Hardening consulting

Release of Accendino 0.6.2

A new version of accendino is out, 0.6.2. It bundles the work accumulated since 0.6.0 (which introduced toolchain support and building under msys2), going through an intermediate 0.6.1. As a reminder, accendino is a project that lets you specify how to build a piece of software and its dependencies in a multi-platform way (at least Windows, Linux, partially Mac, a bit of FreeBSD), building it while making the best use of the bricks already installable on the system (if a package is available, we use it, otherwise we build it). It also tries as much as possible to support MinGW, to allow cross-building for Windows from Linux or other unixes. On the menu for these changes: the ability to build the wayvnc project with all its dependencies, the FreeRDP build gaining features to keep up with the master branch, and of course several fixes and improvements.


What's new since 0.6.0

The FreeRDP build gets richer

Several artifacts were added to enrich the FreeRDP build:

  • added support for SDL3, so sdl-freerdp is now built by default with SDL3 as the client graphical backend;
  • added fido2, to get webauthn redirection;
  • added libyuv, now used by FreeRDP;
  • a bunch of libraries I use on other projects and wanted to be able to build easily (spdlog, cpr, redis, ...)

A newcomer: wayvnc

A lot of work went into the accendino files to make it possible to build wayvnc, so many new .accendino files were also added to cover the necessary dependencies. Existing files were also reworked, since among wayvnc's dependencies we need some of the latest versions of a bunch of projects, and even on an Ubuntu 24.04 the versions shipped with the system are too old.

So we needed to be able to "force" building a dependency from source (without going through an options file) from another accendino file. The new stdBuildFromSourceTest(key: str, locals, defaultVal: bool) function automates this test: it starts by checking whether the <key>_forceBuild variable exists (set by a previously included accendino file), it also checks if in the key section of the options file, the fromSources entry is set to true, this determines if this artifact should be built from sources.

For instance the wayland-protocols.accendino file looks like:

wayland_protocols_fromSources = stdBuildFromSourceTest('wayland_protocols', locals(), False)
if wayland_protocols_fromSources:
    wayland_protocols_pkgDeps = {
        #UBUNTU_LIKE: ['libxcb-xkb-dev'],
    }

    ARTIFACTS += [
        MesonBuildArtifact('wayland-protocols', ['wayland-artifact'],
            stdGitSourceFromOptions('wayland-protocols', 'https://gitlab.freedesktop.org/wayland/wayland-protocols.git', 'main'),
            mesonOpts=[],
            pkgs=wayland_protocols_pkgDeps,
            provides=['wayland-protocols-artifact'],
            mesonVersion='latest'
        ),
    ]

else:
    wayland_protocols_pkgDeps = {
        UBUNTU_LIKE: ['wayland-protocols'],
        # REDHAT_LIKE: ['xkbcommon-devel'],
    }

    ARTIFACTS += [
        DepsBuildArtifact('wayland-protocols-artifact', [], pkgs=wayland_protocols_pkgDeps)
    ]

And in the wlroots.accendino that needs a fresh wayland protocols package on Ubuntu older than 26.04 we have:

...

if checkDistrib('<= Ubuntu 24'):
    wayland_protocols_forceBuild=True
include('wayland-protocols')

...

A couple of handy helpers

  • stdGitSourceFromOptions: a shortcut to create a standard git source that takes the options file into account, so we stop repeating the same code in every .accendino file. It automates the optional configuration of the git repo's URL and tag from the options file;
  • RemoteArchiveSource can now handle archives whose useful content is stored in a subdirectory that needs to be extracted (useful for libressl for example).

Robustness and fixes

  • fixed pkg-config files precedence: packages deployed by accendino in its deploy directory now correctly take priority over the system ones, avoiding picking up the wrong version of a library;
  • ability to specify which meson version to use, since quite a few projects require a relatively recent version of meson and the system's version is sometimes too old;
  • fixed a bug in version comparison;
  • a fix for building FreeRDP on Ubuntu 22.04: we need to build libcbor and fido2 from source since the versions shipped by the system are too old;
  • a whole bunch of fixes for macOS. For instance, toolchain detection: it was identified as Gcc by default while cc/gcc are actually aliases for clang. We also need to force building zlib from source, otherwise some artifacts like fido2 fail because they look for the .pc file which isn't available on Mac.

New command line options

I sometimes use accendino in "development mode", meaning I use accendino to pull down a package and its dependencies, and end up editing the sources directly, so I need to rebuild.

To make life easier in that case I added 2 command line options:

  • --refreshSources: forces updating the git sources to the end of the branch, and rebuilds the artifacts (and their dependents) whose sources actually changed. For artifacts pulling their sources from a maintenance or development branch, this lets you fetch the latest version and rebuild the artifact and its dependents, whereas before, you had to do this by hand and go deleting the build stamp files;
  • there's also --refresh which forces rebuilding the requested targets, even if they were already built. This is handy when developing in the source directories pulled down by accendino.

Conclusion

Nothing revolutionary on the API side compared to 0.5.x, but a nice batch of new building blocks available (SDL3, fido2, libyuv, wayvnc) and, more importantly, fixes that make builds more reliable across distributions. It's becoming very interesting to use.