ci(preview): force transitive Linux runtime rpath

Author: 66HEX

scripts/stage-gstreamer-bundle.cjs

@@ -296,18 +296,22 @@ function patchLinuxRuntimeRpaths(binaryDir, manifest, libTriplet) {
 	for (const entry of fs.readdirSync(binaryDir, { withFileTypes: true })) {
 		const filePath = path.join(binaryDir, entry.name);
 		if (entry.isFile() && isElfFile(filePath)) {
-			run('patchelf', ['--set-rpath', executableRpath, filePath]);
+			setLinuxRpath(filePath, executableRpath);
 		}
 	}
 
 	patchElfTree(manifest.libDir, '$ORIGIN:$ORIGIN/..:$ORIGIN/../..:$ORIGIN/../../..');
 	patchElfTree(manifest.pluginDir, '$ORIGIN/..');
 	patchElfTree(manifest.binDir, `$ORIGIN/../lib/${libTriplet}`);
 	if (isElfFile(manifest.scannerPath)) {
-		run('patchelf', ['--set-rpath', `$ORIGIN/../../lib/${libTriplet}`, manifest.scannerPath]);
+		setLinuxRpath(manifest.scannerPath, `$ORIGIN/../../lib/${libTriplet}`);
 	}
 }
 
+function setLinuxRpath(filePath, rpath) {
+	run('patchelf', ['--force-rpath', '--set-rpath', rpath, filePath]);
+}
+
 function patchElfTree(root, rpath) {
 	if (!fs.existsSync(root)) {
 		return;
@@ -319,7 +323,7 @@ function patchElfTree(root, rpath) {
 			continue;
 		}
 		if (entry.isFile() && isElfFile(entryPath)) {
-			run('patchelf', ['--set-rpath', rpath, entryPath]);
+			setLinuxRpath(entryPath, rpath);
 		}
 	}
 }

scripts/verify-gstreamer-runtime.cjs

@@ -338,6 +338,10 @@ function verifyLinux({ binaryDir }) {
 		if (rpath.includes('.cache/gstreamer')) {
 			throw new Error(`Linux binary still includes build-cache GStreamer RPATH: ${binary}\n${rpath}`);
 		}
+		const dynamicTags = run('readelf', ['-d', binary]);
+		if (!dynamicTags.includes('(RPATH)')) {
+			throw new Error(`Linux binary uses non-transitive RUNPATH instead of bundled RPATH: ${binary}`);
+		}
 
 		const output = run('ldd', [binary], {
 			env: {