r-hub · gaborcsardi · Dec 18, 2024 · Dec 18, 2024 · Dec 18, 2024 · Dec 18, 2024
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -113,7 +113,13 @@ jobs:
     - name: Test
       run: |
         rm -f output/*aarch64* output/*arm64*
-        docker buildx bake -f docker-compose-test.yaml
+        docker compose -f docker-compose-test.yaml build
+      env:
+        COMPOSE_PARALLEL_LIMIT: 1
+        REDHAT_ORG_RHEL8: ${{ secrets.REDHAT_ORG }}
+        REDHAT_ORG_RHEL9: ${{ secrets.REDHAT_ORG }}
+        REDHAT_ACTIVATION_KEY_RHEL8: ${{ secrets.REDHAT_ACTIVATION_KEY_RHEL8 }}
+        REDHAT_ACTIVATION_KEY_RHEL9: ${{ secrets.REDHAT_ACTIVATION_KEY_RHEL9 }}
 
   deploy:
     name: deploy
@@ -231,7 +237,13 @@ jobs:
     - name: Test
       run: |
         rm -f output/*x86_64* output/*amd64*
-        docker buildx bake -f docker-compose-test.yaml
+        docker compose -f docker-compose-test.yaml build
+      env:
+        COMPOSE_PARALLEL_LIMIT: 1
+        REDHAT_ORG_RHEL8: ${{ secrets.REDHAT_ORG }}
+        REDHAT_ORG_RHEL9: ${{ secrets.REDHAT_ORG }}
+        REDHAT_ACTIVATION_KEY_RHEL8: ${{ secrets.REDHAT_ACTIVATION_KEY_RHEL8 }}
+        REDHAT_ACTIVATION_KEY_RHEL9: ${{ secrets.REDHAT_ACTIVATION_KEY_RHEL9 }}
 
   deployarm:
     name: deploy (aarch64)

diff --git a/docker-compose-test.yaml b/docker-compose-test.yaml
@@ -69,19 +69,25 @@ services:
       args:
         CONTAINER: rockylinux:9
 
-  rhel-8:
-    build:
-      context: .
-      dockerfile: dockerfiles/test/Dockerfile
-      args:
-        CONTAINER: redhat/ubi8
-
-  rhel-9:
-    build:
-      context: .
-      dockerfile: dockerfiles/test/Dockerfile
-      args:
-        CONTAINER: redhat/ubi9
+  # rhel-8:
+  #   build:
+  #     context: .
+  #     dockerfile: dockerfiles/test/Dockerfile
+  #     args:
+  #       CONTAINER: redhat/ubi8
+  #     secrets:
+  #       - REDHAT_ORG_RHEL8
+  #       - REDHAT_ACTIVATION_KEY_RHEL8
+
+  # rhel-9:
+  #   build:
+  #     context: .
+  #     dockerfile: dockerfiles/test/Dockerfile
+  #     args:
+  #       CONTAINER: redhat/ubi9
+  #     secrets:
+  #       - REDHAT_ORG_RHEL9
+  #       - REDHAT_ACTIVATION_KEY_RHEL9
 
   opensuse-155:
     build:
@@ -117,3 +123,13 @@ services:
       dockerfile: dockerfiles/test/Dockerfile
       args:
         CONTAINER: fedora:41
+
+secrets:
+  REDHAT_ORG_RHEL8:
+    environment: REDHAT_ORG_RHEL8
+  REDHAT_ACTIVATION_KEY_RHEL8:
+    environment: REDHAT_ACTIVATION_KEY_RHEL8
+  REDHAT_ORG_RHEL9:
+    environment: REDHAT_ORG_RHEL9
+  REDHAT_ACTIVATION_KEY_RHEL9:
+    environment: REDHAT_ACTIVATION_KEY_RHEL9
diff --git a/dockerfiles/bionic/Dockerfile b/dockerfiles/bionic/Dockerfile
@@ -16,7 +16,7 @@ RUN apt-get update && \
     liblzma-dev libpcre2-dev libssl-dev libopenblas-dev \
     libjpeg-turbo8-dev libpng-dev libtiff-dev libicu-dev \
     libcairo-dev libffi-dev libpango1.0-dev libthai-dev \
-    libdatrie-dev texinfo
+    libdatrie-dev texinfo libxt-dev uuid-dev libbsd-dev
 
