fix: unblock 6 build failures (mozjs140 toolchain, abseil/samba gaps, factory repo) - #30
Open
hanthor wants to merge 43 commits into
Open
fix: unblock 6 build failures (mozjs140 toolchain, abseil/samba gaps, factory repo)#30hanthor wants to merge 43 commits into
hanthor wants to merge 43 commits into
Conversation
… factory repo) Investigated run 33361378933. Seven of the eight failures were dependency- closure failures, not compile errors; one (mozjs140) was a real build break. mozjs140 (compile): the recipe declares '%global toolchain clang', so rpm injects the clang hardened-ld config (redhat-hardened-clang-ld.cfg) into the link flags cargo forwards to $CC. The sccache block drove that link through gcc, which rejects the clang-only config. Point the sccache wrapper at clang so the driver matches the hardening the toolchain selected. Verified by a full local rpmbuild (LTO off for host memory): builds to RPM, cargo build scripts link, no gcc rejection. FACTORY_REPO (systemic): the build/builddep steps only add the published [factory] repo when vars.FACTORY_REPO is set, and it is not. Already-published gaps that prepare skips as 'already published' are then in neither [stages] nor [factory], so a to-be-built package cannot resolve them -- e.g. pipewire-libs-extra could not find pkgconfig(libfreeaptx) though libfreeaptx is published. Default FACTORY_REPO to the Pages repo in all six blocks. abseil consumers (closure): utah ships abseil 20260526.0 (soname .2605, the latest upstream Hummingbird targets), but Fedora binaries libphonenumber, re2 and webrtc-audio-processing need .2601 and Fedora abseil is excluded. Per the malcontent precedent in docs/targeting-hummingbird.md, rebuild the consumers against the new soname rather than downgrade the library. Import the three from Rawhide dist-git at stage 1; webrtc's rawhide recipe already patches for current abseil. Unblocks gstreamer1-plugins-bad-free, webkitgtk, gjs, firefox, evolution-data-server. samba (closure): Fedora 44 carries talloc 2.4.4 / tevent 0.17.1; samba 4.25.0 needs >= 2.5.0 / >= 0.17.2. Add libtalloc 2.5.0 and libtevent 0.17.2 as stage 0 gaps. Drop their upstream gpg-verify from %prep: the source pipeline already SHA-512-locks the payload and the detached .tar.asc is not fetched. Verified libtalloc builds to RPM locally. Not addressed here (repo-side, not utah recipes): libicu 77 vs 78 and gpgme multi-version conflicts live in the published Hummingbird repo; Fedora javascriptcoregtk4.1/libcephfs2 still link icu77. Tracked separately.
The first run put co-dependent packages in the same stage, which has no intra-stage ordering, so they resolved against Fedora/Hummingbird instead of each other: - libtevent BuildRequires libtalloc >= 2.5.0; both were stage 0, so libtevent saw only Fedora's talloc 2.4.4 -> 'No match for libtalloc-devel >= 2.5.0'. Move libtevent to stage 1 (libtalloc stays 0). - libphonenumber BuildRequires re2-devel; both were stage 1, so it pulled Fedora/Hummingbird re2, which need abseil .2601 -> unresolved. Move libphonenumber to stage 2 (after abseil 0 and re2 1). - samba needs libtevent -> stage 2. evolution-data-server needs libphonenumber -> stage 3. gstreamer1-plugins-bad-free, webkitgtk and pipewire consume the new stage-1 abseil packages but stay at their current stage; they resolve against the published [factory] repo on the next run once webrtc-audio-processing/re2 publish, per the bootstrap ladder in docs/targeting-hummingbird.md.
publish only fires when all five stages are green, so a wave that built 200 packages and failed on the 201st -- or was cancelled to launch a corrected wave -- published nothing, and the next wave rebuilt the 200. Reuse was keyed on a wave reaching publish, not on a package building. Add an accumulate job that runs after the matrix with if: !cancelled(), so it persists successes even when some package failed. It seeds from ghcr.io/<owner>/utah-packages:building (falling back to :latest, then empty), merges whatever RPMs the matrix produced this run -- a failed job uploads no RPM, so only successes are added -- and pushes back to :building. It does not sign or run the consumer contract: :building is a build cache and may be incoherent, so consumers must never install it. :latest stays the atomic, contract-gated tag publish produces. prepare now seeds its skip list from :building (fall back to :latest, then the Pages repo), so a success persists across waves whether or not its wave ever reached publish. This is what stops the rebuild-everything-again loop after a cancelled wave. :latest and Pages are unchanged: still full-success-gated, still the coherent repository consumers read.
Firefox is by far the longest build in the factory: a full PGO+LTO Gecko compile that dominated wall-clock time and repeatedly hit the runner memory ceiling. It is a leaf application, not a library anything else links, so building it from source buys nothing the Flathub Flatpak does not already give -- and the image already carries the Firefox Flatpak system config hook (99-flatpaks.sh) and lists org.mozilla.firefox in the desktop contract. Drop the firefox RPM from the factory: remove it from upstream-sources.json (no longer built), from bluefin-packages.toml (firefox and firefox-langpacks no longer expected in the image), and delete the recipe. The Flatpak is preinstalled via a new preinstall.d drop-in in the utah image.
