Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package bun for openSUSE:Factory checked in at 2026-08-24 12:09:59 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/bun (Old) and /work/SRC/openSUSE:Factory/.bun.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "bun" Mon Aug 24 12:09:59 2026 rev:3 rq:1373126 version:1.4.0 Changes: -------- --- /work/SRC/openSUSE:Factory/bun/bun.changes 2026-08-18 16:38:24.873077757 +0200 +++ /work/SRC/openSUSE:Factory/.bun.new.1258/bun.changes 2026-08-24 12:15:16.121777993 +0200 @@ -1,0 +2,47 @@ +Sat Aug 22 13:49:13 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 1.4.0 (from 1.4.0~git20260808.52bf09cb snapshot): + switch Source0 to the bun-v1.4.0 release tarball + * bun pm diff + * Redis/Valkey: bitmap, HyperLogLog, geo, scripting, server + and stream commands + * fetch: park an unread body stream instead of buffering + without bound + * node:crypto: fix abort on shake128/256 digest with a huge + outputLength + * Bun.password: verify argon2 hashes with memoryCost below 8 + again + * Crash/panic fixes: path-length limits, Bun.inspect, sqlite + bind, vm ShadowRealm, HTTP/2, shell, fs.watch + * WebKit 0f966e81 +- Provide bundled(rust-argon2): 1.4.0 vendors it as a workspace + path dependency instead of crates.io 3.0 +- Build the C++ half with the same clang as the C half: Bun's + toolchain resolver version-checks the C compiler but not the + C++ one, so it took the unversioned /usr/bin/clang++ for all of + JavaScriptCore and Bun's own bindings while only the C units + honoured the clang BuildRequires. Prepend a PATH shim in + %%build; CC/CXX were never read by that resolver +- Provide bundled(bcrypt): a crates.io dependency backing + Bun.password's bcrypt algorithm, missing from both sources the + bundled() list is regenerated from +- Recommend libsecret-1-0, which Bun.secrets dlopens, so no ELF + dependency is generated for it +- Exercise bun:sqlite, bun:ffi and the bundled tinycc in %%check + instead of only --help; assert sqlite_version() against the + version bundled(sqlite3) advertises so the two cannot drift +- Anchor the %%check revision match on the release form, which a + bare short-sha substring match would not have caught +- Add bun-system-libs.patch: link zstd, brotli, libdeflate, + libspng, libwebp and libjpeg-turbo from the distribution. These + are the bundled C libraries whose pin is an unmodified upstream + release and that bun reaches through their installed headers. + Drop their bundled() Provides, drop IJG from the License tag + and the x86_64 nasm BuildRequires with them, report the linked + zstd and libdeflate in process.versions instead of the vendored + commit hashes, and check in %%check that all six are in the ELF + dependencies and that each one round-trips +- Add bun-llvm-22.patch: build against LLVM 22, the distribution + default, rather than the pinned 21 + +------------------------------------------------------------------- Old: ---- bun-1.4.0~git20260808.52bf09cb.tar.gz bun-node-modules-1.4.0~git20260808.52bf09cb.tar.zst bun-prefetch-1.4.0~git20260808.52bf09cb.tar.zst bun-vendor-1.4.0~git20260808.52bf09cb.tar.zst webkit-1.4.0~git20260808.52bf09cb.tar.zst New: ---- bun-1.4.0.tar.gz bun-llvm-22.patch bun-node-modules-1.4.0.tar.zst bun-prefetch-1.4.0.tar.zst bun-system-libs.patch bun-vendor-1.4.0.tar.zst webkit-1.4.0.tar.zst ----------(New B)---------- New: dependencies and that each one round-trips - Add bun-llvm-22.patch: build against LLVM 22, the distribution default, rather than the pinned 21 New: bare short-sha substring match would not have caught - Add bun-system-libs.patch: link zstd, brotli, libdeflate, libspng, libwebp and libjpeg-turbo from the distribution. These ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ bun.spec ++++++ --- /var/tmp/diff_new_pack.tUIfoY/_old 2026-08-24 12:15:26.187138251 +0200 +++ /var/tmp/diff_new_pack.tUIfoY/_new 2026-08-24 12:15:26.189138323 +0200 @@ -16,18 +16,18 @@ # -# Bun is being rewritten from Zig to Rust. The last release written in Zig is -# 1.3.14; the first written in Rust will be 1.4.0, which is not tagged yet. -# This packages a snapshot of the Rust rewrite, because the Zig branch is no -# longer developed - there will be no 1.3.15 and no fixes for it. The snapshot -# is a commit upstream's own CI published as a canary build, not an arbitrary -# one. Switch Source0 back to a release tarball once 1.4.0 is tagged. -%define git_commit 52bf09cb1cdbed0fbda4cf576e5d329cf92366ef -%define git_short 52bf09cb -%define git_date 20260808 +# 1.4.0 is the first release written in Rust (1.3.14 was the last in Zig). +# git_commit is the bun-v1.4.0 tag peel, used as GIT_SHA for bun --revision; +# it is not part of the RPM version. +%define git_commit 34cbb9a40b4bd1bd767d134a7065e66c2432a676 +%define git_short 34cbb9a4 # The WebKit revision Source1 was made from, for reference; it is read out of # the Bun tarball by bun_webkit, not set here. -# ddea71318fec9b923465c7c45ded8fa713ca3251 +# 0f966e81b78c84bb23213e391bc679c4ef83e56b +# The SQLite amalgamation in Bun's tree. Used for both the bundled() Provides +# and the %%check that asserts it against sqlite_version(), so the two cannot +# drift apart on a version bump. +%define bundled_sqlite 3.53.2 %define bootstrap_version 1.3.14 %define dl_boot https://github.com/oven-sh/bun/releases/download/bun-v%{bootstrap_version} # Building Bun requires an existing Bun. The build driver runs on Node, but 24 @@ -51,23 +51,24 @@ # slower but keeps the package free of foreign binaries. %bcond_without webkit_source Name: bun -Version: 1.4.0~git%{git_date}.