Run two isolated persistent platform builds with 22 jobs each

.github/workflows/nuget-static-graphics-repack.yml

@@ -6,7 +6,7 @@ on:
       source_version:
         description: Existing package version containing the static libraries
         required: true
-        default: 4.150.1-7922.1
+        default: 3.119.4-7922.1
         type: string
       publish_to_nuget:
         description: Publish package to nuget.org

.github/workflows/static-graphics-linux-debian.yml

@@ -13,7 +13,7 @@ on:
     inputs:
       skiasharp_version:
         type: string
-        default: '4.150.1'
+        default: '3.119.4'
 
 permissions:
   contents: read

.github/workflows/static-graphics-linux.yml

@@ -13,7 +13,7 @@ on:
     inputs:
       skiasharp_version:
         type: string
-        default: '4.150.1'
+        default: '3.119.4'
 
 permissions:
   contents: read

.github/workflows/static-graphics-macos.yml

@@ -13,7 +13,7 @@ on:
     inputs:
       skiasharp_version:
         type: string
-        default: '4.150.1'
+        default: '3.119.4'
 
 permissions:
   contents: read

.github/workflows/static-graphics-musl.yml

@@ -13,7 +13,7 @@ on:
     inputs:
       skiasharp_version:
         type: string
-        default: '4.150.1'
+        default: '3.119.4'
 
 permissions:
   contents: read

.github/workflows/static-graphics-windows.yml

@@ -13,7 +13,7 @@ on:
     inputs:
       skiasharp_version:
         type: string
-        default: '4.150.1'
+        default: '3.119.4'
 
 permissions:
   contents: read

.github/workflows/static-graphics-zig-cross.yml

@@ -24,7 +24,7 @@ on:
       skiasharp_version:
         description: Locked SkiaSharp release profile
         type: string
-        default: '4.150.1'
+        default: '3.119.4'
 
 permissions:
   contents: read

.github/workflows/zig-recent-regression.yml

@@ -6,7 +6,7 @@ on:
       versions:
         description: JSON array of stable SkiaSharp versions from this branch major
         type: string
-        default: '["4.150.3","4.150.5","4.153.1"]'
+        default: '["3.119.2","3.119.4"]'
 
 permissions:
   contents: read

.woodpecker.yml

@@ -0,0 +1,22 @@
+when:
+  - event: [push, manual]
+    branch: skia3
+
+labels:
+  platform: linux/amd64
+  backend: local
+
+skip_clone: true
+
+steps:
+  - name: checkout
+    image: bash
+    commands:
+      - git init source
+      - git -C source remote add origin https://git.oeo.one/greepar/StaticLink.Avalonia.git
+      - git -C source fetch --depth=1 origin "$CI_COMMIT_SHA"
+      - git -C source checkout --detach FETCH_HEAD
+  - name: nine-platform-build-link-and-pack
+    image: bash
+    commands:
+      - bash source/scripts/woodpecker-cross-test.sh

NuGet/StaticGraphics/README.md

@@ -11,13 +11,13 @@ Choose the static graphics package that matches the Avalonia and SkiaSharp major
 | 11 | 2.88.9 | `2.88.9-7151.10` |
 | 11 | 3.119.4 | `3.119.4-7922.1` |
 | 12 | 3.119.4 | `3.119.4-7922.1` |
-| 12 | 4.150.1 | `4.150.1-7922.1` |
+| 12 | 3.119.4 | `3.119.4-7922.1` |
 
 Example:
 ```xml
 <ItemGroup>
   <PackageReference Include="Avalonia" Version="12.1.0" />
-  <PackageReference Include="StaticLink.Avalonia" Version="4.150.1-7922.1" />
+  <PackageReference Include="StaticLink.Avalonia" Version="3.119.4-7922.1" />
 </ItemGroup>
 ```
 

