Add gn 0.2511 + bindgen 0.72.1 — chromium-from-source build prerequisites

The #681 spike (pkgmgr-rs) settled that a source-built chromium must use
system toolchains on arm64 — every prebuilt in Google's official tarball
(clang, rustc, bindgen, gn, node) is an x86-64 ELF. These are the two
tools we didn't already package; esbuild/go/llvm/rust/ninja/python all
exist at or above the distro-proven floors.

gn: no upstream releases — its version IS the commit position (Gentoo's
0.<position> scheme; `gn --version` prints "2511 (7324363900cc)").
Source is a git-archive of that commit mirrored to gs:// because gitiles
/+archive/ tarballs are generated on the fly and can't be sha256-pinned.
The smoketest greps the pinned position out of --version so the
no-.git fallback ("0 (UNKNOWN)") can never ship silently. Update-dark
for now, declared in-file: no provenance category fits googlesource and
repology's gn project is all-noscheme; follow-up is a curated
NAME_KEYED_VERSION_CHECK reading the gitiles API.

bindgen: 0.72.1 = exactly Gentoo's floor for chromium 151. libclang +
clang resource headers are RUNTIME deps (bindgen dlopens libclang to
parse headers) — subsetOf llvm.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: bryan-minimal

packages/bindgen/build.ncl

@@ -0,0 +1,61 @@
+let { standaloneTest, subsetOf, Attrs, BuildSpec, Local, OutputBin, Source, Test, .. } = import "minimal.ncl" in
+let base = import "../base/build.ncl" in
+let rust = import "../rust/build.ncl" in
+let toolchain = import "../toolchain/build.ncl" in
+
+let glibc = import "../glibc/build.ncl" in
+let gcc = import "../gcc/build.ncl" in
+let llvm = import "../llvm/build.ncl" in
+
+# bindgen — generates Rust FFI bindings from C/C++ headers by driving
+# libclang. Packaged as a chromium-from-source build prerequisite
+# (pkgmgr-rs#681): chromium's gn wires `rust_bindgen_root` and the
+# official tarball's bundled bindgen is an x86-64-only prebuilt, so the
+# arm64 build needs a system one. 0.72.1 is exactly Gentoo's floor for
+# chromium 151.
+#
+# libclang is a RUNTIME dependency: bindgen dlopens libclang.so to parse
+# headers, and needs clang's resource headers (usr/lib/clang/<ver>/) for
+# builtin includes — both from the llvm package.
+let version = "0.72.1" in
+{
+  name = "bindgen",
+  build_deps = [
+    { file = "build.sh" } | Local,
+    {
+      url = "gs://minimal-staging-archives/rust-lang/rust-bindgen/v%{version}.tar.gz",
+      sha256 = "4ffb17061b2d71f19c5062d2e17e64107248f484f9775c0b7d30a16a8238dfd1",
+      extract = true,
+      strip_prefix = "rust-bindgen-%{version}",
+    } | Source,
+    base,
+    rust,
+    toolchain,
+  ],
+  runtime_deps = [
+    glibc,
+    subsetOf gcc ["libgcc"],
+    subsetOf llvm ["libclang", "libs_clang"],
+  ],
+
+  cmd = "./build.sh",
+
+  outputs = {
+    bindgen = { glob = "usr/bin/bindgen" } | OutputBin,
+  },
+
+  attrs =
+    {
+      upstream_version = version,
+      license_spdx = "BSD-3-Clause",
+      source_provenance = {
+        category = 'GithubRepo,
+        owner = "rust-lang",
+        repo = "rust-bindgen",
+      },
+    } | Attrs,
+
+  tests = {
+    smoketest = standaloneTest "/bin/bindgen --version",
+  },
+} | BuildSpec

packages/bindgen/build.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -ex
+
+export CC=gcc
+export LD=gcc
+export RUSTFLAGS="-C linker=gcc --remap-path-prefix=$(pwd)=/builddir --remap-path-prefix=$HOME/.cargo=/cargo"
+
+# The workspace's CLI crate; the library crate is what other projects
+# vendor themselves.
+cargo build --release -p bindgen-cli
+
+install -D -m 0755 target/release/bindgen "$OUTPUT_DIR/usr/bin/bindgen"