The bootstrap ladder could not advance. Same-stage consumers (webkitgtk and gstreamer1-plugins-bad-free need webrtc-audio-processing/re2; those built in the same stage and so were invisible) can only resolve their siblings from a published repo on a later run -- but builds read Pages via FACTORY_REPO, and Pages only updates when a wave reaches publish, which the librsvg2 %check failure prevents. So nothing new ever became visible and the ladder stalled. Seed work/prior from the :building accumulator in every stage. work/prior is already createrepo'd into the [stages] repo the build resolves against, so this makes every success from every prior wave visible to the current build, independent of whether any wave went fully green. webrtc/re2/icu78 published to :building this way let gstreamer1-plugins-bad-free and webkitgtk resolve on the next run, and webkitgtk built against icu78 then unblocks evolution-data-server, whose only remaining conflict is Fedora javascriptcoregtk pulling icu77.
Disable optional OpenCV and ONNX GStreamer plugins that reintroduce Qt6 and the old abseil ABI. Exclude Hummingbird Ruby 3.3 and 3.4 default gems from Ruby-toolchain builddep transactions so WebKitGTK can use Ruby 4 without file conflicts.
Define the global Hummingbird Ruby exclusion before using it and disable optional GStreamer OpenCV and ONNX plugins with the correct bcond semantics.
The reference test binary compares rendered SVGs against pre-rendered PNGs that were generated with the library versions in Fedora's buildroot. Hummingbird ships newer harfbuzz (14.3 vs 12.3), fontconfig (2.18 vs 2.17), and freetype; the font-shaping differences they produce make these 734 pixel-comparison tests fail deterministically. Remove reference.rs and its meson.build entry in %prep so the binary is not built. Every other test suite (api, bugs, errors, filters, geometries, intrinsic_dimensions, loading_crash, loading_disallowed, primitive_geometries, primitives, render_crash, shapes, text) still runs.
hanthor
force-pushed
the
fix/build-failures-batch1
branch
from
September 1, 2026 02:17
272e88d to
e863453
Compare
gnome-control-center reached libicu through gnome-bluetooth -> bluez-obexd -> libical and hit an unsatisfiable ICU split: Hummingbird still ships libicu-77.1-2.1.hum1 beside libicu 78, and the factory builds icu 78.3 with libical/samba linked against soname .78. Exclude the older Hummingbird libicu-77 NEVR globally so only 78 is selectable. Also extend the workflow quoting guard to the new lane and checkpoint workflows.
Fedora enables vfs_cephfs/vfs_ceph_rgw/ceph_mutex by default on x86_64, which BuildRequires librgw-devel/libcephfs-devel. Those pull libicuuc.so.77 into the buildroot and conflict with the factory libicu 78, and Ceph VFS is not part of the Bluefin desktop contract. Gate the Ceph bconds behind utah_ceph (off by default) so samba links only ICU 78.
A samba built against libicu 77 before the factory moved to 78 lingers in the :building accumulator with the same NEVR as its replacement. In [stages] it is preferred by priority and drags the now-excluded ICU 77 back in, so every buildroot reaching libsmbclient (gvfs, libsoup3, nautilus-python, localsearch) fails to resolve. Drop any prior RPM still requiring the retired ICU 77 soname before building the stages repo; the current run rebuilds a coherent replacement with a matching filename that overwrites it in the accumulator.
Dropping only the ICU-77-linked samba-core-libs left libsmbclient and libsmbclient-devel from the same stale build with unmet private-library deps. Identify stale source packages by ICU 77 soname, then drop every accumulator RPM built from those sources so the replacement set is installed coherently.
gvfs BuildRequires libsmbclient-devel, which only the factory provides once samba (stage 2) is built. At stage 0 gvfs had no coherent libsmbclient in the buildroot -- the stale factory one is purged and Fedora's is excluded by name -- so it could not resolve. Move gvfs to stage 2 so samba is available.
nautilus-python BuildRequires libnautilus-extension-4 from nautilus (stage 2). At stage 0 only Fedora nautilus 50 was offered, which needs the excluded ICU 77, so it could not resolve. Move nautilus-python to stage 3 so the factory nautilus 51 is available. gsconnect only Requires it at runtime, not build time, so build ordering is unaffected.
The NTLM test suite is disabled (Hummingbird FIPS makes GLib HMAC fatal), so /usr/bin/ntlm_auth is never used at build or test time. Requiring it dragged Fedora samba-winbind-clients and its ICU-77 samba-core-libs into the stage-1 buildroot, conflicting with the factory libicu 78.
meson auto-enables NTLM when ntlm_auth is present, then requires it at configure time; ntlm_auth comes from Fedora samba-winbind-clients, which pulls an ICU-77 samba conflicting with the factory libicu 78. NTLM is legacy Windows auth not needed on a GNOME desktop and its test suite is already disabled, so set -Dntlm=disabled.