NuGet/StaticGraphics/StaticLink.Avalonia.csproj

@@ -6,7 +6,7 @@
         <IncludeBuildOutput>false</IncludeBuildOutput>
         <SuppressDependenciesWhenPacking>false</SuppressDependenciesWhenPacking>
         <PackageId>StaticLink.Avalonia</PackageId>
-        <Version>4.150.1-7922.2</Version>
+        <Version>3.119.4-7922.2</Version>
         <Authors>greepar</Authors>
         <Company>greepar</Company>
         <Description>Static SkiaSharp, HarfBuzzSharp, and ANGLE libraries for Avalonia NativeAOT single-file publishing.</Description>
@@ -19,7 +19,7 @@
     </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="SkiaSharp" Version="4.150.1" />
+        <PackageReference Include="SkiaSharp" Version="3.119.4" />
     </ItemGroup>
 
     <ItemGroup>

build/linux-toolchain/angle-linux.gn.in

@@ -21,3 +21,4 @@ clang_version = "19"
 
 # Chromium UI/ATK is not part of the standalone ANGLE library targets.
 use_glib = false
+use_libpci = false

build/linux-toolchain/sources.lock.json

@@ -1,7 +1,7 @@
 {
-  "skiasharp_version": "4.150.1",
-  "skiasharp_revision": "c3e4f4c20e1f23ab74d31a8838a5bd6dc55365f2",
+  "skiasharp_version": "3.119.4",
+  "skiasharp_revision": "f568ac94dd768ef9a2f593537cfde2dd0d348ef5",
   "angle_branch": "7922",
   "angle_revision": "7e08726e32026a0bbabd6ec8a1a90f5ab533ed66",
-  "skia_revision": "0aa2d542e833ffd1d4d1b68a5152375e7f65ce11"
+  "skia_revision": "7dbfc07dd33181f84e0958afb7ee805c6c769f0b"
 }

build/linux-toolchain/zig-cross.py

@@ -67,9 +67,9 @@ def compiler(config, tool, incoming):
         "-F", config["sdk"] + "/System/Library/Frameworks", "-Wno-elaborated-enum-base",
     ] if "macos" in target else []
     if config.get('linux_abi_headers'):
-        args += ['-I' + config['linux_abi_headers']]
+        args += ['-idirafter', config['linux_abi_headers']]
     if config.get('linux_headers'):
-        args += ['-I' + config['linux_headers'], '-I' + config['linux_headers'] + '/freetype2']
+        args += ['-idirafter', config['linux_headers'], '-idirafter', config['linux_headers'] + '/freetype2']
     if config.get('linux_sysroot') and '-c' not in incoming and '-o' in incoming:
         root = Path(config['linux_sysroot'])
         cpu = 'x86_64' if target.startswith('x86_64') else 'aarch64'
@@ -173,7 +173,10 @@ def execute(config, tool, incoming):
                 inputs.append(flag)
         if not output:
             raise SystemExit("Darwin libtool adapter needs -o")
-        command = [config["zig"], "ar", "--format=darwin", "rcs", output, *inputs]
+        libtool = shutil.which('llvm-libtool-darwin') or shutil.which('llvm-libtool-darwin-16')
+        if not libtool:
+            raise SystemExit('The pinned image must provide llvm-libtool-darwin to flatten archive dependencies')
+        command = [libtool, '-static', '-o', output, *inputs]
     if tool in ('ar', 'libtool'):
         # Never leave a truncated archive behind when disk/network/job failures
         # interrupt archiving. GN response files contain a complete member list.
@@ -252,13 +255,22 @@ def prepare(args):
         abi = output / 'include-linux'
         abi.mkdir(exist_ok=True)
         cpu = 'x86_64' if config['target'].startswith('x86_64') else 'aarch64'
-        for name in ('ffi.h', 'ffitarget.h'):
+        for name in ('ffi.h', 'ffitarget.h', 'expat.h', 'expat_external.h'):
             for prefix in (root / 'usr/include' / (cpu + '-linux-gnu'), root / 'usr/include'):
                 src = prefix / name
                 if src.is_file():
                     (abi / name).write_bytes(src.read_bytes())
                     break
         config['linux_abi_headers'] = str(abi)
+        gl_headers = abi / 'GL'
+        gl_headers.mkdir(exist_ok=True)
+        for prefix in (root / 'usr/include/GL', Path('/usr/include/GL')):
+            for header in prefix.glob('*.h'):
+                destination = gl_headers / header.name
+                if not destination.exists():
+                    destination.write_bytes(header.read_bytes())
+        if not (gl_headers / 'glx.h').is_file():
+            raise SystemExit('The pinned Linux SDK/image lacks GL/glx.h')
         pc = output / 'pkg-config'
         dirs = [root / 'usr/lib' / (cpu + '-linux-gnu') / 'pkgconfig', root / 'usr/lib/pkgconfig', root / 'usr/share/pkgconfig']
         pc.write_text('#!/bin/sh\nexport PKG_CONFIG_SYSROOT_DIR=' + shlex.quote(str(root)) + '\nexport PKG_CONFIG_LIBDIR=' + shlex.quote(':'.join(map(str, dirs))) + '\nexec /usr/bin/pkg-config "$@"\n')

