add libyuv package (#32)

* add libyuv package

* update libyuv to upstream 1922

.github/workflows/ci.yml

@@ -0,0 +1,103 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+jobs:
+  build:
+    name: build (${{ matrix.platform }})
+    runs-on: ${{ matrix.runs-on }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux-x86_64
+            runs-on: ubuntu-latest
+          - platform: linux-arm64
+            runs-on: ubuntu-24.04-arm
+          - platform: macos
+            runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/cache@v4
+        with:
+          key: build-cache-v1-${{ matrix.platform }}-${{ hashFiles('build.sh', 'setup.sh', '*/pyproject.toml', '*/setup.py', '*/build.sh') }}
+          restore-keys: build-cache-v1-${{ matrix.platform }}-
+          path: |
+            .uv-cache
+            */*/install
+            */*/toolchain
+            */*/bin
+      - name: Build wheels
+        env:
+          MANYLINUX: ${{ runner.os == 'Linux' && '1' || '0' }}
+          UV_CACHE_DIR: ${{ github.workspace }}/.uv-cache
+          BUILD_SH_REUSE_MANYLINUX_ARTIFACTS: "1"
+        run: ./build.sh
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-${{ matrix.platform }}
+          path: dist/*.whl
+
+  test:
+    name: test distro (${{ matrix.image }})
+    needs: build
+    runs-on: ${{ matrix.runs-on }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: debian:bookworm-slim
+            runs-on: ubuntu-latest
+          - image: ubuntu:24.04
+            runs-on: ubuntu-latest
+          - image: ubuntu:20.04
+            runs-on: ubuntu-latest
+          - image: fedora:41
+            runs-on: ubuntu-latest
+          - image: archlinux:latest
+            runs-on: ubuntu-latest
+          - image: opensuse/tumbleweed:latest
+            runs-on: ubuntu-latest
+          - image: ghcr.io/void-linux/void-glibc:latest
+            runs-on: ubuntu-latest
+          - image: debian:bookworm-slim
+            runs-on: ubuntu-24.04-arm
+          # TODO: add musl test
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/download-artifact@v4
+        with:
+          name: ${{ contains(matrix.runs-on, 'arm') && 'wheels-linux-arm64' || 'wheels-linux-x86_64' }}
+          path: dist/
+      - run: ./test_wheels_in_image.sh "${{ matrix.image }}"
+
+  publish:
+    name: publish wheels
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    needs: [build, test]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: wheels-*
+          merge-multiple: true
+          path: dist
+      - uses: actions/cache/restore@v4
+        with:
+          key: build-cache-v1-${{ matrix.platform }}-${{ hashFiles('build.sh', 'setup.sh', '*/pyproject.toml', '*/setup.py', '*/build.sh') }}
+          restore-keys: build-cache-v1-${{ matrix.platform }}-
+          path: |
+            .uv-cache
+            */*/install
+            */*/toolchain
+            */*/bin
+      - name: Publish wheels and shims
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: ./release.sh --publish-only

.github/workflows/test.yml

@@ -1,73 +0,0 @@
-name: ./test.sh
-
-on:
-  push:
-    branches: [master]
-  pull_request:
-
-jobs:
-  test:
-    name: ${{ matrix.image || matrix.os }}
-    runs-on: ${{ matrix.runs-on }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # native (no docker)
-          - os: macos-latest
-            runs-on: macos-latest
-
-          # the provided github actions runner images
-          # have tons of pre-installed packages. the
-          # goal here is to test across many vanilla setups
-          - image: debian:bookworm-slim
-            runs-on: ubuntu-latest
-          - image: ubuntu:24.04
-            runs-on: ubuntu-latest
-          - image: fedora:41
-            runs-on: ubuntu-latest
-          - image: archlinux:latest
-            runs-on: ubuntu-latest
-          - image: alpine:3.21  # musl libc
-            runs-on: ubuntu-latest
-          - image: opensuse/tumbleweed:latest
-            runs-on: ubuntu-latest
-          - image: ghcr.io/void-linux/void-glibc:latest
-            runs-on: ubuntu-latest
-          - image: debian:bookworm-slim
-            runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: actions/checkout@v6
-
-      # native (macOS)
-      - if: ${{ !matrix.image }}
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.14"
-      - if: ${{ !matrix.image }}
-        name: ./test.sh
-        run: ./test.sh
-
-      # docker (vanilla Linux)
-      - if: ${{ matrix.image }}
-        name: install python3
-        run: |
-          docker build -t test -f - . <<'DOCKERFILE'
-          FROM ${{ matrix.image }}
-          RUN if command -v apk >/dev/null; then \
-                apk add --no-cache python3 py3-pip bash curl; \
-              elif command -v apt-get >/dev/null; then \
-                apt-get update && apt-get install -y --no-install-recommends python3 python3-pip python3-venv curl ca-certificates; \
-              elif command -v dnf >/dev/null; then \
-                dnf install -y python3 python3-pip curl; \
-              elif command -v pacman >/dev/null; then \
-                pacman -Sy --noconfirm python python-pip curl; \
-              elif command -v zypper >/dev/null; then \
-                zypper install -y python3 python3-pip curl; \
-              elif command -v xbps-install >/dev/null; then \
-                xbps-install -Sy python3 python3-pip bash curl; \
-              fi
-          DOCKERFILE
-      - if: ${{ matrix.image }}
-        name: ./test.sh
-        run: docker run --rm -v "$PWD:/work" -w /work test bash ./test.sh

.gitignore

@@ -1,10 +1,28 @@
 .git/
 repo/
+.venv/
+__pycache__/
+
+# agents
+.claude/
+.context/
+TASK.md
 
 # build artifacts (applies to all packages)
 build/
 dist/
+install/
 *.egg-info/
+*-src/
+*.tar.gz
+*.tar.xz
+*.tgz
+Python-*/
+ncurses-*/
+arm-gnu-toolchain-*/
 
 # downloaded toolchain binaries
 gcc-arm-none-eabi/gcc_arm_none_eabi/toolchain/
+
+# downloaded git-lfs
+git-lfs/git_lfs/bin/

README.md

@@ -1,14 +1,23 @@
 # dependencies
 
-a central repo for managing and vendoring third party dependencies for all comma projects.
+a central repo for [vendoring](https://htmx.org/essays/vendoring/) all third party dependencies for comma projects.
 
-all of our projects are python projects, so each of these gets packaged as a pip project.
+since all our projects are Python, we wrap each vendored dependency as a pip package. `git clone` and `uv sync` is all you need.
 
