Kurt Himebauch
2848484a99
* feat: experimental native userland that runs the Linux side without proot * fix(native): keep the visible name of link2symlink binaries * fix(ci): run the native hook build through bash * fix(native): address review findings in the hook and the ctl fallback * fix(ctl): use the broadcast fallback only when content is missing * fix(native): survive Android's seccomp filter in ld.so, libc and posix_spawn children * docs(native): how to test under Android's seccomp filter * fix(session): hide an unlistable /sys/bus/pci/devices so libpci does not abort Chromium's GPU init * fix(native): nested syscall() redirects no longer loop with libblsession's openat2 * fix(native): controllers reach Steam and the install-script evaluator no longer blocks game moves * fix(native): write the hook's NUL character literals as escapes * fix(native): proot fast path turns off and greys out while running without proot * fix(native): D-Bus logins work and Xwayland still admits root once peers read as root * fix(native): scripts on session mounts outside the rootfs run with the rootfs shell * fix(native): games on the SD card library start in their own folder * fix(native): Wine drive links proot made point at their real places * fix(native): at-calls, uid lookups and relative programs follow the session's mounts * fix(native): close-from in spawned programs covers what is open at the spawn * fix(native): service names resolve and the DNS fallback answers what was asked * build(native): the hook is built with its Go support and tracked by the preload recipe * fix(native): drive links into identity mounts stay, and relink and seccomp patch failures are logged * fix(native): seccomp-sim's filter holds every allowed call * fix(ctl): the broadcast fallback only stands in for a missing content command * fix(native): pre-2.33 glibc stat calls present owners as root too * fix(native): res_init and res_ninit call glibc, so Steam's store resolves names * fix(ci): a preload lock older than a new output rebuilds that group, and generated headers are not hashed * fix(native): a second seccomp patch run leaves other system calls alone * fix(native): the terminal and bottom desktop keep proot's environment in a native session * fix(native): any number of session mounts, and openat2 relative to a mounted folder * fix(agent): a native command's stdin is written beside its timeout * fix(ctl): native rejects --env without = and timeouts outside 0-600 s * fix(native): the resolver fallback has the network's IPv6 servers, and lookups keep the fallback's validation errors * fix(native): a spawn whose dup2 source close-from closed fails with EBADF * fix(native): __getcwd_chk checks its buffer, and seccomp-sim -a takes only call numbers * feat(native): guests see the session hostname from uname and gethostname * feat(native): the terminal and bottom desktop run without proot * fix(components): an origin APK without a newer preload output still proves the rest * fix(native): seccomp-sim -a rejects empty fields * fix(native): gethostbyname no longer answers failed lookups with Ubuntu and Debian addresses * feat(native): store installers, root helpers, Comet and Xodus run without proot * fix(native): the hook finds libraries, preloads and itself through a sandbox's mounts, and ldconfig -C makes its cache * feat(native): Flatpak sandboxes run without proot, and apply_extra runs without a runtime * fix(native): remove, glob and nftw take guest paths, and links in a mount are followed as the guest sees them * fix(native): Flatpak sandboxes get the session's mounts, their libraries' RUNPATHs, and no rootfs-only settings * fix(native): gethostbyname asks the network's DNS servers, nftw of / gives single slashes, and the library path fits mapped directories * fix(native): a native process starts in its working directory's real place * fix(native): the library path given to ld.so holds whole directories only * fix(native): Wine drive links keep their guest paths, so proot finds the library after a native session * fix(native): droiddeckctl native prepares the rootfs with the setting off * fix(native): a SysV segment stays while any process has it attached * fix(native): DNS lookups ask the network's own servers before public ones * fix(native): a program's own seccomp traps reach its own SIGSYS handler * feat(native): run native sessions under a device's own app seccomp filter for testing * fix(native): SysV attaches and collection take a lock, a failed mark fails the attach, and collection closes its directory * fix(native): shmat fails when it cannot take the segment lock * fix(native): the SysV segment lock is retried when a signal interrupts it * fix(native): process tools see the session's processes as root's * fix(native): native processes are named after their program, not ld.so * fix(native): a session's helpers keep the mode the session started in * fix(native): a keyed SysV segment stays until IPC_RMID * fix(native): a rootfs link to an absolute guest path is followed in the guest, so Wine finds its z: drive * fix(native): a sandbox whose loader can't be patched runs under proot * fix(native): creating a private SysV segment also collects stale ones * fix(native): a session stopped during startup forgets its mode * fix(xbox): a native backend is authorized by its process ancestry * fix(native): Wine's drive links are followed in the guest from any prefix * fix(native): only the startup that owns the running session publishes its mode * fix(native): a SysV segment stays until IPC_RMID even after its maker ends * fix(native): a sandbox mount nested in another mount gets its own place * fix(native): a sandbox whose mount places can't be made runs under proot
Runtime component preparation
recipes.json owns component source inputs, builders, outputs, package requirements
and pinned downloads. prepare.py runs those recipes, calculates cache identities,
installs the union of missing tools and verifies the prepared artifact handoff.
Builders live in recipes/; the workflow describes scheduling and gates.
flowchart LR
Source[Pin source tree] --> Components[Prepare verified components]
Source --> Xbox[Xbox ARM64 backend]
Source --> Tests[Python and native tests]
Components --> APK[Compile APK and Android tests]
Xbox --> APK
APK --> Gate[Compile and test APK gate]
Tests --> Gate
Gate --> Publish[Main only: signing and publishing]
All workers verify the same source tree. The component artifact records that tree, recipe identities and every output hash; the APK worker verifies the inventory before building. This handoff verifies consistency within the same CI run. It is not independent provenance for arbitrary artifacts. Source policy checks, tests, APK content/ABI checks and signing/publication gates remain in place.
tools/ci/toolchains.env pins the Android NDK shared by component, APK and native
test workers. Linux builds use Ubuntu 24.04. Recipe and input changes invalidate
the relevant component cache; ordinary caches remain performance aids.
Verified preload snapshots
preloads.lock.json pins a small immutable preload archive. It records each
binary's hash, its producing main CI run, the original APK artifact identity and
digest, source/header hashes, the ARM64 build recipe and x86 compiler-image inputs.
It covers core ARM64 preloads and the x86 preload libraries. VR, Android native
libraries, Comet and Xbox use their registered recipes and existing release pins
or component caches.
Every build compares current source inputs, including transitive quoted headers, and build recipes with this manifest. Changed groups rebuild from source. A missing release also selects a rebuild. Corrupt archives, unexpected files and binary hash mismatches fail the build. Existing preload checks, runtime packaging checks and all test jobs still run.
The trust anchor is the manifest in the pinned main base. A new or changed PR
manifest is independently checked against a successful push build of main:
GitHub must confirm the run/source/workflow and original APK artifact digest, and
every claimed binary must match that APK. The claimed source inputs and recipe
must match that run's Git source. A PR cannot establish trust by changing both a
binary and its claimed checksum. This is approved-build reuse, not a claim of
bit-for-bit reproducible compilation or a signed SLSA attestation.
To refresh after source or compiler changes:
- Let a main build compile and test the new inputs.
- Run
python tools/components/preloads.py snapshot --run RUN_ID. - Publish
app/build/component-snapshot/preloads.tar.gzto DroidDeck-Components aspreloads-<full archive SHA-256>, without replacing an existing release. Include the manifest and producing run in the release notes. - Review and commit the updated manifest. CI independently checks its origin.
The workflow dispatch rebuild_preloads option forces source compilation even
when an approved snapshot matches. Use it when refreshing a compiler or system
header revision. Runner image updates do not silently replace an approved binary;
the producing run remains the record of its compiler environment.