gominimal · msample · Mar 29, 2026 · Mar 28, 2026
diff --git a/packages/at-spi2-core/build.ncl b/packages/at-spi2-core/build.ncl
@@ -37,7 +37,7 @@ let version = "2.54.2" in
   cmd = "./build.sh",
 
   outputs = {
-    libs = { glob = "usr/lib/libatspi.so*" } | OutputLib,
+    libs = { glob = "usr/lib/lib{atspi,atk-bridge-2.0}.so*" } | OutputLib,
     includes = { glob = "usr/include/at-spi*/**" } | OutputData,
     pkgconfigs = { glob = "usr/lib/pkgconfig/{atk-bridge*,atspi*}.pc" } | OutputData,
   },

diff --git a/packages/eudev/build.ncl b/packages/eudev/build.ncl
@@ -0,0 +1,45 @@
+let { Attrs, BuildSpec, Local, OutputData, OutputLib, Source, .. } = import "minimal.ncl" in
+let base = import "../base/build.ncl" in
+let glibc = import "../glibc/build.ncl" in
+let gperf = import "../gperf/build.ncl" in
+let make = import "../make/build.ncl" in
+let toolchain = import "../toolchain/build.ncl" in
+
+let version = "3.2.14" in
+{
+  name = "eudev",
+  build_deps = [
+    { file = "build.sh" } | Local,
+    {
+      url = "https://github.com/eudev-project/eudev/releases/download/v%{version}/eudev-%{version}.tar.gz",
+      sha256 = "8da4319102f24abbf7fff5ce9c416af848df163b29590e666d334cc1927f006f",
+      extract = true,
+      strip_prefix = "eudev-%{version}",
+    } | Source,
+    base,
+    gperf,
+    make,
+    toolchain,
+  ],
+  runtime_deps = [
+    glibc,
+  ],
+
+  cmd = "./build.sh",
+
+  outputs = {
+    libs = { glob = "usr/lib/libudev.so*" } | OutputLib,
+    includes = { glob = "usr/include/libudev.h" } | OutputData,
+    pkgconfigs = { glob = "usr/lib/pkgconfig/libudev.pc" } | OutputData,
+  },
+
+  attrs =
+    {
+      upstream_version = version,
+      source_provenance = {
+        category = 'GithubRepo,
+        owner = "eudev-project",
+        repo = "eudev",
+      },
+    } | Attrs,
+} | BuildSpec
diff --git a/packages/eudev/build.sh b/packages/eudev/build.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+set -euo pipefail
+
+case $(uname -m) in
+  x86_64)  MARCH="-march=x86-64-v3" ;;
+  aarch64) MARCH="-march=armv8-a" ;;
+  *)       MARCH="" ;;
+esac
+export CFLAGS="$MARCH -O2 -pipe"
+
+./configure \
+  --prefix=/usr \
+  --disable-programs \
+  --disable-manpages \
+  --disable-hwdb
+
+make -j$(nproc)
+make DESTDIR=$OUTPUT_DIR install
diff --git a/packages/mermaid-cli/build.ncl b/packages/mermaid-cli/build.ncl
@@ -0,0 +1,148 @@
+let { standaloneTest, Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
+let { target, .. } = import "config.ncl" in
+let alsa-lib = import "../alsa-lib/build.ncl" in
+let at-spi2-core = import "../at-spi2-core/build.ncl" in
+let atk = import "../atk/build.ncl" in
+let base = import "../base/build.ncl" in
+let bash = import "../bash/build.ncl" in
+let cairo = import "../cairo/build.ncl" in
+let coreutils = import "../coreutils/build.ncl" in
+let cups = import "../cups/build.ncl" in
+let curl = import "../curl/build.ncl" in
+let dbus = import "../dbus/build.ncl" in
+let eudev = import "../eudev/build.ncl" in
+let expat = import "../expat/build.ncl" in
+let fontconfig = import "../fontconfig/build.ncl" in
+let freetype = import "../freetype/build.ncl" in
+let fribidi = import "../fribidi/build.ncl" in
+let gcc = import "../gcc/build.ncl" in
+let gh = import "../gh/build.ncl" in
+let glib = import "../glib/build.ncl" in
+let glibc = import "../glibc/build.ncl" in
+let harfbuzz = import "../harfbuzz/build.ncl" in
+let liberation-fonts = import "../liberation-fonts/build.ncl" in
+let libdrm = import "../libdrm/build.ncl" in
+let libx11 = import "../libx11/build.ncl" in
+let libxcb = import "../libxcb/build.ncl" in
