Fix build pipeline: sandbox handling, source mirrors, cache pulls, prefix staging - #4
Fix build pipeline: sandbox handling, source mirrors, cache pulls, prefix staging#4marvin1099 wants to merge 9 commits into
Conversation
e1582fb to
8106fa7
Compare
b3d8298 to
f3fa1a1
Compare
|
@marvin1099 I'm just trying to resolve a circular dependency bug with the aliases, which I think I expected from my previous experience with that source, but let me check with my team... |
|
Was the "Fix: Force WINEARCH=win64" change a test as well, should i not have included ? |
75eeff2 to
f3fa1a1
Compare
|
Backed up 75eeff2 in fix/build-pipeline-s if you still need it. |
The first thing was necessary for the timebeing, as I plan to use As for the smoke test breakage, I think I have a fix, but I need to wait until Monday when I can ask my colleague. |
Include the freedesktop-sdk mirror definitions so git_repo sources on gcc.gnu.org / sourceware.org fall back to the freedesktop-sdk GitLab mirrors when upstream returns HTTP 429. Pin the mingw gcc refs to the official releases/gcc-14.3.0 tag commit, which exists in the mirror (the previous -704 snapshot commit does not).
The public artifact cache has no bootstrap artifacts for 25.08.11, so every build had to compile the bootstrap from scratch. 25.08.16 pulls cleanly from cache.freedesktop-sdk.io. Bump the rust-mingw source to 1.95.0 to match the rustc shipped by the new sdk; rust's bootstrap refuses hosts newer than its own version.
Depending on the i686 cross-compilers with build scope staged the whole
i686 userspace onto / (33k overlapping files), which is fatal under the
project's overlaps fatal-warning. Nothing in this element compiles
Linux code - Proton is prebuilt - so drop gnutls/gcc-i686 and keep
exactly what running Proton's 32-bit wine binaries needs:
- standard-libs-i686: i686 glibc multiarch dirs + ld-linux.so.2 loader
- new components/i686-wine-libs.bst: filter exposing only the gcc-libs
runtime split (libgcc_s/libstdc++) of the i686 junction, without its
runtime closure
Also fix trainer-monitor installation: ${prefix-root} is shell syntax
and expands to nothing, installing the exe outside install-root where
it was silently dropped from the artifact. Use %{prefix-root}.
Fill in version, SHA256 and download URL instead of empty strings so the element graph resolves out of the box.
The AppArmor sysctls do not exist on older kernels or inside unprivileged containers, so tolerate their failure instead of aborting. Add a fail-fast step that runs a trivial bubblewrap bind before any build starts and reports a clear error when user namespaces are blocked (e.g. act/docker without --privileged).
Runs on push/PR/manual: installs the CI dependency set, lifts AppArmor restrictions, verifies the bubblewrap sandbox, updates the Proton config from pinned version+SHA256 (no large download), resolves the element graph and builds the cheap winetricks element as a real sandboxed fetch/build/cache round-trip. Validated locally with act --privileged.
bubblewrap is required by BuildStream to sandbox builds; buildstream-plugins provides the autotools element and git/patch sources loaded via origin: pip in project.conf.
- WINEARCH is win32 and STEAM_COMPAT_CLIENT_INSTALL_PATH points to /tmp/steam-dummy - build-prefix.yml was renamed build-matrix.yml long ago; list the reusable build-version.yml and the new smoke-test.yml - document that building from an NTFS/fat checkout breaks artifact cache sharing: such mounts report mode 0777 for every file, which changes the CAS digests of local sources and diverges every subproject key from cache.freedesktop-sdk.io
f3fa1a1 to
4570368
Compare
2 participants
I let AI (Big Pickle - OpenCode Zen) try to find out why the building problems (sandbox problems) came from; this is the fix it came up with. Feel free to cherry-pick if need be.
What was actually broken
--privilegedis required. CI now tolerates missing sysctls and fail-fasts with a clear error when bwrap is unusable.fatal-warnings: [overlaps]): the i686 cross-compilers deps staged the entire i686 userspace onto/(33k overlapping files). Nothing here compiles Linux code, so that block is replaced by exactly what Proton's 32-bit wine binaries need:standard-libs-i686(glibc multiarch + ld-linux.so.2) and a new filter elementi686-wine-libs(libgcc_s/libstdc++ without glibc closure).${prefix-root}is shell syntax and expands to nothing; fixed to%{prefix-root}.Testing
bst build deploy/prefix.bstsucceeds end-to-end: ~134 elements pulled from cache.freedesktop-sdk.io, mingw GCC + rust std built, wineboot + winetricks (sdl, vkd3d, dxvk2030, dotnet48) install headlessly, trainer-monitor.exe lands inC:\windows.act --privileged(all 8 steps).Commits are split into logical chunks.
You don't have to use it of course i just felt like it.