Add gn 0.2511 + bindgen 0.72.1 — chromium-from-source build prerequisites - #588
Merged
Conversation
…ites
The #681 spike (pkgmgr-rs) settled that a source-built chromium must use
system toolchains on arm64 — every prebuilt in Google's official tarball
(clang, rustc, bindgen, gn, node) is an x86-64 ELF. These are the two
tools we didn't already package; esbuild/go/llvm/rust/ninja/python all
exist at or above the distro-proven floors.
gn: no upstream releases — its version IS the commit position (Gentoo's
0.<position> scheme; `gn --version` prints "2511 (7324363900cc)").
Source is a git-archive of that commit mirrored to gs:// because gitiles
/+archive/ tarballs are generated on the fly and can't be sha256-pinned.
The smoketest greps the pinned position out of --version so the
no-.git fallback ("0 (UNKNOWN)") can never ship silently. Update-dark
for now, declared in-file: no provenance category fits googlesource and
repology's gn project is all-noscheme; follow-up is a curated
NAME_KEYED_VERSION_CHECK reading the gitiles API.
bindgen: 0.72.1 = exactly Gentoo's floor for chromium 151. libclang +
clang resource headers are RUNTIME deps (bindgen dlopens libclang to
parse headers) — subsetOf llvm.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThis change adds reproducible package definitions and build scripts for bindgen 0.72.1 and GN 0.2511. Both packages verify source archives, declare dependencies, install binaries, and run version-related smoketests. ChangesToolchain package additions
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant BindgenBuildSpec
participant BindgenBuildScript
participant RustAndGCC
participant BindgenOutput
BindgenBuildSpec->>BindgenBuildScript: Invoke bindgen build
BindgenBuildScript->>RustAndGCC: Configure tools and build bindgen-cli
RustAndGCC->>BindgenOutput: Install bindgen
sequenceDiagram
participant GNBuildSpec
participant GNBuildScript
participant GenAndNinja
participant GNOutput
GNBuildSpec->>GNBuildScript: Invoke GN build
GNBuildScript->>GenAndNinja: Generate metadata and build with Ninja
GenAndNinja->>GNOutput: Install gn
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
twitchyliquid64
approved these changes
Aug 10, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/bindgen/build.ncl`:
- Around line 35-39: Add dns and internet network capabilities to the BuildSpec
for the bindgen Cargo build, alongside the existing runtime_deps declaration, so
cargo build --release -p bindgen-cli can fetch crates. Keep the valid
llvm.libs_clang subsetOf dependency unchanged.
- Around line 23-34: Update the bindgen package definition associated with
build_deps to declare both dns and internet in its needs capabilities, since
build.sh invokes Cargo against non-vendored dependencies. Use the existing needs
configuration rather than adding offline or vendoring changes.
In `@packages/gn/build.ncl`:
- Around line 32-53: Update packages/gn/build.ncl lines 32-53 to declare
build_args forwarding the GN version and pinned commit identifier. In
packages/gn/build.sh lines 12-24, consume those forwarded arguments, derive the
commit position from the forwarded version, and render the generated GN version
header from them instead of hard-coded values.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 7c3f3582-0973-4f68-b61c-c52e080f5f4a
📒 Files selected for processing (4)
packages/bindgen/build.nclpackages/bindgen/build.shpackages/gn/build.nclpackages/gn/build.sh
Comment on lines
+23
to
+34
| build_deps = [ | ||
| { file = "build.sh" } | Local, | ||
| { | ||
| url = "gs://minimal-staging-archives/rust-lang/rust-bindgen/v%{version}.tar.gz", | ||
| sha256 = "4ffb17061b2d71f19c5062d2e17e64107248f484f9775c0b7d30a16a8238dfd1", | ||
| extract = true, | ||
| strip_prefix = "rust-bindgen-%{version}", | ||
| } | Source, | ||
| base, | ||
| rust, | ||
| toolchain, | ||
| ], |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/sh
set -eu
tmp_dir="$(mktemp -d)"
trap 'rm -rf "$tmp_dir"' EXIT
curl -fsSL \
"https://github.com/rust-lang/rust-bindgen/archive/refs/tags/v0.72.1.tar.gz" \
-o "$tmp_dir/bindgen.tar.gz"
if tar -tzf "$tmp_dir/bindgen.tar.gz" | grep -Eq '/(vendor/|\.cargo/config(\.toml)?)'; then
echo "Vendoring or a Cargo source replacement exists; verify that Cargo builds offline."