+let libxcomposite = import "../libxcomposite/build.ncl" in
+let libxdamage = import "../libxdamage/build.ncl" in
+let libxext = import "../libxext/build.ncl" in
+let libxfixes = import "../libxfixes/build.ncl" in
+let libxkbcommon = import "../libxkbcommon/build.ncl" in
+let libxrandr = import "../libxrandr/build.ncl" in
+let libxrender = import "../libxrender/build.ncl" in
+let libxshmfence = import "../libxshmfence/build.ncl" in
+let mesa = import "../mesa/build.ncl" in
+let node = import "../node/build.ncl" in
+let nspr = import "../nspr/build.ncl" in
+let nss = import "../nss/build.ncl" in
+let pango = import "../pango/build.ncl" in
+let python = import "../python/build.ncl" in
+
+let version = "11.12.0" in
+{
+  name = "mermaid-cli",
+  build_deps = [
+    { file = "build.sh" } | Local,
+    {
+      url = "https://github.com/mermaid-js/mermaid-cli/archive/refs/tags/%{version}.tar.gz",
+      sha256 = "1911d5f96546b7278cb734b6f4b388b679bc0b36d6c37ba8de1a032d5a9ae6af",
+    } | Source,
+    match {
+      { arch = 'Amd64, .. } =>
+        {
+          url = "https://playwright.azureedge.net/builds/chromium/1148/chromium-headless-shell-linux.zip",
+          sha256 = "43c8f1e29e089d9765ed83083ebbcaa7c7fe582aa762d0678f88838b55d92f63",
+        } | Source,
+      { arch = 'Arm64, .. } =>
+        {
+          url = "https://playwright.azureedge.net/builds/chromium/1148/chromium-headless-shell-linux-arm64.zip",
+          sha256 = "be65413764b753fb73187dd1d760cc6622730f2a4da23923eef76973c17fb25c",
+        } | Source,
+    } target,
+    base,
+    curl,
+    gh,
+    node,
+    python,
+  ],
+  runtime_deps = [
+    alsa-lib,
+    at-spi2-core,
+    atk,
+    bash,
+    cairo,
+    coreutils,
+    cups,
+    dbus,
+    eudev,
+    expat,
+    fontconfig,
+    freetype,
+    fribidi,
+    gcc,
+    glib,
+    glibc,
+    harfbuzz,
+    liberation-fonts,
+    libdrm,
+    libx11,
+    libxcb,
+    libxcomposite,
+    libxdamage,
+    libxext,
+    libxfixes,
+    libxkbcommon,
+    libxrandr,
+    libxrender,
+    libxshmfence,
+    mesa,
+    node,
+    nspr,
+    nss,
+    pango,
+  ],
+  needs =
+    {
+      dns = {},
+      internet = {},
+    } | Needs,
+
+  cmd = "./build.sh",
+  build_args = {
+    include version,
+  },
+
+  outputs = {
+    bins = { glob = "usr/bin/*" } | OutputBin,
+    libexec = { glob = "usr/lib/node_modules/**", allow_executable = true } | OutputData,
+    chromium = { glob = "usr/share/mermaid-cli/chromium/**", allow_executable = true } | OutputData,
+    config = { glob = "usr/share/mermaid-cli/*.json" } | OutputData,
+  },
+
+  attrs =
+    {
+      upstream_version = version,
+      source_provenance = {
+        category = 'GithubRepo,
+        owner = "mermaid-js",
+        repo = "mermaid-cli",
+      },
+    } | Attrs,
+
+  tests = {
+    smoketest = standaloneTest "/bin/mmdc --version",
+    install_check =
+      {
+        class = 'Standalone,
+        test_deps = [base],
+        cmds = [
+          ["/bin/bash", "-c", "test -x /bin/mmdc"],
+          ["/bin/bash", "-c", "test -f /usr/lib/node_modules/@mermaid-js/mermaid-cli/src/cli.js"],
+          ["/bin/bash", "-c", "test -x /usr/share/mermaid-cli/chromium/headless_shell"],
+          ["/bin/bash", "-c", "! ldd /usr/share/mermaid-cli/chromium/headless_shell | grep -q 'not found'"],
+          ["/bin/bash", "-c", "/bin/mmdc --help | grep -q 'mermaid'"],
+        ],
+      } | Test,
+  },
+} | BuildSpec
diff --git a/packages/mermaid-cli/build.sh b/packages/mermaid-cli/build.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+set -euo pipefail
+
+# Verify GitHub release attestations on the source tarball, if any exist.
