Isolate manual artifact validation without package publication

scripts/apply-release-version.py

@@ -0,0 +1,14 @@
+#!/usr/bin/env python3
+import json, os
+from pathlib import Path
+import xml.etree.ElementTree as ET
+lock = json.loads(os.environ["SOURCE_LOCK_JSON"])
+path = Path("build/linux-toolchain/release.lock.json")
+path.write_text(json.dumps(lock, indent=2) + "\n")
+project = Path("NuGet/StaticGraphics/StaticLink.Avalonia.csproj")
+root = ET.parse(project)
+root.find(".//Version").text = os.environ["PACKAGE_VERSION"]
+for item in root.findall(".//PackageReference"):
+    if item.attrib.get("Include") == "SkiaSharp":
+        item.set("Version", "[" + lock["skiasharp_version"] + "]")
+root.write(project, encoding="unicode")

scripts/build-linux-container.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+rid="${RID:-linux-x64}"
+case "$rid" in
+  linux-x64) cpu=x64; platform=linux/amd64 ;;
+  linux-arm64) cpu=arm64; platform=linux/arm64 ;;
+  *) echo "Debian container currently supports linux-x64 and linux-arm64: $rid" >&2; exit 2 ;;
+esac
+source_lock="$(realpath "${SOURCE_LOCK:-$root/build/linux-toolchain/sources.lock.json}")"
+case "$source_lock" in
+  "$root/"*) container_lock="/src/${source_lock#"$root/"}" ;;
+  *) echo "SOURCE_LOCK must be inside the mounted repository" >&2; exit 2 ;;
+esac
+lock_key="$(sha256sum "$source_lock" | cut -c1-16)"
+eval "$(python3 - "$source_lock" <<'PY'
+import json, shlex, sys
+lock = json.load(open(sys.argv[1]))
+for key, value in lock.items():
+    print(f'{key.upper()}={shlex.quote(value)}')
+PY
+)"
+image="staticlink-debian12:$(sha256sum "$root/build/linux-toolchain/Dockerfile" | cut -c1-16)"
+docker build --platform "$platform" -t "$image" "$root/build/linux-toolchain"
+docker run --rm --platform "$platform" \
+  --user "$(id -u):$(id -g)" \
+  -v "$root:/src" -w /src \
+  -e HOME=/tmp/staticlink-home \
+  -e RID="$rid" -e TARGET_CPU="$cpu" \
+  -e BUILD_JOBS="${BUILD_JOBS:-4}" \
+  -e WORK_DIR="/src/External/NativeStatic/.work/native-$lock_key" \
+  -e SOURCE_LOCK="$container_lock" \
+  -e SKIASHARP_VERSION="$SKIASHARP_VERSION" -e SKIASHARP_REVISION="$SKIASHARP_REVISION" \
+  -e ANGLE_BRANCH="$ANGLE_BRANCH" -e ANGLE_REVISION="$ANGLE_REVISION" \
+  -e DEPOT_TOOLS_DIR=/src/External/NativeStatic/.work/depot_tools \
+  "$image" bash -c '
+    set -euo pipefail
+    mkdir -p "$HOME" "$(dirname "$DEPOT_TOOLS_DIR")"
+    # The image checkout is read-only for a non-root user; gclient needs a writable copy.
+    if [[ ! -d "$DEPOT_TOOLS_DIR/.git" ]]; then
+      cp -a /opt/depot_tools "$DEPOT_TOOLS_DIR"
+    fi
+    scripts/build-linux-static-graphics.sh "${1:-all}"
+    cp /opt/staticlink/packages.lock "External/NativeStatic/$RID/toolchain-packages.lock"
+    cp "$SOURCE_LOCK" "External/NativeStatic/$RID/sources.lock.json"
+  ' bash "${1:-all}"