build/release-tracks.json

@@ -1,5 +1,5 @@
 {
   "branches": [
-    {"major": 4, "ref": "skia4", "angle_branch": "7922", "revision": "2"}
+    {"major": 3, "ref": "skia3", "angle_branch": "7922", "revision": "2"}
   ]
 }

scripts/build-linux-static-graphics.sh

@@ -12,6 +12,7 @@ BUILD_JOBS="${BUILD_JOBS:-$(nproc)}"
 ANGLE_PATCH_DIR="${ANGLE_PATCH_DIR:-$ROOT_DIR/External/NativeStatic/patches}"
 LLVM_AR="${LLVM_AR:-llvm-ar-19}"
 SKIA_DEPS_RETRIES="${SKIA_DEPS_RETRIES:-3}"
+SOURCE_DOWNLOAD_ATTEMPTS="${SOURCE_DOWNLOAD_ATTEMPTS:-5}"
 
 usage() {
   cat <<'USAGE'
@@ -27,6 +28,7 @@ Environment:
   BUILD_JOBS          Ninja parallelism. Default: nproc
   ANGLE_PATCH_DIR     ANGLE patch directory. Default: External/NativeStatic/patches
   LLVM_AR             llvm-ar command used to expand thin archives. Default: llvm-ar-19
+  SOURCE_DOWNLOAD_ATTEMPTS  Maximum attempts per source download. Default: 5
 USAGE
 }
 
@@ -144,22 +146,37 @@ PY
   export PYTHONPATH="$module_dir:${PYTHONPATH:-}"
 }
 
+retry_source_download() {
+  local attempt status
+  if [[ ! "$SOURCE_DOWNLOAD_ATTEMPTS" =~ ^[1-9][0-9]*$ ]]; then
+    echo "SOURCE_DOWNLOAD_ATTEMPTS must be a positive integer" >&2
+    return 1
+  fi
+  for ((attempt = 1; attempt <= SOURCE_DOWNLOAD_ATTEMPTS; attempt++)); do
+    if "$@"; then
+      return 0
+    else
+      status=$?
+    fi
+    if ((attempt == SOURCE_DOWNLOAD_ATTEMPTS)); then
+      echo "Source download failed after $attempt attempts; stopping" >&2
+      return "$status"
+    fi
+    echo "Source download failed ($attempt/$SOURCE_DOWNLOAD_ATTEMPTS); retrying in $((attempt * 10)) seconds" >&2
+    sleep "$((attempt * 10))"
+  done
+}
+
 sync_skiasharp() {
   local src="$WORK_DIR/SkiaSharp-$SKIASHARP_VERSION"
-  if [[ -n "${SKIASHARP_REVISION:-}" ]]; then
-    if [[ ! -d "$src/.git" ]]; then
-      git init "$src" >&2
-      git -C "$src" remote add origin https://github.com/mono/SkiaSharp.git
-    fi
-    git -C "$src" fetch --depth 1 origin "$SKIASHARP_REVISION"
-    git -C "$src" checkout --detach FETCH_HEAD >&2
-  elif [[ ! -d "$src/.git" ]]; then
-    git clone --depth 1 --branch "release/$SKIASHARP_VERSION" https://github.com/mono/SkiaSharp.git "$src"
-  else
-    git -C "$src" fetch --depth 1 origin "release/$SKIASHARP_VERSION"
-    git -C "$src" checkout -q FETCH_HEAD
+  local revision="${SKIASHARP_REVISION:-release/$SKIASHARP_VERSION}"
+  if [[ ! -d "$src/.git" ]]; then
+    git init "$src" >&2 || return $?
+    git -C "$src" remote add origin https://github.com/mono/SkiaSharp.git || return $?
   fi
-  git -C "$src" submodule update --init --depth 1 externals/skia >&2
+  retry_source_download git -C "$src" fetch --depth 1 origin "$revision" >&2 || return $?
+  git -C "$src" checkout --detach FETCH_HEAD >&2 || return $?
+  retry_source_download git -C "$src" submodule update --init --depth 1 externals/skia >&2 || return $?
   echo "$src"
 }
 
