/libplacebo, not a fork), whose annotated v7.351.0 tag object 98c1416e95b21cd767b84ac9ee430ccadf263ff6 dereferences to that same commit. It is consulted only after the primary fails, and the commit pin is verified identically either way, so it cannot introduce a different tree."
|
|
},
|
|
"mpv": {
|
|
"kind": "archive",
|
|
"version": "0.40.0",
|
|
"url": "https://github.com/mpv-player/mpv/archive/refs/tags/v0.40.0.tar.gz",
|
|
"sha256": "10a0f4654f62140a6dd4d380dcf0bbdbdcf6e697556863dc499c296182f081a3",
|
|
"commit": "e48ac7ce08462f5e33af6ef9deeac6fa87eef01e",
|
|
"provenance": "GitHub reports annotated tag object 287d7cdb78975ae350d7c2a287eae3c2072c93f7 as a valid PGP signature over release commit e48ac7ce08462f5e33af6ef9deeac6fa87eef01e; the complete tag archive was then hashed."
|
|
},
|
|
"simdutf": {
|
|
"kind": "archive",
|
|
"version": "6.4.2",
|
|
"url": "https://github.com/simdutf/simdutf/releases/download/v6.4.2/singleheader.zip",
|
|
"sha256": "9fe4d6f515724a55c8de88fee4463e0890a1abe2267cda13c4b5d245d58039e6",
|
|
"provenance": "Official GitHub release 210237657 records asset 243345703 as singleheader.zip with size 3013061 bytes; the complete release asset was independently hashed before recording this digest."
|
|
}
|
|
}
|
|
}
|