scripts/build-linux-static-graphics.sh

@@ -53,10 +53,20 @@ ensure_tools() {
 }
 
 ensure_depot_tools() {
-  local depot_dir="$WORK_DIR/depot_tools"
+  local depot_dir="${DEPOT_TOOLS_DIR:-$WORK_DIR/depot_tools}"
   local python_bin_dir
   python_bin_dir="$(dirname "$(command -v python3)")"
-  if [[ ! -d "$depot_dir/.git" ]]; then
+  if [[ -n "${DEPOT_TOOLS_REVISION:-}" ]]; then
+    if [[ ! -d "$depot_dir/.git" ]]; then
+      git init "$depot_dir"
+      git -C "$depot_dir" remote add origin https://chromium.googlesource.com/chromium/tools/depot_tools.git
+    fi
+    if [[ "$(git -C "$depot_dir" rev-parse HEAD 2>/dev/null || true)" != "$DEPOT_TOOLS_REVISION" ]]; then
+      git -C "$depot_dir" fetch --depth 1 origin "$DEPOT_TOOLS_REVISION"
+      git -C "$depot_dir" checkout --detach FETCH_HEAD
+    fi
+    export DEPOT_TOOLS_UPDATE=0
+  elif [[ ! -d "$depot_dir/.git" ]]; then
     git clone --depth 1 https://chromium.googlesource.com/chromium/tools/depot_tools.git "$depot_dir"
   else
     git -C "$depot_dir" pull --ff-only
@@ -136,7 +146,14 @@ PY
 
 sync_skiasharp() {
   local src="$WORK_DIR/SkiaSharp-$SKIASHARP_VERSION"
-  if [[ ! -d "$src/.git" ]]; then
+  if [[ -n "${SKIASHARP_REVISION:-}" ]]; then
+    if [[ ! -d "$src/.git" ]]; then
+      git init "$src" >&2
+      git -C "$src" remote add origin https://github.com/mono/SkiaSharp.git
+    fi
+    git -C "$src" fetch --depth 1 origin "$SKIASHARP_REVISION"
+    git -C "$src" checkout --detach FETCH_HEAD >&2
+  elif [[ ! -d "$src/.git" ]]; then
     git clone --depth 1 --branch "release/$SKIASHARP_VERSION" https://github.com/mono/SkiaSharp.git "$src"
   else
     git -C "$src" fetch --depth 1 origin "release/$SKIASHARP_VERSION"
@@ -155,7 +172,7 @@ import sys
 
 path = pathlib.Path(sys.argv[1])
 text = path.read_text()
-deps_path = path.with_name("DEPS")
+deps_path = path.parent.parent / "DEPS"
 if deps_path.exists():
     deps = deps_path.read_text()
     deps = re.sub(r'^\s*"third_party/externals/dng_sdk"\s*:\s*"[^"]+",\s*\n', '', deps, flags=re.MULTILINE)
@@ -169,21 +186,21 @@ PY
 
 sync_skia_deps() {
   local skia_dir="$1/externals/skia"
-  if [[ ! -x "$skia_dir/bin/gn" ]]; then
-    prepare_skia_git_sync_deps "$skia_dir"
+  # GN can exist after a partial/failed sync; it is not a completion marker.
+  # git-sync-deps reuses already-correct checkouts and repairs missing dependencies.
+  prepare_skia_git_sync_deps "$skia_dir"
 
-    local attempt
-    for attempt in $(seq 1 "$SKIA_DEPS_RETRIES"); do
-      if python3 "$skia_dir/tools/git-sync-deps"; then
-        return 0
-      fi
-      if [[ "$attempt" == "$SKIA_DEPS_RETRIES" ]]; then
-        return 1
-      fi
-      echo "git-sync-deps failed; retrying ($attempt/$SKIA_DEPS_RETRIES)..." >&2
-      sleep 10
-    done
-  fi
+  local attempt
+  for attempt in $(seq 1 "$SKIA_DEPS_RETRIES"); do
+    if GIT_SYNC_DEPS_SKIP_EMSDK=1 python3 "$skia_dir/tools/git-sync-deps"; then
+      return 0
+    fi
+    if [[ "$attempt" == "$SKIA_DEPS_RETRIES" ]]; then
+      return 1
+    fi
+    echo "git-sync-deps failed; retrying ($attempt/$SKIA_DEPS_RETRIES)..." >&2
+    sleep 10
+  done
 }
 
