From e1871494aee04b69d8f905d11de02824dd41b060 Mon Sep 17 00:00:00 2001 From: Mike Solar Date: Fri, 21 Aug 2026 00:46:40 +0800 Subject: [PATCH] cd: audit the release binaries' NEEDED list on Linux Static FFmpeg + static OCIO leave only base-OS libraries; the audit step prints objdump NEEDED for each packaged binary so any accidental dynamic dependency (and any distro-specific package-name surface) is visible in the build log. --- .github/workflows/cd.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index fde901a5d..5da494af0 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -84,6 +84,18 @@ jobs: - name: Build (release) run: cargo build --release --locked + # Runtime-dependency audit: everything media-related (FFmpeg, OCIO) + # is statically linked, so the NEEDED list should contain only + # base-OS libraries (glibc, X11, ALSA/PipeWire, Vulkan) — names that + # are stable across Debian/openKylin (no distro-specific package + # names leak into the deb's dependency surface). + - name: Audit runtime dependencies + run: | + for bin in target/release/oak-editor target/release/oak-cli target/release/oak-worker; do + echo "== $bin" + objdump -p "$bin" | grep NEEDED || true + done + - name: Package (deb, AppImage, pacman) run: cargo packager --release --formats deb,appimage,pacman