From 56ab299d015761ce3b51d41b63fc9effb8aa2b8b Mon Sep 17 00:00:00 2001 From: Mariano Abad Date: Tue, 21 Jul 2026 00:39:42 -0300 Subject: [PATCH] drm: harden the libdrmtap source pin 1- verify the commit-SHA pin on a reused checkout too, not only on a fresh clone: a stale or mismatched third_party/libdrmtap (e.g. from a failed clone) is now removed and the build fails instead of silently reusing unpinned source. 2- default DRMTAP_REPO to the fork that actually publishes the pinned tag, so a clean git clone --branch v0.4.13 resolves (and to the expected commit) instead of failing on a repo that does not carry the tag. --- .github/workflows/flutter-build.yml | 4 +++- build.py | 19 ++++++++++++++----- 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/.github/workflows/flutter-build.yml b/.github/workflows/flutter-build.yml index fa6e60674..94ddd4a79 100644 --- a/.github/workflows/flutter-build.yml +++ b/.github/workflows/flutter-build.yml @@ -1706,7 +1706,9 @@ jobs: # against the pinned immutable commit DRMTAP_SHA after clone (below). The drm backend # has NO libdrmtap-sys Cargo dependency: rustdesk dlopens this .so at runtime # (drmtap_dl.rs checks ABI-major). Keep DRMTAP_SHA in sync with the tag on every bump. - export DRMTAP_REPO="https://github.com/rustdesk-org/libdrmtap" + # Source-of-truth fork that publishes the pinned tag (rustdesk-org syncs from it; switch + # this once rustdesk-org carries v0.4.13). + export DRMTAP_REPO="https://github.com/fxd0h/libdrmtap" export DRMTAP_REF="v0.4.13" export DRMTAP_SHA="${DRMTAP_SHA:-c9cf0938f3b10a3d4a9eeb9c6f97aaa1606c6b4a}" # Guard: refuse a loose/branch ref so a moving `main` can never silently diff --git a/build.py b/build.py index 17eb57913..8d7b11c30 100755 --- a/build.py +++ b/build.py @@ -341,7 +341,9 @@ def ffi_bindgen_function_refactor(): # libdrmtap-sys crate (whose build.rs would statically link the C tree, a helper and # libdrm/seccomp/cap). Override the repo/ref via env (DRMTAP_REPO / DRMTAP_REF) for # local testing or another fork. -LIBDRMTAP_REPO = os.environ.get('DRMTAP_REPO', 'https://github.com/rustdesk-org/libdrmtap') +# Source-of-truth fork that publishes the pinned release tag (rustdesk-org syncs from it; point +# DRMTAP_REPO there once it carries the tag). +LIBDRMTAP_REPO = os.environ.get('DRMTAP_REPO', 'https://github.com/fxd0h/libdrmtap') LIBDRMTAP_REF = os.environ.get('DRMTAP_REF', 'v0.4.13') # The immutable commit the release tag must resolve to. `git clone --branch` follows a mutable tag, # so verifying this after clone catches a moved/compromised tag swapping the .so. Keep in sync with @@ -383,12 +385,19 @@ def build_libdrmtap_so(): shutil.rmtree(src) os.makedirs(os.path.dirname(src), exist_ok=True) system2(f'git clone --depth 1 --branch {LIBDRMTAP_REF} {LIBDRMTAP_REPO} {src}') + # Verify the immutable-commit pin on BOTH a fresh clone AND a reused checkout: a stale or + # mismatched third_party/libdrmtap left by an earlier/failed clone must not be built. On a + # mismatch, remove it and fail; the next run re-clones cleanly. + try: got_sha = subprocess.check_output( ['git', '-C', src, 'rev-parse', 'HEAD']).decode().strip() - if got_sha != LIBDRMTAP_SHA: - raise Exception( - f'libdrmtap {LIBDRMTAP_REF} resolved to {got_sha}, expected {LIBDRMTAP_SHA} ' - f'(moved/compromised tag?)') + except Exception: + got_sha = None + if got_sha != LIBDRMTAP_SHA: + shutil.rmtree(src, ignore_errors=True) + raise Exception( + f'libdrmtap {LIBDRMTAP_REF} at {src} is {got_sha}, expected {LIBDRMTAP_SHA} ' + f'(moved/compromised tag or stale checkout; removed, re-run to re-clone)') build_dir = os.path.join(src, 'build-pkg') if not os.path.exists(os.path.join(build_dir, 'build.ninja')): system2(f'meson setup {build_dir} {src} --buildtype=release')