@@ -266,19 +283,13 @@ EOF_ARGS
 
 sync_angle() {
   local src="$WORK_DIR/ANGLE-$ANGLE_BRANCH"
-  if [[ -n "${ANGLE_REVISION:-}" ]]; then
-    if [[ ! -d "$src/.git" ]]; then
-      git init "$src" >&2
-      git -C "$src" remote add origin https://github.com/google/angle.git
-    fi
-    git -C "$src" fetch --depth 1 origin "$ANGLE_REVISION"
-    git -C "$src" checkout --detach FETCH_HEAD >&2
-  elif [[ ! -d "$src/.git" ]]; then
-    git clone --depth 1 --branch "chromium/$ANGLE_BRANCH" https://github.com/google/angle.git "$src"
-  else
-    git -C "$src" fetch --depth 1 origin "chromium/$ANGLE_BRANCH"
-    git -C "$src" checkout -q FETCH_HEAD
+  local revision="${ANGLE_REVISION:-chromium/$ANGLE_BRANCH}"
+  if [[ ! -d "$src/.git" ]]; then
+    git init "$src" >&2 || return $?
+    git -C "$src" remote add origin https://github.com/google/angle.git || return $?
   fi
+  retry_source_download git -C "$src" fetch --depth 1 origin "$revision" >&2 || return $?
+  git -C "$src" checkout --detach FETCH_HEAD >&2 || return $?
   echo "$src"
 }
 

scripts/prepare-cross-sources.sh

@@ -26,9 +26,9 @@ ensure_depot_tools
 initialize_depot_tools_system_python "$DEPOT_TOOLS_DIR"
 patch_depot_tools_python_deps "$DEPOT_TOOLS_DIR"
 export VPYTHON_BYPASS="manually managed python not supported by chrome operations"
-skia_sharp="$(sync_skiasharp)"
-python3 "$SCRIPT_ROOT/build/linux-toolchain/sync-skia-deps.py" --source "$skia_sharp/externals/skia" --cache "$SCRIPT_ROOT/External/NativeStatic/.work/skia-deps"
-angle="$(sync_angle)"
+skia_sharp="$(sync_skiasharp)" || exit $?
+retry_source_download python3 "$SCRIPT_ROOT/build/linux-toolchain/sync-skia-deps.py" --source "$skia_sharp/externals/skia" --cache "$SCRIPT_ROOT/External/NativeStatic/.work/skia-deps"
+angle="$(sync_angle)" || exit $?
 project_patch="$SCRIPT_ROOT/External/NativeStatic/patches/angle-chromium-$ANGLE_BRANCH.patch"
 if git -C "$angle" apply --reverse --check "$project_patch" >/dev/null 2>&1; then
   :
@@ -50,7 +50,7 @@ target_os = ["linux", "win", "mac"]
 PY
 # Zig and the image's SDKs supply the compiler/runtime; skip native Xcode/MSVC
 # setup hooks while retaining the pinned source dependencies for every target.
-(cd "$angle" && gclient sync --nohooks --force)
+(cd "$angle" && retry_source_download gclient sync --nohooks --force)
 python3 - "$WORK_DIR/cross-sources.json" "$skia_sharp/externals/skia" "$angle" "$SOURCE_LOCK" <<'PY'
 import json, sys
 from pathlib import Path

