Catcrafts/fingerprintd
Watch
2
0
Fork
You've already forked fingerprintd
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions
fingerprintd/packaging/make-sysroot.sh

58 lines
2.7 KiB
Shell
Raw Normal View History

Add the cross-build sysroot recipe, verified on the device packaging/make-sysroot.sh populates a minimal Alpine aarch64 rootfs with apk-tools-static, so a cross build needs no root, no qemu and no phone. Adapted from imsd's, plus glib-dev for the bus layer that is coming. Building against a real Alpine sysroot means the binary links dynamically against the phone's own musl and libc++ -- libc++, libc++abi, libunwind and libgcc_s are all already on pmOS. The harness this daemon replaces had to be built -static, but only because it was built with the host's glibc toolchain; that constraint was never about the target. The pipeline is proven end to end rather than assumed: the cross-built binary runs on the phone, and all five core suites pass there too -- on the real hardware, not just under qemu-aarch64. That matters for modules that are almost entirely little-endian field packing and offset arithmetic.
2026-09-02 17:34:27 +02:00
#!/bin/sh
# SPDX-License-Identifier: GPL-3.0-only
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
# make-sysroot.sh — build an Alpine aarch64 sysroot for cross-compiling
# fingerprintd.
#
# Downloads apk-tools-static + the Alpine signing keys from the CDN and
# populates a minimal rootfs (musl, libc++, glib and their headers) that clang
# can use via --sysroot. No root, no qemu, no device needed:
#
# packaging/make-sysroot.sh [dir] # default: ~/.cache/fingerprintd/sysroot-aarch64-alpine
# crafter-build -- --target=aarch64-alpine-linux-musl --sysroot=<dir> \
# --march=armv8-a --mtune=generic
#
# Cross-building against a real Alpine sysroot is why the binary links
# DYNAMICALLY against the phone's own musl and libc++. The research harness
# this daemon replaces had to be built -static, but only because it was built
# with the host's glibc toolchain; that constraint does not apply here.
set -eu
SYSROOT="${1:-$HOME/.cache/fingerprintd/sysroot-aarch64-alpine}"
MIRROR="${MIRROR:-https://dl-cdn.alpinelinux.org/alpine/edge}"
ARCH=aarch64
# gcc is in the list for its crtbeginS.o/libgcc: clang's driver for
# *-alpine-linux-musl links against the GCC runtime it detects under
packaging, ci: build the apk with the Crafter.Build Flatpak Crafter.Build's releases carry a Flatpak and nothing else since 2026-10-02 (imsd a625248): the rolling `latest` release's crafter-build-linux-x86_64-musl-v2.tar.gz that build-package.sh fetched is gone, so the push of 0.2.6 failed at `fetch crafter-build` (run 10, 2026-10-14, three 404s) and published nothing; the registry still serves 0.2.5. The move imsd made on 2026-10-04: install the Flatpak (net.catcrafts.CrafterBuild//stable from flatpak.catcrafts.net) in the job container and run it as crafter-build. bubblewrap inside the container needs a privileged runner, so the job runs on the `flatpak` label. The host keeps clang and llvm-ar for libqcomtee, which make-libqcomtee.sh compiles against the sysroot; the daemon's compiler, lld and libc++ are the Flatpak's, so the host packages that served the native test-suite run go. The sysroot gains llvm-runtimes, the package with the std module source of its own libc++ (libc++-dev ships none), added with --upgrade so a sysroot from before this change comes out with a matching libc++ and source. The README's Build section carries the install lines. Tested: build-package.sh run end to end on this commit in a privileged alpine:edge container (podman) on the workstation: crafter-build 2.1.0 (clang 23.1.2) from `stable`, the sysroot at libc++ and llvm-runtimes 23.1.3, daemon and agent cross-built, 8 suites passed natively, the three apks built, the daemon an aarch64 PIE against the sysroot's musl and libc++ (65 s). The rehearsed copy differs from this commit by the wrapping of one comment line.
