bryan-minimal · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
@@ -0,0 +1,100 @@
+let { Attrs, BuildSpec, Local, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
+let { target, .. } = import "config.ncl" in
+let base = import "../base/build.ncl" in
+let unzip = import "../unzip/build.ncl" in
+let glibc = import "../glibc/build.ncl" in
+let gcc = import "../gcc/build.ncl" in
+let nss = import "../nss/build.ncl" in
+let nspr = import "../nspr/build.ncl" in
+let glib = import "../glib/build.ncl" in
+let libxcb = import "../libxcb/build.ncl" in
+# The amd64 build also links libdbus-1 (the arm64 one does not).
+let dbus = import "../dbus/build.ncl" in
+let chromium-headless-shell-bin = import "../chromium-headless-shell-bin/build.ncl" in
+
+# ChromeDriver from Chrome for Testing, at the SAME version as
+# chromium-headless-shell-bin (ChromeDriver refuses a browser of a
+# different major). Lets Selenium-driven browser tests (Rails system
+# tests, Capybara + selenium-webdriver) run against packaged binaries
+# instead of Selenium Manager downloading an unpinned Chrome + driver
+# (~400 MB) at test time. Point Selenium at them with SE_OFFLINE=true and
+# the browser/driver paths (see the test below).
+#
+# License: the CfT chromedriver zip carries LICENSE.chromedriver, the
+# Chromium BSD-3-Clause grant, with no proprietary terms (unlike the full
+# CfT `chrome` bundle, which ships Widevine). Re-checked at 155.0.8059.84.
+#
+# The version is NOT pinned here: it is chromium-headless-shell-bin's
+# `upstream_version`, so the pair cannot drift. Bumping the browser changes
+# the URLs below, and this package's build then fails on the two sha256s
+# until they are updated in the same change. That failure is the point:
+# a silent mismatch would ship a driver that refuses the browser.
+let browser_version = chromium-headless-shell-bin.attrs.upstream_version in
+{
+  name = "chromedriver-bin",
+  build_deps = [
+    { file = "build.sh" } | Local,
+    match {
+      { arch = 'Amd64, .. } =>
+        {
+          url = "https://storage.googleapis.com/chrome-for-testing-public/%{browser_version}/linux64/chromedriver-linux64.zip",
+          sha256 = "4fe2433044363e5233d642e70fa50278b471bda08032d922402c8bd7c6d743fd",
+        } | Source,
+      { arch = 'Arm64, .. } =>
+        {
+          url = "https://storage.googleapis.com/chrome-for-testing-public/%{browser_version}/linux-arm64/chromedriver-linux-arm64.zip",
+          sha256 = "738853f050812e78e249c2ba8b46e4b6dfee9521bbfdd86d04f882fbf4ef5f47",
+        } | Source,
+    } target,
+    base,
+    unzip,
+  ],
+  runtime_deps = [
+    glibc,
+    gcc,
+    nss,
+    nspr,
+    glib,
+    libxcb,
+    dbus,
+  ],
+  cmd = "./build.sh",
+  outputs = {
+    chromedriver = { glob = "usr/bin/chromedriver" } | OutputBin,
+    licenses = { glob = "usr/share/licenses/chromedriver/**" } | OutputData,
+  },
+  attrs =
+    {
+      upstream_version = browser_version,
+      license_spdx = "BSD-3-Clause",
+      source_provenance = {
+        category = 'GithubRepo,
+        owner = "GoogleChromeLabs",
+        repo = "chrome-for-testing",
+      },
+      binary_from =
+        match {
+          { arch = 'Amd64, .. } => "https://storage.googleapis.com/chrome-for-testing-public/%{browser_version}/linux64/chromedriver-linux64.zip",
+          { arch = 'Arm64, .. } => "https://storage.googleapis.com/chrome-for-testing-public/%{browser_version}/linux-arm64/chromedriver-linux-arm64.zip",
+        } target,
+    } | Attrs,
+  tests = {
+    # Explicit argv + base: the string form of standaloneTest runs under a
+    # shell, and this package (unlike headless-shell's wrapper) ships none.
+    smoketest =
+      {
+        class = 'Standalone,
+        test_deps = [base],
+        cmds = [["/bin/chromedriver", "--version"]],
+      } | Test,
+    # The driver must report the same version as the packaged browser.
