From 5d8eafbc8850e265197520d624cec89477e91ea3 Mon Sep 17 00:00:00 2001 From: ethernet Date: Thu, 8 Oct 2026 15:31:36 -0400 Subject: [PATCH 1/2] fix(termux): keep apt's libc++ ahead of the payload's on the build linker path The wheelhouse build stage still compiled cmake from PyPI source (pillow -> pybind11 -> cmake bootstrap, exit 11) after the Dockerfile and the apt install began upgrading libc++ to 30. LD_LIBRARY_PATH put the payload's pinned libc++ 29 first, and a library found there beats the binary's own RUNPATH, so apt's cmake died with 'cannot locate symbol _ZNSt6__ndk113__hash_memoryEPKvm' and scikit-build-core read that as 'no cmake'. Probed in the pinned termux-docker image under qemu with the same apt package list: payload libc++ 29 first fails, a one-symlink dir to the system libc++ in front of it starts cmake and clang. The build now makes that dir after apt runs and fails fast if cmake cannot start, instead of burning 30 minutes compiling cpython, cryptography and pillow first. --- scripts/termux/termux_build.sh | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/scripts/termux/termux_build.sh b/scripts/termux/termux_build.sh index c0b20bd213..9c26492129 100755 --- a/scripts/termux/termux_build.sh +++ b/scripts/termux/termux_build.sh @@ -44,7 +44,14 @@ if [ "${1:-}" = "--in-container" ]; then # (linkerconfig on-device). Inside the container the tree lives at # $PAYLOAD_ROOT/python$PREFIX, so the dynamic linker needs to be told # where the payload's libs live before any staged binary runs. - export LD_LIBRARY_PATH="$PAYLOAD_ROOT/python$PREFIX/lib:$PAYLOAD_ROOT/node$PREFIX/lib:$PAYLOAD_ROOT/runtime-libs/lib:$PREFIX/lib" + # $SYSTEM_LIBCXX_DIR leads on purpose. The payload pins libc++ 29, but the toolchain below + # needs the libc++ 30 that apt installs, and a library found on LD_LIBRARY_PATH beats the + # binary's own RUNPATH. With the payload dir first, apt's cmake cannot start, scikit-build-core + # reads that as "no cmake" and compiles one from PyPI source (pillow -> pybind11 -> cmake + # bootstrap). The dir holds only that one symlink, made after apt runs, so no other payload + # lib is shadowed. + SYSTEM_LIBCXX_DIR="$PREFIX/tmp/system-libcxx" + export LD_LIBRARY_PATH="$SYSTEM_LIBCXX_DIR:$PAYLOAD_ROOT/python$PREFIX/lib:$PAYLOAD_ROOT/node$PREFIX/lib:$PAYLOAD_ROOT/runtime-libs/lib:$PREFIX/lib" if [ -n "$PAYLOAD_ROOT" ] && [ -x "$STAGED_PY" ]; then PY="$STAGED_PY" log "Using the staged payload Python ($PY)" @@ -77,6 +84,10 @@ if [ "${1:-}" = "--in-container" ]; then libyaml openssl readline zlib liblzma libsqlite ncurses \ || fail "apt install of the build toolchain failed" fi + mkdir -p "$SYSTEM_LIBCXX_DIR" + ln -sf "$PREFIX/lib/libc++_shared.so" "$SYSTEM_LIBCXX_DIR/libc++_shared.so" + cmake -E capabilities >/dev/null 2>&1 \ + || fail "container cmake cannot start; the wheel build would compile cmake from source" # BINARIES, not package names: the rust package provides rustc/cargo # (there is no `rust` binary). for tool in clang rustc cargo make git; do From 7ad6fd69d7a6a80048becff9d90e2da8c01f9298 Mon Sep 17 00:00:00 2001 From: ethernet Date: Thu, 8 Oct 2026 15:50:12 -0400 Subject: [PATCH 2/2] fix(termux): repin the termux pool and drop the libc++ shadow shim