scripts/woodpecker-cross-test.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TOOLCHAIN_IMAGE="ghcr.io/greepar/staticlink.avalonia-zig@sha256:a88b5ea9f76f659978cda36dda06233d7fdc9121046eedf945044fc908d24b85"
+export CROSS_RID=linux-x64
+AGENT_HOME="$(getent passwd "$(id -u)" | cut -d: -f6)"
+if [ -z "$AGENT_HOME" ] || [ "$AGENT_HOME" = / ]; then
+  echo "Cannot find a persistent home directory for the agent user" >&2
+  exit 1
+fi
+CACHE_KEY="$(printf '%s\n' "${CI_REPO_OWNER:?}/${CI_REPO_NAME:?}" "${CI_COMMIT_BRANCH:?}" "$TOOLCHAIN_IMAGE" "$CROSS_RID" | sha256sum | cut -c1-24)"
+CACHE_ROOT="$AGENT_HOME/.cache/staticlink-woodpecker/$CACHE_KEY"
+RESULTS="$AGENT_HOME/staticlink-ci-artifacts/${CI_REPO_OWNER}/${CI_REPO_NAME}/${CI_COMMIT_BRANCH}/${CI_PIPELINE_NUMBER:?}"
+mkdir -p "$CACHE_ROOT"
+exec 9>"$CACHE_ROOT/build.lock"
+echo "Waiting for exclusive access to persistent cache: $CACHE_ROOT"
+flock 9
+if [ ! -d "$CACHE_ROOT/source/.git" ]; then
+  git clone --no-hardlinks "$SCRIPT_ROOT" "$CACHE_ROOT/source"
+fi
+git -C "$CACHE_ROOT/source" fetch --depth=1 "$SCRIPT_ROOT" HEAD
+git -C "$CACHE_ROOT/source" checkout --force --detach FETCH_HEAD
+cd "$CACHE_ROOT/source"
+cp build/linux-toolchain/sources.lock.json build/linux-toolchain/release.lock.json
+mkdir -p "$RESULTS/environment"
+df -h .
+free -h
+command -v docker
+docker version
+if [ "$(docker info --format '{{.OSType}}/{{.Architecture}}')" != "linux/x86_64" ]; then
+  echo "Requires a Linux x86_64 Docker daemon on the WSL agent" >&2
+  exit 1
+fi
+AVAILABLE_KB="$(df -Pk . | awk 'NR == 2 {print $4}')"
+if [ "$AVAILABLE_KB" -lt 41943040 ]; then
+  echo "Need at least 40 GiB free before pulling the toolchain and compiling; more is recommended" >&2
+  exit 1
+fi
+echo "Persistent test results: $RESULTS"
+exec > >(tee "$RESULTS/build.log") 2>&1
+trap 'result=$?; trap - EXIT; printf "%s\n" "$result" > "$RESULTS/exit-code"; echo "Results retained at $RESULTS"; exit "$result"' EXIT
+git rev-parse HEAD > "$RESULTS/commit"
+printf '%s\n' "$TOOLCHAIN_IMAGE" > "$RESULTS/toolchain-image"
+docker pull "$TOOLCHAIN_IMAGE"
+docker run --rm --user "$(id -u):$(id -g)" \
+  -e HOME=/tmp -e DOTNET_CLI_HOME=/tmp -e ZIG_GLOBAL_CACHE_DIR=/tmp/zig-cache \
+  -v "$RESULTS/environment:/validation" --entrypoint python3 \
+  "$TOOLCHAIN_IMAGE" /opt/staticlink/validate-toolchain.py \
+  --output /validation --rids '[]'
+mkdir -p External/NativeStatic/.work/home
+docker run --rm --user "$(id -u):$(id -g)" \
+  -e HOME=/src/External/NativeStatic/.work/home -e CROSS_RID \
+  -e CCACHE_DIR=/src/External/NativeStatic/.work/ccache -e CCACHE_MAXSIZE=1G \
+  -e ZIG_GLOBAL_CACHE_DIR=/src/External/NativeStatic/.work/zig-global \
+  -v "$PWD:/src" -v "$RESULTS:/results" -w /src --entrypoint bash "$TOOLCHAIN_IMAGE" -c '
+    set -euo pipefail
+    export SOURCE_LOCK=/src/build/linux-toolchain/release.lock.json
+    source scripts/prepare-cross-sources.sh
+    python3 scripts/woodpecker-nine-platforms.py \
+      --sources-manifest "$WORK_DIR/cross-sources.json" --results /results
+  '

