Update linux-mingw image.

- No need to download boost from suyu/ext-linux-bin since the package is
  already on the ownstuff repository. Same for SDL
- Use mingw-w64-cmake instead of the system Cmake

.forgejo/workflows/ci.yml

@@ -12,11 +12,11 @@ on:
 
 jobs:
   build:
-    runs-on: verify
+    runs-on: docker-build
     strategy:
       matrix:
         # image: ["linux-clang-format", "linux-fresh", "linux-mingw", "linux-transifex"]
-        image: ["forgejo-runner-dind", "linux-clang-format", "linux-fresh", "linux-mingw"]
+        image: ["android", "linux-clang-format", "linux-fresh", "linux-mingw"]
     
     steps:
     - uses: https://github.com/actions/checkout@v2

android/Dockerfile

@@ -0,0 +1,16 @@
+FROM ubuntu:jammy
+LABEL maintainer="suyu"
+ENV ANDROID_HOME=/usr/lib/android-sdk/
+
+RUN useradd -m -u 1027 -s /bin/bash suyu \
+		&& apt-get update && apt-get -y full-upgrade \
+		&& apt-get install -y git gpg-agent wget \
+		&& wget -qO- https://deb.nodesource.com/setup_20.x | bash - \
+    && DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC apt-get install -y ccache apksigner glslang-dev glslang-tools git sdkmanager android-sdk bash openjdk-17-jdk openjdk-17-jre curl zip unzip tar cmake ninja-build pkg-config nodejs \
+    && DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC apt-get install -y --no-install-recommends clang-14 lld-14 llvm-14 llvm-14-linker-tools \
+    && ln -s $(which clang-14) /usr/bin/clang && ln -s $(which clang++-14) /usr/bin/clang++ \
+    && echo y | sdkmanager --sdk_root=/usr/lib/android-sdk --licenses \
+		&& apt-get clean autoclean && apt-get autoremove --yes && rm -rf /var/lib/apt /var/lib/dpkg /var/lib/cache /var/lib/log
+#Disable user for now.
+#USER 1027
+

forgejo-runner-dind/Dockerfile

@@ -97,11 +97,15 @@ ENV DIND_COMMIT 65cfcc28ab37cb75e1560e4b4738719c07c6618e
 
 RUN set -eux; \
 	wget -O /usr/local/bin/dind "https://raw.githubusercontent.com/docker/docker/${DIND_COMMIT}/hack/dind"; \
-	chmod +x /usr/local/bin/dind \
-	wget -O /usr/local/bin/forgejo-runner https://code.forgejo.org/forgejo/runner/releases/download/v3.3.0/forgejo-runner-3.3.0-linux-amd64 \
-	chmod +x /usr/local/bin/forgejo-runner
+	chmod +x /usr/local/bin/dind
 
-COPY dockerd-entrypoint.sh /usr/local/bin/
+RUN set -eux; \
+	wget -O /usr/local/bin/dockerd-entrypoint.sh "https://raw.githubusercontent.com/docker-library/docker/master/26/dind/dockerd-entrypoint.sh"; \
+	chmod +x /usr/local/bin/dockerd-entrypoint.sh
+
+RUN set -eux; \
+	wget -O /usr/local/bin/forgejo-runner "https://code.forgejo.org/forgejo/runner/releases/download/v3.3.0/forgejo-runner-3.3.0-linux-amd64"; \
+	chmod +x /usr/local/bin/forgejo-runner
 