 # roll our own libcurl, the original has way too many depe
 RUN curl -LO https://curl.haxx.se/download/curl-8.11.0.tar.gz
@@ -64,10 +64,18 @@ RUN export ARCH=$(dpkg --print-architecture) && \
       curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libpango1.0-dev_1.40.14-1ubuntu0.1_$ARCH.deb && \
       curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libglib2.0-dev_2.56.4-0ubuntu0.18.04.9_$ARCH.deb && \
       curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libgraphite2-dev_1.3.11-2_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libxdmcp-dev_1.1.2-3_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libxt-dev_1.1.5-1_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libsm-dev_1.2.2-1_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libx11-dev_1.6.4-3ubuntu0.4_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libbsd-dev_0.8.7-1ubuntu0.1_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libxrender-dev_0.9.10-1_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libxext-dev_1.3.3-1_$ARCH.deb && \
       apt-get update && \
       apt-get install -y libjbig-dev libjbig0 libjpeg-dev libjpeg8 && \
       dpkg -i ./libssl-dev* ./libssl1* ./openssl* ./libtiff* libfreetype* \
-        libpng* libpixman* libpango* libglib* libgraphite2* && \
+        libpng* libpixman* libpango* libglib* libgraphite2* libxdmcp* \
+        libxt* libsm* libx11* libbsd* libxrender* libxext* && \
       rm *.deb; \
     fi
 
@@ -106,9 +114,20 @@ RUN export ARCH=$(dpkg --print-architecture) && \
       curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libdatrie-dev_0.2.10-7_$ARCH.deb && \
       curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libpcre3-dev_8.39-9ubuntu0.1_$ARCH.deb && \
       curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libglib2.0-dev_2.56.4-0ubuntu0.18.04.9_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libsm-dev_1.2.2-1_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libxext-dev_1.3.3-1_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libx11-dev_1.6.4-3ubuntu0.4_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libxt-dev_1.1.5-1_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libice-dev_1.0.9-2ubuntu0.18.04.1_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libxrender-dev_0.9.10-1_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libxcb1-dev_1.13-2.ubuntu18.04_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libxdmcp-dev_1.1.2-3_$ARCH.deb && \
+      curl -LO https://github.com/r-hub/r-glibc/releases/download/bionic/libbsd-dev_0.8.7-1ubuntu0.1_$ARCH.deb && \
       dpkg -i ./zlib* libpixman* libfreetype6* libtiff* libjbig* \
         libjpeg* liblzma* libpng* libfontconfig* libexpat* libcairo* \
-        libgcc* libgfortran* libgraphite2* libpango* libharfbuzz* libdatrie* libpcre3* libglib* && \
+        libgcc* libgfortran* libgraphite2* libpango* libharfbuzz* libdatrie* libpcre3* \
+        libglib* libsm* libxext* libx11* libxt* libice* libxrender* libxcb1* libxdmcp* \
+        libbsd* && \
       rm *.deb; \
     fi
 
@@ -151,7 +170,19 @@ RUN mkdir -p /opt/r-lib/lib && \
     cp `find /usr -name libthai.a` /opt/r-lib/lib/ && \
     cp `find /usr -name libdatrie.a` /opt/r-lib/lib/ && \
     cp `find /usr -name libtermcap.a` /opt/r-lib/lib/ && \
-    ln -s libthai.pc /usr/lib/$(arch)-linux-gnu/pkgconfig/thai.pc
+    ln -s libthai.pc /usr/lib/$(arch)-linux-gnu/pkgconfig/thai.pc && \
+    cp `find /usr -name libXt.a` /opt/r-lib/lib/ && \
+    cp `find /usr -name libSM.a` /opt/r-lib/lib/ && \
+    cp `find /usr -name libICE.a` /opt/r-lib/lib/ && \
+    cp `find /usr -name libX11.a` /opt/r-lib/lib/ && \
+    cp `find /usr -name libuuid.a` /opt/r-lib/lib/ && \
+    cp `find /usr -name libbsd.a` /opt/r-lib/lib/ && \
+    cp `find /usr -name libxcb.a` /opt/r-lib/lib/ && \
+    cp `find /usr -name libXau.a` /opt/r-lib/lib/ && \
+    cp `find /usr -name libXdmcp.a` /opt/r-lib/lib/ && \
+    cp `find /usr -name libXrender.a` /opt/r-lib/lib/ && \
+    cp `find /usr -name libXext.a` /opt/r-lib/lib/
+
 
