snapshot of https://github.com/ActivityWatch/aw-server-rust.git (master, 2026-09-16; blobs > 131072B omitted)

scripts/Dockerfile

@@ -0,0 +1,53 @@
+# Build stage: aw-webui (node) + aw-server (rust, with the webui embedded via rust-embed)
+# Node is taken from the official image instead of the NodeSource install script,
+# so no remotely fetched script is executed as root in the stage that produces
+# the artifacts shipped in the final image.
+FROM node:22-bookworm-slim AS node
+
+FROM rust:1-bookworm AS builder
+
+RUN apt-get update -qq -y && \
+    apt-get install -qq -y --no-install-recommends \
+        build-essential pkg-config libssl-dev ca-certificates git make && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \
+    ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
+
+WORKDIR /app/aw-server-rust
+COPY . .
+
+# `make aw-server` builds the webui (aw-webui/dist) before cargo, so that
+# aw-server's build.rs can embed the assets into the binary.
+# We avoid the `build` target, which also builds aw-sync: that binary pulls in
+# openssl with the "vendored" feature (builds OpenSSL from source) and is not
+# used by this image.
+RUN make aw-server
+
+FROM debian:bookworm-slim
+
+RUN apt-get update -qq -y && \
+    apt-get install -qq -y --no-install-recommends \
+        libssl3 && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN groupadd --gid 10001 aw && \
+    useradd --uid 10001 --gid 10001 --home-dir /home/aw --create-home \
+        --shell /usr/sbin/nologin aw && \
+    mkdir -p /home/aw/.local/share/activitywatch /home/aw/.config/activitywatch && \
+    chown -R aw:aw /home/aw
+
+COPY --from=builder /app/aw-server-rust/target/release/aw-server /usr/local/bin/aw-server-rust
+COPY --from=builder /app/aw-server-rust/aw-webui/dist /usr/local/share/aw-webui
+
+USER aw
+# Set explicitly so the datastore path does not depend on the runtime resolving
+# the home directory from /etc/passwd.
+ENV HOME=/home/aw
+WORKDIR /home/aw
+
+EXPOSE 5600
+
+CMD ["aw-server-rust"]

scripts/create-cargo-config.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+if [ -z $ANDROID_NDK_HOME ]; then
+    echo '$ANDROID_NDK_HOME not set';
+    exit 1;
+fi
+
+tee ~/test-cargo-config.toml <<< "
+[target.aarch64-linux-android]
+ar = '$NDK_HOME/arm64/bin/aarch64-linux-android-ar'
+linker = '$NDK_HOME/arm64/bin/aarch64-linux-android-clang'
+
+[target.armv7-linux-androideabi]
+ar = '$NDK_HOME/arm/bin/arm-linux-androideabi-ar'
+linker = '$NDK_HOME/arm/bin/arm-linux-androideabi-clang'
+
+[target.i686-linux-android]
+ar = '$NDK_HOME/x86/bin/i686-linux-android-ar'
+linker = '$NDK_HOME/x86/bin/i686-linux-android-clang'
+"

scripts/test-compile-android-cwd.sh

@@ -0,0 +1,101 @@
+#!/bin/bash
+
+set -euo pipefail
+
+REPO_ROOT="$(
+    unset CDPATH
+    cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.."
+    pwd
+)"
+TEST_DIR="$(mktemp -d)"
+trap 'rm -rf "$TEST_DIR"' EXIT
+
+platform="$(uname -s | tr '[:upper:]' '[:lower:]')"
+NDK_BIN="$TEST_DIR/ndk/toolchains/llvm/prebuilt/${platform}-x86_64/bin"
+mkdir -p "$NDK_BIN" "$TEST_DIR/ndk/sysroot/lib" "$TEST_DIR/bin"
+touch "$TEST_DIR/ndk/sysroot/lib/libunwind.a" "$TEST_DIR/libgcc.a"
+
+cat > "$NDK_BIN/llvm-ar" <<'EOF'
+#!/bin/bash
+exit 0
+EOF
+
+cat > "$NDK_BIN/llvm-ranlib" <<'EOF'
+#!/bin/bash
+exit 0
+EOF
+
+write_clang_stub() {
+    cat > "$NDK_BIN/$1" <<EOF
+#!/bin/bash
+if [ "\$1" = "-print-libgcc-file-name" ]; then
+    echo "$TEST_DIR/libgcc.a"
+fi
+exit 0
+EOF
+}
+
+write_clang_stub aarch64-linux-android-clang
+write_clang_stub arm-linux-androideabi-clang
+write_clang_stub i686-linux-android-clang
+write_clang_stub x86_64-linux-android-clang
+
+cat > "$TEST_DIR/bin/cargo" <<EOF
+#!/bin/bash
+printf '%s\n' "\$PWD" >> "$TEST_DIR/cargo_pwds.txt"
+printf '%s\n' "\$*" >> "$TEST_DIR/cargo_args.txt"
+exit 0
+EOF
+
+chmod +x \
+    "$NDK_BIN/llvm-ar" \
+    "$NDK_BIN/llvm-ranlib" \
+    "$NDK_BIN/aarch64-linux-android-clang" \
+    "$NDK_BIN/arm-linux-androideabi-clang" \
+    "$NDK_BIN/i686-linux-android-clang" \
+    "$NDK_BIN/x86_64-linux-android-clang" \
+    "$TEST_DIR/bin/cargo"
+
+run_compile() {
+    cd /tmp
+    PATH="$TEST_DIR/bin:$PATH" \
+    ANDROID_NDK_HOME="$TEST_DIR/ndk" \
+    RELEASE=false \
+    "$REPO_ROOT/compile-android.sh" "$@" >/dev/null
+}
+
+assert_cargo_invocations() {
+    if [ ! -s "$TEST_DIR/cargo_pwds.txt" ]; then
+        echo "Expected cargo to be invoked"
+        exit 1
+    fi
+
+    if [ "$(wc -l < "$TEST_DIR/cargo_pwds.txt")" -ne "$1" ]; then
+        echo "Expected exactly $1 cargo invocations"
+        cat "$TEST_DIR/cargo_args.txt"
+        exit 1
+    fi
+
+    if grep -Fxv "$REPO_ROOT" "$TEST_DIR/cargo_pwds.txt" >/dev/null; then
+        echo "cargo ran outside repo root:"
+        cat "$TEST_DIR/cargo_pwds.txt"
+        exit 1
+    fi
+}
+
+run_compile arm64
+assert_cargo_invocations 2
+grep -F -- "-p aw-server" "$TEST_DIR/cargo_args.txt" >/dev/null
+grep -F -- "-p aw-sync" "$TEST_DIR/cargo_args.txt" >/dev/null
+grep -F -- "--target aarch64-linux-android" "$TEST_DIR/cargo_args.txt" >/dev/null
+if grep -F -- "--target armv7-linux-androideabi" "$TEST_DIR/cargo_args.txt" >/dev/null; then
+    echo "arm64 should not match the arm target"
+    exit 1
+fi
+
+: > "$TEST_DIR/cargo_pwds.txt"
+: > "$TEST_DIR/cargo_args.txt"
+
+run_compile arm
+assert_cargo_invocations 2
+grep -F -- "--target armv7-linux-androideabi" "$TEST_DIR/cargo_args.txt" >/dev/null