-this vendoring serves a few goals:
-- all dependencies are centrally managed here
-- we can slim them down to only what we need
-- all platforms get the same versions installed
-- tighter control of distribution for fast installs (e.g. Ubuntu's `apt-get` is slow)
+motivations for this approach
+- `apt-get` is slow
+- `apt-get` updates its packages on a schedule we don't control
+- `apt-get` package versions don't match `brew` versions
+- `apt-get` doesn't come with Arch Linux
+- `apt-get` packages come with more than we need, bloating our project footprint 
+
+<!--
+this critically adds friction to adding dependencies to our project
+- `apt-get` installing a package is easy. is it 1MB, 10MB, or 100MB? no idea.
+- `apt-get` installing a package is much easier than adding it here. how much do you want it?
+-->
+
+`uv`, as opposed to `apt-get`, `brew`, and friends, is fast and already used in our projects.
 
 we target the following platforms:
 - Linux x86_64
@@ -16,3 +25,37 @@ we target the following platforms:
 - Darwin aarch64 (Apple Silicon)
 
 contributions welcome for other platforms!
+
+<!--
+## packages
+
+| package           | description                                                              |
+|-------------------|--------------------------------------------------------------------------|
+| gcc-arm-none-eabi | builds [panda](https://github.com/commaai/panda) firmware for STM32 MCUs |
+| capnproto         | message serialization for openpilot                                      |
+| ffmpeg            | video encode and decode for openpilot                                    |
+| git-lfs           | for tracking large files in openpilot                                    |
+| zeromq            | bridging the openpilot IPC between different hosts                       |
+-->
+
+## usage
+
+```python
+dependencies = [
+  # use the releases branch for pre-built wheels
+  "capnproto @ git+https://github.com/commaai/dependencies.git@releases#subdirectory=capnproto",
+  "ffmpeg @ git+https://github.com/commaai/dependencies.git@releases#subdirectory=ffmpeg",
+
+  # use the master branch to build the package on pip install
+  "capnproto @ git+https://github.com/commaai/dependencies.git@master#subdirectory=capnproto",
+  "ffmpeg @ git+https://github.com/commaai/dependencies.git@master#subdirectory=ffmpeg",
+]
+```
+
+## workflow
+
+to add a new package:
+* start a new top-level directory as a new package
+* `./test.sh` tests the building of all packages
+*  on pushes to `master`, wheels are built for our target platforms and pushed to a GitHub release
+*  the `releases` branch contains shim packages that allow pointing to a git branch and always getting the appropriate wheel for your platform

_shim_setup.py

@@ -0,0 +1,73 @@
+"""Shim setup.py: downloads pre-built wheels from GitHub Releases at install time."""
+import os
+import platform
+import zipfile
+from io import BytesIO
+from urllib.request import urlopen
+
+try:
+  import tomllib
+except ImportError:
+  import tomli as tomllib
+
+from setuptools import setup
+from setuptools.command.build_py import build_py
+
+_HERE = os.path.dirname(os.path.abspath(__file__))
+with open(os.path.join(_HERE, "pyproject.toml"), "rb") as _f:
+  _cfg = tomllib.load(_f)
+
+REPO_URL = _cfg["tool"]["shim"]["repo_url"]
+TAG = _cfg["tool"]["shim"]["tag"]
+DATADIR = _cfg["tool"]["shim"]["datadir"]
+VERSION = _cfg["project"]["version"]
+MODULE = _cfg["project"]["name"].replace("-", "_")
+
+PLATFORM_MAP = {
+  ("Linux", "x86_64"): "linux_x86_64",
+  ("Linux", "aarch64"): "linux_aarch64",
+  ("Darwin", "arm64"): "macosx_11_0_arm64",
+}
+
+
+class InstallPrebuilt(build_py):
+  def run(self):
+    data_dir = os.path.join(_HERE, MODULE, DATADIR)
+
+    if not os.path.exists(os.path.join(data_dir, "bin")):
+      key = (platform.system(), platform.machine())
+      plat = PLATFORM_MAP.get(key)
+      if plat is None:
+        raise RuntimeError(f"unsupported platform: {key}")
+
+      whl_name = f"{MODULE}-{VERSION}-py3-none-{plat}.whl"
+      url = f"{REPO_URL}/releases/download/{TAG}/{whl_name}"
+
+      print(f"Downloading {url} ...")
+      raw = urlopen(url).read()
+
+      print(f"Extracting {DATADIR} ...")
+      with zipfile.ZipFile(BytesIO(raw)) as zf:
+        prefix = f"{MODULE}/{DATADIR}/"
+        alt_prefix = f"{MODULE}-{VERSION}.data/purelib/{MODULE}/{DATADIR}/"
+        for info in zf.infolist():
+          for p in (prefix, alt_prefix):
+            if info.filename.startswith(p):
+              rel = info.filename[len(p):]
+              if not rel:
+                continue
+              dest = os.path.join(data_dir, rel)
+              if info.is_dir():
+                os.makedirs(dest, exist_ok=True)
+              else:
+                os.makedirs(os.path.dirname(dest), exist_ok=True)
+                with open(dest, "wb") as f:
+                  f.write(zf.read(info))
+                if info.external_attr >> 16 & 0o111:
+                  os.chmod(dest, 0o755)
+              break
+
+    super().run()
+
+
+setup(cmdclass={"build_py": InstallPrebuilt})

build.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$ROOT_DIR"
+
+if [[ $# -gt 0 ]]; then
+  echo "usage: MANYLINUX=1 ./build.sh" >&2
+  exit 2
+fi
+
+USE_MANYLINUX="${MANYLINUX:-0}"
+
+if [[ -z "${BUILD_SH_IN_MANYLINUX:-}" ]] && ! command -v uv >/dev/null 2>&1; then
+  ./setup.sh
+fi
+
+if [[ "$USE_MANYLINUX" == "1" && -z "${BUILD_SH_IN_MANYLINUX:-}" ]]; then
+  UV_BIN="$(command -v uv)"
+  docker run --rm \
+    -e BUILD_SH_IN_MANYLINUX=1 \
+    -e BUILD_SH_REUSE_MANYLINUX_ARTIFACTS="${BUILD_SH_REUSE_MANYLINUX_ARTIFACTS:-}" \
+    -e HOME=/tmp \
+    -e UV_CACHE_DIR=/work/.uv-cache \
+    -e UV_PYTHON=/opt/python/cp312-cp312/bin/python3 \
+    -v "$ROOT_DIR:/work" \
+    -v "$UV_BIN:/usr/local/bin/uv:ro" \
+    -w /work \
+    "quay.io/pypa/manylinux_2_28_$(uname -m)" \
+    bash build.sh
+  exit 0
+fi
+
+if [[ -n "${BUILD_SH_IN_MANYLINUX:-}" ]]; then
+  export PATH="/opt/python/cp312-cp312/bin:$PATH"
+
+  ./setup.sh
+
+  if [[ -z "${BUILD_SH_REUSE_MANYLINUX_ARTIFACTS:-}" ]]; then
+    for toml in */pyproject.toml; do
+      pkg="${toml%/pyproject.toml}"
+      module="${pkg//-/_}"
+      rm -rf "$pkg/$module/install" "$pkg/$module/toolchain" "$pkg/$module/bin"
+    done
+  fi
+fi
+
+echo "Building workspace packages into dist"
+START_SECS=$SECONDS
+
+uv build --all-packages --wheel --out-dir dist --no-create-gitignore --no-build-logs
+
+if [[ -n "${BUILD_SH_IN_MANYLINUX:-}" ]]; then
+  VENV_DIR="$ROOT_DIR/.venv-manylinux"
+else
+  VENV_DIR="$ROOT_DIR/.venv"
+fi
+
+echo
+echo "Running smoketests"
+
+uv venv --allow-existing --quiet "$VENV_DIR"
+uv pip install --python "$VENV_DIR/bin/python" --reinstall --no-deps --quiet dist/*.whl >/dev/null
+
+for toml in */pyproject.toml; do
+  module="$(basename "$(dirname "$toml")" | tr '-' '_')"
+  "$VENV_DIR/bin/python" -c "import $module; $module.smoketest()" >/dev/null
+done
+
+du -hs dist/* | sort -hr
+
+echo
+echo "Done in $((SECONDS - START_SECS))s"

