xvfb: probe host DRI paths so GLX is advertised on non-EL distros (#78)

Xvfb's bundled libGLdispatch is hardcoded to look for DRI drivers under
/usr/lib64/dri (the AlmaLinux 8 layout). On Debian/Ubuntu they live in
/usr/lib/x86_64-linux-gnu/dri, so the GL provider fails to load and the
server brings up without the GLX extension — which silently breaks any
GLX client (raylib/GLFW). Set LIBGL_DRIVERS_PATH from the wrapper to a
list of standard distro paths so the host's swrast driver is found.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -27,3 +27,12 @@ gcc-arm-none-eabi/gcc_arm_none_eabi/toolchain/
 
 # downloaded git-lfs
 git-lfs/git_lfs/bin/
+
+# downloaded mdbook
+mdbook/mdbook/bin/
+
+# vendored at build time
+acados/acados/acados_template/
+acados/casadi/
+acados/casadi-venv/
+acados/casadi-wheel/

README.md

@@ -42,9 +42,9 @@ contributions welcome for other platforms!
 
 ```python
 dependencies = [
-  # use the releases branch for pre-built wheels
-  "capnproto @ git+https://github.com/commaai/dependencies.git@releases#subdirectory=capnproto",
-  "ffmpeg @ git+https://github.com/commaai/dependencies.git@releases#subdirectory=ffmpeg",
+  # use per-package release branches for pre-built wheels
+  "capnproto @ git+https://github.com/commaai/dependencies.git@release-capnproto#subdirectory=capnproto",
+  "ffmpeg @ git+https://github.com/commaai/dependencies.git@release-ffmpeg#subdirectory=ffmpeg",
 
   # use the master branch to build the package on pip install
   "capnproto @ git+https://github.com/commaai/dependencies.git@master#subdirectory=capnproto",
@@ -58,4 +58,4 @@ to add a new package:
 * start a new top-level directory as a new package
 * `./test.sh` tests the building of all packages
 *  on pushes to `master`, wheels are built for our target platforms and pushed to a GitHub release
-*  the `releases` branch contains shim packages that allow pointing to a git branch and always getting the appropriate wheel for your platform
+*  each `release-<package>` branch contains a single shim package, so old lockfiles keep resolving even as new packages are added

_shim_setup.py

@@ -25,6 +25,17 @@ DATADIR = _cfg["tool"]["shim"]["datadir"]
 VERSION = _cfg["project"]["version"]
 MODULE = _cfg["project"]["name"].replace("-", "_")
 
+# all top-level packages bundled in this wheel (e.g. acados + casadi).
+# `packages` may be a flat list or a dict with find.include patterns.
+_pkgs = _cfg.get("tool", {}).get("setuptools", {}).get("packages", [f"{MODULE}*"])
+if isinstance(_pkgs, list):
+  _INCLUDE = _pkgs
+elif isinstance(_pkgs, dict):
+  _INCLUDE = _pkgs.get("find", {}).get("include", [f"{MODULE}*"])
+else:
+  _INCLUDE = [f"{MODULE}*"]
+TOP_PACKAGES = sorted({p.rstrip("*").rstrip("/") for p in _INCLUDE if p.rstrip("*").rstrip("/")})
+
 PLATFORM_MAP = {
   ("Linux", "x86_64"): "linux_x86_64",
   ("Linux", "aarch64"): "linux_aarch64",
@@ -43,59 +54,52 @@ class InstallPrebuilt(build_py):
       if plat is None:
         raise RuntimeError(f"unsupported platform: {key}")
 
-      whl_name = f"{MODULE}-{VERSION}-py3-none-{plat}.whl"
-      url = f"{REPO_URL}/releases/download/{TAG}/{whl_name}"
+      whl_names = [
+        f"{MODULE}-{VERSION}-py3-none-{plat}.whl",
+        f"{MODULE}-{VERSION}-py3-none-any.whl",
+      ]
 
-      print(f"Downloading {url} ...")
-      for attempt in range(3):
-        try:
-          raw = urlopen(url, timeout=60).read()
+      raw = None
+      for whl_name in whl_names:
+        url = f"{REPO_URL}/releases/download/{TAG}/{whl_name}"
+        print(f"Downloading {url} ...")
+        for attempt in range(3):
+          try:
+            raw = urlopen(url, timeout=60).read()
+            break
+          except (URLError, OSError) as e:
+            if attempt == 2:
+              if whl_name == whl_names[-1]:
+                raise
+              break
+            wait = 2 ** attempt
+            print(f"Download failed ({e}), retrying in {wait}s ...")
+            time.sleep(wait)
+        if raw is not None:
           break
-        except (URLError, OSError) as e:
-          if attempt == 2:
-            raise
-          wait = 2 ** attempt
-          print(f"Download failed ({e}), retrying in {wait}s ...")
-          time.sleep(wait)
 
-      print(f"Extracting {DATADIR} ...")
+      print("Extracting wheel ...")
       with zipfile.ZipFile(BytesIO(raw)) as zf:
-        prefix = f"{MODULE}/{DATADIR}/"
-        alt_prefix = f"{MODULE}-{VERSION}.data/purelib/{MODULE}/{DATADIR}/"
+        purelib_data = f"{MODULE}-{VERSION}.data/purelib/"
         for info in zf.infolist():
-          for p in (prefix, alt_prefix):
-            if info.filename.startswith(p):
-              rel = info.filename[len(p):]
-              if not rel:
-                continue
-              dest = os.path.join(data_dir, rel)
-              if info.is_dir():
-                os.makedirs(dest, exist_ok=True)
-              else:
-                os.makedirs(os.path.dirname(dest), exist_ok=True)
-                with open(dest, "wb") as f:
-                  f.write(zf.read(info))
-                if info.external_attr >> 16 & 0o111:
-                  os.chmod(dest, 0o755)
-              break
-
-        # Also extract compiled extension modules (.so)
-        ext_prefix = f"{MODULE}/"
-        ext_alt_prefix = f"{MODULE}-{VERSION}.data/purelib/{MODULE}/"
-        for info in zf.infolist():
-          if not info.filename.endswith('.so'):
+          if info.is_dir():
             continue
-          for p in (ext_prefix, ext_alt_prefix):
-            if info.filename.startswith(p):
-              rel = info.filename[len(p):]
-              if rel and '/' not in rel:
-                dest = os.path.join(module_dir, rel)
-                os.makedirs(os.path.dirname(dest), exist_ok=True)
-                with open(dest, "wb") as f:
-                  f.write(zf.read(info))
-                if info.external_attr >> 16 & 0o111:
-                  os.chmod(dest, 0o755)
-              break
+          name = info.filename
+          if name.startswith(purelib_data):
+            rel = name[len(purelib_data):]
+          else:
+            rel = name
+          if "/" not in rel:
+            continue
+          top = rel.split("/", 1)[0]
+          if top not in TOP_PACKAGES:
+            continue
+          dest = os.path.join(_HERE, rel)
+          os.makedirs(os.path.dirname(dest), exist_ok=True)
+          with open(dest, "wb") as f:
+            f.write(zf.read(info))
+          if info.external_attr >> 16 & 0o111:
+            os.chmod(dest, 0o755)
 
     super().run()
 

acados/acados/__init__.py

@@ -0,0 +1,48 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+INCLUDE_DIR = os.path.join(DIR, "include")
+LIB_DIR = os.path.join(DIR, "lib")
+BIN_DIR = os.path.join(DIR, "bin")
+TERA_PATH = os.path.join(BIN_DIR, "t_renderer")
+
+TEMPLATE_DIR = os.path.join(os.path.dirname(__file__), "acados_template")
+
+
+def smoketest():
+  import sys
+
+  lib_ext = ".dylib" if sys.platform == "darwin" else ".so"
+  for lib in ("libacados", "libblasfeo", "libhpipm", "libqpOASES_e"):
+    path = os.path.join(LIB_DIR, lib + lib_ext)
+    assert os.path.isfile(path), f"missing lib: {path}"
+
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "acados_c", "ocp_nlp_interface.h"))
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "blasfeo", "include", "blasfeo.h"))
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "hpipm", "include", "hpipm_common.h"))
+
+  assert os.path.isfile(TERA_PATH) and os.access(TERA_PATH, os.X_OK), f"t_renderer missing/not executable: {TERA_PATH}"
+
+  assert os.path.isfile(os.path.join(TEMPLATE_DIR, "__init__.py"))
+  assert os.path.isfile(os.path.join(TEMPLATE_DIR, "acados_layout.json"))
+  assert os.path.isdir(os.path.join(TEMPLATE_DIR, "c_templates_tera"))
+
+  # the vendored slim casadi shipped in this wheel is built against cpython 3.12
+  # and pulls in numpy; only exercise it when both are available (real consumers
+  # like openpilot install via the shim, which declares numpy as a dep).
