python 3.13 rebuild: part 4

.github/workflows/package_updates.yml

@@ -113,13 +113,15 @@ jobs:
           size: 16G
           priority: 100
           device_name: /dev/zram0
+      - name: Load Docker image
+        run: |
+          ./scripts/run-docker.sh echo ""
       - name: Free additional disk space
-        run: CLEAN_DOCKER_IMAGES=false ./scripts/free-space.sh
+        run: ./scripts/free-space.sh
       - name: Process package updates
         env:
           GITHUB_TOKEN: ${{ secrets.TERMUXBOT2_TOKEN }}
           BUILD_PACKAGES: "true"
-          TERMUX_DOCKER__CONTAINER_EXEC_COMMAND__PRE_CHECK_IF_WILL_BUILD_PACKAGES: "true"
           CREATE_ISSUE: "true"
           GIT_COMMIT_PACKAGES: "true"
           GIT_PUSH_PACKAGES: "true"

.github/workflows/packages.yml

@@ -20,6 +20,10 @@ on:
       packages:
         description: "A space-separated names of packages selected for rebuilding"
         required: true
+      free-space:
+        description: "Free space even if not building large package (useful when building a large number of packages)"
+        type: boolean
+        default: false
 
 permissions: {} # none
 
@@ -98,7 +102,6 @@ jobs:
           # Forces CI to cancel current build with status 'passed'
           if grep -qiP '^\s*%ci:no-build\s*$' <(git log --format="%B" -n 1 --no-merges "HEAD"); then
             tar cf artifacts/debs-${{ matrix.target_arch }}.tar debs
-            echo "docker-build=true" >> $GITHUB_OUTPUT
             echo "[!] Force exiting as tag '%ci:no-build' was applied to HEAD commit message."
             exit 0
           fi
@@ -186,31 +189,33 @@ jobs:
 
         echo "packages: ${packages[*]}"
 
-        docker='true'
+        free_space='false'
+        if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+          free_space=${{ github.event.inputs.free-space }}
+        else
+          if grep -qiP '^\s*%ci:free-disk\s*$' <(git log --format="%B" -n 1 --no-merges "HEAD"); then
+            free_space=true
+          fi
+        fi
         if [[ "${#packages[@]}" -gt 0 ]]; then
           for pkg in "${packages[@]}"; do
             if grep -qFx "$pkg" ./scripts/big-pkgs.list; then
-              docker='false'
+              free_space='true'
               break
             fi
           done
         fi
+        echo "free-space=$free_space" >> $GITHUB_OUTPUT
 
-        echo "docker-build=$docker" >> $GITHUB_OUTPUT
+        needs_docker_build=false
         if [ "${{ github.event_name }}" != "workflow_dispatch" ]; then
           # Build local Docker image if setup scripts were changed.
           # Useful for pull requests submitting changes for both build environment and packages.
           if grep -qP '^scripts/(Dockerfile|properties\.sh|setup-android-sdk\.sh|setup-ubuntu\.sh)$' <<< "$CHANGED_FILES"; then
-            echo "Detected changes for environment setup scripts. Building custom Docker image now."
-            if [ $docker == 'false' ]; then
-              echo "Skipping due to building large packages."
-              exit 0
-            fi
-            cd ./scripts
-            docker build -t ghcr.io/termux/package-builder:latest .
-            cd ..
+            needs_docker_build=true
           fi
         fi
+        echo "needs-docker-build=$needs_docker_build" >> $GITHUB_OUTPUT
 
     - name: Lint packages
       run: |
@@ -235,22 +240,24 @@ jobs:
         priority: 100
         device_name: /dev/zram0
 
+    - name: Build docker image
+      if: ${{ steps.build-info.outputs.needs-docker-build == 'true' }}
+      run: |
+        docker build -t ghcr.io/termux/package-builder:latest scripts/
+        docker buildx prune -af
+
+    - name: Load Docker image
+      if: ${{ steps.build-info.outputs.free-space == 'true' && steps.build-info.outputs.skip-building != 'true' }}
+      run: |
+        ./scripts/run-docker.sh echo ""
+
     - name: Free additional disk space (if needed)
-      if: ${{ steps.build-info.outputs.docker-build == 'false' && steps.build-info.outputs.skip-building != 'true' }}
+      if: ${{ steps.build-info.outputs.free-space == 'true' && steps.build-info.outputs.skip-building != 'true' }}
       run: |
-        ./scripts/setup-ubuntu.sh
-        # need to unset these for setup-android-sdk.sh.
-        unset NDK ANDROID_HOME
-        ./scripts/setup-android-sdk.sh
-        rm -f ${HOME}/lib/ndk-*.zip ${HOME}/lib/sdk-*.zip
-        sudo apt install ninja-build
         ./scripts/free-space.sh
 