2026-10-14 02:32:30 +02:00
# <sysroot>/usr/lib/gcc/<triple>/. llvm-runtimes is in it for the std module
# source of this very libc++ (usr/share/libc++/v1/std.cppm; libc++-dev ships
# none): crafter-build compiles the sysroot's own copy first. --upgrade below
# is for a run over an existing sysroot: added alone beside an older libc++,
# a newer llvm-runtimes' source does not compile against its headers
# (imsd, 2026-10-04: 23.1.2 against 22.1.8); upgraded together, it does.
Add the cross-build sysroot recipe, verified on the device packaging/make-sysroot.sh populates a minimal Alpine aarch64 rootfs with apk-tools-static, so a cross build needs no root, no qemu and no phone. Adapted from imsd's, plus glib-dev for the bus layer that is coming. Building against a real Alpine sysroot means the binary links dynamically against the phone's own musl and libc++ -- libc++, libc++abi, libunwind and libgcc_s are all already on pmOS. The harness this daemon replaces had to be built -static, but only because it was built with the host's glibc toolchain; that constraint was never about the target. The pipeline is proven end to end rather than assumed: the cross-built binary runs on the phone, and all five core suites pass there too -- on the real hardware, not just under qemu-aarch64. That matters for modules that are almost entirely little-endian field packing and offset arithmetic.
2026-09-02 17:34:27 +02:00
# glib-dev is for the GDBus bus layer (net.reactivated.Fprint).
packaging, ci: build the apk with the Crafter.Build Flatpak Crafter.Build's releases carry a Flatpak and nothing else since 2026-10-02 (imsd a625248): the rolling `latest` release's crafter-build-linux-x86_64-musl-v2.tar.gz that build-package.sh fetched is gone, so the push of 0.2.6 failed at `fetch crafter-build` (run 10, 2026-10-14, three 404s) and published nothing; the registry still serves 0.2.5. The move imsd made on 2026-10-04: install the Flatpak (net.catcrafts.CrafterBuild//stable from flatpak.catcrafts.net) in the job container and run it as crafter-build. bubblewrap inside the container needs a privileged runner, so the job runs on the `flatpak` label. The host keeps clang and llvm-ar for libqcomtee, which make-libqcomtee.sh compiles against the sysroot; the daemon's compiler, lld and libc++ are the Flatpak's, so the host packages that served the native test-suite run go. The sysroot gains llvm-runtimes, the package with the std module source of its own libc++ (libc++-dev ships none), added with --upgrade so a sysroot from before this change comes out with a matching libc++ and source. The README's Build section carries the install lines. Tested: build-package.sh run end to end on this commit in a privileged alpine:edge container (podman) on the workstation: crafter-build 2.1.0 (clang 23.1.2) from `stable`, the sysroot at libc++ and llvm-runtimes 23.1.3, daemon and agent cross-built, 8 suites passed natively, the three apks built, the daemon an aarch64 PIE against the sysroot's musl and libc++ (65 s). The rehearsed copy differs from this commit by the wrapping of one comment line.
2026-10-14 02:32:30 +02:00
PKGS="musl-dev libc++ libc++-dev llvm-runtimes glib-dev compiler-rt llvm-libunwind-dev gcc"
Add the cross-build sysroot recipe, verified on the device packaging/make-sysroot.sh populates a minimal Alpine aarch64 rootfs with apk-tools-static, so a cross build needs no root, no qemu and no phone. Adapted from imsd's, plus glib-dev for the bus layer that is coming. Building against a real Alpine sysroot means the binary links dynamically against the phone's own musl and libc++ -- libc++, libc++abi, libunwind and libgcc_s are all already on pmOS. The harness this daemon replaces had to be built -static, but only because it was built with the host's glibc toolchain; that constraint was never about the target. The pipeline is proven end to end rather than assumed: the cross-built binary runs on the phone, and all five core suites pass there too -- on the real hardware, not just under qemu-aarch64. That matters for modules that are almost entirely little-endian field packing and offset arithmetic.