 build_skia() {
@@ -233,7 +250,7 @@ extra_cflags_cc = [ "-frtti" ]
 extra_ldflags = [ "-static-libstdc++", "-static-libgcc" ]
 EOF_ARGS
 
-  (cd "$skia_dir" && "$skia_dir/bin/gn" gen "$out_dir")
+  python3 "$ROOT_DIR/build/linux-toolchain/skia_compat.py" --source "$skia_dir" --out "$out_dir"
   ninja -C "$out_dir" -j "$BUILD_JOBS" skia SkiaSharp HarfBuzzSharp
 
   copy_first_existing "$OUTPUT_DIR/libskia.a" \
@@ -249,7 +266,14 @@ EOF_ARGS
 
 sync_angle() {
   local src="$WORK_DIR/ANGLE-$ANGLE_BRANCH"
-  if [[ ! -d "$src/.git" ]]; then
+  if [[ -n "${ANGLE_REVISION:-}" ]]; then
+    if [[ ! -d "$src/.git" ]]; then
+      git init "$src" >&2
+      git -C "$src" remote add origin https://github.com/google/angle.git
+    fi
+    git -C "$src" fetch --depth 1 origin "$ANGLE_REVISION"
+    git -C "$src" checkout --detach FETCH_HEAD >&2
+  elif [[ ! -d "$src/.git" ]]; then
     git clone --depth 1 --branch "chromium/$ANGLE_BRANCH" https://github.com/google/angle.git "$src"
   else
     git -C "$src" fetch --depth 1 origin "chromium/$ANGLE_BRANCH"
@@ -544,4 +568,6 @@ main() {
   esac
 }
 
-main "$@"
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  main "$@"
+fi

scripts/build-macos-font-preinit.sh

@@ -30,7 +30,9 @@ static void StaticLinkAvaloniaPreinitializeAppKitFonts(void)
 }
 OBJC
 
-clang -arch "$ARCH" \
+compiler=("${CC:-clang}")
+if [[ "${STATICLINK_ZIG_CROSS:-0}" != 1 ]]; then compiler+=(-arch "$ARCH"); fi
+"${compiler[@]}" \
   -mmacosx-version-min=12.0 \
   -fobjc-arc \
   -c "$src" \

scripts/build-macos-static-graphics.sh

@@ -33,8 +33,11 @@ ensure_depot_tools() {
   if [[ ! -d "$depot_dir/.git" ]]; then
     git clone --depth 1 https://chromium.googlesource.com/chromium/tools/depot_tools.git "$depot_dir"
   else
-    git -C "$depot_dir" pull --ff-only
+    : # The pinned checkout is refreshed below
   fi
+  git -C "$depot_dir" fetch --depth 1 origin 8a5434051036b32412a2ecb10c213a72e3f3ccb9
+  git -C "$depot_dir" checkout -q --force FETCH_HEAD
+  export DEPOT_TOOLS_UPDATE=0
   export PATH="$depot_dir:$PATH"
 }
 