     - name: Build packages
       if: ${{ steps.build-info.outputs.skip-building != 'true' }}
-      env:
-        DOCKER_BUILD: ${{ steps.build-info.outputs.docker-build }}
-        TERMUX_DOCKER__CONTAINER_EXEC_COMMAND__PRE_CHECK_IF_WILL_BUILD_PACKAGES: "true"
       run: |
         declare -a packages=()
         for repo_path in $(jq --raw-output 'del(.pkg_format) | keys | .[]' repo.json); do
@@ -263,16 +270,7 @@ jobs:
         echo "packages: ${packages[*]}"
 
         if [[ "${#packages[@]}" -gt 0 ]]; then
-          if [ "$DOCKER_BUILD" == 'false' ]; then
-            # these need to be unset a second time again for ./build-package.sh
-            # when it is run outside of Docker, because GitHub Actions does not
-            # support permanently unsetting variables at time of writing.
-            # https://github.com/actions/runner/issues/1126
-            unset NDK ANDROID_HOME
-            ./build-package.sh -I -C -a "${{ matrix.target_arch }}" "${packages[@]}"
-          else
-            ./scripts/run-docker.sh ./build-package.sh -I -C -a "${{ matrix.target_arch }}" "${packages[@]}"
-          fi
+          ./scripts/run-docker.sh -d ./build-package.sh -I -C -a "${{ matrix.target_arch }}" "${packages[@]}"
         fi
 
     - name: Generate build artifacts
@@ -317,6 +315,10 @@ jobs:
       with:
         name: debs-${{ matrix.target_arch }}-${{ github.sha }}
         path: ./artifacts
+    - name: AppArmor Logs
+      if: always()
+      run: |
+        sudo dmesg | grep apparmor
 
   test-buildorder-random:
     permissions:

CODEOWNERS

@@ -15,6 +15,10 @@
 /scripts/ @Grimler91 @thunder-coding
 /repo.json @Grimler91 @thunder-coding
 
+# Docker security profiles
+/scripts/profile.json @thunder-coding @licy183
+/scripts/*.apparmor @thunder-coding
+
 # Build script linter
 /scripts/lint-packages.sh @TomJo2000
 

build-package.sh

@@ -149,6 +149,10 @@ source "$TERMUX_SCRIPTDIR/scripts/build/setup/termux_setup_ldc.sh"
 # shellcheck source=scripts/build/setup/termux_setup_no_integrated_as.sh
 source "$TERMUX_SCRIPTDIR/scripts/build/setup/termux_setup_no_integrated_as.sh"
 
+# Utility function for setting up build-python for cross-compilation of Python and crossenv
+# shellcheck source=scripts/build/setup/termux_setup_build_python.sh
+source "$TERMUX_SCRIPTDIR/scripts/build/setup/termux_setup_build_python.sh"
+
 # Utility function for python packages to setup a python.
 # shellcheck source=scripts/build/setup/termux_setup_python_pip.sh
 source "$TERMUX_SCRIPTDIR/scripts/build/setup/termux_setup_python_pip.sh"

clean.sh

@@ -93,5 +93,16 @@ fi
 		rm -Rf "/data/data/.built-packages"
 	fi
 
-	rm -Rf "$TERMUX_TOPDIR"
+	# unmount overlayfs before we remove the parent directory
+	[ -d "$TERMUX_TOPDIR" ] && for dir in $(find "$TERMUX_TOPDIR" -type d); do
+		if mountpoint -q "$dir"; then
+			umount "$dir"
+		fi
+	done
+
+	# We can't use rm -Rf "$TERMUX_TOPDIR" in case the "$TERMUX_TOPDIR" is mounted as a Docker volume
+	if [ -d "$TERMUX_TOPDIR" ]; then
+		find "$TERMUX_TOPDIR" -type f,l -delete
+		find "$TERMUX_TOPDIR" -type d ! -path "$TERMUX_TOPDIR" -delete
+	fi
 } 5< "$TERMUX_BUILD_LOCK_FILE"

