Build the AstroArch image in CI, and ship a PHD2 that starts

[teoteo]

Builds the whole AstroArch chain on a GitHub-hosted runner and produces a bootable Raspberry Pi .img, and fixes the PHD2 that the image has been shipping broken.

Green end-to-end run, 17 minutes on ubuntu-24.04-arm: https://github.com/teoteo/ArchLinuxARM/actions/runs/34129179533 — artifact astroarch-2.0.8-20260907-aarch64.img.zst, 4073 MiB, 0 failures and 0 warnings from the verifier.

PHD2 is currently dead in the image

The [astromatto] phd2 package is linked against opencv 4.13. Arch has since replaced opencv 4 with opencv 5, so all 57 libopencv_*.so.413 it asks for exist in no aarch64 repo any more:

libopencv_alphamat.so.413: cannot open shared object file

Nothing catches it. The package declares no opencv dependency, so pacman resolves the transaction cleanly; kstars pulls in opencv 5 anyway; the build goes green and PHD2 only fails the first time a user launches it on their Pi.

PHD2 does not need OpenCV. It references exactly four symbols — cv::VideoCapture, cv::Mat's ctor and dtor, cv::cvtColor — all from src/cam_opencv.cpp, which is entirely inside #ifdef OPENCV_CAMERA: the webcam driver, redundant next to the INDI V4L2 driver and the vendor SDKs. Deleting that one define and the unconditional find_package(OpenCV) drops the OpenCV link completely, so the binary stops tracking opencv sonames for good.

PHD2 2.6.14 is therefore compiled in its own stage, which uses the same [astromatto] repo as the runtime stage so it links against the cfitsio and libindi the image actually ships. 21 DT_NEEDED entries instead of 79, all resolvable, with the same camera coverage: the ZWO and QHY SDKs move from a shared library to the static archives upstream ships for armv8, and Player One, SVBONY, ToupTek and OGMA are still installed in /usr/lib/phd2.

This is a workaround, not the real fix. These files are owned by no pacman package, so pacman -Syu on a device will not update them, and anyone installing phd2 by hand still gets the broken binary. Patching the PKGBUILD in [astromatto] would make this stage unnecessary — it is three lines:

sed -i '/^#  define OPENCV_CAMERA$/d' src/cameras.h
sed -i 's/^  find_package( OpenCV REQUIRED )$//; \
  s/^  target_link_libraries(phd2 X11 ${OpenCV_LIBS})$/  target_link_libraries(phd2 X11)/' CMakeLists.txt

vtk and hdf5 can come out of that package's depends too — they are not in DT_NEEDED at all, ${OpenCV_LIBS} just drags them in.

Verification that would have caught it

verify_img.sh checked that /usr/bin/phd2 exists, which a dead binary passes. The new check_links resolves every DT_NEEDED of the astrophotography binaries against the sonames present in the image:

== shared library resolution ==
  6728 sonames indexed under /usr/lib, /usr/lib64 and /lib
  ok    KStars links: 44 shared libraries all resolve
  ok    PHD2 links: 21 shared libraries all resolve
  ok    indiserver links: 7 shared libraries all resolve
  ok    solve-field links: 6 shared libraries all resolve

It reads the ELF headers with readelf, so it needs neither a chroot nor QEMU.

The rest of the branch

• .github/workflows/astroarch-image.yml — the full chain on one runner, defaulting to ubuntu-24.04-arm so nothing is emulated. Each image is tagged with exactly the reference the next Dockerfile's FROM expects, which is what makes the from-scratch chain work in a single job without pushing to a registry in between. Nothing is published by default; the image is uploaded as an artifact and releases are opt-in.
• scripts/build_img.sh — maps partitions with per-partition loop devices, since losetup --partscan does not reliably create /dev/loopNp1 on GitHub runners.
• scripts/verify_img.sh — checks a built .img without booting it. Symlinks are resolved against the image rather than the host, because much of what AstroArch installs points into /home/astronaut/.astroarch with absolute targets.
• Dockerfile.astroarch — libgphoto2 pinned to extra. The [astromatto] copy still depends on the bare libjpeg virtual that libjpeg-turbo no longer provides, and because [astromatto] sits above [extra] it takes libindi, indi-3rdparty-* and kstars down with it.

One thing worth a second opinion

The workflow skips compression and upload when verification fails. That is deliberate — no point compressing a bad image — but it means a bug in the checker throws away a complete build, which is exactly what happened on the first run here. Making the upload if: always() while leaving the job red would keep the image around to inspect. Happy to change it either way.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HpwpeqWfJDvjfbWZJ8jKE6