 VOLUME /var/lib/docker
 EXPOSE 2375 2376

forgejo-runner-dind/dockerd-entrypoint.sh

@@ -0,0 +1,233 @@
+#!/bin/sh
+set -eu
+
+_tls_ensure_private() {
+	local f="$1"; shift
+	[ -s "$f" ] || openssl genrsa -out "$f" 4096
+}
+_tls_san() {
+	{
+		ip -oneline address | awk '{ gsub(/\/.+$/, "", $4); print "IP:" $4 }'
+		{
+			cat /etc/hostname
+			echo 'docker'
+			echo 'localhost'
+			hostname -f
+			hostname -s
+		} | sed 's/^/DNS:/'
+		[ -z "${DOCKER_TLS_SAN:-}" ] || echo "$DOCKER_TLS_SAN"
+	} | sort -u | xargs printf '%s,' | sed "s/,\$//"
+}
+_tls_generate_certs() {
+	local dir="$1"; shift
+
+	# if server/{ca,key,cert}.pem && !ca/key.pem, do NOTHING except verify (user likely managing CA themselves)
+	# if ca/key.pem || !ca/cert.pem, generate CA public if necessary
+	# if ca/key.pem, generate server public
+	# if ca/key.pem, generate client public
+	# (regenerating public certs every startup to account for SAN/IP changes and/or expiration)
+
+	if [ -s "$dir/server/ca.pem" ] && [ -s "$dir/server/cert.pem" ] && [ -s "$dir/server/key.pem" ] && [ ! -s "$dir/ca/key.pem" ]; then
+		openssl verify -CAfile "$dir/server/ca.pem" "$dir/server/cert.pem"
+		return 0
+	fi
+
+	# https://github.com/FiloSottile/mkcert/issues/174
+	local certValidDays='825'
+
+	if [ -s "$dir/ca/key.pem" ] || [ ! -s "$dir/ca/cert.pem" ]; then
+		# if we either have a CA private key or do *not* have a CA public key, then we should create/manage the CA
+		mkdir -p "$dir/ca"
+		_tls_ensure_private "$dir/ca/key.pem"
+		openssl req -new -key "$dir/ca/key.pem" \
+			-out "$dir/ca/cert.pem" \
+			-subj '/CN=docker:dind CA' -x509 -days "$certValidDays"
+	fi
+
+	if [ -s "$dir/ca/key.pem" ]; then
+		# if we have a CA private key, we should create/manage a server key
+		mkdir -p "$dir/server"
+		_tls_ensure_private "$dir/server/key.pem"
+		openssl req -new -key "$dir/server/key.pem" \
+			-out "$dir/server/csr.pem" \
+			-subj '/CN=docker:dind server'
+		cat > "$dir/server/openssl.cnf" <<-EOF
+			[ x509_exts ]
+			subjectAltName = $(_tls_san)
+		EOF
+		openssl x509 -req \
+				-in "$dir/server/csr.pem" \
+				-CA "$dir/ca/cert.pem" \
+				-CAkey "$dir/ca/key.pem" \
+				-CAcreateserial \
+				-out "$dir/server/cert.pem" \
+				-days "$certValidDays" \
+				-extfile "$dir/server/openssl.cnf" \
+				-extensions x509_exts
+		cp "$dir/ca/cert.pem" "$dir/server/ca.pem"
+		openssl verify -CAfile "$dir/server/ca.pem" "$dir/server/cert.pem"
+	fi
+
+	if [ -s "$dir/ca/key.pem" ]; then
+		# if we have a CA private key, we should create/manage a client key
+		mkdir -p "$dir/client"
+		_tls_ensure_private "$dir/client/key.pem"
+		chmod 0644 "$dir/client/key.pem" # openssl defaults to 0600 for the private key, but this one needs to be shared with arbitrary client contexts
+		openssl req -new \
+				-key "$dir/client/key.pem" \
+				-out "$dir/client/csr.pem" \
+				-subj '/CN=docker:dind client'
+		cat > "$dir/client/openssl.cnf" <<-'EOF'
+			[ x509_exts ]
+			extendedKeyUsage = clientAuth
+		EOF
+		openssl x509 -req \
+				-in "$dir/client/csr.pem" \
+				-CA "$dir/ca/cert.pem" \
+				-CAkey "$dir/ca/key.pem" \
+				-CAcreateserial \
+				-out "$dir/client/cert.pem" \
+				-days "$certValidDays" \
+				-extfile "$dir/client/openssl.cnf" \
+				-extensions x509_exts
+		cp "$dir/ca/cert.pem" "$dir/client/ca.pem"
+		openssl verify -CAfile "$dir/client/ca.pem" "$dir/client/cert.pem"
+	fi
+}
+
+# no arguments passed
+# or first arg is `-f` or `--some-option`
+if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then
+	# set "dockerSocket" to the default "--host" *unix socket* value (for both standard or rootless)
+	uid="$(id -u)"
+	if [ "$uid" = '0' ]; then
+		dockerSocket='unix:///var/run/docker.sock'
+	else
+		# if we're not root, we must be trying to run rootless
+		: "${XDG_RUNTIME_DIR:=/run/user/$uid}"
+		dockerSocket="unix://$XDG_RUNTIME_DIR/docker.sock"
+	fi
+	case "${DOCKER_HOST:-}" in
+		unix://*)
+			dockerSocket="$DOCKER_HOST"
+			;;
+	esac
+
+	# add our default arguments
+	if [ -n "${DOCKER_TLS_CERTDIR:-}" ]; then
+		_tls_generate_certs "$DOCKER_TLS_CERTDIR"
+		# generate certs and use TLS if requested/possible (default in 19.03+)
+		set -- dockerd \
+			--host="$dockerSocket" \
+			--host=tcp://0.0.0.0:2376 \
+			--tlsverify \
+			--tlscacert "$DOCKER_TLS_CERTDIR/server/ca.pem" \
+			--tlscert "$DOCKER_TLS_CERTDIR/server/cert.pem" \
+			--tlskey "$DOCKER_TLS_CERTDIR/server/key.pem" \
+			"$@"
+		DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2376:2376/tcp"
+	else
+		# TLS disabled (-e DOCKER_TLS_CERTDIR='') or missing certs
+		set -- dockerd \
+			--host="$dockerSocket" \
+			--host=tcp://0.0.0.0:2375 \