packages/at-spi2-core/build.sh

@@ -3,6 +3,7 @@ TERMUX_PKG_DESCRIPTION="Assistive Technology Service Provider Interface (AT-SPI)
 TERMUX_PKG_LICENSE="LGPL-2.1"
 TERMUX_PKG_MAINTAINER="@termux"
 TERMUX_PKG_VERSION="2.58.3"
+TERMUX_PKG_REVISION=1
 TERMUX_PKG_SRCURL=https://download.gnome.org/sources/at-spi2-core/${TERMUX_PKG_VERSION%.*}/at-spi2-core-${TERMUX_PKG_VERSION}.tar.xz
 TERMUX_PKG_SHA256=b0fabea6c9742eda8c9c675f9b8c1d1babba1da82da03ea1103710233717c1b0
 TERMUX_PKG_AUTO_UPDATE=true

packages/dbus-python/build.sh

@@ -3,7 +3,7 @@ TERMUX_PKG_DESCRIPTION="Python bindings for D-Bus"
 TERMUX_PKG_LICENSE="MIT"
 TERMUX_PKG_MAINTAINER="@termux"
 TERMUX_PKG_VERSION="1.4.0"
-TERMUX_PKG_REVISION=1
+TERMUX_PKG_REVISION=2
 TERMUX_PKG_SRCURL=https://gitlab.freedesktop.org/dbus/dbus-python/-/archive/dbus-python-${TERMUX_PKG_VERSION}/dbus-python-dbus-python-${TERMUX_PKG_VERSION}.tar.gz
 TERMUX_PKG_SHA256=da4ee9bbb9eb901d463a7cc9f99dfdbe6c751c8b48b29b78d378985a3c9656ad
 TERMUX_PKG_AUTO_UPDATE=true

packages/gst-python/build.sh

@@ -3,6 +3,7 @@ TERMUX_PKG_DESCRIPTION="Python bindings for GStreamer"
 TERMUX_PKG_LICENSE="LGPL-2.1"
 TERMUX_PKG_MAINTAINER="@termux"
 TERMUX_PKG_VERSION="1.28.1"
+TERMUX_PKG_REVISION=1
 TERMUX_PKG_SRCURL=https://gstreamer.freedesktop.org/src/gst-python/gst-python-${TERMUX_PKG_VERSION}.tar.xz
 TERMUX_PKG_SHA256=d47cea95adb95ba10443ed7812c7c5fa0807aef43b98cd1c6d8fb9f9a86f7085
 TERMUX_PKG_AUTO_UPDATE=true

packages/libunbound/build.sh

@@ -3,7 +3,7 @@ TERMUX_PKG_DESCRIPTION="A validating, recursive, caching DNS resolver"
 TERMUX_PKG_LICENSE="BSD 3-Clause"
 TERMUX_PKG_MAINTAINER="@termux"
 TERMUX_PKG_VERSION="1.24.2"
-TERMUX_PKG_REVISION=1
+TERMUX_PKG_REVISION=2
 TERMUX_PKG_SRCURL=https://nlnetlabs.nl/downloads/unbound/unbound-${TERMUX_PKG_VERSION}.tar.gz
 TERMUX_PKG_SHA256=44e7b53e008a6dcaec03032769a212b46ab5c23c105284aa05a4f3af78e59cdb
 TERMUX_PKG_AUTO_UPDATE=true

packages/libxml2/build.sh

@@ -3,7 +3,7 @@ TERMUX_PKG_DESCRIPTION="Library for parsing XML documents"
 TERMUX_PKG_LICENSE="MIT"
 TERMUX_PKG_MAINTAINER="@termux"
 TERMUX_PKG_VERSION="2.15.1"
-TERMUX_PKG_REVISION=1
+TERMUX_PKG_REVISION=2
 TERMUX_PKG_SRCURL=https://download.gnome.org/sources/libxml2/${TERMUX_PKG_VERSION%.*}/libxml2-${TERMUX_PKG_VERSION}.tar.xz
 TERMUX_PKG_SHA256=c008bac08fd5c7b4a87f7b8a71f283fa581d80d80ff8d2efd3b26224c39bc54c
 TERMUX_PKG_AUTO_UPDATE=true

packages/nala/build.sh

@@ -3,7 +3,7 @@ TERMUX_PKG_DESCRIPTION="Commandline frontend for the apt package manager"
 TERMUX_PKG_LICENSE="GPL-3.0"
 TERMUX_PKG_MAINTAINER="@termux"
 TERMUX_PKG_VERSION="0.16.0"
-TERMUX_PKG_REVISION=1
+TERMUX_PKG_REVISION=2
 TERMUX_PKG_SRCURL=https://gitlab.com/volian/nala/-/archive/v${TERMUX_PKG_VERSION}/nala-v${TERMUX_PKG_VERSION}.tar.bz2
 TERMUX_PKG_SHA256=49e384aa3b94597d09c61b7accc41d1cf10cb6beea85d4620c80c28d7cdc4d5f
 TERMUX_PKG_DEPENDS="python-apt, python-pip"

