[Dummgelaufen007]

Two kinds of downloads bypass the Dockerfile today: libjxl's deps.sh fetches nine archives without a checksum, and meson downloads subprojects for glib and cairo when a dependency is not installed. Neither shows in the Dockerfile, and both fail only when the build reaches them.

With this PR these steps download nothing the Dockerfile does not list. highway gets its own recipe with a checksum, and the dependencies meson used to fetch come from Alpine packages pinned by ALPINE_VERSION.

libjxl without deps.sh

deps.sh fetches nine GitHub tarballs by commit hash, without a checksum: testdata, brotli, googletest, highway, sjpeg, skcms, zlib, libpng and libjpeg-turbo (deps.sh#L50, #L78-L86). Of these the recipe needs only highway; brotli is installed already and the rest are not built.

highway is now built before libjxl as a static library, without tests, examples and contrib (CMakeLists.txt#L85-L88), switched off as libjxl does for its bundled copy (third_party/CMakeLists.txt#L22-L24); libjxl picks it up with -DJPEGXL_FORCE_SYSTEM_HWY=ON (third_party/CMakeLists.txt#L28-L34). Without deps.sh nothing uses curl any more, so the package is dropped.

highway stays at the version libjxl pins in deps.sh, 1.2.0 for libjxl 0.12.0 (deps.sh#L20). That is the version libjxl builds and tests with; newer releases bring targets libjxl cannot switch off (libjxl#5047). So highway has no bump rule of its own: the libjxl bump reads the pin from the new deps.sh and sets highway's version and checksum to match. highway moves only when libjxl moves it.

Alpine packages instead of meson subprojects

glib looks for pcre2, libffi and libintl and downloads each missing one as a wrap subproject (meson.build#L2259-L2276, #L2302, #L2315-L2353); cairo does the same for pixman (meson.build#L677-L679). The build log of the current Dockerfile shows "Run-time dependency libpcre2-8 found: NO", likewise for libffi, intl and pixman-1, followed by the downloads of pcre2 10.46, libffi 3.5.2, proxy-libintl 0.5 and pixman 0.44.2.

Alpine ships pcre2, libffi and pixman with static archives. gettext is part of musl's libc, so musl-libintl only adds libintl.h. With pcre2-dev pcre2-static libffi-dev musl-libintl pixman-dev pixman-static installed, meson finds all four ("libpcre2-8 found: YES 10.49", "libffi found: YES 3.5.2", "intl found: YES", "pixman-1 found: YES 0.46.4") and downloads nothing. versions.json lists the three new packages.

Research and wording by Claude (Anthropic), directed and reviewed by me.

[wader]

this replaces a #ifdef with #define? it seems to build so guess i misunderstand

[Dummgelaufen007]

It doesn't replace anything: & stands for the matched #ifndef line, so the #define is inserted just above it. With the macro already defined, the #ifndef skips highway's own default for AVX10_2. That is the override the "allow override" comment there offers, and it switches the target off.

Anyway, I expected more from the newer highway than libjxl would actually use; a closer look didn't confirm that, so I dropped the patch. highway now stays at the version libjxl pins in deps.sh, which is why the libjxl bump has that somewhat ugly after line: it reads the highway pin from the new deps.sh and updates HIGHWAY_VERSION and its checksum.

Research and wording by Claude (Anthropic), directed and reviewed by me.

[wader]

wonder if all these comments should move up and be inline in the apt add args? 🤔

[Dummgelaufen007]

Done, each comment now sits above the packages it explains, the existing ones for python3 and linux-headers included.

Research and wording by Claude (Anthropic), directed and reviewed by me.

[wader]

Impressive :) i wonder if we want to have this in hashupdate as special case for libjxl? then just a comment here that it will also update highway?

[Dummgelaufen007]

Thanks :) It would work in hashupdate, but I'd rather keep that script generic: today it knows nothing about any package. With the logic on the libjxl bump line, the Dockerfile itself shows that highway follows libjxl, and anyone touching libjxl sees it right there.

That it works as is: I started from libjxl 0.10.3 with highway 1.1.0, as deps.sh of 0.10.3 pins it, and placeholder checksums. The test Dockerfile holds only the highway and libjxl lines of this PR:

ARG HIGHWAY_VERSION=1.1.0
ARG HIGHWAY_URL="https://github.com/google/highway/releases/download/$HIGHWAY_VERSION/highway-$HIGHWAY_VERSION.tar.gz"
ARG HIGHWAY_SHA256=old
# bump: libjxl /LIBJXL_VERSION=([\d.]+)/ https://github.com/libjxl/libjxl.git|^0
# bump: libjxl after ./hashupdate Dockerfile LIBJXL $LATEST
# bump: libjxl after HWY=$(curl -sL https://raw.githubusercontent.com/libjxl/libjxl/v$LATEST/deps.sh | sed -n 's/^THIRD_PARTY_HIGHWAY="\([0-9a-f]*\)".*/\1/p') && V=$(git ls-remote --tags https://github.com/google/highway | awk -v c=$HWY '$1==c {sub("refs/tags/","",$2); sub("\\^\\{\\}","",$2); print $2}') && sed -i -E "s/^ARG HIGHWAY_VERSION=.*/ARG HIGHWAY_VERSION=$V/" Dockerfile && ./hashupdate Dockerfile HIGHWAY $V
ARG LIBJXL_VERSION=0.10.3
ARG LIBJXL_URL="https://github.com/libjxl/libjxl/archive/refs/tags/v${LIBJXL_VERSION}.tar.gz"
ARG LIBJXL_SHA256=old

bump -r update Dockerfile, next to hashupdate, in alpine:3.24.3 with git and curl:

-ARG HIGHWAY_VERSION=1.1.0
+ARG HIGHWAY_VERSION=1.2.0
-ARG HIGHWAY_SHA256=old
+ARG HIGHWAY_SHA256=58e9d5d41d6573ad15245ad76aec53a69499ca7480c092d899c4424812ed906f
-ARG LIBJXL_VERSION=0.10.3
+ARG LIBJXL_VERSION=0.12.0
-ARG LIBJXL_SHA256=old
+ARG LIBJXL_SHA256=03e9be69a30be4011f559da75328b6d7cea8ad921fabfbd551ce10bf45cdc992

Both checksums match a fresh download of the written URLs.

Research and wording by Claude (Anthropic), directed and reviewed by me.