feat(packaging): ship CeraLive SRT runtime

.github/workflows/abi.yml

@@ -7,7 +7,7 @@ on:
     branches: [ "master", "dev" ]
 
 env:
-  SRT_BASE: v1.5.0
+  SRT_BASE: reorderfreeze-1.5.5
 
 jobs:
   build_pr:
@@ -18,7 +18,7 @@ jobs:
        base_version: ${{ steps.build.outputs.SRT_BASE }}
        tag_version: ${{ steps.build.outputs.SRT_TAG_VERSION }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
       with:
         path: gitview_pr
     - id: configure
@@ -38,19 +38,13 @@ jobs:
         echo "SRT_TAG_VERSION=$SRT_TAG_VERSION" >> "$GITHUB_OUTPUT"
         SRT_TAG=${SRT_TAG_VERSION}dev-$(git rev-parse --short HEAD)
         echo "TAGGING PR BUILD: $SRT_TAG"
-        abi-dumper libsrt.so -o libsrt-pr.dump -public-headers installdir/usr/local/include/srt/ -lver $SRT_TAG
+        abi-dumper libsrt.so -o libsrt-pr.dump -public-headers installdir/usr/local/include/srt/ -lver "$SRT_TAG"
         ls -ld libsrt-pr.dump
         sha256sum libsrt-pr.dump
-        SRT_BASE=v$(../scripts/get-build-version.tcl base)
-        if [[ $SRT_TAG_VERSION == $SRT_BASE ]]; then
-            echo "NOT CHECKING ABI: base version is being built: $SRT_TAG  (not emitting SRT_BASE)"
-            #echo "SRT_BASE=''" >> "$GITHUB_OUTPUT"
-        else
-            echo "WILL CHECK ABI changes $SRT_BASE - $SRT_TAG_VERSION"
-            echo "SRT_BASE=$SRT_BASE" >> "$GITHUB_OUTPUT"
-        fi
+        echo "WILL CHECK ABI changes ${SRT_BASE} - ${SRT_TAG_VERSION}"
+        echo "SRT_BASE=${SRT_BASE}" >> "$GITHUB_OUTPUT"
     - id: upload_pr_dump
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: abidump_pr
         path: gitview_pr/_build/libsrt-pr.dump
@@ -65,7 +59,7 @@ jobs:
        SRT_BASE: ${{ needs.build_pr.outputs.base_version }}
        SRT_TAG_VERSION: ${{ needs.build_pr.outputs.tag_version }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
       with:
         path: gitview_base
         ref: ${{ env.SRT_BASE }}
@@ -92,11 +86,11 @@ jobs:
         cd _build && cmake --build ./
         make install DESTDIR=./installdir
         echo "TAGGING BASE BUILD: $SRT_BASE"
-        abi-dumper libsrt.so -o libsrt-base.dump -public-headers installdir/usr/local/include/srt/ -lver $SRT_BASE
+        abi-dumper libsrt.so -o libsrt-base.dump -public-headers installdir/usr/local/include/srt/ -lver "$SRT_BASE"
         ls -ld libsrt-base.dump
         sha256sum libsrt-base.dump
     - id: upload_base_dump
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: abidump_base
         path: gitview_base/_build/libsrt-base.dump
@@ -110,12 +104,12 @@ jobs:
 
     steps:
     - name: Download base dump
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8
       with:
         name: abidump_base
         path: .
     - name: Download pr dump
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8
       with:
         name: abidump_pr
         path: .
@@ -132,11 +126,11 @@ jobs:
         sha256sum libsrt-pr.dump
         abi-compliance-checker -l libsrt -old libsrt-base.dump -new libsrt-pr.dump
         RES=$?
-        if (( $RES != 0 )); then
+        if (( RES != 0 )); then
            echo "ABI/API Compatibility check failed with value $?"
            exit $RES
         fi
     - name: Download report
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8
       with:
         path: compat_reports

.github/workflows/android.yaml

@@ -18,7 +18,7 @@ jobs:
       with:
         ndk-version: r23
         add-to-path: false
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
     - name: build
       run: |
         cd ./scripts/build-android/

.github/workflows/codeql.yml

@@ -22,13 +22,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
 
       - name: Configure
         run: cmake -DENABLE_HEAVY_LOGGING=1 -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_FLAGS=-fpermissive -DENABLE_BONDING=1 .        
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
@@ -38,6 +38,6 @@ jobs:
           make
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/codespell.yml

@@ -4,13 +4,13 @@ on: pull_request
 
 jobs:
   spellcheck:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.10'
 

.github/workflows/cxx03-ubuntu.yaml

@@ -11,7 +11,7 @@ jobs:
     name: ubuntu
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
     - name: configure
       run: |
         mkdir _build && cd _build

.github/workflows/cxx11-macos.yaml

@@ -6,6 +6,13 @@ on:
   pull_request:
     branches: [ "master", "dev" ]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     name: macos
@@ -16,11 +23,12 @@ jobs:
       run: |
         brew tap-new Haivision/gt-local
         brew extract --version=1.12.1 --force googletest Haivision/gt-local
+        brew trust --formula Haivision/gt-local/googletest@1.12.1
         brew install googletest@1.12.1
         # NOTE: 1.12.1 is the last version that requires C++11; might need update later
         # curl -o googletest.rb https://raw.githubusercontent.com/Homebrew/homebrew-core/23e7fb4dc0cc73facc3772815741e1deb87d6406/Formula/googletest.rb
         # brew install -s googletest.rb
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
     - name: configure
       run: |
         mkdir _build && cd _build