packages/pycairo/build.sh

@@ -3,6 +3,7 @@ TERMUX_PKG_DESCRIPTION="Python bindings for the cairo graphics library"
 TERMUX_PKG_LICENSE="LGPL-2.1"
 TERMUX_PKG_MAINTAINER="@termux"
 TERMUX_PKG_VERSION="1.29.0"
+TERMUX_PKG_REVISION=1
 TERMUX_PKG_SRCURL=https://github.com/pygobject/pycairo/releases/download/v${TERMUX_PKG_VERSION}/pycairo-${TERMUX_PKG_VERSION}.tar.gz
 TERMUX_PKG_SHA256=f3f7fde97325cae80224c09f12564ef58d0d0f655da0e3b040f5807bd5bd3142
 TERMUX_PKG_AUTO_UPDATE=true

packages/pygobject/build.sh

@@ -3,6 +3,7 @@ TERMUX_PKG_DESCRIPTION="Python package which provides bindings for GObject based
 TERMUX_PKG_LICENSE="LGPL-2.1"
 TERMUX_PKG_MAINTAINER="@termux"
 TERMUX_PKG_VERSION="3.56.0"
+TERMUX_PKG_REVISION=1
 TERMUX_PKG_SRCURL=https://download.gnome.org/sources/pygobject/${TERMUX_PKG_VERSION%.*}/pygobject-${TERMUX_PKG_VERSION}.tar.gz
 TERMUX_PKG_SHA256=4fbb5bf47524e01026f8e309dd54233eb0f75f2281392c5bf0df5d9041cc7891
 TERMUX_PKG_AUTO_UPDATE=true

packages/python-apt/build.sh

@@ -3,6 +3,7 @@ TERMUX_PKG_DESCRIPTION="Python bindings for APT"
 TERMUX_PKG_LICENSE="GPL-2.0"
 TERMUX_PKG_MAINTAINER="@termux"
 TERMUX_PKG_VERSION="3.1.0"
+TERMUX_PKG_REVISION=1
 TERMUX_PKG_SRCURL=https://ftp.debian.org/debian/pool/main/p/python-apt/python-apt_${TERMUX_PKG_VERSION}.tar.xz
 TERMUX_PKG_SHA256=daf46b0ed85061ccee64c3aa3004c695b33047f9f62f0de7863966c287731d5a
 TERMUX_PKG_DEPENDS="apt, libandroid-support, libc++, python"

packages/python-cmake/build.sh

@@ -3,6 +3,7 @@ TERMUX_PKG_DESCRIPTION="Python wrapper for CMake"
 TERMUX_PKG_LICENSE="Apache-2.0"
 TERMUX_PKG_MAINTAINER="@termux"
 TERMUX_PKG_VERSION="4.2.3"
+TERMUX_PKG_REVISION=1
 TERMUX_PKG_SRCURL="https://github.com/scikit-build/cmake-python-distributions/archive/refs/tags/$TERMUX_PKG_VERSION.tar.gz"
 TERMUX_PKG_SHA256=6d563b85888e26789d1dbf0ecf1df142cabe6bf4bac9d134cadc0e638a3f2638
 TERMUX_PKG_DEPENDS="cmake, cmake-curses-gui, python, python-pip"

packages/python-lxml/build.sh

@@ -3,6 +3,7 @@ TERMUX_PKG_DESCRIPTION="Python binding for the libxml2 and libxslt libraries"
 TERMUX_PKG_LICENSE="MIT"
 TERMUX_PKG_MAINTAINER="@termux"
 TERMUX_PKG_VERSION="6.0.2"
+TERMUX_PKG_REVISION=1
 TERMUX_PKG_SRCURL=https://github.com/lxml/lxml/releases/download/lxml-$TERMUX_PKG_VERSION/lxml-$TERMUX_PKG_VERSION.tar.gz
 TERMUX_PKG_SHA256=cd79f3367bd74b317dda655dc8fcfa304d9eb6e4fb06b7168c5cf27f96e0cd62
 TERMUX_PKG_DEPENDS="libxml2, libxslt, python, python-pip"

packages/python-numpy/build.sh

@@ -4,7 +4,7 @@ TERMUX_PKG_LICENSE="BSD 3-Clause"
 TERMUX_PKG_MAINTAINER="@termux"
 # Revbump revdeps after updating
 TERMUX_PKG_VERSION="2.2.5"
-TERMUX_PKG_REVISION=3
+TERMUX_PKG_REVISION=4
 TERMUX_PKG_SRCURL=git+https://github.com/numpy/numpy
 TERMUX_PKG_DEPENDS="libc++, libopenblas, python"
 TERMUX_PKG_AUTO_UPDATE=false
@@ -73,6 +73,6 @@ termux_step_make() {
 
