Philip Peterson
08c8fa6d0c
OpenSSL's module builds with --openssldir=/app/ssl, but nothing populates /app/ssl/certs, so SSL_CTX_set_default_verify_paths() always fails to find any CA. Point SSL_CERT_FILE at the runtime's real bundle (/etc/ssl/cert.pem) via finish-args instead. Verified with --headless=text against example.com, news.ycombinator.com, and google.com. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
78 lines
3.1 KiB
YAML
78 lines
3.1 KiB
YAML
version: "3"
|
|
|
|
# Builds Ladybird's OWN flatpak manifest (Meta/CMake/flatpak/org.ladybird.Ladybird.json,
|
|
# maintained by the LadybirdBrowser team, CI-tested on every commit via
|
|
# .github/workflows/flatpak.yml there) rather than a manifest we maintain ourselves.
|
|
# See README.md for why. That manifest isn't standalone -- it's built from inside a full
|
|
# checkout of the Ladybird repo -- so `task clone` fetches one.
|
|
|
|
vars:
|
|
APP_ID: org.ladybird.Ladybird
|
|
MANIFEST_PATH: Meta/CMake/flatpak/{{.APP_ID}}.json
|
|
RUNTIME_VERSION: "6.10"
|
|
LADYBIRD_DIR: ladybird
|
|
DISTROBOX_NAME: flatpak-builder
|
|
IN_BOX: distrobox enter {{.DISTROBOX_NAME}} --
|
|
|
|
tasks:
|
|
install-tools:
|
|
desc: Create the flatpak-builder distrobox and install the Flatpak runtime/SDK this manifest needs
|
|
cmds:
|
|
- distrobox create --name {{.DISTROBOX_NAME}} --image fedora:latest --yes
|
|
- "{{.IN_BOX}} sudo dnf install -y flatpak-builder flatpak git"
|
|
- flatpak install -y --user flathub org.kde.Platform//{{.RUNTIME_VERSION}} org.kde.Sdk//{{.RUNTIME_VERSION}}
|
|
|
|
clone:
|
|
desc: Clone LadybirdBrowser/ladybird into ./ladybird and apply patches/ (no-op if already cloned)
|
|
status:
|
|
- test -d {{.LADYBIRD_DIR}}/.git
|
|
cmds:
|
|
- git clone --depth 1 https://github.com/LadybirdBrowser/ladybird.git {{.LADYBIRD_DIR}}
|
|
- task: apply-patches
|
|
|
|
update:
|
|
desc: Pull the latest ladybird master into ./ladybird and reapply patches/
|
|
dir: "{{.LADYBIRD_DIR}}"
|
|
cmds:
|
|
- git fetch --depth 1 origin master
|
|
- git reset --hard origin/master
|
|
- task: apply-patches
|
|
|
|
apply-patches:
|
|
desc: >
|
|
Apply patches/*.patch on top of the ladybird checkout. These aren't upstreamed yet
|
|
(see README.md) -- git reset/clone wipes them, so clone/update always reapply.
|
|
dir: "{{.LADYBIRD_DIR}}"
|
|
cmds:
|
|
- git apply ../patches/sandbox-fixes.patch
|
|
- git apply ../patches/flatpak-ssl-cert-path.patch
|
|
|
|
build:
|
|
desc: Build upstream's flatpak manifest with flatpak-builder, run inside the flatpak-builder distrobox
|
|
deps: [clone]
|
|
cmds:
|
|
- "{{.IN_BOX}} bash -c 'cd {{.LADYBIRD_DIR}} && flatpak-builder --disable-rofiles-fuse --install-deps-from=flathub --user --install --force-clean --ccache build {{.MANIFEST_PATH}}'"
|
|
|
|
run:
|
|
desc: >
|
|
Run the installed flatpak (host flatpak sees it too, since the distrobox shares
|
|
~/.local/share/flatpak). Runs fully sandboxed -- see README.md for the three sandbox
|
|
bugs patches/ fixes to make that possible. If a crashed session left a stale
|
|
single-instance lock, this will fail with "connect: Connection refused"; run
|
|
`task clean-runtime`.
|
|
cmds:
|
|
- flatpak run {{.APP_ID}}
|
|
|
|
clean-runtime:
|
|
desc: Remove a stale single-instance lock/socket left by a crashed session
|
|
vars:
|
|
UID:
|
|
sh: id -u
|
|
LOCK_DIR: /run/user/{{.UID}}/.flatpak/{{.APP_ID}}/xdg-run/Ladybird/Profiles/default
|
|
cmds:
|
|
- rm -f {{.LOCK_DIR}}/*.pid {{.LOCK_DIR}}/*.socket {{.LOCK_DIR}}/*.lock
|
|
|
|
clean:
|
|
desc: Remove local build artifacts (not the ladybird checkout)
|
|
cmds:
|
|
- rm -rf {{.LADYBIRD_DIR}}/build {{.LADYBIRD_DIR}}/.flatpak-builder
|