%{git_short} +Version: 1.4.0 Release: 0 Summary: Fast all-in-one JavaScript runtime and toolkit # Bun itself is MIT, but it is one statically linked executable and everything # in the Provides: bundled() list below ends up inside it, so the tag covers the # whole binary. The notable ones are JavaScriptCore and tinycc (LGPL-2.1) and -# the Servo CSS crates (MPL-2.0); IJG comes from libjpeg-turbo, blessing from -# the SQLite amalgamation, Unicode-3.0 from unicode-ident. zstd -# (BSD-3-Clause OR GPL-2.0-only) and picohttpparser (MIT OR Artistic-1.0-Perl) -# are taken under their permissive halves. See LICENSE.md, which upstream keeps -# current, and re-check this on every version bump. +# the Servo CSS crates (MPL-2.0); blessing comes from the SQLite amalgamation, +# Unicode-3.0 from unicode-ident, BSD-3-Clause from lol-html and lsquic. +# picohttpparser (MIT OR Artistic-1.0-Perl) is taken under its permissive half. +# See LICENSE.md, which upstream keeps current, and re-check this on every +# version bump. IJG is gone with libjpeg-turbo, the only thing that carried it, +# now that Patch5 links it from the distribution. # # LGPL-2.1 section 6 is satisfied by shipping the engine's source: WebKit is # Source1 and is part of the src.rpm. -License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND IJG AND LGPL-2.1-or-later AND MIT AND MPL-2.0 AND Unicode-3.0 AND Zlib AND blessing +License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND LGPL-2.1-or-later AND MIT AND MPL-2.0 AND Unicode-3.0 AND Zlib AND blessing URL: https://bun.sh/ -Source0: https://github.com/oven-sh/bun/archive/%{git_commit}.tar.gz#/%{name}-%{version}.tar.gz +Source0: https://github.com/oven-sh/bun/archive/refs/tags/bun-v%{version}.tar.gz#/%{name}-%{version}.tar.gz # JavaScriptCore source. Upstream's fork, at the revision Bun is developed # against; not fetched by Bun's dependency machinery, which expects a manual # clone. Produced by the bun_webkit generator. @@ -129,17 +130,30 @@ # each and drops the rest, leaving .debug_str_offsets entries no unit refers to # any more, and debugedit asserts on the first of those. Patch4: bun-webkit-no-type-units.patch +# Link zstd, brotli, libdeflate, libspng, libwebp and libjpeg-turbo from the +# distribution instead of the vendored copies. These are the bundled C +# libraries whose pin is an unmodified upstream release rather than a fork and +# that Bun reaches through their installed public headers, so each can be +# tracked like any other shared library. See the patch header for the details +# that are specific to each of them. +Patch5: bun-system-libs.patch +# Raise the LLVM version bun pins from 21 to the distribution default. +Patch6: bun-llvm-22.patch BuildRequires: cargo -# LLVM 21.1.x is required and enforced by the build (scripts/build/tools.ts). -BuildRequires: clang21 +# LLVM 22.1.x, per Patch6. scripts/build/tools.ts enforces this for the C +# compiler and the linker only; see the PATH shim in %%build for the C++ +# compiler, which it looks up without a version check. +BuildRequires: clang22 BuildRequires: cmake >= 3.24 BuildRequires: gcc-c++ # Bun patches several of its vendored C dependencies with `git apply`. BuildRequires: git-core -BuildRequires: lld21 -BuildRequires: llvm21 +BuildRequires: lld22 +BuildRequires: llvm22 BuildRequires: ninja BuildRequires: nodejs24 >= 24.3.0 +# WebKit cmake. This is not a Perl package: spec-cleaner --perl explodes +# this into hundreds of perl(...) module BRs and drops git-core. BuildRequires: perl BuildRequires: pkgconfig BuildRequires: python3 @@ -149,40 +163,55 @@ BuildRequires: rust >= 1.97 BuildRequires: unzip BuildRequires: zstd -# Bun is a single statically linked executable and its build system has no -# option to link any of these from the distribution: each is pinned to an exact -# commit, several are upstream forks (boringssl, tinycc, mimalloc, lol-html) -# and the JavaScript engine is a fork of WebKit. Unversioned because upstream -# pins commits rather than releases. Regenerate from bun-prefetch.manifest and -# LICENSE.md on a version bump. +# Unbundled by Patch5. brotlicommon has no header of its own but is a separate +# pkg-config module, and the link line names it. libwebp's sharpyuv needs no +# entry of its own: it is a transitive dependency of libwebp.so. +BuildRequires: pkgconfig(libbrotlicommon) +BuildRequires: pkgconfig(libbrotlidec) +BuildRequires: pkgconfig(libbrotlienc) +BuildRequires: pkgconfig(libdeflate) +BuildRequires: pkgconfig(libturbojpeg) +BuildRequires: pkgconfig(libwebp) +BuildRequires: pkgconfig(libwebpdemux) +BuildRequires: pkgconfig(libwebpmux) +BuildRequires: pkgconfig(libzstd) +BuildRequires: pkgconfig(spng) +# Bun.secrets dlopens libsecret at run time, so no ELF dependency is generated +# for it. Without it that API fails with "libsecret not available"; everything +# else works, hence Recommends rather than Requires. +Recommends: libsecret-1-0 +# Bun is a single statically linked executable and everything still listed here +# ends up inside it. Each is pinned to an exact commit, several are upstream +# forks (boringssl, tinycc, mimalloc, lol-html) and the JavaScript engine is a +# fork of WebKit, so none of them can be unbundled the way the six in Patch5 +# were. Unversioned because upstream pins commits rather than releases. +# Regenerate from bun-prefetch.manifest, LICENSE.md and the crates.io +# dependencies in Cargo.toml on a version bump - the manifest and LICENSE.md +# do not list the Rust crates. +Provides: bundled(bcrypt) = 0.19.0 Provides: bundled(boringssl) -Provides: bundled(brotli) = 1.1.0 Provides: bundled(c-ares) Provides: bundled(hdr_histogram) Provides: bundled(highway) Provides: bundled(libarchive) -Provides: bundled(libdeflate) -Provides: bundled(libjpeg-turbo) -Provides: bundled(libspng) -Provides: bundled(libwebp) Provides: bundled(lol-html) Provides: bundled(ls-hpack) Provides: bundled(ls-qpack) Provides: bundled(lsquic) Provides: bundled(mimalloc) Provides: bundled(picohttpparser) +Provides: bundled(rust-argon2) # bun:sqlite and node:sqlite are built against the SQLite amalgamation in # Bun's own tree. Unbundling is not possible even in principle: the alternative # Bun offers (LAZY_LOAD_SQLITE) is a macOS-only path that dlopens a hardcoded # "libsqlite3.dylib" (src/jsc/bindings/sqlite/lazy_sqlite3.h), so on Linux # there is no configuration that links or loads the system library. -Provides: bundled(sqlite3) = 3.53.2 +Provides: bundled(sqlite3) = %{bundled_sqlite} Provides: bundled(tinycc) Provides: bundled(usockets) Provides: bundled(uwebsockets) Provides: bundled(webkit) Provides: bundled(zlib-ng) -Provides: bundled(zstd) # Upstream supports linux-x64 and linux-arm64 only, and Bun can only be built # where an upstream bootstrap binary is published for the same architecture. ExclusiveArch: x86_64 aarch64 @@ -201,7 +230,7 @@ runner, and Node.js-compatible package manager. %prep -%autosetup -p1 -n %{name}-%{git_commit} +%autosetup -p1 -n %{name}-bun-v%{version} # JavaScriptCore. Bun's build expects a manual checkout here. mkdir -p vendor/WebKit @@ -223,11 +252,17 @@ # in it already chooses at run time. find . -path '*/node_modules/.bin/esbuild' -exec