 termux_step_make_install() {
 	local _pyv="${TERMUX_PYTHON_VERSION/./}"
-	local _whl="numpy-$TERMUX_PKG_VERSION-cp$_pyv-cp$_pyv-linux_$TERMUX_ARCH.whl"
+	local _whl="numpy-$TERMUX_PKG_VERSION-cp$_pyv-cp$_pyv-android_$TERMUX_ARCH.whl"
 	pip install --no-deps --prefix=$TERMUX_PREFIX --force-reinstall $TERMUX_PKG_SRCDIR/dist/$_whl
 }

packages/python-pip/android-api-abi.patch

@@ -0,0 +1,14 @@
+Allow installing without specifying abi version. Needed for crossenv specifically.
+May not be needed for on-device, but let's just keep it just in case in case there is some psycho who is doing this already
+diff --git a/src/pip/_vendor/packaging/tags.py b/src/pip/_vendor/packaging/tags.py
+index 8522f59c4..ef55342fb 100644
+--- a/src/pip/_vendor/packaging/tags.py
++++ b/src/pip/_vendor/packaging/tags.py
+@@ -563,6 +563,7 @@ def android_platforms(
+     # without major patching. Yield every API level from the maximum down to the
+     # minimum, inclusive.
+     min_api_level = 16
++    yield f"android_{abi}"
+     for ver in range(api_level, min_api_level - 1, -1):
+         yield f"android_{ver}_{abi}"
+

packages/python/0001-fix-hardcoded-paths.patch

@@ -1,26 +1,3 @@
---- a/Lib/aifc.py
-+++ b/Lib/aifc.py
-@@ -920,7 +920,7 @@
- if __name__ == '__main__':
-     import sys
-     if not sys.argv[1:]:
--        sys.argv.append('/usr/demos/data/audio/bach.aiff')
-+        sys.argv.append('@TERMUX_PREFIX@/demos/data/audio/bach.aiff')
-     fn = sys.argv[1]
-     with open(fn, 'r') as f:
-         print("Reading", fn)
---- a/Lib/mailcap.py
-+++ b/Lib/mailcap.py
-@@ -55,7 +55,8 @@
-             # Don't bother with getpwuid()
-             home = '.' # Last resort
-         mailcaps = [home + '/.mailcap', '/etc/mailcap',
--                '/usr/etc/mailcap', '/usr/local/etc/mailcap']
-+                '/usr/etc/mailcap', '/usr/local/etc/mailcap',
-+                '@TERMUX_PREFIX@/etc/mailcap']
-     return mailcaps
-
-
 --- a/Lib/mimetypes.py
 +++ b/Lib/mimetypes.py
 @@ -49,6 +49,7 @@

packages/python/0005-impl-multiprocessing.patch

@@ -10,18 +10,6 @@
              _dir_candidates = []
 
 
---- a/Modules/_multiprocessing/multiprocessing.c
-+++ b/Modules/_multiprocessing/multiprocessing.c
-@@ -172,7 +172,7 @@
-     _MULTIPROCESSING_RECV_METHODDEF
-     _MULTIPROCESSING_SEND_METHODDEF
- #endif
--#if !defined(POSIX_SEMAPHORES_NOT_ENABLED) && !defined(__ANDROID__)
-+#if !defined(POSIX_SEMAPHORES_NOT_ENABLED)
-     _MULTIPROCESSING_SEM_UNLINK_METHODDEF
- #endif
-     {NULL}
-
 --- a/Modules/_multiprocessing/posixshmem.c
 +++ b/Modules/_multiprocessing/posixshmem.c
 @@ -11,6 +11,72 @@

packages/python/0006-disable-multiarch.patch

@@ -0,0 +1,12 @@
+diff --git a/configure.ac b/configure.ac
+index 597a44b331a..fa78e09c192 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1134,6 +1134,7 @@ dnl architecture. PLATFORM_TRIPLET will be a pair or single value for these
+ dnl platforms.
+ AC_MSG_CHECKING([for multiarch])
+ AS_CASE([$ac_sys_system],
++  [Linux-android], [MULTIARCH=""],
+   [Darwin*], [MULTIARCH=""],
+   [iOS], [MULTIARCH=""],
+   [FreeBSD*], [MULTIARCH=""],