else
echo "No vendored Cargo source replacement found; declare dns and internet needs."
fiRepository: gominimal/pkgs
Length of output: 228
🏁 Script executed:
#!/bin/sh
set -eu
printf '%s\n' '--- build.ncl ---'
cat -n packages/bindgen/build.ncl
printf '%s\n' '--- build.sh ---'
cat -n packages/bindgen/build.sh
printf '%s\n' '--- Cargo manifests and offline configuration ---'
find packages/bindgen -maxdepth 3 -type f \( \
-name 'Cargo.toml' -o -name 'Cargo.lock' -o -name 'config' -o -name 'config.toml' \
\) -print
rg -n --hidden --glob '!target/**' --glob '!node_modules/**' \
'(\[source\.|replace|patch\.|vendor|offline|cargo build|cargo fetch)' \
packages/bindgenRepository: gominimal/pkgs
Length of output: 3084
🏁 Script executed:
#!/bin/sh
set -eu
printf '%s\n' '--- Needs declarations ---'
rg -n -C 4 '\bNeeds\b|needs[[:space:]]*=' packages --glob 'build.ncl' | head -n 240
printf '%s\n' '--- Upstream Cargo dependency metadata ---'
tmp_dir="$(mktemp -d)"
trap 'rm -rf "$tmp_dir"' EXIT
curl -fsSL \
"https://github.com/rust-lang/rust-bindgen/archive/refs/tags/v0.72.1.tar.gz" \
-o "$tmp_dir/bindgen.tar.gz"
tar -xzf "$tmp_dir/bindgen.tar.gz" -C "$tmp_dir"
root="$(find "$tmp_dir" -mindepth 1 -maxdepth 1 -type d -name 'rust-bindgen-*' -print -quit)"
find "$root" -maxdepth 3 -type f \( -name 'Cargo.toml' -o -name 'Cargo.lock' -o -name 'config' -o -name 'config.toml' \) -print
if [ -f "$root/Cargo.lock" ]; then
rg -n 'source = "registry\+https://github.com/rust-lang/crates.io-index"|source = "registry\+https://github.com/rust-lang/crates.io-index"|source = "sparse\+https://index.crates.io"' "$root/Cargo.lock" | head -n 30
else
echo "No Cargo.lock at archive root"
fiRepository: gominimal/pkgs
Length of output: 144
Declare Cargo network capabilities.
packages/bindgen/build.sh runs cargo build --release -p bindgen-cli, and the v0.72.1 archive has no vendored crates or offline Cargo configuration. Add dns and internet to needs, or vendor all crates and force Cargo offline.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/bindgen/build.ncl` around lines 23 - 34, Update the bindgen package
definition associated with build_deps to declare both dns and internet in its
needs capabilities, since build.sh invokes Cargo against non-vendored
dependencies. Use the existing needs configuration rather than adding offline or
vendoring changes.
Source: Coding guidelines
Member
Author
There was a problem hiding this comment.
Checked against the repo's working precedent: no cargo package here declares needs network (bat, atuin, ast-grep, bandwhich — all plain cargo build from pristine mirrored tarballs, no vendoring), because the fetch layer pre-resolves Cargo.lock dependencies before the sandbox runs. The clean-room minimal build gate on this PR passed with no network declared — that's the empirical proof for this package specifically. Leaving as-is to match every other rust package.
