My gamescope gate withheld the host .deb it was meant to protect — the release still ships the KDE-breaking one #140

Merged

enricobuehler merged 1 commits from worktree-gamescope-gate-placement into main 2026-08-09 09:12:58 +00:00

Conversation 0 Commits 1 Files Changed 2

+72 -36

enricobuehler commented 2026-08-09 08:53:05 +00:00

Owner

Copy Link

Copy Source

The damage

The gate #135 added fails the job at the gamescope build step. In deb.yml that step runs before "Publish to the Gitea apt registry" and "Attach the host .deb to the Gitea release" — so failing it skipped both.

Asset timestamps on release 729 show the result:

2026-08-09T00:17:24Z  punktfunk-host_0.26.0_amd64.deb     <- re-point #1, PRE-#136
2026-08-09T08:29:43Z  punktfunk-client_0.26.0_arm64.deb
2026-08-09T08:30:54Z  punktfunk-client_0.26.0_amd64.deb
2026-08-09T08:31:03Z  punktfunk-scripting_0.26.0_amd64.deb
2026-08-09T08:31:12Z  punktfunk-web_0.26.0_amd64.deb

The published Debian host is from before #136 revoked CAP_SYS_NICE. It still runs setcap cap_sys_nice=ep in its postinst — the exact thing that makes the host unidentifiable to KWin and kills every KDE desktop session. A gate meant to protect the release withheld the fix for it and left the broken artifact in place.

rpm.yml has the identical latent bug and only escaped because Fedora went green this run: a gamescope failure there would skip the sysext image, the feed publish and the release attach — withholding the punktfunk RPMs and .raw images too.

The fix

Both files now warn at the build/package steps and gate as the last step of the job, after everything has published. The rule this encodes: a missing extra must never stop a good artifact shipping — go red afterwards instead.

And name noble's dependencies outright

apt-get build-dep gamescope gives noble almost nothing (no comparable distro package), which is why this peeled one dep per CI cycle — wayland-protocols, then xdamage, and there would have been more. The full set is derived from the Arch package's depends+makedepends — the build that demonstrably works — plus wlroots' own, since it is a forced fallback subproject.

One apt-get per name, deliberately. A single transaction aborts wholesale on one unknown package, installing nothing and hiding the real gap behind a name typo. Per-package and best-effort, with any missing name echoed; the end-of-job gate is what actually decides.

⚠ Verification

• both YAML files parse
• every gamescope-touching run: block is bash -n clean with matrix placeholders substituted (9 blocks)
• the .deb glob matches build-gamescope-deb.sh's documented output (dist/punktfunk-gamescope_<version>_<arch>.deb)
• the RPM glob excludes debuginfo/debugsource, exactly as the attach loop above it does

The noble dep names cannot be proven from macOS. The next tag run decides that — and it now decides it without holding the host .deb hostage.

Status of the claim this all started from

Arch ✅ · Fedora ✅ (both bases, libstdc++-static was the fix — RPMs are attached and in the registry) · Debian/Ubuntu ❌ still.

## The damage The gate #135 added fails the job at the gamescope **build** step. In `deb.yml` that step runs *before* "Publish to the Gitea apt registry" and "Attach the host .deb to the Gitea release" — so failing it skipped both. Asset timestamps on release 729 show the result: ``` 2026-08-09T00:17:24Z punktfunk-host_0.26.0_amd64.deb <- re-point #1, PRE-#136 2026-08-09T08:29:43Z punktfunk-client_0.26.0_arm64.deb 2026-08-09T08:30:54Z punktfunk-client_0.26.0_amd64.deb 2026-08-09T08:31:03Z punktfunk-scripting_0.26.0_amd64.deb 2026-08-09T08:31:12Z punktfunk-web_0.26.0_amd64.deb ``` **The published Debian host is from before #136 revoked `CAP_SYS_NICE`.** It still runs `setcap cap_sys_nice=ep` in its postinst — the exact thing that makes the host unidentifiable to KWin and kills every KDE desktop session. A gate meant to protect the release withheld the fix for it and left the broken artifact in place. `rpm.yml` has the **identical latent bug** and only escaped because Fedora went green this run: a gamescope failure there would skip the sysext image, the feed publish *and* the release attach — withholding the punktfunk RPMs and `.raw` images too. ## The fix Both files now **warn** at the build/package steps and gate as the **last step of the job**, after everything has published. The rule this encodes: *a missing extra must never stop a good artifact shipping — go red afterwards instead.* ## And name noble's dependencies outright `apt-get build-dep gamescope` gives noble almost nothing (no comparable distro package), which is why this peeled one dep per CI cycle — `wayland-protocols`, then `xdamage`, and there would have been more. The full set is derived from the Arch package's `depends`+`makedepends` — the build that demonstrably works — plus wlroots' own, since it is a forced fallback subproject. **One `apt-get` per name, deliberately.** A single transaction aborts wholesale on one unknown package, installing *nothing* and hiding the real gap behind a name typo. Per-package and best-effort, with any missing name echoed; the end-of-job gate is what actually decides. ## ⚠ Verification - both YAML files parse - every gamescope-touching `run:` block is `bash -n` clean with matrix placeholders substituted (**9 blocks**) - the `.deb` glob matches `build-gamescope-deb.sh`'s documented output (`dist/punktfunk-gamescope_<version>_<arch>.deb`) - the RPM glob excludes `debuginfo`/`debugsource`, exactly as the attach loop above it does The noble dep **names** cannot be proven from macOS. The next tag run decides that — and it now decides it without holding the host `.deb` hostage. ## Status of the claim this all started from Arch ✅ · Fedora ✅ (both bases, `libstdc++-static` was the fix — RPMs are attached and in the registry) · Debian/Ubuntu ❌ still.