ln -sf ../esbuild/bin/esbuild {} \; -# lol-html is both a download and a Rust path dependency of the workspace, so -# it has to be unpacked before cargo can read the manifest. -mkdir -p vendor/lolhtml +# lol-html and rust-argon2 are both downloads and Rust path dependencies of +# the workspace, so they have to be unpacked before cargo can read the +# manifest. rust-argon2 was a crates.io dep in the snapshot; 1.4.0 vendors +# it to apply patches/rust-argon2/legacy-low-memory.patch (Bun.password +# still verifies argon2 hashes with memoryCost below 8). +mkdir -p vendor/lolhtml vendor/rust-argon2 tar -xzf "prefetch/by-url/$(grep -F 'oven-sh/lol-html' prefetch/manifest.sha256 | cut -d' ' -f1)" \ -C vendor/lolhtml --strip-components=1 +tar -xzf "prefetch/by-url/$(grep -F 'sru-systems/rust-argon2' prefetch/manifest.sha256 | cut -d' ' -f1)" \ + -C vendor/rust-argon2 --strip-components=1 +patch -p1 -d vendor/rust-argon2 < patches/rust-argon2/legacy-low-memory.patch %if %{with bootstrap} mkdir -p bootstrap @@ -259,11 +294,36 @@ %endif %build -export CC=clang-21 -export CXX=clang++-21 -export AR=llvm-ar-21 -export RANLIB=llvm-ranlib-21 +# Bun resolves its own toolchain (scripts/build/tools.ts) and never reads CC, +# CXX, AR or RANLIB - those are for the cc crate in the Rust workspace. Its +# resolver looks up "clang" with a version check, so an unversioned clang of a +# different major is rejected and clang-22 is found instead; but it looks up +# "clang++" with checkVersion:false ("clang++ is the same binary from the same +# install", which does not hold here) and takes the first hit in PATH. +# /usr/bin/clang++ is whatever major the unversioned clang package currently +# points at, so every C++ unit - JavaScriptCore and Bun's own bindings alike - +# can end up built by a different compiler than the C units. Put the right one +# first in PATH; the resolver tries each name across all of PATH before moving +# to the next name variant, so this wins. It is needed even while 22 is the +# distribution default, because that default moves on its own. +mkdir -p _clangshim +ln -sf %{_bindir}/clang-22 _clangshim/clang +ln -sf %{_bindir}/clang++-22 _clangshim/clang++ +export PATH="$PWD/_clangshim:$PATH" +# llvm-ar, llvm-ranlib, llvm-nm and llvm-strip are looked up unversioned too, +# but openSUSE ships no unversioned names for those, so they already resolve to +# the 22 variants. ld.lld is version-checked like clang. +export CC=clang-22 +export CXX=clang++-22 +export AR=llvm-ar-22 +export RANLIB=llvm-ranlib-22 export GIT_SHA="%{git_commit}" +# process.versions.zstd and .libdeflate are generated from the vendored commit +# hashes, which say nothing once the distribution libraries are linked instead +# (Patch5). Report what is actually linked. The other four have no such macro, +# so they need no counterpart. +export BUN_SYSTEM_VERSION_ZSTD="$(pkg-config --modversion libzstd)" +export BUN_SYSTEM_VERSION_LIBDEFLATE="$(pkg-config --modversion libdeflate)" export CARGO_HOME="$PWD/.cargo-home" export CARGO_NET_OFFLINE=true %if %{without rust_nightly} @@ -313,12 +373,72 @@ %check %{buildroot}%{_bindir}/bun --version -%{buildroot}%{_bindir}/bun --revision | grep -F "%{git_short}" +# Anchored on the release form. A canary reports 1.4.0-canary.<stamp>+<sha>, +# which a bare substring match for the short sha would have accepted. +%{buildroot}%{_bindir}/bun --revision | grep -E "^%{version}\+%{git_short}" %{buildroot}%{_bindir}/bun -e 'if (6 * 7 !== 42) process.exit(1)' # The bundler and the package manager are the reason this package exists. %{buildroot}%{_bindir}/bun build --help >/dev/null %{buildroot}%{_bindir}/bun install --help >/dev/null +# The native surfaces this package makes bundled() claims about. --help exiting +# 0 proves nothing about any of them, and all three are statically linked, so +# nothing else in the build would notice if they broke. +# +# bun:sqlite, against the version the Provides advertises. +%{buildroot}%{_bindir}/bun -e 'import{Database}from"bun:sqlite";const v=new Database(":memory:").query("select sqlite_version() v").get().v;if(v!=="%{bundled_sqlite}")throw new Error("bundled(sqlite3) says %{bundled_sqlite}, runtime says "+v)' +# bun:ffi, dlopening a library built here rather than a system one, so the test +# fails on a broken FFI rather than on a missing dependency. +cat > _ffi_check.c <<'EOF' +long long ffi_smoke(long long a, long long b) { return a * b + 1; } +EOF +gcc -shared -fPIC -o _ffi_check.so _ffi_check.c +%{buildroot}%{_bindir}/bun -e 'import{dlopen,FFIType}from"bun:ffi";const{symbols:{ffi_smoke:f}}=dlopen("./_ffi_check.so",{ffi_smoke:{args:[FFIType.i64,FFIType.i64],returns:FFIType.i64}});const r=f(6n,7n);if(r!==43n)throw new Error("bun:ffi returned "+r)' +# bundled(tinycc): cc() compiles at run time with the vendored tcc. No #include, +# so this does not depend on the buildroot's libc headers. +cat > _tcc_check.c <<'EOF' +int tcc_smoke(int x) { return x * 2 + 2; } +EOF +%{buildroot}%{_bindir}/bun -e 'import{cc}from"bun:ffi";const{symbols:{tcc_smoke:g}}=cc({source:"./_tcc_check.c",symbols:{tcc_smoke:{args:["int"],returns:"int"}}});const r=g(20);if(r!==42)throw new Error("bundled(tinycc) returned "+r)' + +# Patch5 must have taken effect: every unbundled library has to be an ELF +# dependency now. A silently reverted patch would otherwise still build and +# still pass every test above. +ldd %{buildroot}%{_bindir}/bun +for lib in libzstd libbrotlienc libbrotlidec libbrotlicommon libdeflate \ + libspng libwebp libwebpmux libwebpdemux libturbojpeg; do + ldd %{buildroot}%{_bindir}/bun | grep -qE "\<$lib\.so" || \ + { echo "$lib is not linked - Patch5 did not take effect"; exit 1; } +done +# ... and each one works through the binary, not just at link time. +%{buildroot}%{_bindir}/bun -e 'const c=Bun.zstdCompressSync(Buffer.from("z".repeat(4096)));if(Bun.zstdDecompressSync(c).length!==4096)throw new Error("zstd round trip failed")' +%{buildroot}%{_bindir}/bun -e 'const z=require("node:zlib");const c=z.brotliCompressSync(Buffer.from("b".repeat(4096)));if(z.brotliDecompressSync(c).length!==4096)throw new Error("brotli round trip failed")' +# Bun.gzipSync/deflateSync are libdeflate, not zlib-ng. +%{buildroot}%{_bindir}/bun -e 'const b=Buffer.from("d".repeat(4096));for(const[c,d]of[[Bun.gzipSync,Bun.gunzipSync],[Bun.deflateSync,Bun.inflateSync]])if(d(c(b)).length!