bzip2/build.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="1.0.8"
+INSTALL_DIR="$DIR/bzip2/install"
+
+# Idempotent: skip if already built
+if [ -f "$INSTALL_DIR/lib/libbz2.a" ]; then
+  echo "bzip2 already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Download
+if [ ! -d "bzip2-src" ]; then
+  curl -L "https://sourceware.org/pub/bzip2/bzip2-${VERSION}.tar.gz" -o bzip2.tar.gz
+  mkdir -p bzip2-src
+  tar xzf bzip2.tar.gz -C bzip2-src --strip-components=1
+  rm bzip2.tar.gz
+fi
+
+# Build static library with -fPIC
+cd bzip2-src
+make -j"$NJOBS" libbz2.a CC="${CC:-cc}" CFLAGS="-Wall -Winline -O2 -fPIC -D_FILE_OFFSET_BITS=64"
+cd "$DIR"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{lib,include}
+
+# Library
+cp bzip2-src/libbz2.a "$INSTALL_DIR/lib/"
+
+# Headers
+cp bzip2-src/bzlib.h "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf bzip2-src
+
+echo "Installed bzip2 to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

bzip2/bzip2/__init__.py

@@ -0,0 +1,10 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(LIB_DIR, "libbz2.a")), "libbz2.a not found"
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "bzlib.h")), "bzlib.h not found"

bzip2/pyproject.toml

@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "bzip2"
+version = "1.0.8"
+description = "bzip2 compression library (static build)"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["bzip2*"]
+
+[tool.setuptools.package-data]
+bzip2 = ["install/**/*"]

bzip2/setup.py

@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildBzip2(build_py):
+  """Run build.sh to compile bzip2 before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "bzip2", "install", "lib", "libbz2.a")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildBzip2}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

capnproto/build.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="1.0.1"
+INSTALL_DIR="$DIR/capnproto/install"
+
+# Idempotent: skip if already built
+if [ -x "$INSTALL_DIR/bin/capnp" ]; then
+  echo "capnproto already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Clone
+if [ ! -d "capnproto-src" ]; then
+  git clone --depth 1 --branch "v${VERSION}" https://github.com/capnproto/capnproto.git capnproto-src
+fi
+
+# Build
+PREFIX="$DIR/build/prefix"
+mkdir -p "$DIR/build"
+
+cmake -S capnproto-src -B "$DIR/build" \
+  -DCMAKE_BUILD_TYPE=MinSizeRel \
+  -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=ON \
+  -DCMAKE_INSTALL_PREFIX="$PREFIX" \
+  -DCMAKE_INSTALL_LIBDIR=lib \
+  -DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
+  -DCMAKE_C_FLAGS="-fPIC" \
+  -DCMAKE_CXX_FLAGS="-fPIC" \
+  -DWITH_OPENSSL=OFF \
+  -DBUILD_TESTING=OFF \
+  -DBUILD_SHARED_LIBS=OFF
+
+cmake --build "$DIR/build" -j"$NJOBS"
+cmake --install "$DIR/build"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{bin,lib,include}
+
+# Binaries
+cp "$PREFIX/bin/capnp" "$INSTALL_DIR/bin/"
+cp "$PREFIX/bin/capnpc-c++" "$INSTALL_DIR/bin/"
+ln -sf capnp "$INSTALL_DIR/bin/capnpc"
+
+# Libraries (only the ones openpilot needs)
+cp "$PREFIX/lib/libcapnp.a" "$INSTALL_DIR/lib/"
+cp "$PREFIX/lib/libkj.a" "$INSTALL_DIR/lib/"
+
+# Headers
+cp -r "$PREFIX/include/capnp" "$INSTALL_DIR/include/"
+cp -r "$PREFIX/include/kj" "$INSTALL_DIR/include/"
+
+# Strip binaries and libs
+strip "$INSTALL_DIR/bin/capnp" "$INSTALL_DIR/bin/capnpc-c++" 2>/dev/null || true
+
+# Strip unused kj objects from libkj.a (not needed by openpilot)
+for obj in filesystem.c++.o main.c++.o test-helpers.c++.o; do
+  ar d "$INSTALL_DIR/lib/libkj.a" "$obj" 2>/dev/null || true
+done
+
+# Clean up
+rm -rf capnproto-src "$DIR/build"
+
+echo "Installed capnproto to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

capnproto/capnproto/__init__.py

@@ -0,0 +1,44 @@
+import os
+import sys
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+BIN_DIR = os.path.join(DIR, "bin")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def _run(name):
+  binary = os.path.join(BIN_DIR, name)
+  env = os.environ.copy()
+  # ensure sibling binaries (e.g. capnpc-c++) are findable
+  env["PATH"] = BIN_DIR + ":" + env.get("PATH", "")
+  os.execvpe(binary, [binary] + sys.argv[1:], env)
+
+
+def _run_capnp():
+  _run("capnp")
+
+
+def _run_capnpc():
+  # capnpc is a symlink to capnp; capnp checks argv[0] to enter compile mode
+  binary = os.path.join(BIN_DIR, "capnp")
+  env = os.environ.copy()
+  env["PATH"] = BIN_DIR + ":" + env.get("PATH", "")
+  os.execvpe(binary, ["capnpc"] + sys.argv[1:], env)
+
+
+def _run_capnpc_cpp():
+  _run("capnpc-c++")
+
+
+def smoketest():
+  import subprocess
+
+  capnp = os.path.join(BIN_DIR, "capnp")
+  capnpc = os.path.join(BIN_DIR, "capnpc")
+  capnpc_cpp = os.path.join(BIN_DIR, "capnpc-c++")
+  env = os.environ.copy()
+  env["PATH"] = BIN_DIR + ":" + env.get("PATH", "")
+  subprocess.run([capnp, "--version"], check=True, env=env)
+  subprocess.run([capnpc, "--version"], check=True, env=env)
+  subprocess.run([capnpc_cpp, "--version"], check=True, env=env)

capnproto/pyproject.toml

@@ -0,0 +1,20 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "capnproto"
+version = "1.0.1"
+description = "Cap'n Proto serialization library and compiler"
+requires-python = ">=3.8"
+
+[project.scripts]
+capnp = "capnproto:_run_capnp"
+capnpc = "capnproto:_run_capnpc"
+"capnpc-c++" = "capnproto:_run_capnpc_cpp"
+
+[tool.setuptools.packages.find]
+include = ["capnproto*"]
+
+[tool.setuptools.package-data]
+capnproto = ["install/**/*"]

capnproto/setup.py

@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildCapnproto(build_py):
+  """Run build.sh to compile capnproto before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "capnproto", "install", "bin", "capnp")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildCapnproto}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

cppcheck/build.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="2.16.0"
+INSTALL_DIR="$DIR/cppcheck/install"
+
+# Idempotent: skip if already built
+if [ -x "$INSTALL_DIR/cppcheck" ]; then
+  echo "cppcheck already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Clone
+if [ ! -d "cppcheck-src" ]; then
+  git clone --depth 1 --branch "$VERSION" https://github.com/danmar/cppcheck.git cppcheck-src
+fi
+
+# Build
+cd cppcheck-src
+make MATCHCOMPILER=yes CXXFLAGS="-O2" -j"$NJOBS"
+cd "$DIR"
+
+# Install
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"
+
+cp cppcheck-src/cppcheck "$INSTALL_DIR/"
+cp -r cppcheck-src/addons "$INSTALL_DIR/"
+cp -r cppcheck-src/cfg "$INSTALL_DIR/"
+cp -r cppcheck-src/platforms "$INSTALL_DIR/"
+strip "$INSTALL_DIR/cppcheck" 2>/dev/null || true
+
+# Clean up
+rm -rf cppcheck-src
+
+echo "Installed cppcheck to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

