feat: add standalone FSDK raster drivers

.gitignore

@@ -4,4 +4,6 @@
 .scratch/
 .worktrees/
 .bst/
-.bst2/
+.bst2/
+.bst-re.conf
+.build-out/

Justfile

@@ -1,6 +1,7 @@
 # BuildStream runs in the pinned freedesktop-sdk builder image.
 bst2_image := env("BST2_IMAGE", "registry.gitlab.com/freedesktop-sdk/infrastructure/freedesktop-sdk-docker-images/bst2:64eb0b4930d57a92710822898fb73af6cc1ae35d")
 sudo_cmd := if `podman info >/dev/null 2>&1 && echo 1 || echo 0` == "1" { "" } else { "sudo" }
+image_ref := "ghcr.io/projectbluefin/ghostscript-printer-app:build"
 
 default:
     @just --list
@@ -9,6 +10,29 @@ bst *ARGS:
     #!/usr/bin/env bash
     set -euo pipefail
     mkdir -p "${HOME}/.cache/buildstream"
+    RE_FLAG=()
+    PF_PID=""
+    cleanup() { [[ -n "$PF_PID" ]] && kill "$PF_PID" 2>/dev/null || true; }
+    trap cleanup EXIT
+    if [[ "${BST_REMOTE:-0}" == "1" ]]; then
+        export KUBECONFIG="${KUBECONFIG:-$HOME/.kube/bluespeed.yaml}"
+        kubectl port-forward -n buildbarn svc/frontend 18980:8980 >/dev/null 2>&1 &
+        PF_PID=$!
+        for _ in $(seq 1 20); do
+            (echo > /dev/tcp/127.0.0.1/18980) 2>/dev/null && break
+            sleep 0.5
+        done
+        cat > .bst-re.conf <<'EOF'
+    remote-execution:
+      execution-service:
+        url: grpc://127.0.0.1:18980
+      storage-service:
+        url: grpc://127.0.0.1:18980
+      action-cache-service:
+        url: grpc://127.0.0.1:18980
+    EOF
+        RE_FLAG=(--config /src/.bst-re.conf)
+    fi
     {{ sudo_cmd }} podman run --rm \
         --privileged \
         --device /dev/fuse \
@@ -17,7 +41,34 @@ bst *ARGS:
         -v "${HOME}/.cache/buildstream:/root/.cache/buildstream:rw" \
         -w /src \
         "{{ bst2_image }}" \
-        bash -c 'bst "$@"' -- --no-interactive {{ ARGS }}
+        bash -c 'bst "$@"' -- --no-interactive "${RE_FLAG[@]}" {{ ARGS }}
+
+validate:
+    just bst show --deps all oci/ghostscript-printer-app.bst
+
+build:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    just bst build oci/ghostscript-printer-app.bst
+    just export
+
+export:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    rm -rf .build-out
+    just bst artifact checkout oci/ghostscript-printer-app.bst --directory /src/.build-out
+    IMAGE_ID=$({{ sudo_cmd }} podman pull -q oci:.build-out)
+    rm -rf .build-out
+    {{ sudo_cmd }} podman tag "$IMAGE_ID" "{{ image_ref }}"
+
+verify-core:
+    tests/core-appliance.sh
+
+verify-payload:
+    tests/core-payload.sh
+
+verify-raster-drivers:
+    tests/standalone-raster-drivers.sh
 
 verify-cups-patch-chain:
     tests/cups-patch-chain.sh

docs/skills/fsdk-cups-patching.md

@@ -30,6 +30,9 @@ metadata:
 6. Do not stage a second CUPS implementation. Duplicate `libcups.so*` ownership creates an artifact overlap and can compile reverse dependencies against a different library than the application receives.
 7. When moving a shared patch, update both Snap and Rock references while Rock remains. Apply patches from the source root when their paths start with `a/backend/` and use `-p1`.
 8. Cross-junction source checkouts nest under `<junction>/<element-path>/`; the CUPS probe therefore checks `freedesktop-sdk/components-_private-cups-base/`, not the checkout root.
+9. Match FSDK's multiarch install layout for every repository-built library. Define `gcc-triplet`, `lib`, and `libdir` in the root project and pass `--libdir=%{libdir}` to Autotools; FSDK's `pkg-config` searches `/usr/lib/<gcc-triplet>/pkgconfig`, not `/usr/lib/pkgconfig`.
+10. Do not `chown` high numeric runtime IDs inside the BuildStream sandbox; user-namespace mappings can reject them with `EINVAL`. After composition, reapply writable directory modes in the final OCI layer. Remove inherited `/run` service directories and let the numeric runtime user recreate them so ownership checks observe the actual user.
+11. Avahi's `--no-drop-root` still resolves its compiled `AVAHI_USER`/`AVAHI_GROUP` and requires its runtime directory to have those numeric IDs. Configure FSDK's Avahi build with `--with-avahi-user=nonroot --with-avahi-group=nonroot`; never create a second passwd/group name with UID/GID `65532`. Remove D-Bus's `<user>` directive so it does not attempt a second privilege drop, and patch Avahi policy at `/etc/dbus-1/system.d/avahi-dbus.conf`.
 
 ## Common Rationalizations
 
@@ -49,6 +52,11 @@ metadata:
 - `cups-libs` or `cups-license` disappears from the FSDK CUPS split rules.
 - A manifest invokes a patch after changing into a subdirectory incompatible with its `a/...` paths.
 - An FSDK junction update lands without rerunning the patch-chain verification.
+- Repository-built `.pc` files under `/usr/lib/pkgconfig` while the FSDK build sandbox searches only `/usr/lib/<gcc-triplet>/pkgconfig` and `/usr/share/pkgconfig`.
+- `chown 65532:65532` in a BuildStream build command; unprivileged sandbox UID maps do not guarantee that numeric owner exists.
+- Pre-creating Avahi's runtime directory as root; Avahi verifies it belongs to its compiled service UID even with `--no-drop-root`.
+- Giving `avahi` and `nonroot` the same UID/GID; numeric-to-name lookup becomes ambiguous and can hide a broken OCI identity.
+- Editing `/usr/share/dbus-1/system.d/avahi-dbus.conf`; the FSDK runtime installs that policy under `/etc/dbus-1/system.d/`.
 
 ## Verification
 
@@ -58,3 +66,6 @@ metadata:
 - [ ] The staged CUPS source contains the DNS-SD and `USB_QUIRK_DIR` changes.
 - [ ] The CUPS base still exposes `cups-libs` and `cups-license`.
 - [ ] Both current Snap and Rock CUPS source versions accept the canonical patches while both packaging paths exist.
+- [ ] Repository-built libraries install their `.pc` files in FSDK's multiarch pkg-config directory and are discoverable from a dependent element's build sandbox.
+- [ ] The exported image runs with the numeric UID/GID, creates runtime directories, and reaches application readiness.
+- [ ] TERM yields signal exit status `143`, not Podman's SIGKILL timeout status `137`; killing a required child makes the container exit nonzero.