+  try:
+    import numpy  # noqa: F401
+  except ImportError:
+    return
+  if sys.version_info[:2] != (3, 12):
+    return
+
+  from casadi import SX, MX, DM, Function, CasadiMeta, vertcat, jacobian, sin, cos, n_nodes  # noqa: F401
+
+  x = SX.sym("x")
+  y = SX.sym("y")
+  expr = vertcat(sin(x), cos(y))
+  J = jacobian(expr, vertcat(x, y))
+  assert J.shape == (2, 2)
+  assert n_nodes(J) > 0
+  assert isinstance(CasadiMeta.version(), str)

acados/build.sh

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+# v0.2.2
+VERSION="8af9b0ad180940ef611884574a0b27a43504311d"
+INSTALL_DIR="$DIR/acados/install"
+TEMPLATE_DIR="$DIR/acados/acados_template"
+CASADI_DIR="$DIR/casadi"
+CASADI_VERSION="3.6.7"
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# pick BLAS target per host arch
+ARCH="$(uname -m)"
+if [[ "$OSTYPE" == "darwin"* ]]; then
+  # this BLASFEO version doesn't have an Apple Silicon target; Cortex-A57
+  # baseline ARMv8 SIMD compiles and runs fine on M1+.
+  BLAS_TARGET="ARMV8A_ARM_CORTEX_A57"
+elif [[ "$ARCH" == "aarch64" ]]; then
+  # Cortex-A57 = TICI baseline; safe for any modern aarch64
+  BLAS_TARGET="ARMV8A_ARM_CORTEX_A57"
+else
+  BLAS_TARGET="X64_AUTOMATIC"
+fi
+
+ACADOS_FLAGS=(
+  -DACADOS_WITH_QPOASES=ON
+  -UBLASFEO_TARGET
+  -DBLASFEO_TARGET="$BLAS_TARGET"
+  -DACADOS_INSTALL_DIR="$INSTALL_DIR"
+  # acados (and several of its submodules) still pin cmake_minimum_required <3.5;
+  # CMake 4 removed that compatibility, so re-enable it here.
+  -DCMAKE_POLICY_VERSION_MINIMUM=3.5
+  # qpOASES + blasfeo both call malloc()/posix_memalign() without including
+  # <stdlib.h>. C99/C2x and modern gcc/clang reject implicit declarations as
+  # errors. qpOASES also has a real Constraints*/Constraints** pointer bug
+  # that gcc 14+ now flags as an error too. Downgrade both so the upstream
+  # (pinned) sources keep compiling.
+  "-DCMAKE_C_FLAGS=-Wno-implicit-function-declaration -Wno-incompatible-pointer-types"
+)
+if [[ "$OSTYPE" == "darwin"* ]]; then
+  ACADOS_FLAGS+=(
+    -DCMAKE_OSX_ARCHITECTURES=arm64
+    -DCMAKE_MACOSX_RPATH=1
+  )
+fi
+
+# clone/update source
+if [ ! -d "acados-src/.git" ]; then
+  rm -rf acados-src
+  git clone https://github.com/acados/acados.git acados-src
+fi
+git -C acados-src fetch --all --tags
+git -C acados-src checkout --force "$VERSION"
+git -C acados-src submodule update --init --recursive --depth=1
+
+# build acados
+mkdir -p build
+cd build
+cmake "${ACADOS_FLAGS[@]}" "$DIR/acados-src"
+make -j"$NJOBS" install
+cd "$DIR"
+
+# we don't ship sample json templates
+rm -f "$INSTALL_DIR"/lib/*.json
+
+# python interface package (acados_template)
+rm -rf "$TEMPLATE_DIR"
+cp -r acados-src/interfaces/acados_template/acados_template "$TEMPLATE_DIR"
+
+# strip future_fstrings (avoids needing the compatibility package on py>=3.6).
+# Cython chokes on the unknown encoding in .pyx/.pxd too, not just .py.
+find "$TEMPLATE_DIR" -type f \( -name '*.py' -o -name '*.pyx' -o -name '*.pxd' \) \
+  -exec sed -i.bak '/future.fstrings/d' {} +
+find "$TEMPLATE_DIR" -name '*.bak' -delete
+
+# acados_template's gnsf/check_reformulation.py uses an absolute `from
+# acados_template.utils import ...` that only worked when acados_template was
+# itself a top-level package on the path. We ship it as `acados.acados_template`,
+# so rewrite to the relative form the rest of gnsf already uses.
+if [ -f "$TEMPLATE_DIR/gnsf/check_reformulation.py" ]; then
+  sed -i.bak 's/^from acados_template\.utils /from ..utils /' "$TEMPLATE_DIR/gnsf/check_reformulation.py"
+  rm -f "$TEMPLATE_DIR/gnsf/check_reformulation.py.bak"
+fi
+
+# build tera renderer (needs cargo)
+if ! command -v cargo >/dev/null 2>&1; then
+  echo "installing rust toolchain (needed for tera_renderer)..."
+  curl -LsSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
+  # shellcheck disable=SC1091
+  source "$HOME/.cargo/env"
+fi
+
+mkdir -p "$INSTALL_DIR/bin"
+cd "$DIR/acados-src/interfaces/acados_template/tera_renderer/"
+if [[ "$OSTYPE" == "darwin"* ]]; then
+  cargo build --release --target aarch64-apple-darwin
+  cp target/aarch64-apple-darwin/release/t_renderer "$INSTALL_DIR/bin/t_renderer"
+else
+  cargo build --release
+  cp target/release/t_renderer "$INSTALL_DIR/bin/t_renderer"
+fi
+
+cd "$DIR"
+
+# vendor a slim casadi: install the upstream wheel into a throwaway cp312 venv
+# (uv resolves the right platform wheel automatically), then move the casadi/
+# tree out and slim it.
+echo "vendoring casadi $CASADI_VERSION ..."
+rm -rf "$CASADI_DIR" casadi-venv
+uv venv --python 3.12 --quiet casadi-venv
+uv pip install --python casadi-venv/bin/python --no-deps --quiet "casadi==$CASADI_VERSION"
+mv casadi-venv/lib/python3.12/site-packages/casadi "$CASADI_DIR"
+rm -rf casadi-venv
+
+# drop everything except the bits openpilot actually needs:
+#   - __init__.py, casadi.py, tools/  (Python wrapper)
+#   - _casadi.so                       (CPython extension; same name on linux+darwin)
+#   - libcasadi.{so,dylib}*            (the C++ runtime that _casadi.so links to)
+# openpilot only uses symbolic SX/MX/Function/jacobian etc., which live in
+# libcasadi + _casadi. Solver plugins (conic_*, nlpsol_*, integrator_*, ...)
+# and their third-party backends (ipopt, bonmin, hpipm, fatrop, ...) are
+# loaded lazily via dlopen and never reached.
+cd "$CASADI_DIR"
+shopt -s extglob
+# libc++.*.dylib only exists on darwin and is needed by _casadi.so via @rpath
+rm -rf !(__init__.py|casadi.py|_casadi.so|tools|libcasadi.*|libc++.*)
+shopt -u extglob
+
+cd "$DIR"
+rm -rf casadi-wheel
+
+echo "Installed acados to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"
+echo "Vendored casadi (slim) at $CASADI_DIR"
+du -sh "$CASADI_DIR"

acados/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "acados"
+version = "0.2.2"
+description = "acados solvers + Python interface, with a slimmed casadi vendored alongside"
+requires-python = ">=3.8"
+dependencies = [
+  # the vendored casadi.py shim imports numpy at module load time
+  "numpy",
+]
+
+# `find` runs at setup() init time, before build.sh creates these dirs, so
+# enumerate packages explicitly. acados.acados_template + casadi.tools are
+# subpackages and ship via package-data.
+[tool.setuptools]
+packages = ["acados", "casadi"]
+
+[tool.setuptools.package-data]
+acados = ["install/**/*", "acados_template/**/*"]
+casadi = ["**/*"]

acados/setup.py

@@ -0,0 +1,68 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+# `casadi/` is generated by build.sh (vendored from the upstream wheel), but
+# setuptools requires every declared package to have a directory + __init__.py
+# *before* any command runs. Drop a stub if it isn't there yet — build.sh
+# replaces it with the real slim casadi during build_py.