==4096)throw new Error("libdeflate round trip failed")' +# The three image codecs, chained so that one seed exercises all of them: +# libspng decodes, libjpeg-turbo re-encodes and decodes, libwebp likewise, and +# libspng encodes at the end. A struct-layout or ABI-constant mismatch between +# Bun's hand-written Rust externs and the distribution headers shows up here as +# a wrong size or a decode failure rather than at link time. +cat > _img_check.mjs <<'EOF' +const seed = Buffer.from( + "iVBORw0KGgoAAAANSUhEUgAAAAgAAAAICAYAAADED76LAAAAXklEQVR42hXKMQHAMAgAsEqp" + + "FKQgBSlIQQpOtvTIl3NOfZcgKZphOecKBEnRDHtfCIEgKZph44UUCJKiGTZfKIEgKZph64UW" + + "CJKiGbZfGIEgKZph54UVCJKiGXbr+wH6kZfBPhkbiwAAAABJRU5ErkJggg==", "base64"); +let bytes = seed; +for (const fmt of ["jpeg", "webp", "png"]) { + bytes = await new Bun.Image(bytes)[fmt]().bytes(); + const m = await new Bun.Image(bytes).metadata(); + if (m.width !== 8 || m.height !== 8) { + throw new Error(`${fmt}: got ${m.width}x${m.height}, expected 8x8`); + } + if (m.format !== fmt) throw new Error(`${fmt}: sniffed as ${m.format}`); +} +EOF +%{buildroot}%{_bindir}/bun run _img_check.mjs +# process.versions reports the linked libraries, not the vendored commits. +%{buildroot}%{_bindir}/bun -e 'for(const[k,w]of[["zstd","'"$(pkg-config --modversion libzstd)"'"],["libdeflate","'"$(pkg-config --modversion libdeflate)"'"]]){const v=process.versions[k];if(v!==w)throw new Error("process.versions."+k+" is "+v+", linked is "+w)}' + %files %license LICENSE.md %doc README.md ++++++ README.SUSE-maint ++++++ --- /var/tmp/diff_new_pack.tUIfoY/_old 2026-08-24 12:15:26.297142193 +0200 +++ /var/tmp/diff_new_pack.tUIfoY/_new 2026-08-24 12:15:26.302142372 +0200 @@ -10,24 +10,16 @@ What is being packaged ---------------------- -Bun is being rewritten from Zig to Rust. 1.3.14 is the last release written in -Zig; the first written in Rust will be 1.4.0, which upstream has not tagged -yet. The Zig branch is no longer developed - there will be no 1.3.15 - so this -packages a snapshot of the Rust rewrite instead. - -The snapshot is not an arbitrary commit. Upstream's CI publishes a "canary" -build for every commit that passes the full matrix, and %{git_commit} is the -commit today's canary was built from. Picking the tip of main instead would -pick up a red build roughly one time in ten. - -Once 1.4.0 is tagged, point Source0 at the release tarball and drop the -git_commit / git_date defines. +1.4.0 is the first release written in Rust; 1.3.14 was the last written in +Zig. Source0 is the bun-v1.4.0 release tarball. %{git_commit} is the commit +that tag points at, passed as GIT_SHA so `bun --revision` reports it; it is +not part of the RPM version. Regenerating the sources ------------------------ -After changing git_commit, in order: +After changing Version, in order: 1. osc service manualrun download_files Source0, the Bun tarball 2. ./bun_webkit Source1 @@ -107,10 +99,12 @@ Source3 - the Rust crates ------------------------- -Plain `cargo vendor`, not obs-service-cargo: the workspace has a path -dependency on vendor/lolhtml, which is one of the downloads in Source2, so -cargo cannot even read the manifest until that has been unpacked. bun_prefetch -does the two steps in the right order. +Plain `cargo vendor`, not obs-service-cargo: the workspace has path +dependencies on vendor/lolhtml and vendor/rust-argon2, which are downloads in +Source2, so cargo cannot even read the manifest until those have been +unpacked. bun_prefetch does the steps in the right order. rust-argon2 used to +be a crates.io crate; 1.4.0 vendors it to apply +patches/rust-argon2/legacy-low-memory.patch. The crates unpack to cargo-vendor/ rather than vendor/, which in Bun's tree already holds WebKit and lol-html; cargo requires every entry of its vendor @@ -178,15 +172,13 @@ - remaining cfg.bun usage"); until then, turn %bcond bootstrap off once the package is in the distribution and it will build with the Bun already there. -1.3.14 is old - it is the last Zig release, while the source here is the Rust -rewrite - but it does the job: it was verified to complete configure and all 24 -code-generation edges against this snapshot. The -build applies no minimum Bun version, and upstream's own CI bootstraps this -tree with 1.3.13 (scripts/bootstrap.sh). - -Do not be tempted to bootstrap from a 1.4.0 canary instead. The canary tag's -assets are replaced in place - they carry no version in the name and no stable -checksum - and there is no per-commit artifact with a permanent URL. +1.3.14 is old - it is the last Zig release, while the source here is the 1.4.0 +Rust tree - but it does the job: the build applies no minimum Bun version, and +upstream's own CI bootstraps this tree with 1.3.13 (scripts/bootstrap.sh). +Keep 1.3.14 until bun is in the distribution, then turn %bcond bootstrap off +so the package builds with itself. Do not switch the bootstrap zips to 1.4.0 +while this package is still the first 1.4.0 in the distro - that would be +another foreign binary for no gain. The binaries are NoSource: uploaded to the build service but not shipped in the src.rpm, and used during %build only - never installed. @@ -222,9 +214,9 @@ cross-language LTO, but doing so resolves std's own dependencies from crates.io, which a build environment cannot reach. The distribution compiler's prebuilt std is what the rest of the system links against anyway, and cross-language LTO -is off in this build. The patch also passes --locked --offline to cargo, and -reduces the `bun install` ninja rule to touching its stamp - see "Source4 - the -npm packages". +is off in this build. The patch also passes --offline to cargo (--locked is +upstream's own since 1.4.0), and reduces the `bun install` ninja rule to +touching its stamp - see "Source4 - the npm packages". bun-unknown-lint.patch adds unknown_lints to two allow() attributes that name a lint newer than the released compiler. The workspace denies warnings, so an ++++++ bun-1.4.0~git20260808.52bf09cb.tar.gz -> bun-1.4.0.tar.gz ++++++ /work/SRC/openSUSE:Factory/bun/bun-1.4.0~git20260808.52bf09cb.tar.gz /work/SRC/openSUSE:Factory/.bun.new.1258/bun-1.4.0.tar.gz differ: char 14, line 1 ++++++ bun-deps.mjs ++++++ --- /var/tmp/diff_new_pack.tUIfoY/_old 2026-08-24 12:15:26.464148177 +0200 +++ /var/tmp/diff_new_pack.tUIfoY/_new 2026-08-24 12:15:26.472148464 +0200 @@ -35,6 +35,9 @@ webkitVersion: WEBKIT_VERSION, cacheDir: "/nonexistent/cache", vendorDir: "/nonexistent/vendor", + // --local-deps redirections. Empty here, but the field has to exist: + // depSourceDir() indexes it unconditionally (scripts/build/source.ts). + localDeps: {}, webkit: webkitMode, os: "linux", linux: true, ++++++ bun-llvm-22.patch ++++++ From: Martin Pluskal <[email protected]> Subject: Build against LLVM 22 Upstream pins LLVM 21.1.8. openSUSE's default is 22, and pinning bun a major behind means carrying a second LLVM in the build root for no benefit. Only the clang C driver and ld.lld are version-checked by findLlvmTool(); the rest of the toolchain is resolved by name, so raising the two constants that LLVM_VERSION_RANGE is built from is the entire change. checkWorkarounds() is not affected. The three entries keyed on the clang major are asan-dyld-shim (Darwin), darwin-cross-stack-size (Darwin) and rust-lld-for-crosslang-lto, which needs cross-language LTO - config.ts only sets crossLangLto when LTO is on, and the spec builds with --lto=off. --- a/scripts/build/tools.ts +++ b/scripts/build/tools.ts @@ -264,8 +264,14 @@ * LLVM version constraint. Any version in the same major.minor range is * accepted (e.g. Alpine 3.23 ships 21.1.2 while we target 21.1.8). */ -export const LLVM_VERSION = "21.1.8"; -const LLVM_MAJOR = "21"; +// openSUSE: built against the distribution's LLVM 22 rather than upstream's +// pinned 21. Only two tools are version-checked (the clang C driver and +// ld.lld); everything else is found by name, so this pair of constants is the +// whole switch. None of the entries in workarounds.ts that key off the clang +// major apply here: the LTO ones need cross-language LTO, which the spec turns +// off, and the rest are Darwin-only. +export const LLVM_VERSION = "22.1.8"; +const LLVM_MAJOR = "22"; const LLVM_MINOR = "1"; const LLVM_VERSION_RANGE = `>=${LLVM_MAJOR}.${LLVM_MINOR}.0 <${LLVM_MAJOR}.${LLVM_MINOR}.99`; ++++++ bun-node-modules-1.4.0~git20260808.52bf09cb.tar.zst -> bun-node-modules-1.4.0.tar.zst ++++++ /work/SRC/openSUSE:Factory/bun/bun-node-modules-1.4.0~git20260808.52bf09cb.tar.zst /work/SRC/openSUSE:Factory/.bun.new.1258/bun-node-modules-1.4.0.tar.zst differ: char 7, line 1 ++++++ bun-offline-build.patch ++++++ --- /var/tmp/diff_new_pack.tUIfoY/_old 2026-08-24 12:15:26.582152405 +0200 +++ /var/tmp/diff_new_pack.tUIfoY/_new 2026-08-24 12:15:26.592152764 +0200 @@ -1,19 +1,16 @@ diff --git a/scripts/build/rust.ts b/scripts/build/rust.ts -index 4e3a41ae..47c344f5 100644 --- a/scripts/build/rust.ts +++ b/scripts/build/rust.ts -@@ -347,20 +347,25 @@ export function cargoBuildInvocation(cfg: Config): CargoInvocation { - triple, +@@ -413,18 +413,22 @@ "--profile", profile.name, + "--locked", + // Distribution builds have no network and a pre-vendored crate tree. -+ "--locked", + "--offline", ]; - if (tier3 || cfg.release || cfg.asan) { + if (tier3 || cfg.asan) { - // Build std/core/alloc from source instead of linking the rustup prebuilt. - // + // Rebuild std from source (cargoBuildStdArg) because: // tier3: no prebuilt `rust-std` exists. - // release: prebuilt std is native code built for generic x86-64 with no - // `.llvm_addrsig`. Rebuilding with our RUSTFLAGS gets it @@ -23,20 +20,20 @@ // asan: prebuilt std is uninstrumented; rebuilding applies // `-Zsanitizer=address` so OOB/UAF inside Vec/String/HashMap are // visible instead of stopping at the std boundary. - // ++ // + // Release builds used to rebuild std here too, to get `-Ctarget-cpu=` into + // it and to feed cross-language LTO. That is dropped when packaging for a + // distribution: rebuilding std means resolving its own dependencies from + // crates.io, which a build environment cannot reach, and the distribution + // compiler's prebuilt std is the one the rest of the system links against + // anyway. Cross-language LTO is off for the same build (--lto=off). -+ // - // The workspace is `panic = "abort"` (see Cargo.toml). `proc_macro` is - // needed because `cargo build --target` still resolves proc-macro crates - // for the host through the same `-Zbuild-std` flag set. Requires the + args.push(cargoBuildStdArg); + if (cfg.release && !cfg.asan) { + // Cargo's default build-std feature set is `panic-unwind,backtrace,default`. +diff --git a/scripts/build/codegen.ts b/scripts/build/codegen.ts --- a/scripts/build/codegen.ts +++ b/scripts/build/codegen.ts -@@ -148,11 +148,14 @@ +@@ -146,11 +146,14 @@ // // CMake only tracked package.json as input; we add bun.lock so lockfile // version bumps actually reinstall. ++++++ bun-prefetch-1.4.0~git20260808.52bf09cb.tar.zst -> bun-prefetch-1.4.0.tar.zst ++++++ /work/SRC/openSUSE:Factory/bun/bun-prefetch-1.4.0~git20260808.52bf09cb.tar.zst /work/SRC/openSUSE:Factory/.bun.new.1258/bun-prefetch-1.4.0.tar.zst differ: char 7, line 1 ++++++ bun-prefetch.manifest ++++++ --- /var/tmp/diff_new_pack.tUIfoY/_old 2026-08-24 12:15:26.666155415 +0200 +++ /var/tmp/diff_new_pack.tUIfoY/_new 2026-08-24 12:15:26.671155594 +0200 @@ -1,22 +1,23 @@ +0f29c74cc80722ca0638c95a101d9a1a 93bb95e613d8c324e673607282fac0ae25a07368eabcc12c0e2539eaa95b0ecc https://github.com/oven-sh/libuv/archive/8023581113b276e7c1aee3f82da57ca0893faab1.tar.gz +1685a3355527fdec398ccf10f79b3f75 c9ea1b3029b23b04376c229bd519489cee180874ec48cd863a5dcba628c0fe03 https://github.com/c-ares/c-ares/archive/c7a3138dcfe3bb0eaaf10c0c24c36dc66dc790ab.tar.gz +297099166a01f75e9a0caaa17f7b74f3 440f3a94390c78eab88f74b92944d2f6b248e592e984412e389885dfb5796bf0 https://github.com/libjpeg-turbo/libjpeg-turbo/archive/e352b02f794f701407b39af08576035ba3360d60.tar.gz +2ced709f169b40bd84b3e0dc2765aff8 76fb89b4454ff2161bb0cca2cf832e19b8b4001b0ef42fbcc2b4a437c945b2b6 https://github.com/webmproject/libwebp/archive/b7e29b9d75bd31422b00c2a446d49d7af06c328d.tar.gz +355b3176162682e2288fd449c39f7939 0f9abe027fe4aa9943c2df3523043c6ae9eb4c8241febc0091b6f537222d26d8 https://github.com/oven-sh/mimalloc/archive/6a14aee24315e503fa295a1fa90fe8b24ad91774.tar.gz +4296b191210d6b1b3f6c85bbce59eddf 042f0efe7147063ff9ba10f1a38ed080e949bcbd04bdbf3592b8846dd11b1da2 https://github.com/libarchive/libarchive/archive/ded82291ab41d5e355831b96b0e1ff49e24d8939.tar.gz +45e9cfbefdc7f69b2e025785c7bd7616 fca113c5d5add8bfb1aa31129a24acb8d49aa69ab3c22a2cc569aec88960526d https://nodejs.org/dist/v26.3.0/node-v26.3.0-headers.tar.gz +655c6ecdb6fc9cd5621eb37cad3758da a0d2a5d122c84b56a793a1553a9c3327fb2eb7469bf7a86b79e3c7be5d92e8d6 