+			"$@"
+		DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2375:2375/tcp"
+	fi
+fi
+
+if [ "$1" = 'dockerd' ]; then
+	# explicitly remove Docker's default PID file to ensure that it can start properly if it was stopped uncleanly (and thus didn't clean up the PID file)
+	find /run /var/run -iname 'docker*.pid' -delete || :
+
+	# XXX inject "docker-init" (tini) as pid1 to workaround https://github.com/docker-library/docker/issues/318 (zombie container-shim processes)
+	set -- docker-init -- "$@"
+
+	iptablesLegacy=
+	if [ -n "${DOCKER_IPTABLES_LEGACY+x}" ]; then
+		# let users choose explicitly to legacy or not to legacy
+		iptablesLegacy="$DOCKER_IPTABLES_LEGACY"
+		if [ -n "$iptablesLegacy" ]; then
+			modprobe ip_tables || :
+		else
+			modprobe nf_tables || :
+		fi
+	elif (
+		# https://git.netfilter.org/iptables/tree/iptables/nft-shared.c?id=f5cf76626d95d2c491a80288bccc160c53b44e88#n420
+		# https://github.com/docker-library/docker/pull/468#discussion_r1442131459
+		for f in /proc/net/ip_tables_names /proc/net/ip6_tables_names /proc/net/arp_tables_names; do
+			if b="$(cat "$f")" && [ -n "$b" ]; then
+				exit 0
+			fi
+		done
+		exit 1
+	); then
+		# if we already have any "legacy" iptables rules, we should always use legacy
+		iptablesLegacy=1
+	elif ! iptables -nL > /dev/null 2>&1; then
+		# if iptables fails to run, chances are high the necessary kernel modules aren't loaded (perhaps the host is using xtables, for example)
+		# https://github.com/docker-library/docker/issues/350
+		# https://github.com/moby/moby/issues/26824
+		# https://github.com/docker-library/docker/pull/437#issuecomment-1854900620
+		modprobe nf_tables || :
+		if ! iptables -nL > /dev/null 2>&1; then
+			# might be host has no nf_tables, but Alpine is all-in now (so let's try a legacy fallback)
+			modprobe ip_tables || :
+			if /usr/local/sbin/.iptables-legacy/iptables -nL > /dev/null 2>&1; then
+				iptablesLegacy=1
+			fi
+		fi
+	fi
+	if [ -n "$iptablesLegacy" ]; then
+		# see https://github.com/docker-library/docker/issues/463 (and the dind Dockerfile where this directory is set up)
+		export PATH="/usr/local/sbin/.iptables-legacy:$PATH"
+	fi
+	iptables --version # so users can see whether it's legacy or not
+
+	uid="$(id -u)"
+	if [ "$uid" != '0' ]; then
+		# if we're not root, we must be trying to run rootless
+		if ! command -v rootlesskit > /dev/null; then
+			echo >&2 "error: attempting to run rootless dockerd but missing 'rootlesskit' (perhaps the 'docker:dind-rootless' image variant is intended?)"
+			exit 1
+		fi
+		user="$(id -un 2>/dev/null || :)"
+		if ! grep -qE "^($uid${user:+|$user}):" /etc/subuid || ! grep -qE "^($uid${user:+|$user}):" /etc/subgid; then
+			echo >&2 "error: attempting to run rootless dockerd but missing necessary entries in /etc/subuid and/or /etc/subgid for $uid"
+			exit 1
+		fi
+		: "${XDG_RUNTIME_DIR:=/run/user/$uid}"
+		export XDG_RUNTIME_DIR
+		if ! mkdir -p "$XDG_RUNTIME_DIR" || [ ! -w "$XDG_RUNTIME_DIR" ] || ! mkdir -p "$HOME/.local/share/docker" || [ ! -w "$HOME/.local/share/docker" ]; then
+			echo >&2 "error: attempting to run rootless dockerd but need writable HOME ($HOME) and XDG_RUNTIME_DIR ($XDG_RUNTIME_DIR) for user $uid"
+			exit 1
+		fi
+		if [ -f /proc/sys/kernel/unprivileged_userns_clone ] && unprivClone="$(cat /proc/sys/kernel/unprivileged_userns_clone)" && [ "$unprivClone" != '1' ]; then
+			echo >&2 "error: attempting to run rootless dockerd but need 'kernel.unprivileged_userns_clone' (/proc/sys/kernel/unprivileged_userns_clone) set to 1"
+			exit 1
+		fi
+		if [ -f /proc/sys/user/max_user_namespaces ] && maxUserns="$(cat /proc/sys/user/max_user_namespaces)" && [ "$maxUserns" = '0' ]; then
+			echo >&2 "error: attempting to run rootless dockerd but need 'user.max_user_namespaces' (/proc/sys/user/max_user_namespaces) set to a sufficiently large value"
+			exit 1
+		fi
+		# TODO overlay support detection?
+		exec rootlesskit \
+			--net="${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:-vpnkit}" \
+			--mtu="${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:-1500}" \
+			--disable-host-loopback \
+			--port-driver=builtin \
+			--copy-up=/etc \
+			--copy-up=/run \
+			${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} \
+			"$@"
+	elif [ -x '/usr/local/bin/dind' ]; then
+		# if we have the (mostly defunct now) Docker-in-Docker wrapper script, use it
+		set -- '/usr/local/bin/dind' "$@"
+	fi
+else
+	# if it isn't `dockerd` we're trying to run, pass it through `docker-entrypoint.sh` so it gets `DOCKER_HOST` set appropriately too
+	set -- docker-entrypoint.sh "$@"
+fi
+
+exec "$@"
+