@@ -56,11 +59,15 @@ copy_first_existing() {
 sync_skiasharp() {
   local src="$WORK_DIR/SkiaSharp-$SKIASHARP_VERSION"
   if [[ ! -d "$src/.git" ]]; then
-    git clone --depth 1 --branch "release/$SKIASHARP_VERSION" https://github.com/mono/SkiaSharp.git "$src"
+    git clone --depth 1 --branch "v$SKIASHARP_VERSION" https://github.com/mono/SkiaSharp.git "$src"
   else
-    git -C "$src" fetch --depth 1 origin "release/$SKIASHARP_VERSION"
+    git -C "$src" fetch --depth 1 origin "${SKIASHARP_REVISION:-refs/tags/v$SKIASHARP_VERSION}"
     git -C "$src" checkout -q FETCH_HEAD
   fi
+  if [[ -n "${SKIASHARP_REVISION:-}" ]]; then
+    git -C "$src" fetch --depth 1 origin "$SKIASHARP_REVISION"
+    git -C "$src" checkout -q --force FETCH_HEAD
+  fi
   git -C "$src" submodule update --init --depth 1 externals/skia >&2
   echo "$src"
 }
@@ -74,7 +81,7 @@ import sys
 
 path = pathlib.Path(sys.argv[1])
 text = path.read_text()
-deps_path = path.with_name("DEPS")
+deps_path = path.parent.parent / "DEPS"
 if deps_path.exists():
     deps = deps_path.read_text()
     deps = re.sub(r'^\s*"third_party/externals/dng_sdk"\s*:\s*"[^"]+",\s*\n', '', deps, flags=re.MULTILINE)
@@ -147,7 +154,7 @@ extra_cflags = [ "-DSKIA_C_DLL" ]
 extra_cflags_cc = [ "-frtti" ]
 EOF_ARGS
 
-  (cd "$skia_dir" && "$skia_dir/bin/gn" gen "$out_dir")
+  python3 "$ROOT_DIR/build/linux-toolchain/skia_compat.py" --source "$skia_dir" --out "$out_dir"
   ninja -C "$out_dir" -j "$BUILD_JOBS" skia SkiaSharp HarfBuzzSharp
   copy_first_existing "$OUTPUT_DIR/libskia.a" "$out_dir/libskia.a" "$out_dir/obj/libskia.a"
   copy_first_existing "$OUTPUT_DIR/libSkiaSharp.a" "$out_dir/libSkiaSharp.a" "$out_dir/obj/libSkiaSharp.a"
@@ -162,6 +169,10 @@ sync_angle() {
     git -C "$src" fetch --depth 1 origin "chromium/$ANGLE_BRANCH"
     git -C "$src" checkout -q FETCH_HEAD
   fi
+  if [[ -n "${ANGLE_REVISION:-}" ]]; then
+    git -C "$src" fetch --depth 1 origin "$ANGLE_REVISION"
+    git -C "$src" checkout -q --force FETCH_HEAD
+  fi
   echo "$src"
 }
 

scripts/build-windows-static-graphics.ps1

@@ -56,8 +56,13 @@ function Ensure-DepotTools {
     if (-not (Test-Path (Join-Path $depotDir ".git"))) {
         $null = git clone --depth 1 https://chromium.googlesource.com/chromium/tools/depot_tools.git $depotDir
     } else {
-        $null = git -C $depotDir pull --ff-only
+        # Refresh the pinned checkout below.
     }
+    $null = git -C $depotDir fetch --depth 1 origin 8a5434051036b32412a2ecb10c213a72e3f3ccb9
+    if ($LASTEXITCODE -ne 0) { throw "Cannot fetch pinned depot_tools" }
+    $null = git -C $depotDir checkout -q --force FETCH_HEAD
+    if ($LASTEXITCODE -ne 0) { throw "Cannot checkout pinned depot_tools" }
+    $env:DEPOT_TOOLS_UPDATE = "0"
     $env:PATH = "$depotDir;$env:PATH"
 }
 