scripts/woodpecker-nine-platforms.py

@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+import argparse
+from concurrent.futures import ThreadPoolExecutor, as_completed
+import hashlib
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import time
+import zipfile
+
+RIDS = (
+    'osx-arm64', 'osx-x64', 'linux-x64', 'linux-arm64',
+    'linux-musl-x64', 'linux-musl-arm64', 'win-x64', 'win-x86', 'win-arm64',
+)
+
+
+def run(command, logfile, rid=None, env=None):
+    prefix = f'[{rid}] ' if rid else ''
+    print(prefix + '+ ' + ' '.join(map(str, command)), flush=True)
+    with logfile.open('a') as output:
+        process = subprocess.Popen(list(map(str, command)), stdout=subprocess.PIPE,
+                                   stderr=subprocess.STDOUT, text=True, env=env,
+                                   errors='replace')
+        try:
+            for line in process.stdout:
+                print(prefix + line, end='', flush=True)
+                output.write(line)
+        except BaseException:
+            process.terminate()
+            process.wait()
+            raise
+        return process.wait()
+
+
+def isolate_sources(manifest, rid):
+    sources = json.loads(manifest.read_text())
+    source_lock = Path(sources['source_lock'])
+    version = hashlib.sha256(source_lock.read_bytes()).hexdigest()[:16]
+    workspace = Path('External/NativeStatic/.work/parallel-sources').resolve() / version / rid
+    workspace.mkdir(parents=True, exist_ok=True)
+    isolated_manifest = workspace / 'cross-sources.json'
+    if isolated_manifest.is_file():
+        return isolated_manifest, workspace
+    for incomplete in (workspace / 'SkiaSharp', workspace / 'ANGLE'):
+        if incomplete.exists():
+            shutil.rmtree(incomplete)
+    skia = Path(sources['skia'])
+    angle = Path(sources['angle'])
+    parent = workspace / 'SkiaSharp'
+    isolated_skia = parent / 'externals/skia'
+    isolated_angle = workspace / 'ANGLE'
+    for original, destination in ((skia.parent.parent, parent),
+                                  (skia, isolated_skia), (angle, isolated_angle)):
+        if not (destination / '.git').is_dir():
+            destination.parent.mkdir(parents=True, exist_ok=True)
+            subprocess.run(['git', 'clone', '--shared', '--no-checkout', str(original),
+                            str(destination)], check=True)
+    ignored = shutil.ignore_patterns('.git', 'out', 'staticlink_zig_*')
+    for original, destination in ((skia, isolated_skia), (angle, isolated_angle)):
+        shutil.copytree(original, destination, dirs_exist_ok=True, symlinks=True,
+                        ignore=ignored)
+    sources.update(skia=str(isolated_skia), angle=str(isolated_angle),
+                   angle_gn=str(isolated_angle / Path(sources['angle_gn']).relative_to(angle)))
+    isolated_manifest.write_text(json.dumps(sources, indent=2) + '\n')
+    return isolated_manifest, workspace
+
+
+def build_target(rid, args, lock, jobs):
+    print(f'=== {rid}: compile and link with {jobs} jobs ===', flush=True)
+    started = time.monotonic()
+    logfile = args.results / (rid + '.log')
+    status = 1
+    failure = None
+    try:
+        manifest, workspace = isolate_sources(args.sources_manifest, rid)
+        env = os.environ.copy()
+        env['ZIG_GLOBAL_CACHE_DIR'] = str(workspace / 'zig-global')
+        libraries = Path('External/NativeStatic/zig-cross') / lock['skiasharp_version'] / rid
+        native = Path('External/NativeStatic') / rid / 'native'
+        command = [sys.executable, 'build/linux-toolchain/build-cross.py',
+                   '--target', rid, '--sources-manifest', manifest,
+                   '--work', workspace / 'toolchains',
+                   '--output', libraries, '--jobs', str(jobs)]