https://github.com/zlib-ng/zlib-ng/archive/12731092979c6d07f42da27da673a9f6c7b13586.tar.gz +723494d4c3a9902a1edf3613ad3d0cdb e720a6ca29428b803f4ad165371771f5398faba397edf6778837a18599ea13ff https://github.com/google/brotli/archive/v1.1.0.tar.gz +73e0c55d12ea4fc2665ba0e3b1461100 07d8bf901bb1b15543f38eabd23938519e1210eebadb52f3d651d6ef130ef973 https://github.com/litespeedtech/ls-hpack/archive/8905c024b6d052f083a3d11d0a169b3c2735c8a1.tar.gz +87c5404c7fc9aa9ce3a44b8b1929b357 e77c797444f191faf488d49c76c4f45c10b3d9275e0364ee10b6d05cfbe57baf https://github.com/sru-systems/rust-argon2/archive/ed81866f163f0c7026aa6fd8388adf37242eb32a.tar.gz +97084f213075a65efe2e2346b2ee6c5c 811c5e5ae5303a75ade50688880af6aad5d2f951ec5785f68186bd18635cdfc9 https://github.com/HdrHistogram/HdrHistogram_c/archive/be60a9987ee48d0abf0d7b6a175bad8d6c1585d1.tar.gz b2dcc6002e95cc474624da9a4aaea204 741d705781e0b3e406beda8f1f994fbae01321237ce8023a1ad90fbaf7940c25 https://github.com/google/highway/archive/2607d3b5b0113992fe84d3848859eae13b3b52c1.tar.gz -ceeb8e315778b9385bcaa3d3cd60390b e9d8abe5b7c1e35b9908a9521e2acd7c1d17547babc01d73c7297e02aebbcc2d https://github.com/litespeedtech/ls-qpack/archive/1e9c5b8e59f8161c54f168a570c8bfdc59ded0c3.tar.gz +c6d78bf3f3d4c21ebdd735187b665bda 6c7aaf0d99ff35475c8678a43543f94d55f68d4956c4b73ce01417fc358cefe7 https://github.com/oven-sh/boringssl/archive/2288897e2e716330490893d226b4f079f9da9e0c.tar.gz ce0e2d9805b30dcc2686113111c1dfba 1e5cc06bdbf3e1245d8b89c9e3588f507e3c8bc53fe8b8229770a9e8661dea81 https://github.com/ebiggers/libdeflate/archive/c8c56a20f8f621e6a966b716b31f1dedab6a41e3.tar.gz +ceeb8e315778b9385bcaa3d3cd60390b e9d8abe5b7c1e35b9908a9521e2acd7c1d17547babc01d73c7297e02aebbcc2d https://github.com/litespeedtech/ls-qpack/archive/1e9c5b8e59f8161c54f168a570c8bfdc59ded0c3.tar.gz d3ef6cf1fbedd7f9d706da665bc05f6b f8cb90fb327eb91597c23163bf596c0d1882560be35b661d9ba84891cc461735 https://github.com/litespeedtech/lsquic/archive/3181911301b1aa4f54c1ed690901abc674ee08fb.tar.gz d63099fc6ce4f6e5281d442e8feb24e9 afd83edbe1a2d4accb72e869cd4218bb8665fda2b7cb2c5106fc4be80001a748 https://github.com/oven-sh/lol-html/archive/725ce499aa9b71e38b7a2d0a9fbb6d7294a4079e.tar.gz e010993a240724688a560d14f80491f4 4b0bd1f0cfb25e61b9103c35f27395530ff5b4c0d2513a00fd745849e85ea52c https://github.com/facebook/zstd/archive/f8745da6ff1ad1e7bab384bd1f9d742439278e99.tar.gz e6aca86c593b51adc54a86edcb58b3ce d656813290d70a750b69e768323ff3b3875adf8c2e8c2fdb4e57ca1467abf86a https://github.com/randy408/libspng/archive/fb768002d4288590083a476af628e51c3f1d47cd.tar.gz e715321533b32b832912e41f2813ea01 50750680312923a59fdd36ae41f7091d8e35e51909d0e0b25b0b33ea9534bc08 https://github.com/oven-sh/tinycc/archive/05f0fafaa3be31e31d7b4b5c17dc60f62c991171.tar.gz fad59b16ad4752cc63c8a23339da36f5 637ff2ab6f5c7f7e05a5b5dc393d5cf2fea8d4754fcaceaaf935ffff5c1323ee https://github.com/h2o/picohttpparser/archive/066d2b1e9ab820703db0837a7255d92d30f0c9f5.tar.gz -048ae509adfa8c2fd0288fa5e3e29297 ab24b837fd6078563fc2c3bbf41cbb16add914c29bdc6b48bf7834ce34259160 https://github.com/oven-sh/libuv/archive/89ee34396dc7f5f1bce620e23d9fe6bbd0facd97.tar.gz -0857e8472251ce3b7129322153f0510e 5e37b00d21b872383dec5c599eea1bc27ffb6d50c914078544b244d1a2a3120b https://github.com/oven-sh/mimalloc/archive/1803341d6241d8fa4b3f65fa68cb13a32ad92f04.tar.gz -2ced709f169b40bd84b3e0dc2765aff8 76fb89b4454ff2161bb0cca2cf832e19b8b4001b0ef42fbcc2b4a437c945b2b6 https://github.com/webmproject/libwebp/archive/b7e29b9d75bd31422b00c2a446d49d7af06c328d.tar.gz -297099166a01f75e9a0caaa17f7b74f3 440f3a94390c78eab88f74b92944d2f6b248e592e984412e389885dfb5796bf0 https://github.com/libjpeg-turbo/libjpeg-turbo/archive/e352b02f794f701407b39af08576035ba3360d60.tar.gz -4e43539b43c0f4aea018742c50ab0561 8c94116cb366ae4a44e487da4d9f7e736287d329efa6f88fdf077cd2d0a2e4b8 https://github.com/c-ares/c-ares/archive/3ac47ee46edd8ea40370222f91613fc16c434853.tar.gz -4296b191210d6b1b3f6c85bbce59eddf 042f0efe7147063ff9ba10f1a38ed080e949bcbd04bdbf3592b8846dd11b1da2 https://github.com/libarchive/libarchive/archive/ded82291ab41d5e355831b96b0e1ff49e24d8939.tar.gz -45e9cfbefdc7f69b2e025785c7bd7616 fca113c5d5add8bfb1aa31129a24acb8d49aa69ab3c22a2cc569aec88960526d https://nodejs.org/dist/v26.3.0/node-v26.3.0-headers.tar.gz -655c6ecdb6fc9cd5621eb37cad3758da a0d2a5d122c84b56a793a1553a9c3327fb2eb7469bf7a86b79e3c7be5d92e8d6 https://github.com/zlib-ng/zlib-ng/archive/12731092979c6d07f42da27da673a9f6c7b13586.tar.gz -7e18f36bacb529113d07b5e3c5afacd4 d93b760e5792beab530990c38eb5a550b26ba86d0a1a809f22b0f4d3bd7b53b0 https://github.com/oven-sh/boringssl/archive/1a41b9025c2c0a37edd07ff10f6944f03e028522.tar.gz -723494d4c3a9902a1edf3613ad3d0cdb e720a6ca29428b803f4ad165371771f5398faba397edf6778837a18599ea13ff https://github.com/google/brotli/archive/v1.1.0.tar.gz -73e0c55d12ea4fc2665ba0e3b1461100 07d8bf901bb1b15543f38eabd23938519e1210eebadb52f3d651d6ef130ef973 https://github.com/litespeedtech/ls-hpack/archive/8905c024b6d052f083a3d11d0a169b3c2735c8a1.tar.gz -97084f213075a65efe2e2346b2ee6c5c 811c5e5ae5303a75ade50688880af6aad5d2f951ec5785f68186bd18635cdfc9 https://github.com/HdrHistogram/HdrHistogram_c/archive/be60a9987ee48d0abf0d7b6a175bad8d6c1585d1.tar.gz ++++++ bun-system-libs.patch ++++++ From: Martin Pluskal <[email protected]> Subject: Link zstd, brotli, libdeflate, libspng, libwebp and libjpeg-turbo from the distribution Bun's build system has no USE_SYSTEM_* switch; the only precedent for a distribution library is the ICU block in systemLibs() (scripts/build/bun.ts), which is where this hooks in. Disabling a Dependency's enabled() predicate makes resolveDep() return null and computeDepLibs() return [], so no fetch, no compile and no -l for the vendored copy; the link flags are then added by hand in the same place ICU's are. These six are the vendored C libraries whose pin is an unmodified upstream release rather than a fork, that bun reaches through their installed public headers, and that no other dependency fetchDeps on. Each dep file carries the specific reasoning; the recurring points are: - zstd: one file, bun_icu_decompress.cpp, uses two ZSTD_STATIC_LINKING_ONLY entry points. Upstream exports those from the shared library too, so they resolve. - libspng and libwebp: the Rust codecs mirror C structs and ABI version constants by hand. The distribution versions equal the vendored pins (0.7.4 and 1.6.0), so