Jungfraujoch/docker/build_in_rocky9.sh

#!/usr/bin/env bash
# Manually build the viewer inside one of the build-environment images and inspect its runtime .so
# deps -- the quick way to confirm the static-libdbus + glib-off changes actually dropped the
# dbus/systemd/glib/selinux tail. Defaults to the rocky9 image built by build_images.sh.
#
# The repo is mounted read-write at /workspace, but the CMake build tree lives in the container's
# /tmp (thrown away with --rm), so nothing root-owned is left in your working copy. Building needs
# network (FetchContent pulls curl/zstd/hdf5/...) but NOT a GPU.
#
# Usage:
#   docker/build_in_rocky9.sh                 # build viewer in jfjoch_rocky9:$TAG, then ldd it
#   docker/build_in_rocky9.sh rocky8          # use a different variant's image
#   TAG=2607b docker/build_in_rocky9.sh
set -euo pipefail

REGISTRY="${REGISTRY:-gitea.psi.ch/leonarski_f}"
TAG="${TAG:-2607b}"
VARIANT="${1:-rocky9}"
IMG="$REGISTRY/jfjoch_$VARIANT:$TAG"

repo="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"   # repo root = docker/..

echo "==> image $IMG"
echo "==> repo  $repo  (mounted at /workspace; build tree in container /tmp)"

docker run --rm \
    -v "$repo":/workspace -w /workspace \
    "$IMG" bash -lc '
        set -eux
        git config --global --add safe.directory /workspace || true
        # If this image predates the CMAKE_PREFIX_PATH fix, point cmake at the static libdbus config
        # dir so the viewer (Qt6::DBus -> find_package(DBus1)) resolves WrapDBus1. Harmless once the
        # image ENV already carries it.
        dbus_dir=$(ls -d /opt/dbus-*-static/lib/cmake/DBus1 2>/dev/null | head -1)
        cmake -G Ninja -S /workspace -B /tmp/build \
            -DJFJOCH_VIEWER_ONLY=ON -DJFJOCH_USE_CUDA=ON \
            ${dbus_dir:+-DDBus1_DIR=$dbus_dir} \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_CXX_FLAGS="-march=x86-64-v3" -DCMAKE_C_FLAGS="-march=x86-64-v3"
        ninja -C /tmp/build -j"$(nproc)" jfjoch_viewer
        bin=/tmp/build/viewer/jfjoch_viewer

        echo "===================== ldd jfjoch_viewer ====================="
        ldd "$bin" | sort
        echo "========== dbus/systemd tail (what the static libdbus removes) =========="
        # These only ever entered via the system libdbus-1.so -> libsystemd chain, so they MUST be gone.
        tail_re="libdbus-1|libsystemd|libzstd|liblz4|libgcrypt|libgpg-error|libcap\."
        if ldd "$bin" | grep -Ei "$tail_re"; then
            echo ">>> FAIL: the dbus/systemd tail is still linked"
        else
            echo ">>> OK: libdbus/libsystemd/zstd/lz4/cap/gcrypt/gpg-error all gone"
        fi
        echo "========== residual glib/selinux (expected on RHEL9, NOT from us) =========="
        # libglib here is pulled by the system harfbuzz/fontconfig/freetype text stack (glib-linked on
        # RHEL9), not by Qt -- QT_FEATURE_glib=OFF is honoured (Qt is off the glib event loop) but cannot
        # drop the font-stack glib. libselinux/libpcre2-8 come from the krb5/GSSAPI stack that static
        # curl links for auth (kept for the reverse-proxy Kerberos plan) -- same bucket as libcrypto.
        # Shedding these would mean static-linking the whole font stack / dropping krb5. (libpcre2-16 is
        # Qt-owned and legitimately stays.)
        ldd "$bin" | grep -Ei "libglib|gthread|selinux|libpcre\.|libpcre2-8" || echo "(none)"
    '