cppcheck/cppcheck/__init__.py

@@ -0,0 +1,16 @@
+import os
+import sys
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+
+
+def _run():
+  binary = os.path.join(DIR, "cppcheck")
+  os.execvp(binary, ["cppcheck"] + sys.argv[1:])
+
+
+def smoketest():
+  import subprocess
+  binary = os.path.join(DIR, "cppcheck")
+  result = subprocess.run([binary, "--version"], capture_output=True, text=True, check=True)
+  print(result.stdout.strip())

cppcheck/pyproject.toml

@@ -0,0 +1,18 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "cppcheck"
+version = "2.16.0"
+description = "Cppcheck static analysis tool"
+requires-python = ">=3.8"
+
+[project.scripts]
+cppcheck = "cppcheck:_run"
+
+[tool.setuptools.packages.find]
+include = ["cppcheck*"]
+
+[tool.setuptools.package-data]
+cppcheck = ["install/**/*"]

cppcheck/setup.py

@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildCppcheck(build_py):
+  """Run build.sh to compile cppcheck before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "cppcheck", "install", "cppcheck")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildCppcheck}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

eigen/build.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="3.4.0"
+INSTALL_DIR="$DIR/eigen/install"
+
+# Idempotent: skip if already present
+if [ -d "$INSTALL_DIR/eigen3/Eigen" ]; then
+  echo "eigen already present, skipping download."
+  exit 0
+fi
+
+TARBALL="eigen-${VERSION}.tar.gz"
+URL="https://gitlab.com/libeigen/eigen/-/archive/${VERSION}/${TARBALL}"
+
+echo "Downloading Eigen ${VERSION} ..."
+curl -fSL -o "$TARBALL" "$URL"
+
+echo "Extracting headers ..."
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR/eigen3"
+
+# Extract only the Eigen/ and unsupported/Eigen/ header directories
+tar --strip-components=1 -xzf "$TARBALL" -C "$INSTALL_DIR/eigen3" \
+  "eigen-${VERSION}/Eigen" \
+  "eigen-${VERSION}/unsupported"
+
+rm -f "$TARBALL"
+
+echo "Installed eigen to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

eigen/eigen/__init__.py

@@ -0,0 +1,9 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+INCLUDE_DIR = DIR
+LIB_DIR = DIR  # header-only; no libraries
+
+
+def smoketest():
+  assert os.path.isdir(os.path.join(DIR, "eigen3", "Eigen")), "Eigen headers not found"

eigen/pyproject.toml

@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "eigen"
+version = "3.4.0"
+description = "Eigen C++ linear algebra headers"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["eigen*"]
+
+[tool.setuptools.package-data]
+eigen = ["install/**/*"]

eigen/setup.py

@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildEigen(build_py):
+  """Run build.sh to download Eigen headers before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "eigen", "install", "eigen3", "Eigen")
+
+    if not os.path.isdir(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildEigen}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

ffmpeg/build.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+FFMPEG_VERSION="7.1"
+INSTALL_DIR="$DIR/ffmpeg/install"
+
+# Idempotent: skip if already built
+if [ -x "$INSTALL_DIR/bin/ffmpeg" ]; then
+  echo "ffmpeg already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+PREFIX="$DIR/build/prefix"
+mkdir -p "$DIR/build"
+
+# --- Build zlib (static) ---
+if [ ! -d "zlib-src" ]; then
+  git clone https://github.com/madler/zlib.git zlib-src
+  git -C zlib-src checkout da607da739fa6047df13e66a2af6b8bec7c2a498  # pin to v1.3.2
+fi
+
+cd zlib-src
+./configure --prefix="$PREFIX" --static
+make -j"$NJOBS"
+make install
+cd "$DIR"
+
+# --- Build x264 (static) ---
+if [ ! -d "x264-src" ]; then
+  git clone --depth 1 --branch stable https://code.videolan.org/videolan/x264.git x264-src
+fi
+
+cd x264-src
+CFLAGS="-fno-finite-math-only" ./configure \
+  --prefix="$PREFIX" \
+  --enable-static \
+  --disable-shared \
+  --disable-cli \
+  --disable-opencl \
+  --enable-pic
+make -j"$NJOBS"
+make install
+cd "$DIR"
+
+# --- Build FFmpeg ---
+if [ ! -d "ffmpeg-src" ]; then
+  git clone --depth 1 --branch "n${FFMPEG_VERSION}" https://github.com/FFmpeg/FFmpeg.git ffmpeg-src
+fi
+
+cd ffmpeg-src
+PKG_CONFIG_PATH="$PREFIX/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}" \
+./configure \
+  --prefix="$PREFIX" \
+  --enable-gpl \
+  --enable-static \
+  --disable-shared \
+  --enable-zlib \
+  --enable-libx264 \
+  --enable-pic \
+  --disable-doc \
+  --disable-ffplay \
+  --disable-autodetect \
+  --disable-everything \
+  --enable-encoder=libx264,aac,ffvhuff,rawvideo,png,mjpeg \
+  --enable-decoder=h264,hevc,ffvhuff,aac,rawvideo,png,mjpeg,mp3,pcm_s16le \
+  --enable-muxer=mpegts,matroska,mp4,hevc,rawvideo,image2,null,mov,framehash \
+  --enable-demuxer=hevc,matroska,mpegts,mov,rawvideo,image2,aac,concat \
+  --enable-parser=h264,hevc,aac,mpegaudio \
+  --enable-protocol=file,pipe \
+  --enable-filter=blend,vflip,format,scale,aformat,anull,aresample,null \
+  --enable-bsf=extract_extradata,h264_mp4toannexb,hevc_mp4toannexb \
+  --extra-cflags="-I$PREFIX/include" \
+  --extra-ldflags="-L$PREFIX/lib"
+make -j"$NJOBS"
+make install
+cd "$DIR"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{bin,lib,include}
+
+# Binaries
+cp "$PREFIX/bin/ffmpeg" "$INSTALL_DIR/bin/"
+cp "$PREFIX/bin/ffprobe" "$INSTALL_DIR/bin/"
+
+# Libraries
+for lib in libavformat.a libavcodec.a libavutil.a libswresample.a libx264.a libz.a; do
+  cp "$PREFIX/lib/$lib" "$INSTALL_DIR/lib/"
+done
+
+# Headers
+for dir in libavformat libavcodec libavutil libswresample; do
+  cp -r "$PREFIX/include/$dir" "$INSTALL_DIR/include/"
+done
+
+# Strip binaries
+strip "$INSTALL_DIR/bin/ffmpeg" "$INSTALL_DIR/bin/ffprobe" 2>/dev/null || true
+
+# Clean up
+rm -rf zlib-src x264-src ffmpeg-src "$DIR/build"
+
+echo "Installed ffmpeg to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

ffmpeg/ffmpeg/__init__.py

@@ -0,0 +1,29 @@
+import os
+import sys
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+BIN_DIR = os.path.join(DIR, "bin")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def _run(name):
+  binary = os.path.join(BIN_DIR, name)
+  os.execvp(binary, [binary] + sys.argv[1:])
+
+
+def _run_ffmpeg():
+  _run("ffmpeg")
+
+
+def _run_ffprobe():
+  _run("ffprobe")
+
+
+def smoketest():
+  import subprocess
+
+  ffmpeg = os.path.join(BIN_DIR, "ffmpeg")
+  ffprobe = os.path.join(BIN_DIR, "ffprobe")
+  subprocess.run([ffmpeg, "-version"], check=True)
+  subprocess.run([ffprobe, "-version"], check=True)