+    matches_browser =
      {
+        class = 'Standalone,
+        test_deps = [base, chromium-headless-shell-bin],
+        cmds = [
+          ["/bin/bash", "-c", "d=$(/bin/chromedriver --version | awk '{print $2}'); b=$(/bin/chromium-headless-shell --version | grep -oE '[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+'); test \"$d\" = \"$b\" && test \"$d\" = %{browser_version}"],
+        ],
+      } | Test,
+  },
+} | BuildSpec
@@ -0,0 +1,14 @@
+#!/bin/bash
+set -euo pipefail
+# One Chrome for Testing chromedriver zip per arch arrives in the cwd.
+if [ "$(uname -m)" = "x86_64" ]; then
+  unzip -q chromedriver-linux64.zip
+  DIR=chromedriver-linux64
+else
+  unzip -q chromedriver-linux-arm64.zip
+  DIR=chromedriver-linux-arm64
+fi
+[ -x "$DIR/chromedriver" ] || { echo "expected $DIR/chromedriver in the CfT zip" >&2; exit 1; }
+install -Dm755 "$DIR/chromedriver" "$OUTPUT_DIR/usr/bin/chromedriver"
+install -Dm644 "$DIR/LICENSE.chromedriver" "$OUTPUT_DIR/usr/share/licenses/chromedriver/LICENSE"
+install -Dm644 "$DIR/THIRD_PARTY_NOTICES.chromedriver" "$OUTPUT_DIR/usr/share/licenses/chromedriver/THIRD_PARTY_NOTICES"
@@ -0,0 +1,54 @@
+let { Attrs, BuildSpec, Local, Needs, OutputBin, Source, Test, .. } = import "minimal.ncl" in
+let base = import "../base/build.ncl" in
+let go = import "../go/build.ncl" in
+let bash = import "../bash/build.ncl" in
+
+# direnv: loads and unloads per-directory environment (.envrc) as you cd.
+# Evaluates every .envrc with bash, so bash is a runtime dep and its path is
+# baked in (DIRENV_BASH still overrides).
+let version = "2.38.1" in
+{
+  name = "direnv",
+  build_deps = [
+    { file = "build.sh" } | Local,
+    {
+      url = "https://github.com/direnv/direnv/archive/refs/tags/v%{version}.tar.gz",
+      sha256 = "3bd0d49c163204543db8f22f55af8985121db24fe6b21c5b749695e4fbdbb1fe",
+      extract = true,
+      strip_prefix = "direnv-%{version}",
+    } | Source,
+    base,
+    go,
+  ],
+  # Go module downloads.
+  needs =
+    {
+      dns = {},
+      internet = {},
+    } | Needs,
+  cmd = "./build.sh",
+  build_args = {
+    include version,
+  },
+  outputs = {
+    direnv = { glob = "usr/bin/direnv" } | OutputBin,
+  },
+  runtime_deps = [bash],
+  attrs =
+    {
+      upstream_version = version,
+      source_provenance = { category = 'GithubRepo, owner = "direnv", repo = "direnv" },
+      license_spdx = "MIT",
+    } | Attrs,
+  tests = {
+    # Loads an allowed .envrc and exports its variable.
+    envrc =
+      {
+        class = 'Standalone,
+        test_deps = [base],
+        cmds = [
+              ["/bin/bash", "-c", "direnv version | grep -qx %{version} && d=$(mktemp -d) && cd \"$d\" && export HOME=$d XDG_CONFIG_HOME=$d/c XDG_DATA_HOME=$d/d && echo 'export DIRENV_SMOKE=ok' > .envrc && direnv allow . && test \"$(direnv exec . sh -c 'echo $DIRENV_SMOKE')\" = ok"],
+        ],
+      } | Test,
+  },
+} | BuildSpec
@@ -0,0 +1,5 @@
+#!/bin/bash
+set -euo pipefail
+export GOROOT=/usr/go CGO_ENABLED=0
+go build -trimpath -ldflags "-buildid= -s -w -X main.bashPath=/bin/bash" -o direnv .
+install -Dm755 direnv "$OUTPUT_DIR/usr/bin/direnv"
@@ -0,0 +1,46 @@
+let { Attrs, BuildSpec, Local, OutputData, Test, .. } = import "minimal.ncl" in
+let base = import "../base/build.ncl" in
+let glibc = import "../glibc/build.ncl" in
+
+# The C.UTF-8 locale. Minimal sessions run with LANG=C.UTF-8, but the glibc
+# package's locale-archive only carries en_US, so setlocale(LC_ALL, "") fails
+# and anything that checks it breaks. The visible case is PostgreSQL's
+# `initdb`, which refuses with "invalid locale settings; check LANG and LC_*".
+# Shipped as a separate directory-form locale (the same layout Debian uses for
+# C.utf8) so adding it does not rebuild glibc and everything above it. The
+# compiled locale format is tied to the glibc version, so this rebuilds
+# whenever glibc does.