+_HERE = os.path.dirname(os.path.abspath(__file__))
+_casadi_init = os.path.join(_HERE, "casadi", "__init__.py")
+if not os.path.exists(_casadi_init):
+  os.makedirs(os.path.dirname(_casadi_init), exist_ok=True)
+  open(_casadi_init, "w").close()
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildAcados(build_py):
+  """Run build.sh to compile acados before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    build_script = os.path.join(pkg_dir, "build.sh")
+    subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildAcados}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

catch2/build.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="v2.13.10"
+INSTALL_DIR="$DIR/catch2/install"
+
+if [ ! -d "catch2-src/.git" ]; then
+  rm -rf catch2-src
+  git clone --depth 1 https://github.com/catchorg/Catch2.git catch2-src
+fi
+git -C catch2-src fetch --depth 1 origin "$VERSION"
+git -C catch2-src checkout --force FETCH_HEAD
+
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR/include"
+cp -r catch2-src/single_include/catch2 "$INSTALL_DIR/include/"
+
+echo "Installed catch2 to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

catch2/catch2/__init__.py

@@ -0,0 +1,9 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+INCLUDE_DIR = os.path.join(DIR, "include")
+LIB_DIR = DIR  # header-only; no libraries
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(INCLUDE_DIR, "catch2", "catch.hpp")), "catch2/catch.hpp not found"

catch2/pyproject.toml

@@ -3,13 +3,14 @@ requires = ["setuptools>=64", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [project]
-name = "qt5"
-version = "5.15.18"
-description = "Qt 5.15 (QtBase + QtCharts)"
+name = "catch2"
+version = "2.13.10"
+description = "Catch2 C++ test framework headers"
 requires-python = ">=3.8"
 
 [tool.setuptools.packages.find]
-include = ["qt5*"]
+include = ["catch2*"]
+exclude = ["catch2-src*"]
 
 [tool.setuptools.package-data]
-qt5 = ["install/**/*"]
+catch2 = ["install/**/*"]

catch2/setup.py

@@ -0,0 +1,28 @@
+import os
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+
+class BuildCatch2(build_py):
+  """Run build.sh to download Catch2 headers before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    build_script = os.path.join(pkg_dir, "build.sh")
+    subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildCatch2}
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

ffmpeg/build.sh

@@ -4,9 +4,12 @@ set -e
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
 cd "$DIR"
 
+PLATFORM="$(uname -s)"
 FFMPEG_VERSION="7.1"
 ZLIB_VERSION="da607da739fa6047df13e66a2af6b8bec7c2a498"  # v1.3.2
 X264_BRANCH="stable"
+LIBDRM_VERSION="libdrm-2.4.124"
+LIBVA_VERSION="2.22.0"
 INSTALL_DIR="$DIR/ffmpeg/install"
 
 NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
@@ -48,6 +51,59 @@ make -j"$NJOBS"
 make install
 cd "$DIR"
 
+# --- Build nv-codec-headers (Linux only, for CUDA/NVDEC) ---
+if [ "$PLATFORM" = "Linux" ]; then
+  if [ ! -d "nv-codec-headers-src/.git" ]; then
+    rm -rf nv-codec-headers-src
+    git clone --depth 1 https://git.videolan.org/git/ffmpeg/nv-codec-headers.git nv-codec-headers-src
+  fi
+  make -C nv-codec-headers-src PREFIX="$PREFIX" install
+fi
+
+# --- Build Vulkan-Headers from source (Linux only, need >= 1.3.277 for FFmpeg 7.1) ---
+if [ "$PLATFORM" = "Linux" ]; then
+  if [ ! -d "vulkan-headers-src/.git" ]; then
+    rm -rf vulkan-headers-src
+    git clone --depth 1 https://github.com/KhronosGroup/Vulkan-Headers.git vulkan-headers-src
+  fi
+  cmake -S vulkan-headers-src -B vulkan-headers-src/build -DCMAKE_INSTALL_PREFIX="$PREFIX" >/dev/null
+  cmake --install vulkan-headers-src/build >/dev/null
+fi
+
+# --- Build libdrm + libva statically (Linux only, for VAAPI without runtime deps) ---
+if [ "$PLATFORM" = "Linux" ]; then
+  if ! command -v meson &>/dev/null; then
+    pip3 install --quiet meson ninja 2>/dev/null || python3 -m pip install --quiet meson ninja 2>/dev/null || true
+    command -v meson &>/dev/null || { echo "error: meson is required (apt install meson or pip install meson)" >&2; exit 1; }
+  fi
+
+  if [ ! -d "libdrm-src/.git" ]; then
+    rm -rf libdrm-src
+    git clone --depth 1 --branch "$LIBDRM_VERSION" https://gitlab.freedesktop.org/mesa/drm.git libdrm-src
+  fi
+  rm -rf libdrm-src/builddir
+  meson setup libdrm-src/builddir libdrm-src \
+    --prefix="$PREFIX" --libdir=lib --default-library=static \
+    -Dintel=disabled -Dradeon=disabled -Damdgpu=disabled -Dnouveau=disabled \
+    -Dvmwgfx=disabled -Dtests=false -Dman-pages=disabled -Dcairo-tests=disabled \
+    -Dvalgrind=disabled
+  ninja -C libdrm-src/builddir install
+
+  if [ ! -d "libva-src/.git" ]; then
+    rm -rf libva-src
+    git clone --depth 1 --branch "$LIBVA_VERSION" https://github.com/intel/libva.git libva-src
+  fi
+  rm -rf libva-src/builddir
+  # libva hardcodes shared_library(); patch to library() so --default-library=static works
+  sed -i 's/shared_library(/library(/g' libva-src/va/meson.build
+  PKG_CONFIG_PATH="$PREFIX/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}" \
+  meson setup libva-src/builddir libva-src \
+    --prefix="$PREFIX" --libdir=lib --default-library=static \
+    -Ddisable_drm=false -Dwith_x11=no -Dwith_glx=no -Dwith_wayland=no \
+    -Dwith_win32=no -Denable_docs=false
+  ninja -C libva-src/builddir install
+fi
+
 # --- Build FFmpeg ---
 if [ ! -d "ffmpeg-src/.git" ]; then
   rm -rf ffmpeg-src
@@ -57,6 +113,39 @@ git -C ffmpeg-src fetch --depth 1 origin "n${FFMPEG_VERSION}"
 git -C ffmpeg-src checkout --force FETCH_HEAD
 
 cd ffmpeg-src
+
+# Platform-specific hardware acceleration flags
+HW_FLAGS=()
+if [ "$PLATFORM" = "Linux" ]; then
+  HW_FLAGS+=(
+    # NVIDIA CUDA/NVDEC (uses dlopen at runtime)
+    --enable-ffnvcodec --enable-cuda --enable-cuvid --enable-nvdec
+    --enable-hwaccel=h264_nvdec,hevc_nvdec
+    --enable-decoder=h264_cuvid,hevc_cuvid
+
+    # VAAPI (Intel/AMD — libva linked statically, driver loaded via dlopen at runtime)
+    --enable-vaapi
+    --enable-hwaccel=h264_vaapi,hevc_vaapi
+
+    # V4L2 Memory-to-Memory (embedded: RPi, Qualcomm, Rockchip)
+    --enable-v4l2-m2m
+    --enable-decoder=h264_v4l2m2m,hevc_v4l2m2m
+    --enable-encoder=h264_v4l2m2m,hevc_v4l2m2m
+
+    # Vulkan video decode/encode (uses dlopen at runtime)
+    --enable-vulkan
+    --enable-hwaccel=h264_vulkan,hevc_vulkan
+    --enable-encoder=h264_vulkan,hevc_vulkan
+  )
+elif [ "$PLATFORM" = "Darwin" ]; then
+  HW_FLAGS+=(
+    # VideoToolbox (Apple Silicon / macOS)
+    --enable-videotoolbox
+    --enable-hwaccel=h264_videotoolbox,hevc_videotoolbox
+    --enable-encoder=h264_videotoolbox,hevc_videotoolbox
+  )
+fi
+
 PKG_CONFIG_PATH="$PREFIX/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}" \
 ./configure \
   --cc="${CC:-cc}" \
@@ -70,6 +159,7 @@ PKG_CONFIG_PATH="$PREFIX/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}" \
   --disable-doc \
   --disable-ffplay \
   --disable-autodetect \
+  --disable-x86asm \
   --disable-everything \
   --enable-encoder=libx264,aac,ffvhuff,rawvideo,png,mjpeg \
   --enable-decoder=h264,hevc,ffvhuff,aac,rawvideo,png,mjpeg,mp3,pcm_s16le \
@@ -80,7 +170,8 @@ PKG_CONFIG_PATH="$PREFIX/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}" \
   --enable-filter=blend,vflip,format,scale,aformat,anull,aresample,null \
   --enable-bsf=extract_extradata,h264_mp4toannexb,hevc_mp4toannexb \
   --extra-cflags="-I$PREFIX/include" \
-  --extra-ldflags="-L$PREFIX/lib"
+  --extra-ldflags="-L$PREFIX/lib" \
+  "${HW_FLAGS[@]}"
 make -j"$NJOBS"
 make install
 cd "$DIR"
@@ -94,7 +185,11 @@ cp "$PREFIX/bin/ffmpeg" "$INSTALL_DIR/bin/"
 cp "$PREFIX/bin/ffprobe" "$INSTALL_DIR/bin/"
 
 # Libraries
-for lib in libavformat.a libavcodec.a libavutil.a libswresample.a libx264.a libz.a; do
+LIBS="libavformat.a libavcodec.a libavutil.a libswresample.a libx264.a libz.a"
+if [ "$PLATFORM" = "Linux" ]; then
+  LIBS="$LIBS libva.a libva-drm.a libdrm.a"
+fi
+for lib in $LIBS; do
   cp "$PREFIX/lib/$lib" "$INSTALL_DIR/lib/"
 done
 

git/build.sh

@@ -0,0 +1,189 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="2.47.1"
+OPENSSL_VERSION="openssl-3.4.1"
+CURL_VERSION="curl-8_12_1"
+ZLIB_VERSION="v1.3.1"
+INSTALL_DIR="$DIR/git/install"
+VERSION_FILE="$INSTALL_DIR/.version"
+
+# Skip if already at correct version
+if [ -f "$VERSION_FILE" ] && [ "$(cat "$VERSION_FILE")" = "$VERSION" ]; then
+  echo "git $VERSION already present, skipping."