the layouts and constants agree. - libjpeg-turbo: 8bit-only.patch and jbun_stubs.c only compile out the 12- and 16-bit precisions to save size, which the distribution library simply has. - libspng's fetchDeps on zlib goes away with it, since resolveDep() returns before reading them. All six stay vendored for Android, whose NDK sysroot ships none of them. process.versions.zstd and .libdeflate are generated from the vendored commit hashes, so depVersionsHeader.ts learns to take the real linked version from the environment instead; the spec file fills it in from pkg-config. diff --git a/scripts/build/bun.ts b/scripts/build/bun.ts index ae2fdef..28a1e4e 100644 --- a/scripts/build/bun.ts +++ b/scripts/build/bun.ts @@ -78,6 +78,25 @@ function systemLibs(cfg: Config): string[] { libs.push("-latomic"); } } + // openSUSE: these are unbundled - see the enabled() predicate in each of + // deps/{zstd,brotli,libdeflate,libspng,libwebp,libjpeg-turbo}.ts for why + // that one can go where the rest of the vendored list cannot. + // brotlicommon comes last: static archives resolve left to right and the + // encoder and decoder both draw symbols from it. + if (cfg.abi !== "android") { + libs.push( + "-lzstd", + "-lbrotlienc", + "-lbrotlidec", + "-lbrotlicommon", + "-ldeflate", + "-lspng", + "-lwebp", + "-lwebpmux", + "-lwebpdemux", + "-lturbojpeg", + ); + } // Linux local WebKit: link system ICU (prebuilt bundles its own). // Assumes system ICU is in default lib paths — true on most distros. // Android: no system ICU; the local WebKit build must bundle it. diff --git a/scripts/build/depVersionsHeader.ts b/scripts/build/depVersionsHeader.ts index fbf24f6..a3ea9a2 100644 --- a/scripts/build/depVersionsHeader.ts +++ b/scripts/build/depVersionsHeader.ts @@ -49,6 +49,14 @@ function computeVersions(cfg: Config): [string, string][] { // Single source of truth — bumping deps/<name>.ts updates this. for (const dep of allDeps) { if (dep.versionMacro === undefined) continue; + // openSUSE: for a dep whose vendored build has been disabled in favour of + // a distribution library, process.versions must report what is actually + // linked. The spec file sets these from pkg-config. + const systemVersion = process.env[`BUN_SYSTEM_VERSION_${dep.name.toUpperCase()}`]; + if (systemVersion !== undefined && systemVersion.length > 0) { + versions.push([dep.versionMacro, systemVersion]); + continue; + } const source = dep.source(cfg); const id = sourceIdentifier(source); // WebKit special case: prebuilt.identity carries the artifact suffix, but diff --git a/scripts/build/deps/brotli.ts b/scripts/build/deps/brotli.ts index 12eb351..643f36a 100644 --- a/scripts/build/deps/brotli.ts +++ b/scripts/build/deps/brotli.ts @@ -30,6 +30,12 @@ const SOURCES = [ export const brotli: Dependency = { name: "brotli", + // openSUSE: link the distribution's libbrotli instead of building the + // vendored copy. Bun includes only <brotli/encode.h> and <brotli/decode.h>, + // the public API, and the pin below is the v1.1.0 release rather than a + // fork. See systemLibs() in scripts/build/bun.ts. + enabled: cfg => !cfg.linux || cfg.abi === "android", + source: () => ({ kind: "github-archive", repo: "google/brotli", diff --git a/scripts/build/deps/libdeflate.ts b/scripts/build/deps/libdeflate.ts index e84688d..c789608 100644 --- a/scripts/build/deps/libdeflate.ts +++ b/scripts/build/deps/libdeflate.ts @@ -15,6 +15,14 @@ export const libdeflate: Dependency = { name: "libdeflate", versionMacro: "LIBDEFLATE_HASH", + // openSUSE: link the distribution's libdeflate instead of building the + // vendored copy. Bun reaches it from Rust (WebSocketDeflate.rs and the + // http compression paths) through hand-written externs that name only + // documented libdeflate_* entry points, all of which take opaque handles + // and scalars - there is no struct layout to keep in step. + // See systemLibs() in scripts/build/bun.ts. + enabled: cfg => !cfg.linux || cfg.abi === "android", + source: () => ({ kind: "github-archive", repo: "ebiggers/libdeflate", diff --git a/scripts/build/deps/libjpeg-turbo.ts b/scripts/build/deps/libjpeg-turbo.ts index 224d1f3..e8eb699 100644 --- a/scripts/build/deps/libjpeg-turbo.ts +++ b/scripts/build/deps/libjpeg-turbo.ts @@ -89,6 +89,16 @@ const cmakedefine = (truthy: boolean): [string, string] => ["#cmakedefine", trut export const libjpegTurbo: Dependency = { name: "libjpeg-turbo", + // openSUSE: link the distribution's libturbojpeg instead of building the + // vendored copy - 3.1.4 either side. codec_jpeg.rs uses only the tj3_* API + // and two POD structs of ints, so nothing here depends on the internals the + // vendored build reconfigures. The two patches above are size trims, not + // fixes: 8bit-only.patch and jbun_stubs.c compile out the 12- and 16-bit + // precisions, which the distribution library simply has. Dropping this also + // drops the NASM SIMD kernels, and with them the only reason the spec + // needed nasm on x86_64. See systemLibs() in scripts/build/bun.ts. + enabled: cfg => !cfg.linux || cfg.abi === "android", + source: () => ({ kind: "github-archive", repo: "libjpeg-turbo/libjpeg-turbo", diff --git a/scripts/build/deps/libspng.ts b/scripts/build/deps/libspng.ts index 0f66452..00b2372 100644 --- a/scripts/build/deps/libspng.ts +++ b/scripts/build/deps/libspng.ts @@ -17,6 +17,17 @@ const LIBSPNG_COMMIT = "fb768002d4288590083a476af628e51c3f1d47cd"; // v0.7.4 export const libspng: Dependency = { name: "libspng", + // openSUSE: link the distribution's libspng instead of building the + // vendored copy - both are 0.7.4. codec_png.rs mirrors spng_ihdr, spng_plte, + // spng_trns and spng_iccp as #[repr(C)] structs, so the layouts have to + // agree; they do (16/1028/268/96 bytes on either side), and the spec's + // %check round-trips a PNG through them. SPNG_STATIC and SPNG_SSE below + // only affect symbol visibility and the x86 filter SIMD level, both of + // which the distribution build settles for itself. The fetchDeps on zlib + // goes away with it: resolveDep() returns before reading them. + // See systemLibs() in scripts/build/bun.ts. + enabled: cfg => !cfg.linux || cfg.abi === "android", + source: () => ({ kind: "github-archive", repo: "randy408/libspng", diff --git a/scripts/build/deps/libwebp.ts b/scripts/build/deps/libwebp.ts index 762034f..f1f8c11 100644 --- a/scripts/build/deps/libwebp.ts +++ b/scripts/build/deps/libwebp.ts @@ -114,6 +114,18 @@ function simd(path: string, x64: boolean) { export const libwebp: Dependency = { name: "libwebp", + // openSUSE: link the distribution's libwebp instead of building the + // vendored copy - both are 1.6.0, so the WEBP_DEMUX_ABI_VERSION and + // WEBP_MUX_ABI_VERSION constants codec_webp.rs passes to the *Internal() + // entry points still match; a mismatch makes those return NULL, which + // would silently drop ICC profile carry-through, so the spec's %check + // round-trips a WebP. WEBP_USE_THREAD stays off either way in practice: + // libwebp only spawns threads when the caller sets config.thread_level, + // and bun never does. sharpyuv is a transitive shared dependency of + // libwebp.so, so it needs no -l of its own. + // See systemLibs() in scripts/build/bun.ts. + enabled: cfg => !cfg.linux || cfg.abi === "android", + source: () => ({ kind: "github-archive", repo: "webmproject/libwebp", diff --git a/scripts/build/deps/zstd.ts b/scripts/build/deps/zstd.ts index 8bf87f0..5c00308 100644 --- a/scripts/build/deps/zstd.ts +++ b/scripts/build/deps/zstd.ts @@ -35,6 +35,20 @@ export const zstd: Dependency = { name: "zstd", versionMacro: "ZSTD_HASH", + // openSUSE: link the distribution's libzstd instead of building the + // vendored copy. Almost all of what bun calls is the stable API — the + // CCtx/DCtx streaming calls, the ZSTD_c_*/ZSTD_d_* parameter enums, the + // ZSTD_error_* codes. The exception is bun_icu_decompress.cpp, which + // defines ZSTD_STATIC_LINKING_ONLY for ZSTD_createDDict_byReference() and + // ZSTD_findFrameCompressedSize(); upstream builds those into the shared + // library too (ZSTDLIB_STATIC_API is visible there), so they link. The two + // non-default knobs below do not survive unbundling and do not need to: + // ZSTD_LEGACY_SUPPORT=0 only drops decoders the system build includes + // anyway, and XXH_NAMESPACE existed solely to keep three statically linked + // copies of xxhash from colliding, which a shared library makes impossible. + // See systemLibs() in scripts/build/bun.ts. + enabled: cfg => !cfg.linux || cfg.abi === "android", + source: () => ({ kind: "github-archive", repo: "facebook/zstd", ++++++ bun-vendor-1.4.0~git20260808.52bf09cb.tar.zst -> bun-vendor-1.4.0.tar.zst ++++++ /work/SRC/openSUSE:Factory/bun/bun-vendor-1.4.0~git20260808.52bf09cb.tar.zst /work/SRC/openSUSE:Factory/.bun.new.1258/bun-vendor-1.4.0.tar.zst differ: char 7, line 1 ++++++ bun_prefetch ++++++ --- /var/tmp/diff_new_pack.tUIfoY/_old 2026-08-24 12:15:26.805160396 +0200 +++ /var/tmp/diff_new_pack.tUIfoY/_new 2026-08-24 12:15:26.813160682 +0200 @@ -28,9 +28,9 @@ # automatically. # # Rust crates are vendored here rather than by obs-service-cargo because the -# workspace has a path dependency on vendor/lolhtml, which is one of the -# downloads above: cargo cannot even read the manifest until it is unpacked, -# which has to happen between the two steps. +# workspace has path dependencies on vendor/lolhtml and vendor/rust-argon2, +# which are downloads above: cargo cannot even read the manifest until they +# are unpacked, which has to happen between the two steps. # # Run after a version bump: # ./bun_prefetch @@ -108,13 +108,20 @@ # --------------------------------------------------------------------------- echo "enumerating dependencies from scripts/build/deps/" cp "$deps_script" "$srcdir/bun-deps.mjs" +# Into a file, not a process substitution: the exit status of the right-hand +# side of `done < <(...)` is not seen by set -e, so an enumeration that failed +# half way through would silently produce an incomplete archive. +deps_list="$workdir/deps.tsv" +(cd "$srcdir" && node --experimental-strip-types --no-warnings bun-deps.mjs) >"$deps_list" lolhtml_url="" +argon2_url="" while IFS=$'\t' read -r kind name url; do case "$kind" in archive|prebuilt) echo " $name" fetch "$url" [ "$name" = "lolhtml" ] && lolhtml_url="$url" + [ "$name" = "rust-argon2" ] && argon2_url="$url" ;; *) # SQLite is committed to Bun's tree as an amalgamation and WebKit @@ -122,7 +129,7 @@ echo " $name: $kind, not downloaded" ;; esac -done < <(cd "$srcdir" && node --experimental-strip-types --no-warnings bun-deps.mjs) +done <"$deps_list" rm -f "$srcdir/bun-deps.mjs" sort -o "$manifest" "$manifest" @@ -131,14 +138,25 @@ # --------------------------------------------------------------------------- # 2. Rust crates # -# The workspace has `lol_html = { path = "vendor/lolhtml" }`, so the lolhtml -# archive fetched above has to be unpacked before cargo will read the manifest. +# The workspace has path dependencies on vendor/lolhtml and +# vendor/rust-argon2, so those archives have to be unpacked before cargo +# will read the manifest. rust-argon2 used to be a crates.io dep; 1.4.0 +# vendors it to apply patches/rust-argon2/legacy-low-memory.patch. # --------------------------------------------------------------------------- [ -n "$lolhtml_url" ] || { echo "$0: lolhtml not in the dependency list" >&2; exit 1; } echo "unpacking lolhtml for the cargo workspace" mkdir -p "$srcdir/vendor/lolhtml" tar -xzf "$byurl/$(url_key "$lolhtml_url")" -C "$srcdir/vendor/lolhtml" --strip-components=1 +[ -n "$argon2_url" ] || { echo "$0: rust-argon2 not in the dependency list" >&2; exit 1; } +echo "unpacking rust-argon2 for the cargo workspace" +mkdir -p "$srcdir/vendor/rust-argon2" +tar -xzf "$byurl/$(url_key "$argon2_url")" -C "$srcdir/vendor/rust-argon2" --strip-components=1 +if [ -f "$srcdir/patches/rust-argon2/legacy-low-memory.patch" ]; then + patch -p1 -d "$srcdir/vendor/rust-argon2" \ + < "$srcdir/patches/rust-argon2/legacy-low-memory.patch" +fi + echo "vendoring Rust crates" # Bun pins a Rust nightly it expects rustup to install. There is no rustup in # a build environment and vendoring does not compile anything, so keep cargo ++++++ webkit-1.4.0~git20260808.52bf09cb.tar.zst -> webkit-1.4.0.tar.zst ++++++ /work/SRC/openSUSE:Factory/bun/webkit-1.4.0~git20260808.52bf09cb.tar.zst /work/SRC/openSUSE:Factory/.bun.new.1258/webkit-1.4.0.tar.zst differ: char 7, line 1 ++++++ webkit.revision ++++++ --- /var/tmp/diff_new_pack.tUIfoY/_old 2026-08-24 12:15:26.905163979 +0200 +++ /var/tmp/diff_new_pack.tUIfoY/_new 2026-08-24 12:15:26.922164588 +0200 @@ -1,2 +1,2 @@ -ddea71318fec9b923465c7c45ded8fa713ca3251 webkit-1.4.0~git20260808.52bf09cb.tar.zst +0f966e81b78c84bb23213e391bc679c4ef83e56b webkit-1.4.0.tar.zst