.github/workflows/cxx11-ubuntu.yaml

@@ -11,7 +11,7 @@ jobs:
     name: ubuntu
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
     - name: configure
       run: |
         mkdir _build && cd _build

.github/workflows/cxx11-win.yaml

@@ -13,7 +13,7 @@ jobs:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
     - name: configure
       run: |
         md _build && cd _build

.github/workflows/iOS.yaml

@@ -16,7 +16,7 @@ jobs:
     runs-on: macos-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
     - name: Install dependency packages
       run: |
          brew install make llvm

.github/workflows/publish-release.yml

@@ -0,0 +1,97 @@
+name: Publish CeraLive SRT Runtime
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Debian package version
+        required: true
+        default: 1.5.5+ceralive.1
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v7
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential cmake dpkg-dev libgnutls28-dev pkg-config
+      - name: Build and test
+        run: |
+          cmake -S . -B build -DENABLE_TESTING=ON -DENABLE_UNITTESTS=ON -DENABLE_BONDING=ON
+          cmake --build build --parallel
+          ctest --test-dir build --output-on-failure
+      - name: Build Debian runtime package
+        env:
+          CERALIVE_SRT_VERSION: ${{ inputs.version }}
+          DEB_ARCH: ${{ matrix.arch }}
+        run: |
+          docker run --rm \
+            -e CERALIVE_SRT_VERSION \
+            -e DEB_ARCH \
+            -v "$PWD":/src \
+            -w /src \
+            debian:bookworm \
+            bash -lc '
+              apt-get update -qq
+              DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
+                build-essential cmake dpkg-dev libgnutls28-dev pkg-config
+              packaging/build-deb.sh
+            '
+      - name: Verify package contract
+        env:
+          CERALIVE_SRT_VERSION: ${{ inputs.version }}
+          DEB_ARCH: ${{ matrix.arch }}
+        run: |
+          deb="dist/libsrt1.5-ceralive_${CERALIVE_SRT_VERSION}_${DEB_ARCH}.deb"
+          dpkg-deb -I "${deb}"
+          tmp="$(mktemp -d)"
+          dpkg-deb -x "${deb}" "${tmp}"
+          test -L "${tmp}/usr/lib/$(dpkg-architecture -a "${DEB_ARCH}" -qDEB_HOST_MULTIARCH)/libsrt-gnutls.so.1.5"
+          rm -rf "${tmp}"
+      - name: Verify GStreamer runtime replacement
+        if: matrix.arch == 'amd64'
+        env:
+          CERALIVE_SRT_VERSION: ${{ inputs.version }}
+          DEB_ARCH: ${{ matrix.arch }}
+        run: packaging/verify-runtime-replacement.sh "dist/libsrt1.5-ceralive_${CERALIVE_SRT_VERSION}_${DEB_ARCH}.deb"
+      - uses: actions/upload-artifact@v7
+        with:
+          name: libsrt1.5-ceralive-${{ matrix.arch }}
+          path: dist/*.deb
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          path: dist
+      - uses: softprops/action-gh-release@v3
+        with:
+          tag_name: srt-v${{ inputs.version }}
+          name: CeraLive SRT ${{ inputs.version }}
+          files: dist/**/*.deb
+      - uses: peter-evans/repository-dispatch@v4
+        with:
+          token: ${{ secrets.CERALIVE_DISPATCH_TOKEN }}
+          repository: CERALIVE/apt-worker
+          event-type: apt-reindex
+          client-payload: >-
+            {"component":"srt","repo":"srt","channel":"stable","tag":"srt-v${{ inputs.version }}","version":"${{ inputs.version }}"}

.github/workflows/runtime-package.yml

@@ -0,0 +1,50 @@
+name: CeraLive SRT Runtime
+
+on:
+  push:
+    branches: [master, 'release/**']
+    paths:
+      - 'packaging/**'
+      - 'CMakeLists.txt'
+      - 'srtcore/**'
+      - '.github/workflows/runtime-package.yml'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'packaging/**'
+      - 'CMakeLists.txt'
+      - 'srtcore/**'
+      - '.github/workflows/runtime-package.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/cache@v6
+        with:
+          path: ~/.cache/ccache
+          key: srt-runtime-${{ runner.os }}-${{ hashFiles('CMakeLists.txt', 'srtcore/**', 'packaging/**') }}
+          restore-keys: srt-runtime-${{ runner.os }}-
+      - name: Build and verify the runtime package
+        run: |
+          docker run --rm \
+            -v "$PWD":/src \
+            -v "$HOME/.cache/ccache":/root/.cache/ccache \
+            -w /src \
+            debian:bookworm \
+            bash -lc '
+              apt-get update -qq
+              DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
+                build-essential ccache cmake dpkg-dev libgnutls28-dev pkg-config
+              CC="ccache gcc" CXX="ccache g++" packaging/build-deb.sh
+              packaging/package-contract.sh
+              packaging/verify-runtime-replacement.sh dist/libsrt1.5-ceralive_1.5.5+ceralive.1_amd64.deb
+            '

.github/workflows/s390x-focal.yaml

@@ -22,7 +22,7 @@ jobs:
           lscpu | grep Endian 
           "
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v7
     - name: configure
       uses: docker://multiarch/ubuntu-core:s390x-focal
       with:

.gitignore

@@ -48,6 +48,9 @@ compile_commands.json
 .idea/
 cmake-build-debug/
 build/
+build-deb-*/
+stage-deb-*/
+dist/
 tags
 
 # OpenCode agent state (local only)