+  exit 0
+fi
+
+PLATFORM="$(uname -s)"
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+PREFIX="$DIR/build/prefix"
+mkdir -p "$DIR/build"
+
+# --- Build zlib (static) ---
+if [ ! -d "zlib-src/.git" ]; then
+  rm -rf zlib-src
+  git clone --depth 1 https://github.com/madler/zlib.git zlib-src
+fi
+git -C zlib-src fetch --depth 1 origin "$ZLIB_VERSION"
+git -C zlib-src checkout --force FETCH_HEAD
+
+cd zlib-src
+./configure --prefix="$PREFIX" --static
+make -j"$NJOBS"
+make install
+cd "$DIR"
+
+# --- Build OpenSSL (static) ---
+if [ ! -d "openssl-src/.git" ]; then
+  rm -rf openssl-src
+  git clone --depth 1 https://github.com/openssl/openssl.git openssl-src
+fi
+git -C openssl-src fetch --depth 1 origin "$OPENSSL_VERSION"
+git -C openssl-src checkout --force FETCH_HEAD
+
+cd openssl-src
+./Configure \
+  --prefix="$PREFIX" \
+  --libdir=lib \
+  no-shared \
+  no-tests \
+  no-docs
+make -j"$NJOBS"
+make install_sw
+cd "$DIR"
+
+# --- Build curl (static, with openssl+zlib) ---
+if [ ! -d "curl-src/.git" ]; then
+  rm -rf curl-src
+  git clone --depth 1 https://github.com/curl/curl.git curl-src
+fi
+git -C curl-src fetch --depth 1 origin "$CURL_VERSION"
+git -C curl-src checkout --force FETCH_HEAD
+
+cd curl-src
+autoreconf -fi
+PKG_CONFIG_PATH="$PREFIX/lib/pkgconfig" \
+./configure \
+  --prefix="$PREFIX" \
+  --with-openssl="$PREFIX" \
+  --with-zlib="$PREFIX" \
+  --disable-shared \
+  --enable-static \
+  --disable-ldap \
+  --disable-rtsp \
+  --disable-dict \
+  --disable-telnet \
+  --disable-tftp \
+  --disable-pop3 \
+  --disable-imap \
+  --disable-smb \
+  --disable-smtp \
+  --disable-gopher \
+  --disable-mqtt \
+  --disable-manual \
+  --disable-docs \
+  --without-libpsl \
+  --without-brotli \
+  --without-zstd \
+  --without-libidn2 \
+  --without-nghttp2 \
+  --without-librtmp
+make -j"$NJOBS"
+make install
+cd "$DIR"
+
+# --- Build git (with static curl+openssl+zlib) ---
+if [ ! -d "git-src/.git" ]; then
+  rm -rf git-src
+  git clone --depth 1 https://github.com/git/git.git git-src
+fi
+git -C git-src fetch --depth 1 origin "v${VERSION}"
+git -C git-src checkout --force FETCH_HEAD
+
+# Gather static link flags for curl and openssl dependencies
+# CURL_LIBCURL: used by git-remote-http, git-http-fetch, git-http-push
+# LIB_4_CRYPTO: used by git-imap-send and other direct openssl consumers
+# Both need transitive deps (-ldl, -lpthread) since we link statically
+CRYPTO_DEPS="-lpthread"
+CURL_EXTRA=""
+if [ "$PLATFORM" = "Linux" ]; then
+  CRYPTO_DEPS="$CRYPTO_DEPS -ldl"
+elif [ "$PLATFORM" = "Darwin" ]; then
+  CURL_EXTRA="-framework SystemConfiguration -framework Security -framework CoreFoundation"
+fi
+
+cd git-src
+make prefix="$PREFIX" \
+  RUNTIME_PREFIX=YesPlease \
+  NO_GETTEXT=YesPlease \
+  NO_TCLTK=YesPlease \
+  NO_PERL=YesPlease \
+  NO_PYTHON=YesPlease \
+  NO_EXPAT=YesPlease \
+  INSTALL_SYMLINKS=1 \
+  CURLDIR="$PREFIX" \
+  CURL_LIBCURL="-L$PREFIX/lib -lcurl -lssl -lcrypto -lz $CRYPTO_DEPS $CURL_EXTRA" \
+  OPENSSL_LIBSSL="-L$PREFIX/lib -lssl" \
+  LIB_4_CRYPTO="-lcrypto $CRYPTO_DEPS" \
+  ZLIB_PATH="$PREFIX" \
+  -j"$NJOBS" \
+  all
+make prefix="$PREFIX" \
+  RUNTIME_PREFIX=YesPlease \
+  NO_GETTEXT=YesPlease \
+  NO_TCLTK=YesPlease \
+  NO_PERL=YesPlease \
+  NO_PYTHON=YesPlease \
+  NO_EXPAT=YesPlease \
+  INSTALL_SYMLINKS=1 \
+  CURLDIR="$PREFIX" \
+  CURL_LIBCURL="-L$PREFIX/lib -lcurl -lssl -lcrypto -lz $CRYPTO_DEPS $CURL_EXTRA" \
+  OPENSSL_LIBSSL="-L$PREFIX/lib -lssl" \
+  LIB_4_CRYPTO="-lcrypto $CRYPTO_DEPS" \
+  ZLIB_PATH="$PREFIX" \
+  install
+cd "$DIR"
+
+# Assemble the package install directory
+# Only copy real files from libexec to avoid bloating the wheel with
+# copies of the main git binary (builtin commands are symlinks to git)
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR/bin" "$INSTALL_DIR/libexec/git-core"
+
+# Main binary
+cp "$PREFIX/bin/git" "$INSTALL_DIR/bin/"
+
+# libexec/git-core: copy real files, resolve non-git symlinks, skip git symlinks
+cd "$PREFIX/libexec/git-core"
+for f in *; do
+  if [ -L "$f" ]; then
+    target="$(readlink "$f")"
+    # Skip symlinks to the main git binary (these are builtins)
+    case "$target" in
+      git|../../bin/git) continue ;;
+    esac
+    # Resolve other symlinks (e.g., git-remote-https -> git-remote-http)
+    cp -L "$f" "$INSTALL_DIR/libexec/git-core/$f"
+  elif [ -f "$f" ]; then
+    cp "$f" "$INSTALL_DIR/libexec/git-core/$f"
+  fi
+done
+cd "$DIR"
+
+# Copy git binary into libexec for builtin resolution
+cp "$PREFIX/bin/git" "$INSTALL_DIR/libexec/git-core/git"
+
+# Templates
+cp -r "$PREFIX/share" "$INSTALL_DIR/"
+
+# Strip binaries
+strip "$INSTALL_DIR/bin/git" "$INSTALL_DIR/libexec/git-core/git" 2>/dev/null || true
+find "$INSTALL_DIR/libexec/git-core" -maxdepth 1 -type f -perm /111 ! -name "*.sh" -exec strip {} \; 2>/dev/null || true
+
+echo "$VERSION" > "$VERSION_FILE"
+
+echo "Installed git to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

git/git/__init__.py

@@ -0,0 +1,17 @@
+import os
+import sys
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+BIN_DIR = os.path.join(DIR, "bin")
+
+
+def _run():
+  binary = os.path.join(BIN_DIR, "git")
+  os.execvp(binary, [binary] + sys.argv[1:])
+
+
+def smoketest():
+  import subprocess
+  binary = os.path.join(BIN_DIR, "git")
+  subprocess.run([binary, "--version"], check=True)
+  subprocess.run([binary, "ls-remote", "https://github.com/commaai/openpilot.git", "HEAD"], check=True)

git/pyproject.toml

@@ -0,0 +1,18 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "git"
+version = "2.47.1"
+description = "Git distributed version control system"
+requires-python = ">=3.8"
+
+[project.scripts]
+git = "git:_run"
+
+[tool.setuptools.packages.find]
+include = ["git*"]
+
+[tool.setuptools.package-data]
+git = ["install/**/*"]

git/setup.py

@@ -10,8 +10,8 @@ except ImportError:
   bdist_wheel = None
 
 
-class BuildQt5(build_py):
-  """Run build.sh to compile Qt5 before collecting package data."""