linux-fresh/Dockerfile

@@ -1,6 +1,8 @@
 FROM ubuntu:20.04
 LABEL maintainer="suyu"
 
+ENV CCACHE_VER=4.9.1
+ENV MOLD_VER=2.30.0
 ENV BOOST_VER=1_79_0
 ENV CLANG_VER=14
 ENV CMAKE_VER=3.22.6
@@ -25,7 +27,6 @@ RUN useradd -m -u 1027 -s /bin/bash suyu && \
     xz-utils \
 # suyu build requirements
     build-essential \
-    ccache \
     git \
     libgl-dev \
     liblz4-dev \
@@ -89,7 +90,6 @@ RUN useradd -m -u 1027 -s /bin/bash suyu && \
     llvm-${CLANG_VER}-linker-tools && \
     ln -s $(which clang-${CLANG_VER}) /usr/bin/clang && \
     ln -s $(which clang++-${CLANG_VER}) /usr/bin/clang++ && \
-    dpkg-reconfigure ccache && \
 # Install NodeJS
 		wget -qO- https://deb.nodesource.com/setup_20.x | bash - && apt-get install -y nodejs && \
 # Clean Container
@@ -139,6 +139,24 @@ RUN cd /tmp && \
     cp -rv binutils-${GNU_BIN_VER}-${UBUNTU_VER}/usr / && \
     rm -rf /tmp/binutils*
 