ffmpeg/pyproject.toml

@@ -0,0 +1,19 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "ffmpeg"
+version = "7.1.0"
+description = "FFmpeg media tools and libraries (minimal build for openpilot)"
+requires-python = ">=3.8"
+
+[project.scripts]
+ffmpeg = "ffmpeg:_run_ffmpeg"
+ffprobe = "ffmpeg:_run_ffprobe"
+
+[tool.setuptools.packages.find]
+include = ["ffmpeg*"]
+
+[tool.setuptools.package-data]
+ffmpeg = ["install/**/*"]

ffmpeg/setup.py

@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildFFmpeg(build_py):
+  """Run build.sh to compile ffmpeg before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "ffmpeg", "install", "bin", "ffmpeg")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildFFmpeg}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

gcc-arm-none-eabi/gcc_arm_none_eabi/__init__.py

@@ -19,3 +19,9 @@ def _run_objcopy():
 
 def _run_size():
   _run("arm-none-eabi-size")
+
+
+def smoketest():
+  import subprocess
+  gcc = os.path.join(TOOLCHAIN_DIR, "bin", "arm-none-eabi-gcc")
+  subprocess.run([gcc, "--version"], check=True)

git-lfs/build.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="3.6.1"
+INSTALL_DIR="$DIR/git_lfs/bin"
+
+# Idempotent: skip if already present
+if [ -x "$INSTALL_DIR/git-lfs" ]; then
+  echo "git-lfs already present, skipping download."
+  exit 0
+fi
+
+OS="$(uname -s)"
+ARCH="$(uname -m)"
+
+case "${OS}-${ARCH}" in
+  Linux-x86_64)   PLATFORM="linux-amd64"  ; EXT="tar.gz" ;;
+  Linux-aarch64)  PLATFORM="linux-arm64"   ; EXT="tar.gz" ;;
+  Darwin-arm64)   PLATFORM="darwin-arm64"  ; EXT="zip" ;;
+  *)
+    echo "Unsupported platform: ${OS}-${ARCH}" >&2
+    exit 1
+    ;;
+esac
+
+FILENAME="git-lfs-${PLATFORM}-v${VERSION}.${EXT}"
+URL="https://github.com/git-lfs/git-lfs/releases/download/v${VERSION}/${FILENAME}"
+
+echo "Downloading $FILENAME ..."
+curl -fSL -o "$FILENAME" "$URL"
+
+echo "Extracting ..."
+mkdir -p "$INSTALL_DIR"
+if [ "$EXT" = "zip" ]; then
+  python3 -c "
+import zipfile, sys
+with zipfile.ZipFile('$FILENAME') as zf:
+  for info in zf.infolist():
+    if info.filename.endswith('/git-lfs'):
+      with open('$INSTALL_DIR/git-lfs', 'wb') as f:
+        f.write(zf.read(info))
+      break
+"
+else
+  tar --strip-components=1 -xzf "$FILENAME" -C "$INSTALL_DIR" --wildcards '*/git-lfs'
+fi
+
+chmod +x "$INSTALL_DIR/git-lfs"
+
+rm -f "$FILENAME"
+
+echo "Installed git-lfs to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

git-lfs/git_lfs/__init__.py

@@ -0,0 +1,15 @@
+import os
+import sys
+
+BIN_DIR = os.path.join(os.path.dirname(__file__), "bin")
+
+
+def _run():
+  binary = os.path.join(BIN_DIR, "git-lfs")
+  os.execvp(binary, [binary] + sys.argv[1:])
+
+
+def smoketest():
+  import subprocess
+  binary = os.path.join(BIN_DIR, "git-lfs")
+  subprocess.run([binary, "--version"], check=True)

git-lfs/pyproject.toml

@@ -0,0 +1,18 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "git-lfs"
+version = "3.6.1"
+description = "Git Large File Storage extension"
+requires-python = ">=3.8"
+
+[project.scripts]
+git-lfs = "git_lfs:_run"
+
+[tool.setuptools.packages.find]
+include = ["git_lfs*"]
+
+[tool.setuptools.package-data]
+git_lfs = ["bin/**/*"]

git-lfs/setup.py

@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildGitLfs(build_py):
+  """Run build.sh to download git-lfs before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "git_lfs", "bin", "git-lfs")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildGitLfs}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

libjpeg/build.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="3.1.0"
+INSTALL_DIR="$DIR/libjpeg/install"
+
+# Idempotent: skip if already built
+if [ -f "$INSTALL_DIR/lib/libjpeg.a" ]; then
+  echo "libjpeg already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Clone
+if [ ! -d "libjpeg-turbo-src" ]; then
+  git clone --depth 1 --branch "${VERSION}" https://github.com/libjpeg-turbo/libjpeg-turbo.git libjpeg-turbo-src
+fi
+
+# Build
+PREFIX="$DIR/build/prefix"
+mkdir -p "$DIR/build"
+
+cmake -S libjpeg-turbo-src -B "$DIR/build" \
+  -DCMAKE_BUILD_TYPE=MinSizeRel \
+  -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=OFF \
+  -DCMAKE_INSTALL_PREFIX="$PREFIX" \
+  -DCMAKE_INSTALL_LIBDIR=lib \
+  -DCMAKE_C_FLAGS="-fPIC" \
+  -DENABLE_SHARED=OFF \
+  -DENABLE_STATIC=ON \
+  -DWITH_TURBOJPEG=OFF
+
+cmake --build "$DIR/build" -j"$NJOBS"
+cmake --install "$DIR/build"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{lib,include}
+
+# Library
+cp "$PREFIX/lib/libjpeg.a" "$INSTALL_DIR/lib/"
+
+# Headers
+cp "$PREFIX/include/jpeglib.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/jconfig.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/jerror.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/jmorecfg.h" "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf libjpeg-turbo-src "$DIR/build"
+
+echo "Installed libjpeg to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

libjpeg/libjpeg/__init__.py

@@ -0,0 +1,10 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(LIB_DIR, "libjpeg.a")), "libjpeg.a not found"
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "jpeglib.h")), "jpeglib.h not found"

libjpeg/pyproject.toml

@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "libjpeg"
+version = "3.1.0"
+description = "libjpeg-turbo JPEG library (static build)"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["libjpeg*"]
+
+[tool.setuptools.package-data]
+libjpeg = ["install/**/*"]

libjpeg/setup.py

@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildLibjpeg(build_py):
+  """Run build.sh to compile libjpeg-turbo before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "libjpeg", "install", "lib", "libjpeg.a")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildLibjpeg}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

libyuv/build.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="6067afde563c3946eebd94f146b3824ab7a97a9c"
+INSTALL_DIR="$DIR/libyuv/install"
+VERSION_FILE="$INSTALL_DIR/VERSION"
+
+# Idempotent: skip if already built at this source revision.
+if [ -f "$INSTALL_DIR/lib/libyuv.a" ] && [ -f "$VERSION_FILE" ] && [ "$(cat "$VERSION_FILE")" = "$VERSION" ]; then
+  echo "libyuv already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+if [ ! -d "libyuv-src/.git" ]; then
+  git clone https://chromium.googlesource.com/libyuv/libyuv libyuv-src
+fi
+
+git -C libyuv-src fetch --force origin
+git -C libyuv-src checkout --force "$VERSION"
+
+BUILD_DIR="$DIR/build/build"
+rm -rf "$DIR/build"
+mkdir -p "$BUILD_DIR"
+
+cmake -S "$DIR/libyuv-src" -B "$BUILD_DIR" \
+  -DCMAKE_BUILD_TYPE=MinSizeRel \
+  -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=OFF \
+  -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+  -DBUILD_SHARED_LIBS=OFF \
+  -DCMAKE_C_FLAGS="-fPIC" \
+  -DCMAKE_CXX_FLAGS="-fPIC"
+
+cmake --build "$BUILD_DIR" -j"$NJOBS"
+
+LIBYUV_STATIC="$(find "$BUILD_DIR" -name "libyuv.a" -type f | head -n 1)"
+if [ -z "$LIBYUV_STATIC" ]; then
+  echo "libyuv.a not found in build output" >&2
+  exit 1
+fi
+
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{lib,include}
+cp "$LIBYUV_STATIC" "$INSTALL_DIR/lib/libyuv.a"
+cp -r "$DIR/libyuv-src/include/." "$INSTALL_DIR/include/"
+echo "$VERSION" > "$VERSION_FILE"
+
+# Keep workspace small and deterministic across builds.
+rm -rf "$DIR/libyuv-src" "$DIR/build"
+
+echo "Installed libyuv to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