+class BuildGit(build_py):
+  """Run build.sh to build git before collecting package data."""
 
   def run(self):
     pkg_dir = os.path.dirname(os.path.abspath(__file__))
@@ -21,7 +21,7 @@ class BuildQt5(build_py):
     super().run()
 
 
-cmdclass = {"build_py": BuildQt5}
+cmdclass = {"build_py": BuildGit}
 
 if bdist_wheel is not None:
 

imgui/build.sh

@@ -11,8 +11,7 @@ NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
 IMGUI_COMMIT="934c6a5f5ef2355d6df25395d555cb71f790c4e9"
 # ImPlot
 IMPLOT_COMMIT="93c801b4bb801c5c11031d880b6af1d1f70bd79d"
-# rlImGui
-RLIMGUI_COMMIT="286e11acd6c785004c9550c7ed3762add2ae3d47"
+
 # GLFW 3.4
 GLFW_COMMIT="7b6aead9fb88b3623e3b3725ebb42670cbe4c579"
 
@@ -32,14 +31,6 @@ fi
 git -C implot-src fetch --depth 1 origin "$IMPLOT_COMMIT"
 git -C implot-src checkout --force "$IMPLOT_COMMIT"
 
-# Clone/update rlimgui
-if [ ! -d "rlimgui-src/.git" ]; then
-  rm -rf rlimgui-src
-  git clone --depth 1 https://github.com/raylib-extras/rlImGui.git rlimgui-src
-fi
-git -C rlimgui-src fetch --depth 1 origin "$RLIMGUI_COMMIT"
-git -C rlimgui-src checkout --force "$RLIMGUI_COMMIT"
-
 # Clone/update GLFW
 if [ ! -d "glfw-src/.git" ]; then
   rm -rf glfw-src
@@ -73,37 +64,61 @@ cmake -B glfw-src/build -S glfw-src \
   -DGLFW_BUILD_DOCS=OFF
 cmake --build glfw-src/build --parallel "$NJOBS"
 
-# Install
+# Install headers
 rm -rf "$INSTALL_DIR"
-mkdir -p "$INSTALL_DIR/include/extras" "$INSTALL_DIR/src" "$INSTALL_DIR/lib"
+mkdir -p "$INSTALL_DIR/include" "$INSTALL_DIR/lib"
 
-# imgui
+# imgui headers
 cp imgui-src/imgui.h imgui-src/imgui_internal.h imgui-src/imconfig.h \
    imgui-src/imstb_rectpack.h imgui-src/imstb_textedit.h imgui-src/imstb_truetype.h \
    "$INSTALL_DIR/include/"
-cp imgui-src/imgui.cpp imgui-src/imgui_draw.cpp imgui-src/imgui_tables.cpp \
-   imgui-src/imgui_widgets.cpp imgui-src/imgui_demo.cpp \
-   "$INSTALL_DIR/src/"
 cp imgui-src/backends/imgui_impl_opengl3.h imgui-src/backends/imgui_impl_opengl3_loader.h \
    imgui-src/backends/imgui_impl_glfw.h \
    "$INSTALL_DIR/include/"
-cp imgui-src/backends/imgui_impl_opengl3.cpp imgui-src/backends/imgui_impl_glfw.cpp \
-   "$INSTALL_DIR/src/"
 
-# implot
+# implot headers
 cp implot-src/implot.h implot-src/implot_internal.h "$INSTALL_DIR/include/"
-cp implot-src/implot.cpp implot-src/implot_items.cpp "$INSTALL_DIR/src/"
-
-# rlimgui
-cp rlimgui-src/rlImGui.h rlimgui-src/rlImGuiColors.h rlimgui-src/imgui_impl_raylib.h \
-   "$INSTALL_DIR/include/"
-cp rlimgui-src/extras/FA6FreeSolidFontData.h rlimgui-src/extras/IconsFontAwesome6.h \
-   "$INSTALL_DIR/include/extras/"
-cp rlimgui-src/rlImGui.cpp "$INSTALL_DIR/src/"
 
 # glfw
 cp glfw-src/build/src/libglfw3.a "$INSTALL_DIR/lib/"
 cp -r glfw-src/include/GLFW "$INSTALL_DIR/include/"
 
+# Build libimgui.a (imgui core + backends + implot)
+IMGUI_SRCS=(
+  imgui-src/imgui.cpp
+  imgui-src/imgui_draw.cpp
+  imgui-src/imgui_tables.cpp
+  imgui-src/imgui_widgets.cpp
+  imgui-src/imgui_demo.cpp
+  imgui-src/backends/imgui_impl_opengl3.cpp
+  imgui-src/backends/imgui_impl_glfw.cpp
+  implot-src/implot.cpp
+  implot-src/implot_items.cpp
+)
+OBJ_DIR="$(mktemp -d)"
+for src in "${IMGUI_SRCS[@]}"; do
+  obj="$OBJ_DIR/$(basename "${src%.cpp}.o")"
+  c++ -c -O2 -fPIC -I"$INSTALL_DIR/include" "$src" -o "$obj" &
+done
+wait
+ar rcs "$INSTALL_DIR/lib/libimgui.a" "$OBJ_DIR"/*.o
+rm -rf "$OBJ_DIR"
+
+# Bundle GLVND dispatchers so Linux users don't need system libGL
+if [[ "$(uname)" == "Linux" ]]; then
+  MESA_DIR="$INSTALL_DIR/lib/mesa"
+  mkdir -p "$MESA_DIR"
+  ldconfig 2>/dev/null || true
+  for lib in libGL.so.1 libGLX.so.0 libEGL.so.1 libOpenGL.so.0 libGLdispatch.so.0; do
+    src="$(ldconfig -p 2>/dev/null | grep -F "$lib" | awk '{print $NF}' | head -1)"
+    if [ -n "$src" ] && [ -f "$src" ]; then
+      cp -L "$src" "$MESA_DIR/"
+      # Create unversioned symlink for the linker
+      base="${lib%%.so.*}"
+      ln -sf "$lib" "$MESA_DIR/${base}.so"
+    fi
+  done
+fi
+
 echo "Installed imgui to $INSTALL_DIR"
 du -sh "$INSTALL_DIR"

imgui/imgui/__init__.py

@@ -1,13 +1,16 @@
 import os
+import platform as _platform
 
 DIR = os.path.join(os.path.dirname(__file__), "install")
 INCLUDE_DIR = os.path.join(DIR, "include")
-SRC_DIR = os.path.join(DIR, "src")
 LIB_DIR = os.path.join(DIR, "lib")
+MESA_DIR = os.path.join(DIR, "lib", "mesa")
 
 
 def smoketest():
   assert os.path.isfile(os.path.join(INCLUDE_DIR, "imgui.h")), "imgui.h not found"
-  assert os.path.isfile(os.path.join(SRC_DIR, "imgui.cpp")), "imgui.cpp not found"
+  assert os.path.isfile(os.path.join(LIB_DIR, "libimgui.a")), "libimgui.a not found"
   assert os.path.isfile(os.path.join(LIB_DIR, "libglfw3.a")), "libglfw3.a not found"
   assert os.path.isfile(os.path.join(INCLUDE_DIR, "GLFW", "glfw3.h")), "GLFW/glfw3.h not found"
+  if _platform.system() == "Linux":
+    assert os.path.isfile(os.path.join(MESA_DIR, "libGL.so.1")), "libGL.so.1 not found"

imgui/pyproject.toml

@@ -5,11 +5,11 @@ build-backend = "setuptools.build_meta"
 [project]
 name = "imgui"
 version = "1.92.7"
-description = "Dear ImGui + ImPlot + rlImGui + GLFW 3.4 (static)"
+description = "Dear ImGui + ImPlot + GLFW 3.4 (static)"
 requires-python = ">=3.8"
 
-[tool.setuptools.packages.find]
-include = ["imgui*"]
+[tool.setuptools]
+packages = ["imgui"]
 
 [tool.setuptools.package-data]
 imgui = ["install/**/*"]

pyproject.toml

@@ -1,11 +1,14 @@
 [tool.uv.workspace]
 members = [
+  "acados",
   "bzip2",
   "capnproto",
+  "catch2",
   "cppcheck",
   "eigen",
   "ffmpeg",
   "gcc-arm-none-eabi",
+  "git",
   "git-lfs",
   "imgui",
   "json11",
@@ -16,6 +19,7 @@ members = [
   "ncurses",
   "qt5",
   "raylib",
+  "xvfb",
   "zeromq",
   "zstd",
 ]

qt5/build.sh

@@ -1,159 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
-cd "$DIR"
-
-QT_VERSION="5.15.18"
-QT_TAG="v${QT_VERSION}-lts-lgpl"
-INSTALL_DIR="$DIR/qt5/install"
-NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
-
-# Install build dependencies
-if [[ "$(uname)" == "Linux" ]]; then
-  if command -v dnf &>/dev/null; then
-    dnf install -y \
-      mesa-libGL-devel \
-      fontconfig-devel \
-      freetype-devel \
-      libxcb-devel \
-      xcb-util-devel \
-      xcb-util-image-devel \
-      xcb-util-keysyms-devel \
-      xcb-util-renderutil-devel \
-      xcb-util-wm-devel \
-      libxkbcommon-devel \
-      libxkbcommon-x11-devel \
-      libX11-devel \
-      perl-IPC-Cmd
-  elif command -v apt-get &>/dev/null; then
-    if [ "$(id -u)" -eq 0 ]; then
-      apt-get update && apt-get install -y \