+#
+# TODO: fold `localedef -i C -f UTF-8 C.UTF-8` into glibc's own build.sh the
+# next time glibc is rebuilt for other reasons, then retire this package.
+{
+  name = "glibc-locale-c-utf8",
+  build_deps = [
+    { file = "build.sh" } | Local,
+    base,
+    glibc,
+  ],
+  runtime_deps = [
+    glibc,
+  ],
+  cmd = "./build.sh",
+  outputs = {
+    locale = { glob = "usr/lib/locale/C.utf8/**" } | OutputData,
+  },
+  attrs =
+    {
+      upstream_version = glibc.attrs.upstream_version,
+      license_spdx = "(GPL-2.0-only AND LGPL-2.1-only)",
+    } | Attrs,
+  tests = {
+    # `locale` warns on stderr when LANG names a locale that cannot be loaded.
+    c_utf8_loads =
+      {
+        class = 'Standalone,
+        test_deps = [base],
+        cmds = [
+          ["/bin/bash", "-c", "out=$(LANG=C.UTF-8 LC_ALL= locale 2>&1 >/dev/null); [ -z \"$out\" ] || { echo \"$out\" >&2; exit 1; }; LC_ALL=C.UTF-8 locale charmap | grep -qx UTF-8"],
+        ],
+      } | Test,
+  },
+} | BuildSpec
@@ -0,0 +1,9 @@
+#!/bin/bash
+set -euo pipefail
+# Compile glibc's C.UTF-8 locale in directory (not archive) form. glibc's
+# setlocale() looks in /usr/lib/locale/locale-archive first and then in
+# /usr/lib/locale/<name>/, so this adds the locale without rewriting the
+# archive that the glibc package owns.
+mkdir -p "$OUTPUT_DIR/usr/lib/locale"
+localedef --no-archive -i C -f UTF-8 "$OUTPUT_DIR/usr/lib/locale/C.utf8"
+[ -f "$OUTPUT_DIR/usr/lib/locale/C.utf8/LC_CTYPE" ] || { echo "localedef produced no LC_CTYPE" >&2; exit 1; }
@@ -0,0 +1,60 @@
+let { Attrs, BuildSpec, Local, OutputBin, OutputData, OutputLib, Source, Test, .. } = import "minimal.ncl" in
+let base = import "../base/build.ncl" in
+let make = import "../make/build.ncl" in
+let toolchain = import "../toolchain/build.ncl" in
+let glibc = import "../glibc/build.ncl" in
+let glibc-locale-c-utf8 = import "../glibc-locale-c-utf8/build.ncl" in
+
+# GNU libidn 1.x (IDNA2003), the predecessor of libidn2. Still what some
+# bindings link against, e.g. the idn-ruby gem (used by Mastodon and other
+# Rails apps), which will not build against libidn2.
+let version = "1.44" in
+{
+  name = "libidn",
+  build_deps = [
+    { file = "build.sh" } | Local,
+    {
+      url = "https://ftpmirror.gnu.org/libidn/libidn-%{version}.tar.gz",
+      sha256 = "499608bab3a65650a0ea52888c13a8deebe3f71408e319acd9ec52e02eb13959",
+    } | Source,
+    base,
+    make,
+    toolchain,
+  ],
+  runtime_deps = [
+    glibc,
+  ],
+  cmd = "./build.sh",
+  build_args = {
+    include version,
+  },
+  outputs = {
+    idn = { glob = "usr/bin/idn" } | OutputBin,
+    libs = { glob = "usr/lib/*.so*" } | OutputLib,
+    pkgconfigs = { glob = "usr/lib/pkgconfig/*" } | OutputData,
+    includes = { glob = "usr/include/**" } | OutputData,
+    locales = { glob = "usr/share/locale/**" } | OutputData,
+    emacs = { glob = "usr/share/emacs/**" } | OutputData,
+  },
+  attrs =
+    {
+      upstream_version = version,
+      # Library: LGPL-3.0+ or GPL-2.0+; the idn tool and the rest: GPL-3.0+.
+      license_spdx = "GPL-3.0-or-later AND (GPL-2.0-or-later OR LGPL-3.0-or-later)",
+      source_provenance = {
+        category = 'GnuProject,
+        name = "libidn",
+      },
+    } | Attrs,
+  tests = {
+    # IDNA ToASCII of a non-ASCII label.