libyuv/libyuv/__init__.py

@@ -0,0 +1,11 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(LIB_DIR, "libyuv.a")), "libyuv.a not found"
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "libyuv.h")), "libyuv.h not found"
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "libyuv", "version.h")), "libyuv/version.h not found"

libyuv/pyproject.toml

@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "libyuv"
+version = "1922.0"
+description = "libyuv image processing library (static build)"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["libyuv*"]
+
+[tool.setuptools.package-data]
+libyuv = ["install/**/*"]

libyuv/setup.py

@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildLibyuv(build_py):
+  """Run build.sh to compile libyuv before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "libyuv", "install", "lib", "libyuv.a")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildLibyuv}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

ncurses/build.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="6.5"
+INSTALL_DIR="$DIR/ncurses/install"
+
+# Idempotent: skip if already built
+if [ -f "$INSTALL_DIR/lib/libncurses.a" ]; then
+  echo "ncurses already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Download
+TARBALL="ncurses-${VERSION}.tar.gz"
+if [ ! -f "$TARBALL" ]; then
+  curl -fsSL "https://ftp.gnu.org/gnu/ncurses/${TARBALL}" -o "$TARBALL"
+fi
+
+# Extract
+if [ ! -d "ncurses-${VERSION}" ]; then
+  tar xf "$TARBALL"
+fi
+
+# Build
+PREFIX="$DIR/build/prefix"
+mkdir -p "$DIR/build"
+
+cd "ncurses-${VERSION}"
+CFLAGS="-fPIC" ./configure \
+  --prefix="$PREFIX" \
+  --without-shared \
+  --with-normal \
+  --without-debug \
+  --without-cxx \
+  --without-cxx-binding \
+  --without-ada \
+  --without-manpages \
+  --without-progs \
+  --without-tests \
+  --without-dlsym \
+  --enable-overwrite
+
+make -j"$NJOBS"
+# Only install libs and headers; skip terminfo database (fails on macOS CI)
+make install.libs install.includes
+cd "$DIR"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{lib,include}
+
+# Libraries (ncurses 6.x builds wide-char by default; provide as libncurses.a)
+cp "$PREFIX/lib/libncursesw.a" "$INSTALL_DIR/lib/libncurses.a" 2>/dev/null \
+  || cp "$PREFIX/lib/libncurses.a" "$INSTALL_DIR/lib/"
+
+# Headers (--enable-overwrite puts them directly in include/)
+cp "$PREFIX/include/ncurses.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/curses.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/ncurses_dll.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/unctrl.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/term.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/termcap.h" "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf "ncurses-${VERSION}" "$TARBALL" "$DIR/build"
+
+echo "Installed ncurses to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

ncurses/ncurses/__init__.py

@@ -0,0 +1,10 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(LIB_DIR, "libncurses.a")), "libncurses.a not found"
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "ncurses.h")), "ncurses.h not found"

ncurses/pyproject.toml

@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "ncurses"
+version = "6.5"
+description = "ncurses terminal library (static build)"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["ncurses*"]
+
+[tool.setuptools.package-data]
+ncurses = ["install/**/*"]

ncurses/setup.py

@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildNcurses(build_py):
+  """Run build.sh to compile ncurses before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "ncurses", "install", "lib", "libncurses.a")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildNcurses}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

openssl3/build.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="3.4.1"
+INSTALL_DIR="$DIR/openssl3/install"
+
+# Idempotent: skip if already built
+if [ -f "$INSTALL_DIR/lib/libcrypto.a" ]; then
+  echo "openssl already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Download
+TARBALL="openssl-${VERSION}.tar.gz"
+if [ ! -d "openssl-src" ]; then
+  curl -fSL -o "$TARBALL" "https://github.com/openssl/openssl/releases/download/openssl-${VERSION}/${TARBALL}"
+  mkdir -p openssl-src
+  tar -xf "$TARBALL" -C openssl-src --strip-components=1
+  rm -f "$TARBALL"
+fi
+
+# Configure
+PREFIX="$DIR/build/prefix"
+cd openssl-src
+
+if [ "$(uname)" = "Darwin" ]; then
+  TARGET="darwin64-arm64-cc"
+else
+  MACHINE="$(uname -m)"
+  if [ "$MACHINE" = "x86_64" ]; then
+    TARGET="linux-x86_64"
+  elif [ "$MACHINE" = "aarch64" ]; then
+    TARGET="linux-aarch64"
+  else
+    TARGET="linux-${MACHINE}"
+  fi
+fi
+
+./Configure "$TARGET" \
+  --prefix="$PREFIX" \
+  --libdir=lib \
+  no-shared \
+  no-tests \
+  no-docs \
+  no-apps \
+  -fPIC \
+  -Os
+
+# Build
+make -j"$NJOBS"
+make install_sw
+
+cd "$DIR"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{lib,include}
+
+# Libraries
+cp "$PREFIX/lib/libcrypto.a" "$INSTALL_DIR/lib/"
+cp "$PREFIX/lib/libssl.a" "$INSTALL_DIR/lib/"
+
+# Headers
+cp -r "$PREFIX/include/openssl" "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf openssl-src "$DIR/build"
+
+echo "Installed openssl to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

openssl3/openssl3/__init__.py

@@ -0,0 +1,11 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(LIB_DIR, "libcrypto.a")), "libcrypto.a not found"
+  assert os.path.isfile(os.path.join(LIB_DIR, "libssl.a")), "libssl.a not found"
+  assert os.path.isdir(os.path.join(INCLUDE_DIR, "openssl")), "openssl headers not found"

openssl3/pyproject.toml

@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "openssl3"
+version = "3.4.1"
+description = "OpenSSL cryptography library (static build)"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["openssl3*"]
+
+[tool.setuptools.package-data]
+openssl3 = ["install/**/*"]

openssl3/setup.py

@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildOpenssl(build_py):
+  """Run build.sh to compile OpenSSL before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "openssl3", "install", "lib", "libcrypto.a")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildOpenssl}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

pyproject.toml

@@ -0,0 +1,17 @@
+[tool.uv.workspace]
+members = [
+  "bzip2",
+  "capnproto",
+  "cppcheck",
+  "eigen",
+  "ffmpeg",
+  "gcc-arm-none-eabi",
+  "git-lfs",
+  "libjpeg",
+  "libyuv",
+  "ncurses",
+  "openssl3",
+  "python3-dev",
+  "zeromq",
+  "zstd",
+]