 ARG R_VERSION
 
@@ -200,16 +231,21 @@ RUN if [ -e R-rc ]; then mv R-rc R-next; fi
 RUN if [ -e R-prerelease ]; then mv R-prerelease R-next; fi
 RUN if [ -e R-pre ]; then mv R-pre R-next; fi
 
-FROM download AS configure
+FROM download AS patch
 
+ENV R_VERSION=${R_VERSION}
 COPY dockerfiles/bionic/R-${R_VERSION}.patch .
 RUN cd R-${R_VERSION} && patch -p1 < ../R-${R_VERSION}.patch
+
+FROM patch AS configure
+
 RUN cd R-${R_VERSION} && \
     PATH="/opt/R/${R_VERSION}-glibc/lib/R/tools:/opt/r-lib/bin:$PATH" \
     ./configure --with-internal-tzcode --prefix=/opt/R/${R_VERSION}-glibc --with-x=no \
     --with-blas --with-lapack --enable-BLAS-shlib=no \
     --with-included-gettext \
     --with-static-cairo \
+    --with-x \
     PKG_CONFIG_PATH="$PKG_CONFIG_PATH:/opt/R/${R_VERSION}-glibc/lib/R/lib/pkgconfig" \
     BLAS_LIBS="-lopenblas -lm -lpthread" \
     CPPFLAGS=-I/opt/R/${R_VERSION}-glibc/lib/R/include \