-        libgl-dev \
-        libfontconfig1-dev libfreetype-dev \
-        libxcb1-dev libxcb-glx0-dev libxcb-keysyms1-dev \
-        libxcb-image0-dev libxcb-shm0-dev libxcb-icccm4-dev \
-        libxcb-sync-dev libxcb-xfixes0-dev libxcb-shape0-dev \
-        libxcb-randr0-dev libxcb-render-util0-dev \
-        libxcb-xinerama0-dev libxcb-xkb-dev \
-        libxkbcommon-dev libxkbcommon-x11-dev \
-        libx11-xcb-dev
-    else
-      sudo apt-get update && sudo apt-get install -y \
-        libgl-dev \
-        libfontconfig1-dev libfreetype-dev \
-        libxcb1-dev libxcb-glx0-dev libxcb-keysyms1-dev \
-        libxcb-image0-dev libxcb-shm0-dev libxcb-icccm4-dev \
-        libxcb-sync-dev libxcb-xfixes0-dev libxcb-shape0-dev \
-        libxcb-randr0-dev libxcb-render-util0-dev \
-        libxcb-xinerama0-dev libxcb-xkb-dev \
-        libxkbcommon-dev libxkbcommon-x11-dev \
-        libx11-xcb-dev
-    fi
-  fi
-fi
-
-# Clone/update qtbase
-if [ ! -d "qtbase-src/.git" ]; then
-  rm -rf qtbase-src
-  git clone --depth 1 https://code.qt.io/qt/qtbase.git qtbase-src
-fi
-git -C qtbase-src fetch --depth 1 origin "$QT_TAG"
-git -C qtbase-src checkout --force FETCH_HEAD
-
-# Clean install dir and build artifacts to avoid stale cache issues
-rm -rf "$INSTALL_DIR"
-
-# Build qtbase (disable modules cabana doesn't need)
-cd qtbase-src
-make distclean 2>/dev/null || true
-./configure \
-  -release \
-  -prefix "$INSTALL_DIR" \
-  -opensource -confirm-license \
-  -nomake examples \
-  -nomake tests \
-  -no-dbus \
-  -no-icu \
-  -opengl desktop
-make -j"$NJOBS"
-make install
-cd "$DIR"
-
-# Clone/update qtcharts
-if [ ! -d "qtcharts-src/.git" ]; then
-  rm -rf qtcharts-src
-  git clone --depth 1 https://code.qt.io/qt/qtcharts.git qtcharts-src
-fi
-git -C qtcharts-src fetch --depth 1 origin "$QT_TAG"
-git -C qtcharts-src checkout --force FETCH_HEAD
-
-# Build qtcharts
-cd qtcharts-src
-make distclean 2>/dev/null || true
-"$INSTALL_DIR/bin/qmake"
-make -j"$NJOBS"
-make install
-cd "$DIR"
-
-# Cleanup (don't let individual failures kill the build)
-set +e
-rm -rf "$INSTALL_DIR/doc" "$INSTALL_DIR/mkspecs" "$INSTALL_DIR/lib/cmake" "$INSTALL_DIR/lib/pkgconfig"
-find "$INSTALL_DIR/lib" -name '*.prl' -delete 2>/dev/null || true
-find "$INSTALL_DIR/lib" -name '*.la' -delete 2>/dev/null || true
-
-# Remove unnecessary binaries (qmake alone is 28MB, only needed for qtcharts build above)
-find "$INSTALL_DIR/bin" -not -name moc -not -name rcc -not -name uic -not -type d -delete 2>/dev/null || true
-
-if [[ "$(uname)" == "Linux" ]]; then
-  # Remove unnecessary shared libs (keep only what cabana links)
-  KEEP_LIBS="Qt5Core Qt5Gui Qt5Widgets Qt5Charts Qt5OpenGL Qt5XcbQpa Qt5EglFSDeviceIntegration Qt5EglFsKmsSupport"
-  for f in "$INSTALL_DIR/lib/"lib*.so; do
-    name="${f##*/lib}"; name="${name%.so}"
-    echo "$KEEP_LIBS" | grep -qw "$name" || rm -f "$INSTALL_DIR/lib/lib${name}".so*
-  done
-
-  # Remove unnecessary include dirs
-  KEEP_INCLUDES="QtCore QtGui QtWidgets QtCharts QtOpenGL"
-  for d in "$INSTALL_DIR/include/"*/; do
-    name="$(basename "$d")"
-    echo "$KEEP_INCLUDES" | grep -qw "$name" || rm -rf "$d"
-  done
-
-  # Remove static libs
-  find "$INSTALL_DIR/lib" -maxdepth 1 -name '*.a' -delete
-
-  # Replace symlinks with copies (wheels can't store symlinks)
-  find "$INSTALL_DIR" -type l | while read -r link; do
-    target="$(readlink -f "$link")"
-    if [ -f "$target" ]; then
-      rm "$link"; cp "$target" "$link"
-    elif [ -d "$target" ]; then
-      rm "$link"; cp -r "$target" "$link"
-    fi
-  done
-
-  # Deduplicate versioned .so: keep only .so and .so.5 (SONAME)
-  find "$INSTALL_DIR/lib" -maxdepth 1 -name 'lib*.so.5.15.18' -delete
-  find "$INSTALL_DIR/lib" -maxdepth 1 -name 'lib*.so.5.15' -delete
-
-  # Strip
-  find "$INSTALL_DIR" -type f \( -name '*.so*' -o -path '*/bin/*' \) -exec strip --strip-unneeded {} + 2>/dev/null || true
-else
-  # macOS: replace symlinks, strip frameworks
-  find "$INSTALL_DIR" -type l | while read -r link; do
-    target="$(readlink -f "$link")"
-    if [ -f "$target" ]; then
-      rm "$link"; cp "$target" "$link"
-    elif [ -d "$target" ]; then
-      rm "$link"; cp -r "$target" "$link"
-    fi
-  done
-  find "$INSTALL_DIR" -type f -name '*.dylib' -exec strip -x {} + 2>/dev/null || true
-  find "$INSTALL_DIR/bin" -type f -exec strip -x {} + 2>/dev/null || true
-  find "$INSTALL_DIR/lib" -maxdepth 1 -name '*.a' -delete 2>/dev/null || true
-fi
-
-set -e
-echo "Installed Qt5 to $INSTALL_DIR"
-du -sh "$INSTALL_DIR"

qt5/qt5/__init__.py

@@ -1,19 +0,0 @@
-import os
-
-DIR = os.path.join(os.path.dirname(__file__), "install")
-BIN_DIR = os.path.join(DIR, "bin")
-LIB_DIR = os.path.join(DIR, "lib")
-INCLUDE_DIR = os.path.join(DIR, "include")
-
-
-def smoketest():
-  assert os.path.isfile(os.path.join(BIN_DIR, "moc")), "moc not found"
-  assert os.path.isfile(os.path.join(BIN_DIR, "rcc")), "rcc not found"
-  import glob
-  import platform
-  if platform.system() == "Darwin":
-    assert os.path.isdir(os.path.join(LIB_DIR, "QtCore.framework")), "QtCore.framework not found"
-    assert os.path.isdir(os.path.join(LIB_DIR, "QtCharts.framework")), "QtCharts.framework not found"
-  else:
-    assert glob.glob(os.path.join(LIB_DIR, "libQt5Core.so*")), "libQt5Core.so not found"
-    assert glob.glob(os.path.join(LIB_DIR, "libQt5Charts.so*")), "libQt5Charts.so not found"

release.sh

@@ -29,7 +29,7 @@ for toml in */pyproject.toml; do
 done
 shopt -u nullglob
 
-TOKEN="$(gh auth token 2>/dev/null)" || { echo "set GH_TOKEN to publish shim branch" >&2; exit 1; }
+TOKEN="$(gh auth token 2>/dev/null)" || { echo "set GH_TOKEN to publish shim branches" >&2; exit 1; }
 
 TMP_DIR="$(mktemp -d)"
 python3 - "$TMP_DIR" "$REPO" <<'PY'
@@ -55,7 +55,8 @@ for toml in sorted(pathlib.Path(".").glob("*/pyproject.toml")):
   datadir = patterns[0].split("/", 1)[0] if patterns and patterns[0] else ""
   scripts = data.get("project", {}).get("scripts", {}) or {}
 
-  pkg_dir = tmp_dir / pkg
+  repo_dir = tmp_dir / pkg
+  pkg_dir = repo_dir / pkg
   mod_dir = pkg_dir / module
   mod_dir.mkdir(parents=True, exist_ok=True)
 
@@ -64,17 +65,37 @@ for toml in sorted(pathlib.Path(".").glob("*/pyproject.toml")):
   for py_file in src_mod.glob("*.py"):
     shutil.copy2(py_file, mod_dir / py_file.name)
 
-  # copy extra packages (e.g. pyray for raylib)
-  include_patterns = data.get("tool", {}).get("setuptools", {}).get("packages", {}).get("find", {}).get("include", [])
+  # copy extra packages (e.g. pyray for raylib, slim casadi for acados)