@@ -344,11 +349,17 @@ function New-WinX86SkiaStdcallThunks([string[]]$InputLibraries, [string[]]$Bindi
 function Sync-SkiaSharp {
     $src = Join-Path $WorkDir "SkiaSharp-$SkiaSharpVersion"
     if (-not (Test-Path (Join-Path $src ".git"))) {
-        $null = git -c core.longpaths=true clone --depth 1 --branch "release/$SkiaSharpVersion" https://github.com/mono/SkiaSharp.git $src
+        $null = git -c core.longpaths=true clone --depth 1 --branch "v$SkiaSharpVersion" https://github.com/mono/SkiaSharp.git $src
     } else {
-        $null = git -C $src fetch --depth 1 origin "release/$SkiaSharpVersion"
+        $null = git -C $src fetch --depth 1 origin "refs/tags/v$SkiaSharpVersion"
         $null = git -C $src checkout -q FETCH_HEAD
     }
+    if ($env:SKIASHARP_REVISION) {
+        $null = git -C $src fetch --depth 1 origin $env:SKIASHARP_REVISION
+        if ($LASTEXITCODE -ne 0) { throw "Cannot fetch locked SkiaSharp commit" }
+        $null = git -C $src checkout -q --force FETCH_HEAD
+        if ($LASTEXITCODE -ne 0) { throw "Cannot checkout locked SkiaSharp commit" }
+    }
     $null = git -C $src submodule update --init --depth 1 externals/skia
     return $src
 }
@@ -359,7 +370,9 @@ function Patch-WinX86SkiaLinker($SkiaDir) {
     }
 
     $linkerPath = Join-Path $SkiaDir "src\c\sk_linker.cpp"
+    if (-not (Test-Path $linkerPath)) { return }
     $text = Get-Content -Path $linkerPath -Raw
+    if ($text -notmatch 'skjson::ObjectValue') { return }
     $pattern = '(?m)^    skjson::ObjectValue\* a = nullptr;\r?\n    auto r = \(\*a\)\["tmp"\]\.getType\(\);\r?$'
     $patched = [regex]::Replace($text, $pattern, '    int r = 0;')
     if ($patched -eq $text) {
@@ -447,7 +460,8 @@ extra_cflags_cc = [ "/GR" ]
 
     Push-Location $skiaDir
     try {
-        & (Join-Path $skiaDir "bin\gn.exe") gen $outDir
+        python (Join-Path $RootDir "build\linux-toolchain\skia_compat.py") --source $skiaDir --out $outDir
+        if ($LASTEXITCODE -ne 0) { throw "Skia capability configuration failed" }
         ninja -C $outDir -j $BuildJobs skia SkiaSharp HarfBuzzSharp
     } finally {
         Pop-Location
@@ -480,6 +494,12 @@ function Sync-Angle {
         $null = git -C $src fetch --depth 1 origin "chromium/$AngleBranch"
         $null = git -C $src checkout -q FETCH_HEAD
     }
+    if ($env:ANGLE_REVISION) {
+        $null = git -C $src fetch --depth 1 origin $env:ANGLE_REVISION
+        if ($LASTEXITCODE -ne 0) { throw "Cannot fetch locked ANGLE commit" }
+        $null = git -C $src checkout -q --force FETCH_HEAD
+        if ($LASTEXITCODE -ne 0) { throw "Cannot checkout locked ANGLE commit" }
+    }
     return $src
 }
 