+    to_ascii =
+      {
+        class = 'Standalone,
+        test_deps = [base, glibc-locale-c-utf8],
+        cmds = [
+          ["/bin/bash", "-c", "test \"$(printf 'b\\303\\274cher.example' | LC_ALL=C.UTF-8 /bin/idn --quiet --idna-to-ascii)\" = xn--bcher-kva.example"],
+        ],
+      } | Test,
+  },
+} | BuildSpec
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -e
+
+tar -xof "libidn-$MINIMAL_ARG_VERSION.tar.gz"
+cd "libidn-$MINIMAL_ARG_VERSION"
+
+case $(uname -m) in
+  x86_64)  MARCH="-march=x86-64-v3" ;;
+  aarch64) MARCH="-march=armv8-a" ;;
+  *)       MARCH="" ;;
+esac
+export CFLAGS="$MARCH -O2 -pipe -gno-record-gcc-switches -ffile-prefix-map=$(pwd)=/builddir"
+export LDFLAGS="-Wl,--build-id=none"
+
+./configure --prefix=/usr --disable-static --disable-java --disable-csharp --disable-doc
+
+make -j$(nproc)
+make DESTDIR="$OUTPUT_DIR" install
+rm -f "$OUTPUT_DIR"/usr/lib/*.la
@@ -0,0 +1,57 @@
+let { Attrs, BuildSpec, Local, Needs, OutputBin, Source, Test, .. } = import "minimal.ncl" in
+let base = import "../base/build.ncl" in
+let go = import "../go/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
+
+# Mailpit: local SMTP server + web UI that catches outgoing mail in
+# development (Rails `config.action_mailer.smtp_settings` -> localhost:1025,
+# UI on :8025). Single static binary with the UI embedded; the UI is built
+# with npm from the locked package-lock.json before `go build`, as upstream's
+# release build does.
+let version = "1.31.4" in
+{
+  name = "mailpit",
+  build_deps = [
+    { file = "build.sh" } | Local,
+    {
+      url = "https://github.com/axllent/mailpit/archive/refs/tags/v%{version}.tar.gz",
+      sha256 = "cd4d0d40044dde07df8ff5c168f6d95356770dca45627a9f9910ba66e70d7832",
+      extract = true,
+      strip_prefix = "mailpit-%{version}",
+    } | Source,
+    base,
+    go,
+    node-lts,
+  ],
+  # Go module downloads and the UI's npm install.
+  needs =
+    {
+      dns = {},
+      internet = {},
+    } | Needs,
+  cmd = "./build.sh",
+  build_args = {
+    include version,
+  },
+  outputs = {
+    mailpit = { glob = "usr/bin/mailpit" } | OutputBin,
+  },
+  runtime_deps = [],
+  attrs =
+    {
+      upstream_version = version,
+      source_provenance = { category = 'GithubRepo, owner = "axllent", repo = "mailpit" },
+      license_spdx = "MIT",
+    } | Attrs,
+  tests = {
+    # Accepts a message over SMTP and serves it back from the HTTP API.
+    smtp_roundtrip =
+      {
+        class = 'Standalone,
+        test_deps = [base],
+        cmds = [
+          ["/bin/bash", "-c", "mailpit version 2>&1 | grep -q %{version} && d=$(mktemp -d) && (mailpit --database \"$d/db\" --smtp 127.0.0.1:1025 --listen 127.0.0.1:8025 >\"$d/log\" 2>&1 &) && for i in $(seq 50); do (exec 3<>/dev/tcp/127.0.0.1/1025) 2>/dev/null && break; sleep 0.2; done && exec 3<>/dev/tcp/127.0.0.1/1025 && printf 'HELO t\\r\\nMAIL FROM:<a@example.com>\\r\\nRCPT TO:<b@example.com>\\r\\nDATA\\r\\nSubject: mailpit-smoke\\r\\n\\r\\nhi\\r\\n.\\r\\nQUIT\\r\\n' >&3 && sleep 1 && exec 4<>/dev/tcp/127.0.0.1/8025 && printf 'GET /api/v1/messages HTTP/1.0\\r\\nHost: localhost\\r\\n\\r\\n' >&4 && grep -q mailpit-smoke <&4"],
+        ],
+      } | Test,
+  },
+} | BuildSpec
@@ -0,0 +1,8 @@
+#!/bin/bash
+set -euo pipefail
+export GOROOT=/usr/go CGO_ENABLED=0
+export HOME="$PWD/.home" npm_config_cache="$PWD/.npm"
+npm ci --no-audit --no-fund
+npm run package
+go build -trimpath -ldflags "-buildid= -s -w -X github.com/axllent/mailpit/config.Version=v$MINIMAL_ARG_VERSION" -o mailpit .
+install -Dm755 mailpit "$OUTPUT_DIR/usr/bin/mailpit"