+# If attestations are present, gh attestation verify must succeed or the build fails.
+REPO="mermaid-js/mermaid-cli"
+TARBALL="${MINIMAL_ARG_VERSION}.tar.gz"
+DIGEST=$(sha256sum "$TARBALL" | cut -d' ' -f1)
+if curl -sf "https://api.github.com/repos/${REPO}/attestations/sha256:${DIGEST}" | grep -q '"bundle"'; then
+  gh attestation verify "$TARBALL" --repo "$REPO"
+fi
+
+# Install mermaid-cli via npm, skipping puppeteer's Chromium download since
+# we provide Playwright's Chromium build as an explicit, SHA256-verified input.
+export PUPPETEER_SKIP_DOWNLOAD=true
+npm install -g --prefix=$OUTPUT_DIR/usr @mermaid-js/mermaid-cli@$MINIMAL_ARG_VERSION
+
+# Extract the Playwright headless shell (both arch variants use the same zip layout).
+CHROMIUM_DIR=$OUTPUT_DIR/usr/share/mermaid-cli/chromium
+mkdir -p "$CHROMIUM_DIR"
+python3 -m zipfile -e chromium-headless-shell-linux*.zip "$CHROMIUM_DIR"
+mv "$CHROMIUM_DIR"/chrome-linux/* "$CHROMIUM_DIR"/
+rmdir "$CHROMIUM_DIR/chrome-linux"
+find "$CHROMIUM_DIR" -type f \( -name "headless_shell" -o -name "*.so" -o -name "*.so.*" \) -exec chmod +x {} +
+
+# Puppeteer config: use headless shell mode, and add --no-sandbox when root.
+mkdir -p $OUTPUT_DIR/usr/share/mermaid-cli
+cat > $OUTPUT_DIR/usr/share/mermaid-cli/puppeteer.json << 'CONF'
+{"headless":"shell","args":["--disable-dev-shm-usage"]}
+CONF
+cat > $OUTPUT_DIR/usr/share/mermaid-cli/puppeteer-root.json << 'CONF'
+{"headless":"shell","args":["--no-sandbox","--disable-dev-shm-usage"]}
+CONF
+
+# Replace the npm-created symlink with a wrapper that points puppeteer at our headless shell.
+rm -f $OUTPUT_DIR/usr/bin/mmdc
+cat > $OUTPUT_DIR/usr/bin/mmdc << 'WRAPPER'
+#!/bin/bash
+export PUPPETEER_EXECUTABLE_PATH=/usr/share/mermaid-cli/chromium/headless_shell
+PUPPETEER_CONF=/usr/share/mermaid-cli/puppeteer.json
+if [ "$(id -u)" = "0" ]; then
+  PUPPETEER_CONF=/usr/share/mermaid-cli/puppeteer-root.json
+fi
+exec node /usr/lib/node_modules/@mermaid-js/mermaid-cli/src/cli.js -p "$PUPPETEER_CONF" "$@"
+WRAPPER
+chmod +x $OUTPUT_DIR/usr/bin/mmdc