enricobuehler added 2 commits 2026-08-09 08:53:07 +00:00

fix(pf-vdisplay): the capability-hint test asserted the environment, not the code ... e8a4f54c07

`silent_without_capabilities` called the real `capability_denial_hint()` and
asserted it returns "", on the strength of a doc comment that read "The test
process has no capabilities."

That is true on a dev box and false in CI, where the runner container is root
with a full permitted set. main went red on 0f79587d with:

    left: " — NOTE: this process carries capabilities (CapPrm=0x000001ffffffffff) …"
   right: ""

Nothing was wrong: the hint fired correctly, on a process that really did hold
every capability. The test was reading the ambient environment and calling it a
property of the code.

`permitted_caps_from_status` had already been split out for exactly this reason
— "so that shape is testable without a capability-carrying process to point at"
— but only the PARSE half. The message half still went to /proc/self/status.
This finishes the split: `capability_denial_hint_for(Option<u64>)` holds the
formatting and takes the mask, `capability_denial_hint()` reads /proc and
delegates. Both keep their callers, so neither is dead code.

Also adds `names_the_mask_and_the_repair_when_capped`. Without it the silent
case passes just as well against a function that returns "" unconditionally —
which is the failure mode this repo has been bitten by before, and the reason
every decode fix carries a counterfactual.

No behaviour change: the three error paths call the same function and get the
same string.

⚠ Verification is CI. `kwin.rs` is `#[cfg(target_os = "linux")]`, so it does not
compile on the macOS host this was written from; `cargo fmt --all --check` is
clean and a Linux container check was attempted but the stock rust image has no
cmake for audiopus_sys, so it never reached the test. ci.yml going green on main
is the proof — and unlike the case it replaces, this test now fails or passes
for reasons that have nothing to do with the machine running it.

Does not touch the v0.26.0 tag: ci.yml runs on `push: branches: [main]` and
`pull_request` only, and no tag leg runs cargo test.

fix(ci): my gamescope gate withheld the host .deb it was supposed to protect ... 5bd92dac5d

The gate #135 added fails the job at the gamescope BUILD step. In deb.yml that
step runs before "Publish to the Gitea apt registry" and "Attach the host .deb
to the Gitea release", so failing it skipped both.

Consequence on the v0.26.0 tag, and it is the worst thing in this release so
far: the host .deb on the release is from 00:17 — re-point #1, BEFORE #136
revoked CAP_SYS_NICE. Every other .deb is from 08:29-08:31. So the published
Debian host still runs `setcap cap_sys_nice=ep` in its postinst, which is
exactly what makes the host unidentifiable to KWin and kills every KDE desktop
session. A gate meant to protect the release withheld the fix for it and left
the broken artifact in place.

rpm.yml has the identical latent bug and only escaped it because Fedora went
green: a gamescope failure there would skip the sysext image, the feed publish
and the release attach, withholding the punktfunk RPMs and .raw images too.

Both now warn at the build/package steps and gate as the LAST step of the job,
after everything has published. A missing EXTRA must never stop a good artifact
shipping — go red afterwards instead.

Also: name noble's dependencies outright. `apt-get build-dep gamescope` gives it
almost nothing (the distro has no comparable package), which is why this peeled
one dep per CI cycle — wayland-protocols, then xdamage. The full set is derived
from the Arch package's depends+makedepends, which is the build that demonstrably
works, plus wlroots' own (it is a forced fallback subproject).

One `apt-get` per name on purpose: a single transaction aborts wholesale on one
unknown package, installing NOTHING and hiding the real gap behind a name typo.
Per-package, best-effort, with the missing name echoed; the end-of-job gate is
what actually decides.

⚠ Verification: both YAML files parse; every gamescope-touching `run:` block is
`bash -n` clean with matrix placeholders substituted (9 blocks); the .deb glob
matches build-gamescope-deb.sh's documented output
(`dist/punktfunk-gamescope_<version>_<arch>.deb`) and the RPM glob excludes
debuginfo/debugsource exactly as the attach loop above it does. The noble dep
NAMES cannot be proven from macOS — that is what the next tag run decides, and
it now decides it without holding the host .deb hostage.

enricobuehler merged commit 516a295432 into main 2026-08-09 09:12:58 +00:00

enricobuehler deleted branch worktree-gamescope-gate-placement 2026-08-09 09:13:02 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

FernandoMX enricobuehler (Enrico Bühler) kszlim nannku neoney sassycrown

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unom/punktfunk#140