python3-dev/build.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="3.12.8"
+INSTALL_DIR="$DIR/python3_dev/install"
+
+# Idempotent: skip if already present
+if [ -f "$INSTALL_DIR/include/Python.h" ]; then
+  echo "python3-dev headers already present, skipping."
+  exit 0
+fi
+
+TARBALL="Python-${VERSION}.tgz"
+URL="https://www.python.org/ftp/python/${VERSION}/${TARBALL}"
+
+echo "Downloading CPython ${VERSION} source ..."
+curl -fSL -o "$TARBALL" "$URL"
+
+echo "Extracting ..."
+tar xzf "$TARBALL"
+
+cd "Python-${VERSION}"
+
+# Run configure to generate pyconfig.h for this platform
+echo "Running configure to generate pyconfig.h ..."
+./configure --disable-shared --without-ensurepip > /dev/null 2>&1
+
+cd "$DIR"
+
+# Copy headers
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR/include"
+
+cp -r "Python-${VERSION}/Include/"* "$INSTALL_DIR/include/"
+cp "Python-${VERSION}/pyconfig.h" "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf "Python-${VERSION}" "$TARBALL"
+
+echo "Installed python3-dev headers to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

python3-dev/pyproject.toml

@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "python3-dev"
+version = "3.12.8"
+description = "CPython development headers"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["python3_dev*"]
+
+[tool.setuptools.package-data]
+python3_dev = ["install/**/*"]

python3-dev/python3_dev/__init__.py

@@ -0,0 +1,9 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "Python.h")), "Python.h not found"
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "pyconfig.h")), "pyconfig.h not found"

python3-dev/setup.py

@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildPython3Dev(build_py):
+  """Run build.sh to download CPython headers before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "python3_dev", "install", "include", "Python.h")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildPython3Dev}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

release.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$ROOT_DIR"
+
+REPO=commaai/dependencies
+
+echo
+echo "Publishing wheels to GitHub Releases ($REPO)"
+
+shopt -s nullglob
+for toml in */pyproject.toml; do
+  pkg="$(dirname "$toml")"
+  module="${pkg//-/_}"
+  version="$(python3 -c "import tomllib; print(tomllib.load(open('$toml', 'rb'))['project']['version'])")"
+  tag="${pkg}/v${version}"
+
+  wheels=("dist/${module}-${version}-"*.whl)
+  if [[ ${#wheels[@]} -eq 0 ]]; then
+    echo "missing wheel for $pkg ($module-$version) in dist" >&2
+    exit 1
+  fi
+
+  echo "[$pkg] Uploading ${#wheels[@]} wheel(s) to $tag"
+
+  gh release create "$tag" "${wheels[@]}" --repo "$REPO" --title "$pkg v$version" --notes "Platform wheels for $pkg $version" 2>/dev/null ||
+    gh release upload "$tag" "${wheels[@]}" --repo "$REPO" --clobber
+done
+shopt -u nullglob
+
+TOKEN="$(gh auth token 2>/dev/null)" || { echo "set GH_TOKEN to publish shim branch" >&2; exit 1; }
+
+TMP_DIR="$(mktemp -d)"
+python3 - "$TMP_DIR" "$REPO" <<'PY'
+import json
+import pathlib
+import shutil
+import tomllib
+import sys
+
+tmp_dir = pathlib.Path(sys.argv[1])
+repo = sys.argv[2]
+repo_url = f"https://github.com/{repo}"
+shim_setup = pathlib.Path("_shim_setup.py")
+
+for toml in sorted(pathlib.Path(".").glob("*/pyproject.toml")):
+  pkg = toml.parent.name
+  module = pkg.replace("-", "_")
+  data = tomllib.load(toml.open("rb"))
+  version = str(data["project"]["version"])
+  tag = f"{pkg}/v{version}"
+  description = data["project"]["description"]
+  patterns = data.get("tool", {}).get("setuptools", {}).get("package-data", {}).get(module, [""])
+  datadir = patterns[0].split("/", 1)[0] if patterns and patterns[0] else ""
+  scripts = data.get("project", {}).get("scripts", {}) or {}
+
+  pkg_dir = tmp_dir / pkg
+  mod_dir = pkg_dir / module
+  mod_dir.mkdir(parents=True, exist_ok=True)
+  shutil.copy2(pathlib.Path(pkg) / module / "__init__.py", mod_dir / "__init__.py")
+  shutil.copy2(shim_setup, pkg_dir / "setup.py")
+
+  lines = [
+    "[build-system]",
+    'requires = ["setuptools>=64", "wheel", \'tomli; python_version < \"3.11\"\']',
+    'build-backend = "setuptools.build_meta"',
+    "",
+    "[project]",
+    f'name = "{pkg}"',
+    f'version = "{version}"',
+    f"description = {json.dumps(description + ' (pre-built)')}",
+    'requires-python = ">=3.8"',
+  ]
+
+  if scripts:
+    lines += ["", "[project.scripts]"]
+    for name, target in scripts.items():
+      lines.append(f'"{name}" = {json.dumps(target)}')
+
+  lines += [
+    "",
+    "[tool.setuptools.packages.find]",
+    f'include = ["{module}*"]',
+    "",
+    "[tool.setuptools.package-data]",
+    f'{module} = ["{datadir}/**/*"]',
+    "",
+    "[tool.shim]",
+    f'repo_url = "{repo_url}"',
+    f'tag = "{tag}"',
+    f'datadir = "{datadir}"',
+  ]
+
+  (pkg_dir / "pyproject.toml").write_text("\n".join(lines) + "\n")
+PY
+
+(
+  cd "$TMP_DIR"
+  git init
+  git checkout -b releases
+  git add .
+  git -c user.name="github-actions[bot]" -c user.email="github-actions[bot]@users.noreply.github.com" commit -m "update shim packages"
+  git remote add origin "https://x-access-token:${TOKEN}@github.com/${REPO}.git"
+  git push -f origin releases
+)
+
+rm -rf "$TMP_DIR"

setup.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# sets up build-time dependencies (NOT runtime dependencies)
+
+run_as_root() {
+  if [ "$(id -u)" -eq 0 ]; then
+    "$@"
+  elif command -v sudo &>/dev/null; then
+    sudo "$@"
+  else
+    echo "error: root privileges required for: $*" >&2
+    exit 1
+  fi
+}
+
+if [ "$(uname)" = "Darwin" ]; then
+  brew install nasm pkg-config
+elif command -v dnf &>/dev/null; then
+  dnf install -y nasm cmake gcc-c++ pkgconfig git perl-IPC-Cmd
+elif command -v apt-get &>/dev/null; then
+  run_as_root apt-get update
+  run_as_root apt-get install -y nasm cmake g++ pkg-config curl
+fi
+
+if ! command -v uv &>/dev/null; then
+  command -v curl &>/dev/null || {
+    echo "error: curl is required to install uv" >&2
+    exit 1
+  }
+  UV_BIN_DIR="$HOME/.local/bin"
+  mkdir -p "$UV_BIN_DIR"
+  curl -LsSf https://astral.sh/uv/install.sh | env UV_UNMANAGED_INSTALL="$UV_BIN_DIR" sh
+  export PATH="$UV_BIN_DIR:$PATH"
+  command -v uv &>/dev/null || {
+    echo "error: failed to install uv" >&2
+    exit 1
+  }
+fi

test.sh

@@ -1,60 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
-
-# Create a temporary virtualenv
-VENV_DIR="$(mktemp -d)"
-trap 'rm -rf "$VENV_DIR"' EXIT
-python3 -m venv "$VENV_DIR"
-source "$VENV_DIR/bin/activate"
-pip install --upgrade pip >/dev/null
-
-# Auto-discover packages: any subdirectory containing a pyproject.toml
-PACKAGES=()
-for toml in "$REPO_DIR"/*/pyproject.toml; do
-  [ -f "$toml" ] || continue
-  PACKAGES+=("$(dirname "$toml")")
-done
-
-if [ ${#PACKAGES[@]} -eq 0 ]; then
-  echo "No packages found."
-  exit 1
-fi
-
-FAILED=()
-
-for pkg in "${PACKAGES[@]}"; do
-  name="$(basename "$pkg")"
-  echo "========================================="
-  echo "Testing: $name"
-  echo "========================================="
-
-  # Install from git URL with subdirectory (simulates real-world usage)
-  echo "[$name] pip install ..."
-  pip install "$pkg" --verbose
-
-  # Verify import works
-  module="${name//-/_}"
-  echo "[$name] Verifying import of $module ..."
-  python -c "import $module; print(f'{$module.__name__} OK')"
-
-  echo "[$name] PASSED"
-  echo
-done
-
-if [ ${#FAILED[@]} -ne 0 ]; then
-  echo "FAILED packages: ${FAILED[*]}"
-  exit 1
-fi
-
-echo "All ${#PACKAGES[@]} package(s) passed."
-echo
-echo "Installed sizes:"
-for pkg in "${PACKAGES[@]}"; do
-  name="$(basename "$pkg")"
-  module="${name//-/_}"
-  mod_dir="$(python -c "import $module, os; print(os.path.dirname($module.__file__))")"
-  size="$(du -sh "$mod_dir" | cut -f1)"
-  echo "  $name: $size"
-done

test_wheels_in_image.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# a small script for testing our built wheels in a variety of linux distros
+
+IMAGE="${1:?usage: ./test_wheels_in_image.sh <image>}"
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$ROOT_DIR"
+
+# setup our deps - should only need a python3 build
+docker build -t wheeltest -f - . <<DOCKERFILE
+FROM $IMAGE
+RUN if command -v apk >/dev/null; then \
+      apk add --no-cache python3 py3-pip bash; \
+    elif command -v apt-get >/dev/null; then \
+      apt-get update && apt-get install -y --no-install-recommends python3 python3-pip python3-venv; \
+    elif command -v dnf >/dev/null; then \
+      dnf install -y python3 python3-pip; \
+    elif command -v pacman >/dev/null; then \
+      pacman -Sy --noconfirm python python-pip; \
+    elif command -v zypper >/dev/null; then \
+      zypper install -y python3 python3-pip; \
+    elif command -v xbps-install >/dev/null; then \
+      xbps-install -Sy python3 python3-pip bash; \
+    fi
+DOCKERFILE
+
+# install + smoketest
+docker run --rm -v "$PWD:/work" -w /work wheeltest bash -lc '
+  set -euo pipefail
+  python3 -m venv /tmp/venv
+  source /tmp/venv/bin/activate
+  pip install dist/*.whl
+  for toml in */pyproject.toml; do
+    module="$(basename "$(dirname "$toml")" | tr "-" "_")"
+    python -c "import $module; $module.smoketest()" && echo "$module: OK"
+  done
+'
+
+echo
+echo "All good!"

zeromq/build.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="4.3.5"
+INSTALL_DIR="$DIR/zeromq/install"
+
+# Idempotent: skip if already built
+if [ -f "$INSTALL_DIR/lib/libzmq.a" ]; then
+  echo "zeromq already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Clone
+if [ ! -d "libzmq-src" ]; then
+  git clone --depth 1 --branch "v${VERSION}" https://github.com/zeromq/libzmq.git libzmq-src
+fi
+
+# Build
+PREFIX="$DIR/build/prefix"
+mkdir -p "$DIR/build"
+
+cmake -S libzmq-src -B "$DIR/build" \
+  -DCMAKE_BUILD_TYPE=MinSizeRel \
+  -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=ON \
+  -DCMAKE_INSTALL_PREFIX="$PREFIX" \
+  -DCMAKE_INSTALL_LIBDIR=lib \
+  -DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
+  -DCMAKE_C_FLAGS="-fPIC" \
+  -DCMAKE_CXX_FLAGS="-fPIC" \
+  -DWITH_LIBSODIUM=OFF \
+  -DWITH_TLS=OFF \
+  -DWITH_DOCS=OFF \
+  -DBUILD_TESTS=OFF \
+  -DBUILD_SHARED=OFF \
+  -DBUILD_STATIC=ON \
+  -DENABLE_DRAFTS=OFF
+
+cmake --build "$DIR/build" -j"$NJOBS"
+cmake --install "$DIR/build"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{lib,include}
+
+# Library
+cp "$PREFIX/lib/libzmq.a" "$INSTALL_DIR/lib/"
+
+# Headers
+cp "$PREFIX/include/zmq.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/zmq_utils.h" "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf libzmq-src "$DIR/build"
+
+echo "Installed zeromq to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

zeromq/pyproject.toml

@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "zeromq"
+version = "4.3.5"
+description = "ZeroMQ messaging library (static build)"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["zeromq*"]
+
+[tool.setuptools.package-data]
+zeromq = ["install/**/*"]

zeromq/setup.py

@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildZeromq(build_py):
+  """Run build.sh to compile zeromq before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "zeromq", "install", "lib", "libzmq.a")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildZeromq}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

zeromq/zeromq/__init__.py

@@ -0,0 +1,10 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(LIB_DIR, "libzmq.a")), "libzmq.a not found"
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "zmq.h")), "zmq.h not found"

zstd/build.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="1.5.6"
+INSTALL_DIR="$DIR/zstd/install"
+
+# Idempotent: skip if already built
+if [ -f "$INSTALL_DIR/lib/libzstd.a" ]; then
+  echo "zstd already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Clone
+if [ ! -d "zstd-src" ]; then
+  git clone --depth 1 --branch "v${VERSION}" https://github.com/facebook/zstd.git zstd-src
+fi
+
+# Build
+PREFIX="$DIR/build/prefix"
+mkdir -p "$DIR/build"
+
+cmake -S zstd-src/build/cmake -B "$DIR/build" \
+  -DCMAKE_BUILD_TYPE=MinSizeRel \
+  -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=OFF \
+  -DCMAKE_INSTALL_PREFIX="$PREFIX" \
+  -DCMAKE_INSTALL_LIBDIR=lib \
+  -DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
+  -DCMAKE_C_FLAGS="-fPIC" \
+  -DZSTD_BUILD_PROGRAMS=OFF \
+  -DZSTD_BUILD_TESTS=OFF \
+  -DZSTD_BUILD_CONTRIB=OFF \
+  -DZSTD_BUILD_SHARED=OFF \
+  -DZSTD_BUILD_STATIC=ON
+
+cmake --build "$DIR/build" -j"$NJOBS"
+cmake --install "$DIR/build"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{lib,include}
+
+# Library
+cp "$PREFIX/lib/libzstd.a" "$INSTALL_DIR/lib/"
+
+# Headers
+cp "$PREFIX/include/zstd.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/zstd_errors.h" "$INSTALL_DIR/include/"
+cp "$PREFIX/include/zdict.h" "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf zstd-src "$DIR/build"
+
+echo "Installed zstd to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

zstd/pyproject.toml

@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "zstd"
+version = "1.5.6"
+description = "Zstandard compression library (static build)"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["zstd*"]
+
+[tool.setuptools.package-data]
+zstd = ["install/**/*"]

zstd/setup.py

@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildZstd(build_py):
+  """Run build.sh to compile zstd before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "zstd", "install", "lib", "libzstd.a")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildZstd}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

zstd/zstd/__init__.py

@@ -0,0 +1,10 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(LIB_DIR, "libzstd.a")), "libzstd.a not found"
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "zstd.h")), "zstd.h not found"