scripts/check-upstream-releases.py

@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+"""Plan stable releases. HTTP/network errors fail closed; only 404 means absent."""
+import argparse, json, re, urllib.request, urllib.error
+from pathlib import Path
+
+def get(url):
+    for attempt in range(3):
+        try:
+            with urllib.request.urlopen(url, timeout=45) as response:
+                return json.load(response)
+        except urllib.error.HTTPError as error:
+            if error.code == 404:
+                return None
+            if error.code < 500 and error.code != 429:
+                raise
+            if attempt == 2:
+                raise
+        except (OSError, TimeoutError):
+            if attempt == 2:
+                raise
+    raise RuntimeError("Unreachable")
+
+def plan(config, upstream, published, force=False):
+    result = []
+    for entry in config["branches"]:
+        major = entry["major"]
+        candidates = [v for v in upstream if re.fullmatch(r"\d+\.\d+\.\d+", v)
+                      and int(v.split(".")[0]) == major]
+        version = entry.get("fixed_version") or max(candidates, key=lambda v: tuple(map(int, v.split("."))))
+        package = f"{version}-{entry['angle_branch']}.{entry['revision']}"
+        if entry.get("daily", True) and (force or package.lower() not in {v.lower() for v in published}):
+            result.append({"ref": entry["ref"], "skiasharp_version": version, "package_version": package})
+    return result
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--config", default="build/release-tracks.json")
+    parser.add_argument("--output", default="release-plan.json")
+    parser.add_argument("--force", action="store_true")
+    args = parser.parse_args()
+    upstream = get("https://api.nuget.org/v3-flatcontainer/skiasharp/index.json")
+    published = get("https://api.nuget.org/v3-flatcontainer/staticlink.avalonia/index.json")
+    if upstream is None:
+        raise SystemExit("SkiaSharp package index is missing")
+    result = plan(json.loads(Path(args.config).read_text()), upstream["versions"], (published or {}).get("versions", []), force=args.force)
+    Path(args.output).write_text(json.dumps(result, indent=2) + "\n")
+    print(json.dumps(result))

scripts/prepare-cross-sources.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SOURCE_LOCK="${SOURCE_LOCK:-$SCRIPT_ROOT/build/linux-toolchain/sources.lock.json}"
+SOURCE_LOCK="$(realpath "$SOURCE_LOCK")"
+export WORK_DIR="${WORK_DIR:-$SCRIPT_ROOT/External/NativeStatic/.work/zig-sources}"
+export LLVM_AR="${LLVM_AR:-llvm-ar}"
+mkdir -p "$WORK_DIR"
+read -r SKIASHARP_VERSION SKIASHARP_REVISION ANGLE_BRANCH ANGLE_REVISION < <(
+  python3 - "$SOURCE_LOCK" <<'PY'
+import json, sys
+lock = json.load(open(sys.argv[1]))
+print(lock['skiasharp_version'], lock['skiasharp_revision'], lock['angle_branch'], lock['angle_revision'])
+PY
+)
+export SKIASHARP_VERSION SKIASHARP_REVISION ANGLE_BRANCH ANGLE_REVISION
+export WORK_DIR="$WORK_DIR/$SKIASHARP_VERSION-$(sha256sum "$SOURCE_LOCK" | cut -c1-16)"
+mkdir -p "$WORK_DIR"
+source "$SCRIPT_ROOT/scripts/build-linux-static-graphics.sh"
+if [[ ! -d "$WORK_DIR/depot_tools/.git" ]]; then
+  cp -a /opt/depot_tools "$WORK_DIR/depot_tools"
+fi
+export DEPOT_TOOLS_DIR="$WORK_DIR/depot_tools"
+ensure_tools
+ensure_depot_tools
+initialize_depot_tools_system_python "$DEPOT_TOOLS_DIR"
+patch_depot_tools_python_deps "$DEPOT_TOOLS_DIR"
+export VPYTHON_BYPASS="manually managed python not supported by chrome operations"
+skia_sharp="$(sync_skiasharp)"
+python3 "$SCRIPT_ROOT/build/linux-toolchain/sync-skia-deps.py" --source "$skia_sharp/externals/skia" --cache "$SCRIPT_ROOT/External/NativeStatic/.work/skia-deps"
+angle="$(sync_angle)"
+project_patch="$SCRIPT_ROOT/External/NativeStatic/patches/angle-chromium-$ANGLE_BRANCH.patch"
+if git -C "$angle" apply --reverse --check "$project_patch" >/dev/null 2>&1; then
+  :
+else
+  git -C "$angle" apply --check "$project_patch"
+  git -C "$angle" apply "$project_patch"
+fi
+python3 - "$angle/.gclient" <<'PY'
+from pathlib import Path
+import sys
+Path(sys.argv[1]).write_text('''solutions = [{
+  "name": ".", "url": "https://chromium.googlesource.com/angle/angle.git",
+  "deps_file": "DEPS", "managed": False,
+  "custom_deps": {"third_party/llvm-build/Release+Asserts": None},
+  "custom_vars": {"checkout_angle_cl_deps": False, "checkout_angle_dawn_deps": False},
+}]
+target_os = ["linux", "win", "mac"]
+''')
+PY
+# Zig and the image's SDKs supply the compiler/runtime; skip native Xcode/MSVC
+# setup hooks while retaining the pinned source dependencies for every target.
+(cd "$angle" && gclient sync --nohooks --force)
+python3 - "$WORK_DIR/cross-sources.json" "$skia_sharp/externals/skia" "$angle" "$SOURCE_LOCK" <<'PY'
+import json, sys
+from pathlib import Path
+Path(sys.argv[1]).write_text(json.dumps({'skia': sys.argv[2], 'angle': sys.argv[3],
+    'angle_gn': sys.argv[3] + '/buildtools/linux64/gn', 'source_lock': sys.argv[4]}, indent=2) + '\n')
+PY
+echo "Prepared $WORK_DIR/cross-sources.json"

