Merge updates from bookworm-backports

debian/apertis/component

+target

debian/apparmor.d/abstractions/pipewire

+  #include <abstractions/freedesktop.org>
+  #include <abstractions/audio>
+
+  owner @{HOME}/.Xauthority		r,
+
+
+# Applications can launch pulse due to autolaunching in some cases
+  /usr/bin/pipewire                          rmPx,
+
+  # pulseaudio probes whether other processes exist so that it can
+  # know whether to clean up their shared memory segments.
+  signal (receive) set=("exists") peer=/usr/bin/pipewire,

debian/apparmor.d/usr.bin.pipewire

+#include <tunables/global>
+
+profile /usr/bin/pipewire {
+  #include <abstractions/chaiwala-base>
+  #include <abstractions/dbus-strict>
+  #include <abstractions/dbus-session-strict>
+  #include <abstractions/nameservice>
+  #include <abstractions/pipewire>
+  #include <abstractions/user-tmp>
+  #include <abstractions/orc>
+
+  dbus send bus=system peer=(name=org.freedesktop.RealtimeKit1),
+
+  dbus (send, receive) bus=session peer=(label=unconfined),
+
+  @{HOME}/.ICEauthority                        r,
+  @{HOME}/.config/pipewire/                    rw,
+  @{HOME}/.config/pipewire/**                  rw,
+
+  /                                            r,
+  /etc/pipewire/                               r,
+  /etc/pipewire/*.conf                         r,
+  /dev/video*                                  rw,
+  /sys/devices/virtual/dmi/id/*                r,
+  /usr/bin/pactl                               ix,
+  owner @{PROC}/*/stat                         r,
+  owner @{PROC}/*/fd/                          r,
+  owner @{PROC}/*/fd/*                         r,
+  owner @{PROC}/*/task/*/comm                  rw,
+
+  # This seems to be mediated as ptrace(trace), ptrace(traceby).
+  ptrace (read),
+
+  # tell systemd --user that we're ready
+  /run/user/*/systemd/notify w,
+
+  owner /run/user/*/pipewire*                  krw,
+  owner /run/user/*/pulse/{,*}                 krw,
+}

debian/apparmor.d/usr.bin.pipewire-pulse

+#include <tunables/global>
+
+# attach_disconnected flag is needed to open /proc/<pid>/root
+# when called from flatpak containers
+profile /usr/bin/pipewire-pulse flags=(attach_disconnected) {
+  #include <abstractions/chaiwala-base>
+  #include <abstractions/dbus-strict>
+  #include <abstractions/dbus-session-strict>
+  #include <abstractions/nameservice>
+  #include <abstractions/pipewire>
+  #include <abstractions/user-tmp>
+  #include <abstractions/orc>
+
+  dbus send
+       bus=session
+       path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member={RequestName,ReleaseName}
+       peer=(name=org.freedesktop.DBus),
+  dbus bind bus=session name=org.pulseaudio.Server,
+
+  capability sys_ptrace,
+
+  @{HOME}/.config/pulse/                       rw,
+  @{HOME}/.config/pulse/**                     rw,
+
+  /                                            r,
+  /etc/pipewire/*.conf                         r,
+  /sys/devices/virtual/dmi/id/*                r,
+  owner @{PROC}/*/stat                         r,
+  owner @{PROC}/*/fd/                          r,
+  owner @{PROC}/*/fd/*                         r,
+  /.flatpak-info                               r,
+
+
+  # This seems to be mediated as ptrace(trace), ptrace(traceby).
+  ptrace (read),
+
+  /run/user/*/pipewire*                        rw,
+}

debian/control

@@ -5,6 +5,7 @@ Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@alioth-lists.debian.
 Uploaders: Jeremy Bicha <jbicha@debian.org>,
            Dylan Aïssi <daissi@debian.org>
 Build-Depends: debhelper-compat (= 13),
+               dh-apparmor,
                doxygen <!nodoc>,
                graphviz <!nodoc>,
                libasound2-dev,
@@ -12,24 +13,24 @@ Build-Depends: debhelper-compat (= 13),
                libbluetooth-dev [linux-any],
                libcamera-dev [!m68k !hurd-i386],
                libdbus-1-dev,
-               libffado-dev,
-               libfreeaptx-dev,
+#              libffado-dev,
+#              libfreeaptx-dev,
                libglib2.0-dev,
                libgstreamer-plugins-base1.0-dev,
                libgstreamer1.0-dev,
-               libjack-jackd2-dev,
+#              libjack-jackd2-dev,
                libcanberra-dev,
                liblc3-dev,
                libldacbt-abr-dev [!s390x !hppa !m68k !powerpc !ppc64 !sparc64],
                libldacbt-enc-dev [!s390x !hppa !m68k !powerpc !ppc64 !sparc64],
-               liblilv-dev,
-               libmysofa-dev,
+#              liblilv-dev,
+#              libmysofa-dev,
                libncurses-dev,
                libopus-dev,
                libpulse-dev,
-               libreadline-dev,
+               libeditreadline-dev,
                libsbc-dev,
-               libsdl2-dev <!noinsttest>,
+#              libsdl2-dev <!noinsttest>,
                libsndfile1-dev,
                libssl-dev,
                libsystemd-dev [linux-any],
@@ -37,7 +38,7 @@ Build-Depends: debhelper-compat (= 13),
                libusb-1.0-0-dev,
                libv4l-dev,
                libwebrtc-audio-processing-dev,
-               libxfixes-dev (>= 1:6.0.0),
+#              libxfixes-dev (>= 1:6.0.0),
                meson (>= 0.59.0),
                modemmanager-dev,
                pkg-config,