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- Comparable Rust package declarations ---'
for package in bat atuin ast-grep bandwhich; do
build_file="packages/${package}/build.ncl"
if [ -f "$build_file" ]; then
printf '\n--- %s ---\n' "$build_file"
grep -nE 'needs[[:space:]]*=|cargo|rust|Cargo|build_deps[[:space:]]*=' "$build_file" || true
else
printf '\n--- packages/%s/build.ncl not found ---\n' "$package"
fi
done
printf '%s\n' '\n--- Fetch-layer and Cargo-resolution references ---'
rg -n -i -C 3 \
'pre-resolv|cargo\.lock|cargo (dependency|dependencies)|crate(s)?\.io|cargo.*fetch|fetch.*cargo' \
README.md packages .github 2>/dev/null || trueLength of output: 3983
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for package in bat atuin ast-grep bandwhich; do
printf '\n--- packages/%s/build.ncl ---\n' "$package"
sed -n '1,110p' "packages/${package}/build.ncl"
if [ -f "packages/${package}/build.sh" ]; then
printf '\n--- packages/%s/build.sh ---\n' "$package"
sed -n '1,100p' "packages/${package}/build.sh"
fi
doneLength of output: 7877
@bryan-minimal, I verified the cited packages. The precedent is mixed.
packages/ast-grep/build.ncl runs Cargo and declares internet.
packages/bandwhich/build.ncl runs Cargo and declares both dns and internet.
packages/libkrun/build.ncl also declares both capabilities for Cargo fetching.
The successful minimal build is useful evidence for the current environment. It does not show that Cargo cannot require a registry lookup in a clean cache state. The bindgen source has no vendored crates or offline Cargo configuration, and the package guideline requires the capabilities in this case.
I will keep the finding open.
You are interacting with an AI system.
…d.sh renders the header from build_args
CR catch: version (build.ncl) and the header values (build.sh) were two
hardcoded copies of the same fact. Now `position` + `commit` are the only
pins; version = "0.%{position}", the smoketest greps %{position}, and
build.sh renders the header from MINIMAL_ARG_POSITION/COMMIT.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First concrete slice of the chromium source-build spike (pkgmgr-rs#681): the two build tools we don't already package. The spike settled that arm64 must use system toolchains — every prebuilt in Google's official tarball (clang, rustc, bindgen, gn, node) is an x86-64 ELF — and everything else we need (llvm 21.1.8, rust 1.97.1, esbuild 0.28.1, go 1.26.5, ninja, python) already exists at or above the distro-proven floors.
gn 0.2511 (commit
7324363900cc, 2026-08-09):0.<position>scheme.gn --versionprints2511 (7324363900cc).git archiveof that commit mirrored togs://minimal-staging-archives/gn/gn/— gitiles/+archive/tarballs are generated on the fly and not byte-stable, so they can't be sha256-pinned directly.--version: gen.py's no-.gitfallback is0 (UNKNOWN), and that must never ship silently.CXXFLAGS/LDFLAGS(gen.py appends env flags);--no-static-libstdc++links the packaged libstdc++.gnproject is all-noscheme(dates/hashes/positions per distro) sorepology_projectwould propose garbage. Follow-up tracked on pkgmgr-rs#681: a curatedNAME_KEYED_VERSION_CHECKentry reading the gitiles API for the latest commit position.bindgen 0.72.1 — exactly Gentoo's floor for chromium 151:
cargo build --release -p bindgen-cli, remap-path-prefix flags, mirrored GitHub tarball, GithubRepo provenance).subsetOf llvm [\"libclang\", \"libs_clang\"]) — bindgen dlopens libclang to parse headers.Both packages evaluate cleanly through
mip dumplocally; CI's build gate is the proof for the compile.🤖 Generated with Claude Code
Summary by CodeRabbit
bindgencommand-line tool, version 0.72.1, for generating Rust bindings from C and C++ headers.gnbuild configuration tool, version 0.2511, for generating build files and coordinating native builds.