+        status = run(command, logfile, rid, env)
+        if status == 0:
+            status = run([sys.executable, 'build/linux-toolchain/package-zig.py',
+                          '--rid', rid, '--input', libraries, '--output', native],
+                         logfile, rid, env)
+        if status == 0:
+            shutil.copytree(native, args.results / rid / 'native', dirs_exist_ok=True)
+            shutil.copytree(libraries / 'link-tests', args.results / rid / 'link-tests',
+                            dirs_exist_ok=True)
+    except Exception as error:
+        status = 1
+        failure = f'{type(error).__name__}: {error}'
+        print(f'[{rid}] {failure}', flush=True)
+    print(f'=== {rid}: {"PASS" if status == 0 else "FAIL"} ===', flush=True)
+    return {'exit_code': status, 'passed': status == 0, 'error': failure,
+            'elapsed_seconds': round(time.monotonic() - started, 1)}
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--sources-manifest', type=Path, required=True)
+    parser.add_argument('--results', type=Path, required=True)
+    args = parser.parse_args()
+    args.results.mkdir(parents=True, exist_ok=True)
+    lock = json.loads(Path('build/linux-toolchain/release.lock.json').read_text())
+    processors = int(subprocess.check_output(['nproc'], text=True).strip())
+    workers = min(2, processors)
+    jobs = min(22, max(1, processors // workers))
+    report = {'sources': lock, 'jobs': jobs, 'parallel_platforms': workers,
+              'targets': {}, 'package': 'not-built',
+              'runtime_tests': 'not performed; cross compilation and executable linking only'}
+    descriptor = args.results / 'nine-platform-results.json'
+
+    def save():
+        descriptor.write_text(json.dumps(report, indent=2) + '\n')
+
+    save()
+    print(f'Parallel platforms: {workers}; compile jobs per platform: {jobs}', flush=True)
+    with ThreadPoolExecutor(max_workers=workers) as executor:
+        pending = {executor.submit(build_target, rid, args, lock, jobs): rid for rid in RIDS}
+        for future in as_completed(pending):
+            report['targets'][pending[future]] = future.result()
+            save()
+
+    failed = [rid for rid in RIDS if not report['targets'][rid]['passed']]
+    if failed:
+        print('Failed platforms: ' + ', '.join(failed), flush=True)
+        return 1
+    os.environ['SOURCE_LOCK_JSON'] = json.dumps(lock)
+    os.environ['PACKAGE_VERSION'] = lock['skiasharp_version'] + '-' + lock['angle_branch'] + '.2'
+    logfile = args.results / 'pack.log'
+    status = run([sys.executable, 'scripts/apply-release-version.py'], logfile)
+    if status == 0:
+        status = run(['dotnet', 'pack', 'NuGet/StaticGraphics/StaticLink.Avalonia.csproj',
+                      '-c', 'Release', '-o', args.results / 'nuget'], logfile)
+    if status == 0:
+        package = next((args.results / 'nuget').glob('*.nupkg'))
+        with zipfile.ZipFile(package) as archive:
+            names = set(archive.namelist())
+        required = {'buildTransitive/StaticLink.Avalonia.props',
+                    'buildTransitive/StaticLink.Avalonia.targets'}
+        required.update('static/' + rid + '/native/' +
+                        ('skia.lib' if rid.startswith('win-') else 'libskia.a') for rid in RIDS)
+        if not required.issubset(names) or any('\\' in name for name in names):
+            print('NuGet package is missing target archives or has non-portable paths', flush=True)
+            status = 1
+    report['package'] = 'passed' if status == 0 else 'failed'
+    save()
+    print('Nine-platform build/link/package: ' + report['package'], flush=True)
+    return status
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())