scripts/resolve-release-lock.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+"""Resolve a published SkiaSharp tag and its Skia gitlink to immutable commits."""
+import argparse, json, re, subprocess, tempfile
+from pathlib import Path
+import xml.etree.ElementTree as ET
+
+def git(*args):
+    return subprocess.check_output(["git", *args], text=True).strip()
+
+p = argparse.ArgumentParser()
+p.add_argument("--version", default="")
+p.add_argument("--output", default="build/linux-toolchain/release.lock.json")
+a = p.parse_args()
+root = ET.parse("NuGet/StaticGraphics/StaticLink.Avalonia.csproj").getroot()
+current = next(x.attrib["Version"] for x in root.findall(".//PackageReference") if x.attrib.get("Include") == "SkiaSharp")
+version = a.version or current
+if not re.fullmatch(r"\d+\.\d+\.\d+", version) or version.split(".")[0] != current.split(".")[0]:
+    raise SystemExit("Only stable versions from this branch's SkiaSharp major are allowed")
+if current.startswith("2.") and version != "2.88.9":
+    raise SystemExit("SkiaSharp 2 is frozen at 2.88.9")
+base, revision = root.findtext(".//Version").rsplit(".", 1)
+angle = base.split("-", 1)[1]
+# ANGLE remains fixed: changing SkiaSharp must not silently change its toolchain.
+profile = json.loads(Path("build/linux-toolchain/sources.lock.json").read_text())
+if profile["angle_branch"] != angle:
+    raise SystemExit("ANGLE branch does not match the source lock")
+remote = "https://github.com/mono/SkiaSharp.git"
+refs = git("ls-remote", "--tags", remote, f"refs/tags/v{version}", f"refs/tags/v{version}^{{}}")
+if not refs:
+    raise SystemExit(f"No immutable upstream release tag for {version}; refusing a moving branch")
+lines = refs.splitlines()
+commit = next((x.split()[0] for x in lines if x.endswith("^{}")), lines[0].split()[0])
+with tempfile.TemporaryDirectory() as tmp:
+    git("init", "-q", tmp)
+    git("-C", tmp, "fetch", "-q", "--depth=1", remote, commit)
+    tree = git("-C", tmp, "ls-tree", "FETCH_HEAD", "externals/skia")
+    mode, kind, skia, name = tree.split()
+    if mode != "160000" or kind != "commit":
+        raise SystemExit("Skia source is not a pinned git submodule")
+profile.update(skiasharp_version=version, skiasharp_revision=commit, skia_revision=skia)
+Path(a.output).write_text(json.dumps(profile, indent=2) + "\n")
+package = f"{version}-{angle}.{revision}"
+print(json.dumps({"skiasharp_version": version, "package_version": package, "lock": profile}))