2026-09-02 17:34:27 +02:00
work=$(mktemp -d)
trap 'rm -rf "$work"' EXIT
fetch_pkg() { # $1 = repo (main/community), $2 = package name -> path on stdout
file=$(curl -fsSL "$MIRROR/$1/x86_64/" |
grep -o "href=\"$2-[0-9][^\"]*\.apk\"" | head -n1 | cut -d'"' -f2)
[ -n "$file" ] || { echo "cannot find $2 in $MIRROR/$1" >&2; exit 1; }
curl -fsSL -o "$work/$file" "$MIRROR/$1/x86_64/$file"
echo "$work/$file"
}
echo ">> fetching apk-tools-static + alpine-keys"
tar -xzf "$(fetch_pkg main apk-tools-static)" -C "$work" sbin/apk.static 2>/dev/null
tar -xzf "$(fetch_pkg main alpine-keys)" -C "$work" usr/share/apk/keys 2>/dev/null
echo ">> populating $SYSROOT ($ARCH: $PKGS)"
mkdir -p "$SYSROOT"
"$work/sbin/apk.static" \
--arch "$ARCH" --root "$SYSROOT" --initdb --no-scripts --no-cache \
--usermode --keys-dir "$work/usr/share/apk/keys/$ARCH" \
-X "$MIRROR/main" -X "$MIRROR/community" \
packaging, ci: build the apk with the Crafter.Build Flatpak Crafter.Build's releases carry a Flatpak and nothing else since 2026-10-02 (imsd a625248): the rolling `latest` release's crafter-build-linux-x86_64-musl-v2.tar.gz that build-package.sh fetched is gone, so the push of 0.2.6 failed at `fetch crafter-build` (run 10, 2026-10-14, three 404s) and published nothing; the registry still serves 0.2.5. The move imsd made on 2026-10-04: install the Flatpak (net.catcrafts.CrafterBuild//stable from flatpak.catcrafts.net) in the job container and run it as crafter-build. bubblewrap inside the container needs a privileged runner, so the job runs on the `flatpak` label. The host keeps clang and llvm-ar for libqcomtee, which make-libqcomtee.sh compiles against the sysroot; the daemon's compiler, lld and libc++ are the Flatpak's, so the host packages that served the native test-suite run go. The sysroot gains llvm-runtimes, the package with the std module source of its own libc++ (libc++-dev ships none), added with --upgrade so a sysroot from before this change comes out with a matching libc++ and source. The README's Build section carries the install lines. Tested: build-package.sh run end to end on this commit in a privileged alpine:edge container (podman) on the workstation: crafter-build 2.1.0 (clang 23.1.2) from `stable`, the sysroot at libc++ and llvm-runtimes 23.1.3, daemon and agent cross-built, 8 suites passed natively, the three apks built, the daemon an aarch64 PIE against the sysroot's musl and libc++ (65 s). The rehearsed copy differs from this commit by the wrapping of one comment line.
2026-10-14 02:32:30 +02:00
add --upgrade $PKGS
Add the cross-build sysroot recipe, verified on the device packaging/make-sysroot.sh populates a minimal Alpine aarch64 rootfs with apk-tools-static, so a cross build needs no root, no qemu and no phone. Adapted from imsd's, plus glib-dev for the bus layer that is coming. Building against a real Alpine sysroot means the binary links dynamically against the phone's own musl and libc++ -- libc++, libc++abi, libunwind and libgcc_s are all already on pmOS. The harness this daemon replaces had to be built -static, but only because it was built with the host's glibc toolchain; that constraint was never about the target. The pipeline is proven end to end rather than assumed: the cross-built binary runs on the phone, and all five core suites pass there too -- on the real hardware, not just under qemu-aarch64. That matters for modules that are almost entirely little-endian field packing and offset arithmetic.
2026-09-02 17:34:27 +02:00
echo ">> done: $SYSROOT"
Reference in a new issue Copy permalink