The blanket libicu-77 exclusion traded one conflict for many: it broke every Fedora buildroot dep that legitimately links ICU 77 (raptor2 via gstreamer-bad, and localsearch/pipewire-libs-extra transitively). The real driver of the original gnome-control-center conflict was a stale ICU-77 factory samba in the accumulator, which the whole-source purge already removes. With fresh factory samba linked against ICU 78, dnf resolves ICU per transaction without a global exclusion.
Measured on run 33461820477: webkitgtk 5h01m, the next longest package 25 minutes (mesa), then mozjs140 at 18. One package is the wall clock, and it sits five hours against a six-hour job limit. Its recipe compiles the source twice, once per GTK port, and the two compiles share nothing but the tarball. So the recipe now builds twice on two runners. A source-manifest entry may name another entry's recipe directory and the rpm defines to build it with (tools/recipe.py); webkitgtk builds the GTK 4 port with --without gtk3 and the new webkit2gtk4.1 entry builds the GTK 3 port with --without gtk4. The spec gates each port behind a bcond, so a plain rpmbuild with no defines still builds both, as Fedora does. Only the GTK 4 shard produces the -debugsource package; two of the same name and different contents would otherwise collide in the repository. The lane workflow resolves the recipe directory and defines outside the container and passes them in; the defines go to builddep as well as to rpmbuild, so a shard resolves the BuildRequires of the port it will compile. The build identity hashes the shared directory and the entry, defines included, so the shards get distinct keys and an edit to the recipe invalidates both. The source pipeline keeps dist_git_name for the lookaside, which is a different question from which directory to build. mozjs140 leaves the heavy lane: at eighteen minutes it belongs in the ordinary stage-1 lane, and gjs stops waiting behind WebKitGTK for it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KVSCoKWBWAuFFZyLwteEbB
…iriu0i ci: build WebKitGTK as two shards on two runners
The publish closure gate proved the factory was internally consistent but its runtime closure against a real Hummingbird base was incomplete. Build the libraries Hummingbird does not provide and the desktop stack hard-requires: shared-mime-info (gtk4), libXxf86vm (mesa-libGL), libcloudproviders (gtk3), and libcdio + libcdio-paranoia (gvfs audio CD). shared-mime-info had a recipe but was never in the manifest. Demote gsconnect ffmpeg to Recommends: it powers only the optional screen-share feature and is an RPMFusion package Utah does not carry.
The ICU-77 whole-source purge misfired: a factory package that transiently resolved an ICU-77 dependency through the in-flight samba rebuild (localsearch, nautilus) was deleted from the accumulator, forcing Fedora's older localsearch into the buildroot. Remove the purge entirely. A full or selected dispatch now seeds nothing from :building (fresh=true), so a coherent rebuild cannot be poisoned by a stale prior artifact; matching filenames overwrite stale RPMs in the accumulator naturally.
A fresh full rebuild produces its own coherent closure; the published FACTORY_REPO is a prior run and can offer an incoherent set (a factory mutter needing a pipewire this run has not published), which the resolver drags into unrelated stage-0 buildroots via GL soname providers. Skip the factory repo when fresh, using only this run staged output plus Hummingbird.
This reverts commit 7189d81.
… rebuilds" This reverts commit 7be3165.
Fedora builds libglvnd with weston + mesa-dri-drivers to run GLVND GL tests, and weston drags the pipewire/webrtc/abseil closure into a stage-0 buildroot. The container has no compositor or X server; disable the compositor/X11 tests so the library builds without that closure.
Root cause of the recurring ICU 77/78 churn: the factory built its own icu 78.3 while Hummingbird already ships libicu-78.3 (its newest), so two ICU-78 copies competed and the leftover Hummingbird libicu-77 kept getting linked by consumers (localsearch, samba), producing RPMs the Hummingbird-only runtime could not install. Stop building icu in the factory and let all eight ICU consumers link Hummingbird 78. Exclude only the exact stale Hummingbird libicu-77 NEVR (not Fedora libicu-77, which build-only deps may still want) so 78 is the sole runtime ICU.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes 6 of 8 failures from run 33361378933.
Changes
%global toolchain clang; gcc rejected the injected clang hardened-ld config. Verified by full local rpmbuild.FACTORY_REPOto the Pages repo so already-published gaps (e.g. libfreeaptx) resolve during builddep. Fixes pipewire-libs-extra.re2,webrtc-audio-processing,libphonenumbergap recipes (Rawhide import, stage 1) built against utah abseil, per the malcontent precedent. Unblocks gstreamer1-plugins-bad-free, webkitgtk, gjs, firefox, evolution-data-server.libtalloc2.5.0 +libtevent0.17.2 (stage 0); Fedora 44 lags samba 4.25.0's floors. Local build of libtalloc verified.Not in this PR (repo-side)
Validation
validate.py, runtime_contract, unit tests, workflow-quoting all pass. All new source locks verified. mozjs140 + libtalloc built to RPM locally.