Files

T

agw 56434ba7ed Bundle non-system libraries instead of version-pinning depends

Bundling R alone was not enough: R links libicuuc, and Arch moves ICU
regularly. The obvious fix - pinning 'icu>=78 <79' in depends - is worse
than the disease on a rolling distro, because pacman would then refuse to
upgrade ICU while JASP is installed, blocking the user's whole system
upgrade until a rebuild lands.

So bundle-libs.sh copies every non-system shared library into
/opt/jasp-desktop/lib and rewrites rpaths, by denylist rather than
allowlist. depends now carries no version constraints at all.

Qt6 stays system-provided on purpose - Qt is binary compatible across Qt 6
minors, and bundling QtWebEngine would add ~500 MB. That also means the
only rebuild triggers left are a new JASP release and a Qt major bump;
rebuilding for anything else would cost users a 1.7 GB re-download.

Also fixes check-upstream.py querying only repo=Extra, which silently
returned nothing for icu (it lives in core).

2026-09-01 22:05:00 +02:00

6.5 KiB

Raw Blame History

jasp-desktop-bin

Automated binary builds of JASP for Arch Linux, published to the AUR as jasp-desktop-bin.

Why this exists

Upstream JASP ships installers for Windows and macOS only — there is no official Linux binary. The official Linux channel is the Flathub build. The existing AUR package jasp-desktop therefore builds everything from source, including buildAllDefaultJaspModules.R, which compiles several hundred R packages. That is the multi-hour build this repo exists to avoid: the compile happens once, here, and users download the result.

The constraint that shapes everything

JASP pins its R package set with renv lockfiles against a frozen CRAN snapshot — for 0.98.1, Modules/Rcpp_RInside.lock points at the Posit snapshot of 2026-03-31. That set targets R 4.5.

Building against Arch's current R (4.6.1) fails immediately: Rcpp 1.1.1 does not compile there, because R_NamespaceRegistry is gone in R 4.6. The Rcpp release that fixes this (1.1.2, 2026-07-05) is newer than the pinned snapshot, so the lockfile cannot resolve it either. This is precisely the "old libraries with issues" problem that makes the source AUR package painful.

So this build compiles and bundles its own R 4.5.3 into /opt/jasp-desktop/R and points R_HOME at it — which is what upstream's own CI does (.github/workflows/ubuntu.yml sets JASP_R_VERSION: 4.5.3 and an explicit R_HOME). Tools/CMake/R.cmake reads R_HOME from the environment on Linux, so this is a supported configuration rather than a hack.

What is bundled, and why nothing is version-pinned

After staging, build/bundle-libs.sh walks every ELF object in the tree, copies each non-system shared library it depends on into /opt/jasp-desktop/lib, and rewrites the rpath to look there. It works by denylist: glibc, libstdc++, Qt6, the GL/X11/Wayland/dbus stack, fontconfig and freetype stay system-provided; everything else — ICU, jsoncpp, glpk, JAGS, readstat, librdata, BLAS/LAPACK, pcre2, readline — is bundled.

The point is that depends contains no version constraints at all. That is a deliberate reversal of the obvious design. Pinning (icu>=78 <79) looks safer but is actively harmful on a rolling distro: when Arch ships the next ICU, pacman would refuse to upgrade it while JASP is installed, blocking the user's entire system upgrade until a rebuild lands. Bundling means JASP never constrains the system, and a pacman -Syu cannot break it.

Qt6 is the deliberate exception and stays a system dependency. Qt guarantees binary compatibility across Qt 6 minor releases, and bundling QtWebEngine would add ~500 MB for very little gain. A Qt 7 transition will need a rebuild — which is why scripts/check-upstream.py watches the Qt major and nothing else besides the JASP version. Rebuilding for anything else would cost every user a ~1.7 GB re-download for no benefit.

jags and librdata-git are AUR-only, and JASP needs freexl >= 2.0.99 while Arch ships 2.0.0 — so the build compiles those itself, matching what upstream CI does.

Layout

Path	Purpose
`build/build-jasp.sh`	The actual build. Runs in an `archlinux:base-devel` container, emits the tarball plus `build-info.json`.
`build/bundle-libs.sh`	Copies non-system shared libraries into `/opt/jasp-desktop/lib` and rewrites rpaths, so the package needs no version-pinned deps.
`scripts/check-upstream.py`	Compares upstream JASP and the Arch Qt major against `state.json`; decides whether to build.
`scripts/gen-pkgbuild.py`	Fills `packaging/PKGBUILD.in` from `build-info.json`; derives `pkgrel` from what is on the AUR.
`scripts/publish-github-release.sh`	Creates the GitHub release and uploads the tarball.
`scripts/push-aur.sh`	Generates `.SRCINFO` and pushes to `aur.archlinux.org`.
`scripts/record-state.sh`	Commits `state.json` so the next nightly run knows what was built.
`packaging/PKGBUILD.in`	Template for the AUR package.
`state.json`	Last successfully built combination.

Flow

nightly (03:00) ─► check-upstream.py
                     │ new JASP tag, or a Qt major transition?
                     ▼
                   build-jasp.sh  (Arch container, hours)
                     │  builds R 4.5.3, JASP, all R modules, then bundles libs
                     │  jasp-desktop-<ver>-x86_64.tar.zst + build-info.json
                     ▼
                   GitHub release ──► gen-pkgbuild.py ──► push to AUR
                     │
                     ▼
                   state.json committed back

Required configuration

Set these in the Gitea repo before the first run.

Variables (Settings → Actions → Variables):

Name	Example	Meaning
`GH_OWNER`	`asgerw`	GitHub account hosting the release repo
`GH_REPO`	`jasp-desktop-bin`	Release repo name
`AUR_MAINTAINER`	`Asger Geel Weirsoe <asger@weircon.dk>`	Written into the PKGBUILD header

Secrets (Settings → Actions → Secrets):

Name	Meaning
`GH_TOKEN`	GitHub PAT with `contents: write` on the release repo
`AUR_SSH_PRIVATE_KEY`	Private SSH key registered with your AUR account. Copy the value already set on `agw/pi3-smart-workspace`.
`STATE_PUSH_TOKEN`	Gitea token with write access to this repo, for committing `state.json`. (Gitea reserves the `GITEA_` secret prefix.)

The GitHub repo GH_OWNER/GH_REPO must exist and be public — the AUR PKGBUILD downloads the tarball from its releases, so it has to be reachable anonymously.

Runner requirements

The build runs for hours and needs disk. On the Gitea runner host:

runner.timeout in /var/lib/gitea-worker/config.yaml must exceed the build time (set to 16h).
Gitea's own job timeout ([actions] ENDLESS_TASK_TIMEOUT in app.ini, default 3h) must match, otherwise Gitea kills the job at 3h regardless of the runner.
Roughly 40–60 GB of free disk for the build tree, the bundled R and the staged install.

Running it by hand

# Build a specific tag without waiting for the schedule
Actions → Build JASP binary and publish to AUR → Run workflow
         jasp_tag = v0.98.1   force = true

Caveat worth knowing

AUR convention is that a -bin package repackages binaries published by upstream. Here upstream publishes no Linux binary, so this one is built by us. That is unusual, and a maintainer or TU may question it. It is not against the rules, but the package description and this README should stay honest about where the binary comes from.

6.5 KiB Raw Blame History Unescape Escape