packages/gn/build.ncl

@@ -0,0 +1,79 @@
+let { standaloneTest, subsetOf, Attrs, BuildSpec, Local, OutputBin, Source, Test, .. } = import "minimal.ncl" in
+let base = import "../base/build.ncl" in
+let python = import "../python/build.ncl" in
+let ninja = import "../ninja/build.ncl" in
+let toolchain = import "../toolchain/build.ncl" in
+
+let glibc = import "../glibc/build.ncl" in
+let gcc = import "../gcc/build.ncl" in
+
+# gn — Google's meta-build system generator (generates ninja files).
+# Packaged as a chromium-from-source build prerequisite (pkgmgr-rs#681):
+# the official chromium tarball ships only an x86-64 prebuilt gn, so the
+# arm64 build needs a system gn either way, and a package beats
+# re-bootstrapping it inside every chromium build.
+#
+# Versioning: upstream has NO releases or tags beyond `initial-commit`;
+# its version IS the commit position — `gn --version` prints
+# "<position> (<12-char sha>)", derived from `git describe`. We follow
+# Gentoo's scheme: version 0.<position>. Source is a `git archive` of
+# that commit mirrored to gs:// — gitiles' own /+archive/ tarballs are
+# generated on the fly and NOT byte-stable, so they can never be
+# sha256-pinned directly. Bumping = new archive from a newer commit,
+# update `version` here AND the position/sha pinned in build.sh.
+#
+# ⚠ Version-tracking: update-dark for now. Upstream is
+# gn.googlesource.com (no provenance category fits), and repology's
+# `gn` project is all-`noscheme` (each distro invents its own scheme:
+# dates, short hashes, positions) so `repology_project` would propose
+# garbage. The clean fix is a curated NAME_KEYED_VERSION_CHECK entry in
+# pkgmgr-rs reading the gitiles API for the latest commit position —
+# tracked as a follow-up on pkgmgr-rs#681.
+let version = "0.2511" in
+{
+  name = "gn",
+  build_deps = [
+    { file = "build.sh" } | Local,
+    {
+      url = "gs://minimal-staging-archives/gn/gn/%{version}.tar.gz",
+      sha256 = "3e85ceeb08cdb563a5db995175f9e5173a337f7e0b4822078f514a0bb7c991bf",
+      extract = true,
+      strip_prefix = "gn-%{version}",
+    } | Source,
+    base,
+    python,
+    ninja,
+    toolchain,
+  ],
+  runtime_deps = [
+    glibc,
+    subsetOf gcc ["libstdcpp"],
+  ],
+
+  cmd = "./build.sh",
+
+  outputs = {
+    gn = { glob = "usr/bin/gn" } | OutputBin,
+  },
+
+  attrs =
+    {
+      upstream_version = version,
+      license_spdx = "BSD-3-Clause",
+    } | Attrs,
+
+  tests = {
+    # Pins the version header wired in build.sh: `gn --version` must
+    # print the pinned commit position, not 0 (UNKNOWN) — the tarball
+    # has no .git, so a silent fallback would ship a gn that lies about
+    # what it is.
+    smoketest =
+      {
+        class = 'Standalone,
+        test_deps = [base],
+        cmds = [
+          ["/bin/bash", "-c", "/bin/gn --version | grep -q '^2511 '"],
+        ],
+      } | Test,
+  },
+} | BuildSpec

packages/gn/build.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+set -ex
+
+export CXX=g++
+export AR=ar
+export LD=g++
+# Reproducibility per AGENTS.md; gen.py appends env CFLAGS/CXXFLAGS/LDFLAGS
+# to its own flag set.
+export CXXFLAGS="-ffile-prefix-map=$(pwd)=/builddir -gno-record-gcc-switches"
+export LDFLAGS="-Wl,--build-id=none"
+
+# gen.py derives the version header from `git describe`; a tarball has no
+# .git, so pin it here. MUST move in lockstep with `version` in build.ncl
+# (0.<NUM>) and the commit the mirrored archive was cut from — the
+# smoketest greps for the number.
+mkdir -p out
+cat > out/last_commit_position.h <<'EOF'
+// Generated by build/gen.py.
+
+#ifndef OUT_LAST_COMMIT_POSITION_H_
+#define OUT_LAST_COMMIT_POSITION_H_
+
+#define LAST_COMMIT_POSITION_NUM 2511
+#define LAST_COMMIT_POSITION "2511 (7324363900cc)"
+
+#endif  // OUT_LAST_COMMIT_POSITION_H_
+EOF
+
+# --no-static-libstdc++: link the system libstdc++ (runtime_deps carries
+# gcc/libstdcpp) instead of gen.py's static default.
+python3 build/gen.py --no-last-commit-position --no-static-libstdc++ --allow-warnings
+ninja -C out gn
+
+mkdir -p "$OUTPUT_DIR/usr/bin"
+install -m 0755 out/gn "$OUTPUT_DIR/usr/bin/"