+  # binaries (.so/.dylib) are fetched from the wheel at install time, so the
+  # shim repo only carries Python sources to keep it small
+  def _ignore_binaries(_dir, names):
+    return [n for n in names if n.endswith((".so", ".dylib", ".a")) or ".so." in n or n == "__pycache__"]
+
+  # `packages` is either a flat list (["acados", "casadi"]) or a dict with
+  # `find.include` patterns (["acados*", "casadi*"]) — handle both
+  pkgs_val = data.get("tool", {}).get("setuptools", {}).get("packages", [])
+  if isinstance(pkgs_val, list):
+    include_patterns = list(pkgs_val)
+  elif isinstance(pkgs_val, dict):
+    include_patterns = pkgs_val.get("find", {}).get("include", [])
+  else:
+    include_patterns = []
   extra_packages = []
   for pattern in include_patterns:
     p = pattern.rstrip("*")
     if p and p != module and p != f"{module}/":
       src_extra = pathlib.Path(pkg) / p
+      dst_extra = pkg_dir / p
       if src_extra.is_dir():
-        dst_extra = pkg_dir / p
-        shutil.copytree(src_extra, dst_extra, dirs_exist_ok=True)
-        extra_packages.append(pattern)
+        shutil.copytree(src_extra, dst_extra, dirs_exist_ok=True, ignore=_ignore_binaries)
+      else:
+        # source not in the workspace (typically built lazily by build.sh and
+        # not cached into the publish job). Drop a placeholder __init__.py so
+        # setuptools.packages.find picks it up; the shim's setup.py overwrites
+        # it from the wheel at install time.
+        dst_extra.mkdir(parents=True, exist_ok=True)
+        (dst_extra / "__init__.py").write_text("")
+      extra_packages.append(pattern)
 
   shutil.copy2(shim_setup, pkg_dir / "setup.py")
 
@@ -100,14 +121,28 @@ for toml in sorted(pathlib.Path(".").glob("*/pyproject.toml")):
     for name, target in scripts.items():
       lines.append(f'"{name}" = {json.dumps(target)}')
 
-  find_include = [f"{module}*"] + extra_packages
+  # propagate the workspace's package-data so the shim wheel knows to ship
+  # everything the upstream wheel ships (e.g. acados_template/, casadi/*.so).
+  workspace_pkgdata = data.get("tool", {}).get("setuptools", {}).get("package-data", {})
+
+  # extra_packages may be plain names (["casadi"]) or globs (["casadi*"]).
+  # Normalise to plain package names for both `packages` and `package-data`.
+  extra_pkg_names = [p.rstrip("*").rstrip("/") for p in extra_packages]
+
   lines += [
     "",
-    "[tool.setuptools.packages.find]",
-    f"include = {json.dumps(find_include)}",
+    "[tool.setuptools]",
+    f"packages = {json.dumps([module] + extra_pkg_names)}",
     "",
     "[tool.setuptools.package-data]",
-    f'{module} = ["{datadir}/**/*", "*.so"]',
+  ]
+  module_data = sorted(set(workspace_pkgdata.get(module, [f"{datadir}/**/*"]) + ["*.so"]))
+  lines.append(f"{module} = {json.dumps(module_data)}")
+  for name in extra_pkg_names:
+    extra_data = workspace_pkgdata.get(name, ["**/*"])
+    lines.append(f"{name} = {json.dumps(list(extra_data))}")
+
+  lines += [
     "",
     "[tool.shim]",
     f'repo_url = "{repo_url}"',
@@ -118,14 +153,25 @@ for toml in sorted(pathlib.Path(".").glob("*/pyproject.toml")):
   (pkg_dir / "pyproject.toml").write_text("\n".join(lines) + "\n")
 PY
 
-(
-  cd "$TMP_DIR"
-  git init
-  git checkout -b releases
-  git add .
-  git -c user.name="github-actions[bot]" -c user.email="github-actions[bot]@users.noreply.github.com" commit -m "update shim packages"
-  git remote add origin "https://x-access-token:${TOKEN}@github.com/${REPO}.git"
-  git push -f origin releases
-)
+shopt -s nullglob
+for repo_dir in "$TMP_DIR"/*; do
+  [[ -d "$repo_dir" ]] || continue
+
+  pkg="$(basename "$repo_dir")"
+  branch="release-$pkg"
+
+  echo "[$pkg] Publishing shim branch $branch"
+
+  (
+    cd "$repo_dir"
+    git init
+    git checkout -b "$branch"
+    git add "$pkg"
+    git -c user.name="github-actions[bot]" -c user.email="github-actions[bot]@users.noreply.github.com" commit -m "update $pkg shim"
+    git remote add origin "https://x-access-token:${TOKEN}@github.com/${REPO}.git"
+    git push -f origin "$branch"
+  )
+done
+shopt -u nullglob
 
 rm -rf "$TMP_DIR"

setup.sh

@@ -15,12 +15,12 @@ run_as_root() {
 }
 
 if [ "$(uname)" = "Darwin" ]; then
-  brew install nasm pkg-config ccache
+  brew install nasm pkg-config ccache autoconf automake libtool
 elif command -v dnf &>/dev/null; then
-  dnf install -y nasm cmake gcc-c++ pkgconfig git perl-IPC-Cmd ccache
+  dnf install -y nasm cmake gcc-c++ pkgconfig git perl-IPC-Cmd ccache autoconf automake libtool
 elif command -v apt-get &>/dev/null; then
   run_as_root apt-get update
-  run_as_root apt-get install -y nasm cmake g++ pkg-config curl ccache
+  run_as_root apt-get install -y nasm cmake g++ pkg-config curl ccache autoconf automake libtool
 fi
 
 if ! command -v uv &>/dev/null; then

xvfb/build.sh

@@ -0,0 +1,133 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+INSTALL_DIR="$DIR/xvfb/install"
+
+# macOS: Xvfb is Linux-only. Ship an empty install dir so the wheel still
+# builds; smoketest() is a no-op on Darwin.
+if [[ "$OSTYPE" == "darwin"* ]]; then
+  rm -rf "$INSTALL_DIR"
+  mkdir -p "$INSTALL_DIR"/{bin,lib,share/X11/xkb}
+  echo "xvfb: macOS not supported, shipping empty install dir"
+  exit 0
+fi
+
+# Linux: bundle the Xvfb binary, xkbcomp, xkb keymap data, and the closure
+# of shared libraries it needs (minus libc/libpthread/etc which the host
+# always provides). For CI/manylinux we pull from AlmaLinux 8 so the wheel
+# works on any glibc >= 2.28 distro; on a Debian/Ubuntu dev host we accept
+# whatever the system has (the local wheel just won't be as portable).
+if command -v dnf >/dev/null 2>&1; then
+  dnf install -y -q xorg-x11-server-Xvfb xorg-x11-xkb-utils xkeyboard-config >/dev/null
+elif command -v apt-get >/dev/null 2>&1; then
+  if [[ "$(id -u)" -eq 0 ]]; then SUDO=""
+  elif command -v sudo >/dev/null 2>&1; then SUDO=sudo
+  else echo "xvfb: need sudo or root to apt-get install" >&2; exit 1; fi
+  export DEBIAN_FRONTEND=noninteractive
+  $SUDO apt-get update -qq
+  $SUDO apt-get install -y -qq --no-install-recommends \
+    xvfb x11-xkb-utils xkb-data patchelf
+else
+  echo "xvfb: need dnf or apt-get to fetch upstream Xvfb" >&2
+  exit 1
+fi
+
+if ! command -v patchelf >/dev/null 2>&1; then
+  echo "xvfb: patchelf is required but not found" >&2
+  exit 1
+fi
+
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{bin,lib,share/X11/xkb}
+
+# Xvfb may live in /usr/bin (RPM/Debian) — just locate it.