diff --git a/dockerfiles/bionic/R-4.4.2.patch b/dockerfiles/bionic/R-4.4.2.patch
@@ -1,6 +1,8 @@
---- R-4.4.2-old/configure	2024-10-31 08:01:28.000000000 +0000
-+++ R-4.4.2/configure	2024-11-27 06:38:21.520000365 +0000
-@@ -49650,7 +49650,7 @@
+diff --git a/configure b/configure
+index ca7bd8d..ede5977 100755
+--- a/configure
++++ b/configure
+@@ -49650,7 +49650,7 @@ then :
    printf %s "(cached) " >&6
  else case e in #(
    e) r_save_LIBS="${LIBS}"
@@ -9,12 +11,81 @@
  if test "$cross_compiling" = yes
  then :
    r_cv_icu=no
-@@ -49702,7 +49702,7 @@
- 
+@@ -49702,7 +49702,7 @@ if test "x${r_cv_icu}" = xyes; then
+
  printf "%s\n" "#define USE_ICU 1" >>confdefs.h
- 
+
 -  LIBS="${LIBS} -licuuc -licui18n"
 +  LIBS="${LIBS} -licui18n -licuuc -licudata -lstdc++ -lm -ldl"
  else
    use_ICU=no
  fi
+@@ -49813,7 +49813,7 @@ ac_x_includes=no
+ ac_x_libraries=no
+ # Do we need to do anything special at all?
+ ac_save_LIBS=$LIBS
+-LIBS="-lX11 $LIBS"
++LIBS="-lX11 -lxcb -lXau -lXdmcp -lSM -lICE -lbsd $LIBS"
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h.  */
+ #include <X11/Xlib.h>
+@@ -49956,7 +49956,7 @@ if test "$ac_x_libraries" = no; then
+   # See if we find them without any special options.
+   # Don't add to $LIBS permanently.
+   ac_save_LIBS=$LIBS
+-  LIBS="-lX11 $LIBS"
++  LIBS="-lX11 -lxcb -lXau -lXdmcp -lSM -lICE -lbsd $LIBS"
+   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h.  */
+ #include <X11/Xlib.h>
+@@ -50046,6 +50046,7 @@ else
+     X_CFLAGS="$X_CFLAGS -I$x_includes"
+   fi
+
++  X_LIBS="-lxcb"
+   # It would also be nice to do this for all -L options, not just this one.
+   if test -n "$x_libraries"; then
+     X_LIBS="$X_LIBS -L$x_libraries"
+@@ -50131,7 +50132,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.beam \
+     # Martyn Johnson says this is needed for Ultrix, if the X
+     # libraries were built with DECnet support.  And Karl Berry says
+     # the Alpha needs dnet_stub (dnet does not exist).
+-    ac_xsave_LIBS="$LIBS"; LIBS="$LIBS $X_LIBS -lX11"
++    ac_xsave_LIBS="$LIBS"; LIBS="$LIBS $X_LIBS -lX11 -lxcb -lXau -lXdmcp -lSM -lICE -lbsd"
+     cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h.  */
+
+@@ -50710,7 +50711,7 @@ then :
+   printf %s "(cached) " >&6
+ else case e in #(
+   e) ac_check_lib_save_LIBS=$LIBS
+-LIBS="-lXt ${X_LIBS} -lX11 $LIBS"
++LIBS="-lXt ${X_LIBS} -lX11 -lxcb -lXau -lXdmcp -lSM -lICE -lbsd $LIBS"
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h.  */
+
+@@ -50771,7 +50772,7 @@ if test "x${use_X11}" = "xyes"; then
+
+ printf "%s\n" "#define HAVE_X11 1" >>confdefs.h
+
+-  X_LIBS="${X_LIBS} -lX11 -lXt"
++  X_LIBS="${X_LIBS} -lX11 -lxcb -lXt -lXau -lXdmcp -lSM -lICE -lbsd"
+ else
+   if test "x${with_x}" != "xno"; then
+     as_fn_error $? "--with-x=yes (default) and X11 headers/libs are not available" "$LINENO" 5
+diff --git a/src/modules/X11/Makefile.in b/src/modules/X11/Makefile.in
+index 0a118d8..c6ef405 100644
+--- a/src/modules/X11/Makefile.in
++++ b/src/modules/X11/Makefile.in
+@@ -20,7 +20,10 @@ ALL_CFLAGS = $(ALL_CFLAGS_LO)
+ ## This relies on ld re-ordering the flags, as X_PRE_LIBS does not
+ ## contain a -L flag but relies on that in X_LIBS.
+ ## This comes from AC_PATH_XTRA so we have not interfered.
+-ALL_X_LIBS = $(X_PRE_LIBS) @CAIROX11_LIBS@ $(X_LIBS) $(X_EXTRA_LIBS)
++CAIRO_X_LIBS = @CAIROX11_LIBS@
++# CAIRO_X_LIBS2 := $(patsubst -lX11,-Wl\\,--whole-archive -lX11 -Wl\\,--no-whole-archive,$(CAIRO_X_LIBS))
++CAIRO_X_LIBS2 := $(CAIRO_X_LIBS:-lX11=-Wl,--whole-archive -lX11 -Wl,--no-whole-archive)
++ALL_X_LIBS = $(X_PRE_LIBS) $(CAIRO_X_LIBS2) $(X_LIBS) $(X_EXTRA_LIBS)
+
+ SOURCES = devX11.c rotated.c rbitmap.c
+ DEPENDS = $(SOURCES:.c=.d)
diff --git a/dockerfiles/test/Dockerfile b/dockerfiles/test/Dockerfile
@@ -2,8 +2,11 @@
 ARG CONTAINER=r-hub/failure
 FROM ghcr.io/gaborcsardi/figlet AS figlet
 FROM ${CONTAINER}
+ARG CONTAINER
 COPY --from=figlet /usr/local /usr/local
 
+ENV CONTAINER=${CONTAINER}
+
 # The repo must be bind mounted to the /root directory,
 # and it must include the built packages in output/
 