+# Install CCache from suyu/ext-linux-bin
+RUN cd /tmp && \
+    wget --no-verbose https://git.suyu.dev/suyu/ext-linux-bin/media/branch/main/ccache/ccache-${CCACHE_VER}-linux-x86_64.tar.xz && \
+    tar xvf ccache-${CCACHE_VER}-linux-x86_64.tar.xz && \
+    chown -R root:root ccache-${CCACHE_VER}-linux-x86_64/ && \
+    cp -rv ccache-${CCACHE_VER}-linux-x86_64/ccache /usr/bin/ccache && \
+    rm -rf ccache*
+
+# Install Mold from suyu/ext-linux-bin
+RUN cd /tmp && \
+    wget --no-verbose https://git.suyu.dev/suyu/ext-linux-bin/media/branch/main/mold/mold-${MOLD_VER}-x86_64-linux.tar.gz && \
+    tar xvf mold-${MOLD_VER}-x86_64-linux.tar.gz && \
+    chown -R root:root mold-${MOLD_VER}-x86_64-linux/ && \
+    cp -rv mold-${MOLD_VER}-x86_64-linux/libexec/* /usr/libexec/ && \
+    cp -rv mold-${MOLD_VER}-x86_64-linux/lib/* /usr/lib/ && \
+    cp -rv mold-${MOLD_VER}-x86_64-linux/bin/* /usr/bin/ && \
+    rm -rf mold*
+
 # Setup paths for Qt binaries
 ENV LD_LIBRARY_PATH=/opt/qt${QT_PKG_VER}/lib:${LD_LIBRARY_PATH}
 ENV PATH=/opt/qt${QT_PKG_VER}/bin:${PATH}

linux-mingw/Dockerfile

@@ -43,37 +43,22 @@ RUN useradd -m -u 1027 -s /bin/bash suyu && mkdir -p /tmp/pkgs && \
     mingw-w64-winpthreads \
     mingw-w64-zlib \
     mingw-w64-zstd \
+    mingw-w64-cmake \
+    mingw-w64-sdl2 \
+		mingw-w64-boost \
 		nodejs-lts-iron \
     && \
     pacman -Scc --noconfirm && \
     rm -rf /usr/share/man/ /tmp/* /var/tmp/ /usr/{i686-w64-mingw32,lib32} /usr/lib/gcc/i686-w64-mingw32
 
-# Install Boost from suyu/ext-linux-bin
-RUN wget --no-verbose \
-        https://git.suyu.dev/suyu/ext-linux-bin/raw/main/mingw/mingw-w64-boost-1.79.0-1-any.pkg.tar.zst && \
-    pacman -U --noconfirm mingw-w64-boost-1.79.0-1-any.pkg.tar.zst && \
-    rm mingw-w64-boost-1.79.0-1-any.pkg.tar.zst
-
 # Compatibility with the old Ubuntu MingW image
 RUN ln -s /usr/x86_64-w64-mingw32/lib/qt /usr/x86_64-w64-mingw32/lib/qt5
 # Give suyu user sudo access for AUR usage
 RUN echo "suyu ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers
 
 USER 1027
-
 # Build/install small AUR packages
 RUN \
-# mingw-w64-sdl2
-    cd && \
-    git clone https://aur.archlinux.org/mingw-w64-sdl2.git && \
-    cd mingw-w64-sdl2 && \
-    # Revert to SDL 2.26.4
-    git checkout 277c44a && \
-    # Only build for x86_64
-    sed -i "s/'i686-w64-mingw32'//g" PKGBUILD && \
-    makepkg -si --noconfirm --noprogressbar && \
-    # Get rid of -mwindows from SDL2 CMake configs
-    sudo sed -i 's/-mwindows//g' /usr/x86_64-w64-mingw32/lib/cmake/SDL2/sdl2-config.cmake && \
 # mingw-w64-clang -- MinGW wrapper for host clang
     cd && \
     git clone https://aur.archlinux.org/mingw-w64-wclang-git.git && \