debian/libpipewire-0.3-0.install

 usr/lib/*/libpipewire*.so.*
+debian/apparmor.d/abstractions/pipewire etc/apparmor.d/abstractions/

debian/libpipewire-0.3-modules.install

@@ -6,8 +6,6 @@ usr/lib/*/pipewire-0.3/libpipewire-module-client-node.so
 usr/lib/*/pipewire-0.3/libpipewire-module-combine-stream.so
 usr/lib/*/pipewire-0.3/libpipewire-module-echo-cancel.so
 usr/lib/*/pipewire-0.3/libpipewire-module-f*.so
-usr/lib/*/pipewire-0.3/libpipewire-module-jack-tunnel.so
-usr/lib/*/pipewire-0.3/libpipewire-module-jackdbus-detect.so
 usr/lib/*/pipewire-0.3/libpipewire-module-link-factory.so
 usr/lib/*/pipewire-0.3/libpipewire-module-loopback.so
 usr/lib/*/pipewire-0.3/libpipewire-module-metadata.so

debian/patches/Fix_meson_readline.patch

+Description: If dependency() doesn't find readline, the build stops with:
+ "ERROR: Dependency "readline" not found, tried pkgconfig"
+ without using the fallback cc.find_library(). Let's give it a second chance
+ to find readline with cc.find_library().
+Author: Dylan Aïssi <dylan.aissi@collabora.com>
+Forwarded: TODO
+
+--- a/meson.build
++++ b/meson.build
+@@ -260,7 +260,7 @@
+ sdl_dep = dependency('sdl2', required : get_option('sdl2'))
+ summary({'SDL2 (video examples)': sdl_dep.found()}, bool_yn: true, section: 'Misc dependencies')
+ drm_dep = dependency('libdrm', required : false)
+-readline_dep = dependency('readline', required : get_option('readline'))
++readline_dep = dependency('readline', required : false)
+ 
+ if not readline_dep.found()
+   readline_dep = cc.find_library('readline', required : get_option('readline'))

debian/patches/series

 Don-t-automatically-start-pipewire-for-root-logins.patch
 Fix_services.patch
 # Upstream patch for 0.3.8X
+
+# Apertis patch
+Fix_meson_readline.patch

debian/pipewire-bin.install

@@ -45,3 +45,4 @@ usr/share/man/man1/pw-profiler.*
 usr/share/man/man1/pw-top.*
 usr/share/man/man5
 etc/security/limits.d/25-pw-rlimits.conf
+debian/apparmor.d/usr.bin.pipewire	/etc/apparmor.d/

debian/pipewire-pulse.install

@@ -3,3 +3,4 @@ usr/bin/pipewire-pulse
 usr/lib/systemd/user/pipewire-pulse.service
 usr/lib/systemd/user/pipewire-pulse.socket
 usr/share/man/man1/pipewire-pulse.*
+debian/apparmor.d/usr.bin.pipewire-pulse etc/apparmor.d/

debian/rules

@@ -4,7 +4,7 @@ export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 export DEB_LDFLAGS_MAINT_APPEND = -Wl,-z,defs
 
 %:
-	dh $@
+	dh $@ -Nlibspa-0.2-jack
 
 ifneq ($(filter nodoc,$(DEB_BUILD_PROFILES)),)
 DOCS=disabled
@@ -40,9 +40,9 @@ LV2=disabled
 LIBMYSOFA=disabled
 LIBFFADO=disabled
 else
-LV2=enabled
-LIBMYSOFA=enabled
-LIBFFADO=enabled
+LV2=disabled
+LIBMYSOFA=disabled
+LIBFFADO=disabled
 endif
 
 override_dh_auto_configure:
@@ -52,7 +52,7 @@ override_dh_auto_configure:
 		-Davahi=enabled \
 		-Dbluez5-backend-native-mm=enabled \
 		-Dbluez5-codec-aac=disabled \
-		-Dbluez5-codec-aptx=enabled \
+		-Dbluez5-codec-aptx=disabled \
 		-Dbluez5-codec-lc3=enabled \
 		-Dbluez5-codec-lc3plus=disabled \
 		-Dbluez5-codec-ldac=$(BLUEZ5_CODEC_LDAC) \
@@ -71,6 +71,9 @@ override_dh_auto_configure:
 		-Dtest=enabled \
 		-Dvideotestsrc=enabled \
 		-Dvulkan=disabled \
+		-Dsdl2=disabled \
+		-Djack=disabled \
+		-Dx11-xfixes=disabled \
 		$(NULL)
 	install -d debian/ld.so.conf.d
 	echo "/usr/lib/$(DEB_HOST_MULTIARCH)/pipewire-0.3/jack/" > "debian/ld.so.conf.d/pipewire-jack-$(DEB_HOST_MULTIARCH).conf"
@@ -85,6 +88,10 @@ ifneq ($(filter mips%,$(DEB_HOST_ARCH_CPU)),)
 test_timeout_multiplier = 10
 endif
 
+override_dh_install:
+	dh_install
+	dh_apparmor -ppipewire --profile-name=usr.bin.pipewire
+
 override_dh_auto_test:
 	dh_auto_test \
 		-- \