@@ -12,8 +15,26 @@ WORKDIR /root
 
 COPY tools/install-bats.sh install-bats.sh
 COPY test test
-RUN ::: test deps && : ----------------------------------------------- && \
-    sh install-bats.sh && \
+RUN --mount=type=secret,id=REDHAT_ORG_RHEL9 \
+    --mount=type=secret,id=REDHAT_ACTIVATION_KEY_RHEL9 \
+    --mount=type=secret,id=REDHAT_ORG_RHEL8 \
+    --mount=type=secret,id=REDHAT_ACTIVATION_KEY_RHEL8 \
+    ::: test deps && : ----------------------------------------------- && \
+    if [ "${CONTAINER}" = "redhat/ubi9" ]; then \
+      subscription-manager register \
+        --org `cat /run/secrets/REDHAT_ORG_RHEL9` \
+        --activationkey `cat /run/secrets/REDHAT_ACTIVATION_KEY_RHEL9` && \
+      sh install-bats.sh && \
+      subscription-manager unregister 2>/dev/null; \
+    elif [ "${CONTAINER}" = "redhat/ubi8" ]; then \
+      subscription-manager register \
+        --org `cat /run/secrets/REDHAT_ORG_RHEL8` \
+        --activationkey `cat /run/secrets/REDHAT_ACTIVATION_KEY_RHEL8` && \
+      sh install-bats.sh && \
+      subscription-manager unregister 2>/dev/null; \
+    else \
+      sh install-bats.sh; \
+    fi && \
     ----- # ---------------------------------------------------------------
 
 COPY output output

diff --git a/test/test-x11.R b/test/test-x11.R
@@ -0,0 +1,22 @@
+R.home()
+
+# -------------------------------------------------------------------------
+
+stopifnot(isTRUE(capabilities()[["X11"]]))
+
+# -------------------------------------------------------------------------
+
+tmp <- tempfile(fileext = "png")
+png(tmp, type = "Xlib")
+plot(1:10)
+dev.off()
+
+out <- system2("file", tmp, stdout = TRUE)
+message(out)
+stopifnot(grepl("PNG", out))
+
+# -------------------------------------------------------------------------
+
+x11()
+plot(1:10)
+dev.off()
diff --git a/test/test.bats b/test/test.bats
@@ -56,3 +56,13 @@
   run R -q -f test-cve-2024-27322.R
   [ "$status" -eq 0 ] || echo "$output" && [ "$status" -eq 0 ]
 }
+
+@test "X11" {
+  Xvfb :1 -screen 0 1280x1024x24 &
+  pid=$!
+  trap "kill -15 $pid || kill -9 $pid" EXIT
+  export DISPLAY=:1
+  run R -q -f test-x11.R
+  kill -15 $pid 2>/dev/null
+  [ "$status" -eq 0 ] || echo "$output" && [ "$status" -eq 0 ]
+}
diff --git a/tools/install-bats.sh b/tools/install-bats.sh
@@ -4,23 +4,27 @@ set -e
 
 if command -v apt-get; then
     apt-get update &&
-	apt-get install -y curl patchelf file gcc make libc6-dev g++ gfortran
+	apt-get install -y curl patchelf file gcc make libc6-dev g++ \
+        gfortran xvfb
 elif command -v dnf; then
     dnf install -y epel-release || true # might be needed, might be not
-    dnf install -y --allowerasing curl file gcc make glibc-devel gcc-c++ gcc-gfortran
+    dnf install -y --allowerasing curl file gcc make glibc-devel \
+        gcc-c++ gcc-gfortran xorg-x11-server-Xvfb
 elif command -v yum; then
     yum install -y epel-release || true # might be needed, might be not
-    yum install -y curl file gcc make glibc-devel gcc-c++ gcc-gfortran
+    yum install -y curl file gcc make glibc-devel gcc-c++ gcc-gfortran \
+        xorg-x11-server-Xvfb
 elif command -v zypper; then
     # glibc-locale-base is actually needed on OpenSUSE currently, to install
     # packages with a latin1 DESCRIPTION
     zypper --non-interactive install curl file gcc make \
-	   glibc-devel gcc-c++ gcc-fortran tar gzip glibc-locale-base
+	   glibc-devel gcc-c++ gcc-fortran tar gzip glibc-locale-base \
+       xorg-x11-server-Xvfb
 else
     >&2 echo Cannot install bats on this platform
     exit 1
 fi
-	
+
 curl -LO https://github.com/bats-core/bats-core/archive/refs/tags/v1.11.0.tar.gz
 tar xzf v1.11.0.tar.gz
 cd bats-core-*