drm: harden the libdrmtap source pin

1- verify the commit-SHA pin on a reused checkout too, not only on a fresh clone:
a stale or mismatched third_party/libdrmtap (e.g. from a failed clone) is now
removed and the build fails instead of silently reusing unpinned source.
2- default DRMTAP_REPO to the fork that actually publishes the pinned tag, so a
clean git clone --branch v0.4.13 resolves (and to the expected commit) instead of
failing on a repo that does not carry the tag.

.github/workflows/flutter-build.yml

@@ -1706,7 +1706,9 @@ jobs:
               # against the pinned immutable commit DRMTAP_SHA after clone (below). The drm backend
               # has NO libdrmtap-sys Cargo dependency: rustdesk dlopens this .so at runtime
               # (drmtap_dl.rs checks ABI-major). Keep DRMTAP_SHA in sync with the tag on every bump.
-              export DRMTAP_REPO="https://github.com/rustdesk-org/libdrmtap"
+              # Source-of-truth fork that publishes the pinned tag (rustdesk-org syncs from it; switch
+              # this once rustdesk-org carries v0.4.13).
+              export DRMTAP_REPO="https://github.com/fxd0h/libdrmtap"
               export DRMTAP_REF="v0.4.13"
               export DRMTAP_SHA="${DRMTAP_SHA:-c9cf0938f3b10a3d4a9eeb9c6f97aaa1606c6b4a}"
               # Guard: refuse a loose/branch ref so a moving `main` can never silently

build.py

@@ -341,7 +341,9 @@ def ffi_bindgen_function_refactor():
 # libdrmtap-sys crate (whose build.rs would statically link the C tree, a helper and
 # libdrm/seccomp/cap). Override the repo/ref via env (DRMTAP_REPO / DRMTAP_REF) for
 # local testing or another fork.
-LIBDRMTAP_REPO = os.environ.get('DRMTAP_REPO', 'https://github.com/rustdesk-org/libdrmtap')
+# Source-of-truth fork that publishes the pinned release tag (rustdesk-org syncs from it; point
+# DRMTAP_REPO there once it carries the tag).
+LIBDRMTAP_REPO = os.environ.get('DRMTAP_REPO', 'https://github.com/fxd0h/libdrmtap')
 LIBDRMTAP_REF = os.environ.get('DRMTAP_REF', 'v0.4.13')
 # The immutable commit the release tag must resolve to. `git clone --branch` follows a mutable tag,
 # so verifying this after clone catches a moved/compromised tag swapping the .so. Keep in sync with
@@ -383,12 +385,19 @@ def build_libdrmtap_so():
             shutil.rmtree(src)
         os.makedirs(os.path.dirname(src), exist_ok=True)
         system2(f'git clone --depth 1 --branch {LIBDRMTAP_REF} {LIBDRMTAP_REPO} {src}')
+    # Verify the immutable-commit pin on BOTH a fresh clone AND a reused checkout: a stale or
+    # mismatched third_party/libdrmtap left by an earlier/failed clone must not be built. On a
+    # mismatch, remove it and fail; the next run re-clones cleanly.
+    try:
         got_sha = subprocess.check_output(
             ['git', '-C', src, 'rev-parse', 'HEAD']).decode().strip()
-        if got_sha != LIBDRMTAP_SHA:
-            raise Exception(
-                f'libdrmtap {LIBDRMTAP_REF} resolved to {got_sha}, expected {LIBDRMTAP_SHA} '
-                f'(moved/compromised tag?)')
+    except Exception:
+        got_sha = None
+    if got_sha != LIBDRMTAP_SHA:
+        shutil.rmtree(src, ignore_errors=True)
+        raise Exception(
+            f'libdrmtap {LIBDRMTAP_REF} at {src} is {got_sha}, expected {LIBDRMTAP_SHA} '
+            f'(moved/compromised tag or stale checkout; removed, re-run to re-clone)')
     build_dir = os.path.join(src, 'build-pkg')
     if not os.path.exists(os.path.join(build_dir, 'build.ninja')):
         system2(f'meson setup {build_dir} {src} --buildtype=release')