+XVFB_SRC="$(command -v Xvfb || true)"
+XKBCOMP_SRC="$(command -v xkbcomp || true)"
+if [[ -z "$XVFB_SRC" || -z "$XKBCOMP_SRC" ]]; then
+  echo "xvfb: Xvfb or xkbcomp not found after install" >&2
+  exit 1
+fi
+
+cp "$XVFB_SRC"    "$INSTALL_DIR/bin/Xvfb"
+cp "$XKBCOMP_SRC" "$INSTALL_DIR/bin/xkbcomp"
+chmod u+w "$INSTALL_DIR/bin/Xvfb" "$INSTALL_DIR/bin/xkbcomp"
+cp -a /usr/share/X11/xkb/. "$INSTALL_DIR/share/X11/xkb/"
+
+# Two binary patches to make Xvfb relocatable:
+#
+# 1. "/usr/bin"  -> "" (null bytes)
+#    Xvfb's compile-time XkbBinDirectory points at /usr/bin and is used to
+#    build an absolute path to xkbcomp. Blanking it makes the spawned
+#    command just "xkbcomp", which popen() then resolves via PATH. Our
+#    Python wrapper prepends the bundled bin/ to PATH.
+#
+# 2. "-R%s" -> "-I%s" (in the xkbcomp argv format string)
+#    Xvfb passes its XkbBaseDirectory to xkbcomp via -R, expecting xkbcomp
+#    to chdir there *and* add "." to the include path. xkbcomp 1.4.x only
+#    chdirs — the include-path side was added later. Switching to -I makes
+#    1.4.2 actually search the path we hand it via -xkbdir.
+python3 - "$INSTALL_DIR/bin/Xvfb" <<'PY'
+import sys
+path = sys.argv[1]
+with open(path, "r+b") as f:
+    data = bytearray(f.read())
+
+def replace_unique(needle: bytes, replacement: bytes):
+    assert len(needle) == len(replacement)
+    idx = data.find(needle)
+    if idx < 0:
+        sys.exit(f"could not find {needle!r} in Xvfb binary")
+    if data.find(needle, idx + 1) >= 0:
+        sys.exit(f"multiple {needle!r} matches; refusing to patch")
+    data[idx:idx + len(needle)] = replacement
+
+replace_unique(b"/usr/bin\x00", b"\x00" * 9)
+replace_unique(b'"-R%s"\x00', b'"-I%s"\x00')
+
+with open(path, "wb") as f:
+    f.write(data)
+PY
+
+# bundle the shared library closure. Recursively walk ldd output to catch
+# libs-of-libs (e.g. libXfont2 -> libfontenc -> libbz2). Skip core glibc
+# pieces; everything else gets copied alongside the binary.
+declare -A SEEN
+collect_libs() {
+  local target="$1"
+  while IFS= read -r line; do
+    local lib
+    lib=$(echo "$line" | awk '{print $3}')
+    [[ -z "$lib" || "$lib" == "not" ]] && continue
+    [[ ! -e "$lib" ]] && continue
+    local base
+    base=$(basename "$lib")
+    case "$base" in
+      libc.so.*|libpthread.so.*|libm.so.*|librt.so.*|libdl.so.*|libgcc_s.so.*|libresolv.so.*|libutil.so.*|ld-linux-*.so.*|linux-vdso.so.*|linux-gate.so.*)
+        continue ;;
+    esac
+    [[ -n "${SEEN[$base]:-}" ]] && continue
+    SEEN[$base]=1
+    cp -L "$lib" "$INSTALL_DIR/lib/$base"
+    chmod u+w "$INSTALL_DIR/lib/$base"
+    collect_libs "$INSTALL_DIR/lib/$base"
+  done < <(ldd "$target" 2>/dev/null || true)
+}
+collect_libs "$INSTALL_DIR/bin/Xvfb"
+collect_libs "$INSTALL_DIR/bin/xkbcomp"
+
+# point the binaries (and the bundled libs) at our private lib dir so they
+# don't accidentally resolve against an incompatible host copy.
+patchelf --set-rpath '$ORIGIN/../lib' "$INSTALL_DIR/bin/Xvfb"
+patchelf --set-rpath '$ORIGIN/../lib' "$INSTALL_DIR/bin/xkbcomp"
+for so in "$INSTALL_DIR"/lib/*.so*; do
+  patchelf --set-rpath '$ORIGIN' "$so" 2>/dev/null || true
+done
+
+strip --strip-unneeded "$INSTALL_DIR/bin/Xvfb" "$INSTALL_DIR/bin/xkbcomp" 2>/dev/null || true
+find "$INSTALL_DIR/lib" -name '*.so*' -exec strip --strip-unneeded {} + 2>/dev/null || true
+
+echo "Installed xvfb to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"

xvfb/pyproject.toml

@@ -0,0 +1,18 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "xvfb"
+version = "1.20.11.post1"
+description = "Xvfb (X virtual framebuffer) headless X server"
+requires-python = ">=3.8"
+
+[project.scripts]
+Xvfb = "xvfb:_run_xvfb"
+
+[tool.setuptools.packages.find]
+include = ["xvfb*"]
+
+[tool.setuptools.package-data]
+xvfb = ["install/**/*"]

xvfb/setup.py

@@ -0,0 +1,58 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildXvfb(build_py):
+  """Run build.sh to fetch and bundle Xvfb before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    build_script = os.path.join(pkg_dir, "build.sh")
+    subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildXvfb}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()

xvfb/xvfb/__init__.py

@@ -0,0 +1,57 @@
+import os
+import sys
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+BIN_DIR = os.path.join(DIR, "bin")
+LIB_DIR = os.path.join(DIR, "lib")
+XKB_DIR = os.path.join(DIR, "share", "X11", "xkb")
+
+XVFB_BIN = os.path.join(BIN_DIR, "Xvfb")
+XKBCOMP_BIN = os.path.join(BIN_DIR, "xkbcomp")
+
+
+# Common host paths where Mesa DRI drivers (e.g. swrast_dri.so) live. Xvfb
+# was built on AlmaLinux 8 with /usr/lib64/dri baked in; on other distros
+# (Debian/Ubuntu in particular) the drivers are elsewhere, and without them
+# Xvfb fails to bring up a GL provider and silently disables the GLX
+# extension. Probing the standard locations lets the host's drivers be
+# found regardless of distro.
+_DRI_PATHS = (
+  "/usr/lib64/dri",
+  "/usr/lib/x86_64-linux-gnu/dri",
+  "/usr/lib/aarch64-linux-gnu/dri",
+  "/usr/lib/dri",
+)
+
+
+def _run_xvfb():
+  # The bundled Xvfb has its compile-time XkbBinDirectory blanked out so it
+  # invokes xkbcomp via PATH lookup; prepend our bin dir so the bundled
+  # xkbcomp wins. -xkbdir points the server at the bundled keymap data.
+  env = os.environ.copy()
+  env["PATH"] = BIN_DIR + os.pathsep + env.get("PATH", "")
+  if "LIBGL_DRIVERS_PATH" not in env:
+    found = [p for p in _DRI_PATHS if os.path.isdir(p)]
+    if found:
+      env["LIBGL_DRIVERS_PATH"] = os.pathsep.join(found)
+  args = sys.argv[1:]
+  if not any(a == "-xkbdir" for a in args):
+    args = ["-xkbdir", XKB_DIR] + args
+  os.execvpe(XVFB_BIN, [XVFB_BIN] + args, env)
+
+
+def smoketest():
+  if sys.platform == "darwin":
+    return
+  assert os.path.isfile(XVFB_BIN), f"Xvfb not found at {XVFB_BIN}"
+  assert os.path.isfile(XKBCOMP_BIN), f"xkbcomp not found at {XKBCOMP_BIN}"
+  assert os.path.isdir(XKB_DIR), f"xkb data not found at {XKB_DIR}"
+
+  import subprocess
+  # Xvfb prints usage to stderr and exits non-zero on `-help`; the banner
+  # mentions Xvfb-specific flags like -screen and -fbdir. If those appear,
+  # the binary loaded its bundled libs and ran far enough to print help.
+  result = subprocess.run([XVFB_BIN, "-help"], capture_output=True, text=True)
+  output = result.stderr + result.stdout
+  assert "-screen scrn WxHxD" in output, \
+      f"Xvfb -help did not produce expected output: {output}"