The payload pinned libc++ 29 while the build container's apt cmake needs 30, so the two disagreed and the shim in the previous commit papered over it. The pool has since retired 17 of our pins, so repin them all with `hermes pm update --termux`, which fixes the mismatch at the source. Repinned: libc++ 29 -> 30 plus 14 more runtime libs (fribidi, glib, harfbuzz, libaom, libbluray, libexpat, libheif, libmp3lame, libpng, libvidstab, openssl, pcre2, readline, vulkan-loader-generic) and the bionic lock rows for uv 0.12.15 -> 0.12.23 and ffmpeg 8.1.2-5 -> 8.1.3. The pool serves ffmpeg 8.1.3 only, so that row moves back from 9.0.1 as the pool has it. Staging with the new table succeeds: 84 packages, 269 .so, same counts as before. The libc++ SONAME is unchanged. The one unresolved DT_NEEDED (libharfbuzz-cairo -> libcairo) is present on the old table too. The shim is removed. What stays from it is the in-container `cmake -E capabilities` check, which fails in 2 minutes if the table drifts from the pool again, instead of after 30 minutes of compiling. --- pm/lock.json | 8 +-- pm/termux_runtime_libs.json | 90 +++++++++++++++++----------------- scripts/termux/termux_build.sh | 16 ++---- 3 files changed, 54 insertions(+), 60 deletions(-) diff --git a/pm/lock.json b/pm/lock.json index baa77b9674..800fdda389 100644 --- a/pm/lock.json +++ b/pm/lock.json @@ -132,8 +132,8 @@ "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-31-13-27/ffmpeg-n9.0.1-11-ge47273f4d9-linuxarm64-gpl-9.0.tar.xz" }, "linux-arm64-bionic": { - "sha256": "1ec37f4f092521cb785e0ccfa2d82cc4a79ec8d2a4864f5eefc50a314f2d5dec", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/f/ffmpeg/ffmpeg_8.1.2-5_aarch64.deb" + "sha256": "07c8f7d6afb11396aab3a67564415658ad761b5a7d67a9bc598bc2c734651e0a", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/f/ffmpeg/ffmpeg_8.1.3_aarch64.deb" }, "linux-x64": { "sha256": "182c1b509720e939bb47bfb47dc29cc0c298640401128e3dce8627d10707eb5a", @@ -623,8 +623,8 @@ "url": "https://github.com/astral-sh/uv/releases/download/0.12.3/uv-aarch64-unknown-linux-gnu.tar.gz" }, "linux-arm64-bionic": { - "sha256": "6bacc745de035ac87cb6948f495f8d82a0fe0c6e6ff2ca65e6ecf487973b09cd", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/u/uv/uv_0.12.15_aarch64.deb" + "sha256": "d174f8397eeff5aefdf798add7abeee1294e1662eeb6d52b6b160ae0e47f7f43", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/u/uv/uv_0.12.23_aarch64.deb" }, "linux-arm64-musl": { "sha256": "fa513fca1eb2913334c944fe9adbdd410274a1cbe8dd05d03699a9eb85311d4e", diff --git a/pm/termux_runtime_libs.json b/pm/termux_runtime_libs.json index 2ba79b76a7..a4a6bef146 100644 --- a/pm/termux_runtime_libs.json +++ b/pm/termux_runtime_libs.json @@ -32,9 +32,9 @@ "version": "2.14.3" }, "fribidi": { - "sha256": "a15369457781dbe0af15344d9d184f22ad5da4a7546f94c44c3614646d1f6904", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/f/fribidi/fribidi_1.0.16-1_aarch64.deb", - "version": "1.0.16-1" + "sha256": "879a180b10e105600fb6033f15eff0987eb48ae11f1b87beeca803aab84b8666", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/f/fribidi/fribidi_1.0.17_aarch64.deb", + "version": "1.0.17" }, "game-music-emu": { "sha256": "ffe1c43919d485409b2459d462b2dc6389492afeea869aef701b391a4ed29c67", @@ -47,9 +47,9 @@ "version": "1.26-1" }, "glib": { - "sha256": "fee438e69505cda78f29e6662afb04613947f56db3e8d1557f25a0a5c3ea7c9c", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/g/glib/glib_2.90.0_aarch64.deb", - "version": "2.90.0" + "sha256": "132d8ce961d96a7252fd4bc2228bddd385b1b17b706a46caae6d541ae0e4b2c0", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/g/glib/glib_2.90.1_aarch64.deb", + "version": "2.90.1" }, "glslang": { "sha256": "c5b5d6cb57d5841966c4b07033d319ebf6a3df61347a484b9dc5e332d29cd721", @@ -57,9 +57,9 @@ "version": "16.6.0" }, "harfbuzz": { - "sha256": "7f39fffee18a0956f65d2d3b8e86a36204829cf44f09d36c27d5e5177f36d360", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/h/harfbuzz/harfbuzz_14.4.0_aarch64.deb", - "version": "14.4.0" + "sha256": "eeeebc3cb1d10612ef5e53c1ecdf1b15f36889592e847d10774f350ba07ecf74", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/h/harfbuzz/harfbuzz_14.6.0_aarch64.deb", + "version": "14.6.0" }, "highway": { "sha256": "71b8e0c231ab6b66827374543d55997a5cb02d8882f5d53e059ba78cd2511da1", @@ -87,9 +87,9 @@ "version": "29-1" }, "libaom": { - "sha256": "f284096506dbdeb160ac09d803948b8fb3ad26535361776535ec43d87f185841", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/liba/libaom/libaom_3.15.0_aarch64.deb", - "version": "3.15.0" + "sha256": "87ece0ac014c683b519d9f40045f62e02f1b175a73002b93d44d4a3fb0f8a537", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/liba/libaom/libaom_3.15.1_aarch64.deb", + "version": "3.15.1" }, "libass": { "sha256": "4f94205285ea2062be4f60e695723a6f3350339ec89720943b0dce5ae30db01d", @@ -97,9 +97,9 @@ "version": "0.17.5" }, "libbluray": { - "sha256": "8045df20cfb42de55c14990137391a0cb2f72fa709df672e86e0ebb6107fbf39", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/libb/libbluray/libbluray_1.5.0_aarch64.deb", - "version": "1.5.0" + "sha256": "fbe931e6a7d9604fe865bd24b8012ad3b7f04c6bbb6cf9b277760db1b4a8df7e", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/libb/libbluray/libbluray_1.5.1_aarch64.deb", + "version": "1.5.1" }, "libbs2b": { "sha256": "c71660d99e4baa064ba93f0ef750b6b2ea0d1d494a754cf1c67b550bb4baa91d", @@ -112,9 +112,9 @@ "version": "1.0.8-8" }, "libc++": { - "sha256": "bb9f12113c137aa0e8513bb51cc49fe77a5ce3ca39ab9e92c57d228ecdf00222", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/libc/libc++/libc++_29_aarch64.deb", - "version": "29" + "sha256": "53d0b84a7ba7459024257cb94d5b136fe13ef858567f65a8064b35950799f2ca", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/libc/libc++/libc++_30_aarch64.deb", + "version": "30" }, "libcrypt": { "sha256": "6c283eed576b98cc3568f99638156f8588f77d979579d03bef8683d6eb8601e1", @@ -142,9 +142,9 @@ "version": "7.1.1" }, "libexpat": { - "sha256": "71934cf00b404627702034bd1308cb58353dd851d9a2d3ecd9205b4ae6a67a27", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/libe/libexpat/libexpat_2.8.4_aarch64.deb", - "version": "2.8.4" + "sha256": "f8a104e8227c9c181f6818658a3ee2fa4c107fac94219b068144fc6591086cdb", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/libe/libexpat/libexpat_2.9.0_aarch64.deb", + "version": "2.9.0" }, "libffi": { "sha256": "4f255badf74cd31f6a2801c17fa1444199c84c834b517b7c843e2fe9ebe91d77", @@ -157,9 +157,9 @@ "version": "1.3.15" }, "libheif": { - "sha256": "78c53ef6df843f01abc65d79ea6e4253965b64b918ca6d6b0ba10ce069b56c50", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/libh/libheif/libheif_1.23.4_aarch64.deb", - "version": "1.23.4" + "sha256": "14681f626daef5eac65bbfce8eadcc3add8fb881de3fafa2ea3014c6f8b46ffe", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/libh/libheif/libheif_1.23.6_aarch64.deb", + "version": "1.23.6" }, "libiconv": { "sha256": "fe9481b1dc101c6c3552943f25435109fd522aecc615ae49594f9fbee863bb37", @@ -187,9 +187,9 @@ "version": "5.8.4" }, "libmp3lame": { - "sha256": "8c28c74209eb5c31675b4e9c1ee5193c1bf22c49ff5965612dcf9aede5d870d9", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/libm/libmp3lame/libmp3lame_3.100-7_aarch64.deb", - "version": "3.100-7" + "sha256": "59f70ad8885578063bcbea3b11e74fb69e2416ca036b47aa255c1fa4f074565e", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/libm/libmp3lame/libmp3lame_4.0-1_aarch64.deb", + "version": "4.0-1" }, "libmpg123": { "sha256": "883b104faae53820b2e758363300ccf99e28f627a263d766af61ae07b73b07b3", @@ -227,9 +227,9 @@ "version": "7.360.1" }, "libpng": { - "sha256": "e47937405c72734867513cf0c63d27f36400d462666b65dfada984667d7228c4", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/libp/libpng/libpng_1.6.58_aarch64.deb", - "version": "1.6.58" + "sha256": "32d61f0b1a60cf7283aa3a80e288737493df2c6b84c8c749606b77c94a10f2b2", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/libp/libpng/libpng_1.6.59_aarch64.deb", + "version": "1.6.59" }, "librav1e": { "sha256": "ac7842a5896bdff1b4d4974d9c02e60f7d4a587b8618df691118a8591f8dbccf", @@ -282,9 +282,9 @@ "version": "1.2.0" }, "libvidstab": { - "sha256": "4611cb90ee015b02bf69b5da9031aff64ae1ec11589986e58e37ea6dfe6f4cd4", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/libv/libvidstab/libvidstab_1.1.1-3_aarch64.deb", - "version": "1.1.1-3" + "sha256": "598d1c5ea7de4e4c76aa2198602e3dc35684671d9690e69d665058d55a89ab75", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/libv/libvidstab/libvidstab_1.1.2_aarch64.deb", + "version": "1.1.2" }, "libvmaf": { "sha256": "8c65e85997426c00ce6a419343eb820e164d725e4b267e268a9e8e351e2f9001", @@ -382,19 +382,19 @@ "version": "2.5.4" }, "openssl": { - "sha256": "86760e9ce736f463236f2c15b1eb3a3fdcfc5778d0fd7077a917448dcc90f3aa", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/o/openssl/openssl_1:3.6.3_aarch64.deb", - "version": "1:3.6.3" + "sha256": "a2fb7856875e63ef6b90442752e05974813372c3ca86d2513a78ea43c67a0f8b", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/o/openssl/openssl_1:3.6.5_aarch64.deb", + "version": "1:3.6.5" }, "pcre2": { - "sha256": "51f915d22de639bfca6ec029ae613987bbe3bc73626eede13319fd2e95f50b63", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/p/pcre2/pcre2_10.47_aarch64.deb", - "version": "10.47" + "sha256": "c27995e5f52b8ecc9b8b3e662eb08e49f82a18bfd3f34343936acc7b23964724", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/p/pcre2/pcre2_10.49_aarch64.deb", + "version": "10.49" }, "readline": { - "sha256": "e50fb67f40753247dbb83efb17c7fbee0ac868ffcb5b5555d44d76ec8d90b4b1", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/r/readline/readline_8.3.3_aarch64.deb", - "version": "8.3.3" + "sha256": "616cc73009bc0223f61caed8dd09455714455aa5ea5e180126e2f69c4c775136", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/r/readline/readline_8.3.6_aarch64.deb", + "version": "8.3.6" }, "rubberband": { "sha256": "1172030a1e3ed70976114c8ca3eb4da0b82c1714825bd751ac1ada606dbc685a", @@ -407,9 +407,9 @@ "version": "4.2.0" }, "vulkan-loader-generic": { - "sha256": "f830c374fae2b3d421de401185e4171ff52b706701a1d9e19ab17281a84893ac", - "url": "https://packages.termux.dev/apt/termux-main/pool/main/v/vulkan-loader-generic/vulkan-loader-generic_1.4.362_aarch64.deb", - "version": "1.4.362" + "sha256": "99b22e01c966aa1e3dc4ab827508ccc256bebe3fafb20cf7c4883e965a7c3311", + "url": "https://packages.termux.dev/apt/termux-main/pool/main/v/vulkan-loader-generic/vulkan-loader-generic_1.4.365_aarch64.deb", + "version": "1.4.365" }, "xvidcore": { "sha256": "2f358b11fd750935b43ac19f09bb7c4228e007079426e0b73ee8bae1ddf26fc1", diff --git a/scripts/termux/termux_build.sh b/scripts/termux/termux_build.sh index 9c26492129..b351618ecb 100755 --- a/scripts/termux/termux_build.sh +++ b/scripts/termux/termux_build.sh @@ -44,14 +44,7 @@ if [ "${1:-}" = "--in-container" ]; then # (linkerconfig on-device). Inside the container the tree lives at # $PAYLOAD_ROOT/python$PREFIX, so the dynamic linker needs to be told # where the payload's libs live before any staged binary runs. - # $SYSTEM_LIBCXX_DIR leads on purpose. The payload pins libc++ 29, but the toolchain below - # needs the libc++ 30 that apt installs, and a library found on LD_LIBRARY_PATH beats the - # binary's own RUNPATH. With the payload dir first, apt's cmake cannot start, scikit-build-core - # reads that as "no cmake" and compiles one from PyPI source (pillow -> pybind11 -> cmake - # bootstrap). The dir holds only that one symlink, made after apt runs, so no other payload - # lib is shadowed. - SYSTEM_LIBCXX_DIR="$PREFIX/tmp/system-libcxx" - export LD_LIBRARY_PATH="$SYSTEM_LIBCXX_DIR:$PAYLOAD_ROOT/python$PREFIX/lib:$PAYLOAD_ROOT/node$PREFIX/lib:$PAYLOAD_ROOT/runtime-libs/lib:$PREFIX/lib" + export LD_LIBRARY_PATH="$PAYLOAD_ROOT/python$PREFIX/lib:$PAYLOAD_ROOT/node$PREFIX/lib:$PAYLOAD_ROOT/runtime-libs/lib:$PREFIX/lib" if [ -n "$PAYLOAD_ROOT" ] && [ -x "$STAGED_PY" ]; then PY="$STAGED_PY" log "Using the staged payload Python ($PY)" @@ -84,10 +77,11 @@ if [ "${1:-}" = "--in-container" ]; then libyaml openssl readline zlib liblzma libsqlite ncurses \ || fail "apt install of the build toolchain failed" fi - mkdir -p "$SYSTEM_LIBCXX_DIR" - ln -sf "$PREFIX/lib/libc++_shared.so" "$SYSTEM_LIBCXX_DIR/libc++_shared.so" + # The payload's libc++ leads LD_LIBRARY_PATH, so it must be the one apt's cmake needs. If the + # pin table drifts from the pool, cmake cannot start and scikit-build-core compiles one from + # PyPI source, which takes 30 minutes to fail. Say so now. cmake -E capabilities >/dev/null 2>&1 \ - || fail "container cmake cannot start; the wheel build would compile cmake from source" + || fail "container cmake cannot start (payload libc++ older than apt's? run: hermes pm update --termux)" # BINARIES, not package names: the rust package provides rustc/cargo # (there is no `rust` binary). for tool in clang rustc cargo make git; do