Skip to content

Update graphviz to 15.1.0 - #535

Merged
bryan-minimal merged 3 commits into
mainfrom
update-graphviz-15.1.0
Jul 29, 2026
Merged

Update graphviz to 15.1.0#535
bryan-minimal merged 3 commits into
mainfrom
update-graphviz-15.1.0

Conversation

@gominimal-pkgmgr-mgr

Copy link
Copy Markdown
Contributor

Update graphviz 14.1.115.1.0

Source: custom:https://gitlab.com/api/v4/projects/4207231/repository/tags?per_page=100
Released: unknown (non-GitHub source or tag-only fallback)

Note

Auto-applied structural fixes:

  • Migrated source tarball extension .tar.bz2 → .tar.xz: upstream no longer publishes the .tar.bz2 artifact, so the mirror + build.ncl now track the .tar.xz tarball (bytes identical to upstream).
Pkgscan: 5 below-threshold signals (all Info severity, risk score 0.5). Demoted in benign contexts (test fixtures, CI workflow setup); expand for details.
Severity File Line Capability (MBC) Pattern
INFO configure 3356 execution/eval eval(
INFO configure 13293 execution/spawn system(
INFO configure 19111 execution/spawn system(
INFO m4/libtool.m4 2876 execution/spawn system(
INFO libltdl/configure 11904 execution/spawn system(

Components changed

CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)
Component Old New
~ graphviz 14.1.1 15.1.0

Changes

Old New
Version 14.1.1 15.1.0
SHA256 975f4b9a7a7a7b61... 4c44f9f6654d3963...
Size 21.0 MB
Source gs://minimal-staging-archives/graphviz-14.1.1.tar.bz2 gs://minimal-staging-archives/graphviz-15.1.0.tar.xz
  • License: EPL-2.0 (source: tarball)

Quality suggestions

  • Missing tests block. This package has no standalone tests, so the buildbot will only verify compilation — not functional correctness. Consider adding a minimal smoke test (e.g., a --version or small round-trip invocation) as part of this PR so future bumps catch regressions. See packages/python/build.ncl for a simple example.

Created by pkgmgr

gominimal-pkgmgr-mgr Bot and others added 3 commits July 28, 2026 01:26
The 15.1.0 build failed on both arches:

  I/O error: No such file or directory (os error 2) when hard linking
    graphviz-15.1.0/redhat/graphviz.spec.fedora.in
  to .../temp/.tmpXXX/redhat/graphviz.spec.rhel.in

Upstream added ONE hardlink in this release — 14.1.1 had none, which is
why it built for months:

  graphviz 14.1.1 — 0 hardlink entries
  graphviz 15.1.0 — 1 hardlink entry
    hrw-rw-rw- graphviz-15.1.0/redhat/graphviz.spec.rhel.in
               link to graphviz-15.1.0/redhat/graphviz.spec.fedora.in

The prefix-stripping extraction path cannot place a hardlink. It strips
the prefix from the entry's DESTINATION but passes the link TARGET
through verbatim — still carrying `graphviz-15.1.0/` — so the target
resolves outside the stripped tree and hard_link fails with ENOENT. Note
the two paths in the error: one keeps the prefix, one doesn't.

The no-strip path doesn't have this problem: it uses whole-archive
unpack, which resolves link targets against the destination root.

So extract with the prefix intact and `cd` into it from build.sh — the
same shape bash, binutils, bison and coreutils already use, with
`build_args = { include version }` exposing MINIMAL_ARG_VERSION.

This is a workaround, not the root fix. Any package whose upstream starts
shipping a hardlink will hit the same wall, and that belongs upstream in
the extractor rather than in each recipe.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…tarball

Reverts the strip_prefix/hardlink workaround in 81ca043 and fixes the
actual cause, which was upstream of it.

graphviz 15.x stopped shipping the CMake build files in its release
tarball. `graphviz-15.1.0.tar.xz` is an autotools `make dist` output:

  15.1.0 release tarball   0 CMakeLists.txt, 1 hardlink,  21 MB
  15.1.0 repo archive     78 CMakeLists.txt, 0 hardlinks, 41 MB
  14.1.1 release tarball   present,          0 hardlinks, 36 MB

This recipe is CMake-based (`sed -i lib/CMakeLists.txt`, `cmake ...`), so
it cannot build from the dist tarball at all — the build failed with
`sed: can't read lib/CMakeLists.txt` because that file genuinely is not
in the archive.

Nothing changed on our side. `graphviz-15.1.0.tar.bz2` — the extension
this recipe had always used — now 404s upstream, so the resolver moved to
`.tar.xz`: same version, DIFFERENT artifact class. The hardlink I chased
in 81ca043 was a property of that wrong artifact, not a problem of its
own; the repo archive has none.

So: point at the GitLab repo archive, which carries the CMake files the
recipe needs, and restore `strip_prefix` + the original build.sh.

Verified with a local `min build --rebuild graphviz` before pushing this
time. The same command in the same session failed loudly ten minutes
earlier (`cd: graphviz-15.1.0: No such file or directory`) and now
completes clean, with and without --rebuild. Note the artifact itself
could not be inspected — `min attach -c` only accepts `min build`/`min
run`, and build outputs aren't visible from a task sandbox (minimal#978)
— so this is "builds without erroring", not "the binary was held".

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@bryan-minimal

Copy link
Copy Markdown
Member

Two failed buildbot runs on this PR were both symptoms of one cause, now fixed in f6aca66. Summary for review, since the commit history here is messier than the final change.

The actual cause

graphviz 15.x stopped shipping CMake build files in its release tarball.

CMakeLists.txt hardlinks size
14.1.1 release tarball present 0 36 MB
15.1.0 release tarball 0 1 21 MB
15.1.0 repo archive 78 0 41 MB

graphviz-15.1.0.tar.xz is an autotools make dist output. This recipe is CMake-based (sed -i lib/CMakeLists.txt, cmake …), so it cannot build from it — sed: can't read lib/CMakeLists.txt because that file genuinely isn't in the archive.

Nothing changed on our side

graphviz-15.1.0.tar.bz2 — the extension this recipe had always used — 404s upstream. So the resolver moved to .tar.xz: same version, different artifact class.

The hardlink I chased in 81ca043 was a property of that wrong artifact, not a problem in its own right. The repo archive has none, so that workaround is reverted here.

The fix

Point at the GitLab repo archive, which carries the CMake files the recipe expects. strip_prefix and the original build.sh are restored — the net change versus main is the version bump plus the source URL/sha.

Verification

Built locally with min build --rebuild graphviz before pushing this time. The same command in the same session failed loudly ten minutes earlier (cd: graphviz-15.1.0: No such file or directory) and now completes clean, with and without --rebuild.

Being precise about the limit: the artifact itself could not be inspected — min attach -c only accepts min build/min run, and build outputs aren't visible from a task sandbox (gominimal/minimal#978). So this is "builds without erroring", not "the dot binary was held". The buildbot is still the authority.

Worth a follow-up

pkgmgr can silently switch artifact class on a bump and nothing notices. The 2× size guard didn't fire here — 36.5 MB → 21 MB is a 0.57 ratio, comfortably inside the band — because size can't distinguish "same project, different tarball contents".

compare_trees already extracts both sides during the pkgscan diff, so checking that paths the build script references still exist in the new tree is cheap. Filing that separately.

@bryan-minimal
bryan-minimal added this pull request to the merge queue Jul 29, 2026
Merged via the queue into main with commit dcd05b5 Jul 29, 2026
9 checks passed
@bryan-minimal
bryan-minimal deleted the update-graphviz-15.1.0 branch July 29, 2026 00:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants