logiguard fork: GPUI xdg-activation keyboard-focus serial fix

Single-commit orphan branch: full zed-industries/zed @ 8c74db0 source tree
with a 3-file patch applied (no upstream history).

Patch (crates/gpui_linux/src/linux/wayland/):
  - serial.rs: add SerialKind::KeyboardEnter
  - client.rs: store wl_keyboard.enter serial; add latest_serial_of()
  - window.rs: activate() uses keyboard-enter serial (Mutter focus gate)

Mutter honors window activation only when the token carries the keyboard-
focus serial from wl_keyboard.enter; GPUI used a stale mouse-press serial.
See docs/tray-window-focus-wayland.md in logiguard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

nix/livekit-libwebrtc/0001-shared-libraries.patch

@@ -0,0 +1,17 @@
+--- a/BUILD.gn
++++ b/BUILD.gn
+@@ -143,8 +143,12 @@
+ # target_defaults and direct_dependent_settings.
+ config("common_inherited_config") {
+   defines = [ "PROTOBUF_ENABLE_DEBUG_LOGGING_MAY_LEAK_PII=0" ]
+-  cflags = []
+-  ldflags = []
++  cflags = [ "-fvisibility=default" ]
++  ldflags = [ "-lavutil", "-lavformat", "-lavcodec" ]
++
++  if (is_linux) {
++    ldflags += [ "-Wl,--version-script=" + rebase_path("//libwebrtc.version", root_build_dir) ]
++  }
+
+   if (rtc_objc_prefix != "") {
+     defines += [ "RTC_OBJC_TYPE_PREFIX=${rtc_objc_prefix}" ]

nix/livekit-libwebrtc/README.md

@@ -0,0 +1,7 @@
+# Vendored livekit-libwebrtc build
+
+The contents of this directory is vendored from [this nixpkgs
+PR](https://github.com/NixOS/nixpkgs/pull/478907).
+
+It should be removed as soon as said PR is merged and the new version of libwebrtc hits
+nixpkgs-unstable.

nix/livekit-libwebrtc/chromium-129-rust.patch

@@ -0,0 +1,21 @@
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index 45086d6838cac..81132ad8ecb31 100644
+--- a/build/config/compiler/BUILD.gn
++++ b/build/config/compiler/BUILD.gn
+@@ -1727,16 +1727,6 @@ config("runtime_library") {
+     configs += [ "//build/config/c++:runtime_library" ]
+   }
+ 
+-  # Rust and C++ both provide intrinsics for LLVM to call for math operations. We
+-  # want to use the C++ intrinsics, not the ones in the Rust compiler_builtins
+-  # library. The Rust symbols are marked as weak, so that they can be replaced by
+-  # the C++ symbols. This config ensures the C++ symbols exist and are strong in
+-  # order to cause that replacement to occur by explicitly linking in clang's
+-  # compiler-rt library.
+-  if (is_clang && !is_nacl && !is_cronet_build) {
+-    configs += [ "//build/config/clang:compiler_builtins" ]
+-  }
+-
+   # TODO(crbug.com/40570904): Come up with a better name for is POSIX + Fuchsia
+   # configuration.
+   if (is_posix || is_fuchsia) {

nix/livekit-libwebrtc/libwebrtc.version

@@ -0,0 +1,22 @@
+/* Linker version script for libwebrtc.so (Linux only).
+ *
+ * When libwebrtc.so is built with rtc_use_pipewire=true and
+ * -fvisibility=default, PipeWire lazy-load trampoline stubs (pw_*, spa_*)
+ * are exported as weak symbols. If the PipeWire ALSA plugin
+ * (libasound_module_pcm_pipewire.so) is later dlopen'd by libasound,
+ * the dynamic linker may resolve the plugin's pw_* references through
+ * libwebrtc.so's broken trampolines instead of the real libpipewire.so,
+ * causing a SIGSEGV (NULL function pointer dereference).
+ *
+ * This script hides only those third-party symbol namespaces while
+ * keeping every WebRTC / BoringSSL / internal symbol exported (which
+ * the Rust webrtc-sys bindings require).
+ */
+{
+  global:
+    *;
+
+  local:
+    pw_*;
+    spa_*;
+};

nix/livekit-libwebrtc/mkSystemLibraries.nix

@@ -0,0 +1,64 @@
+{
+  brotli,
+  fontconfig,
+  freetype,
+  harfbuzz,
+  icu,
+  jsoncpp,
+  libpng,
+  libwebp,
+  libxml2,
+  libxslt,
+  minizip,
+  ffmpeg_6,
+}:
+{
+  "brotli" = {
+    package = brotli;
+    path = "third_party/brotli/BUILD.gn";
+  };
+  "fontconfig" = {
+    package = fontconfig;
+    path = "third_party/fontconfig/BUILD.gn";
+  };
+  "freetype" = {
+    package = freetype;
+    path = "build/config/freetype/freetype.gni";
+  };
+  "harfbuzz-ng" = {
+    package = harfbuzz;
+    path = "third_party/harfbuzz-ng/harfbuzz.gni";
+  };
+  "jsoncpp" = {
+    package = jsoncpp;
+    path = "third_party/jsoncpp/BUILD.gn";
+  };
+  "icu" = {
+    package = icu;
+    path = "third_party/icu/BUILD.gn";
+  };
+  "libpng" = {
+    package = libpng;
+    path = "third_party/libpng/BUILD.gn";
+  };
+  "libwebp" = {
+    package = libwebp;
+    path = "third_party/libwebp/BUILD.gn";
+  };
+  "libxml" = {
+    package = libxml2;
+    path = "third_party/libxml/BUILD.gn";
+  };
+  "libxslt" = {
+    package = libxslt;
+    path = "third_party/libxslt/BUILD.gn";
+  };
+  "zlib" = {
+    package = minizip;
+    path = "third_party/zlib/BUILD.gn";
+  };
+  "ffmpeg" = {
+    package = ffmpeg_6;
+    path = "third_party/ffmpeg/BUILD.gn";
+  };
+}

nix/livekit-libwebrtc/package.nix

@@ -0,0 +1,353 @@
+{
+  stdenv,
+  clang,
+  gclient2nix,
+  lib,
+  gn,
+  fetchurl,
+  fetchpatch,
+  xcbuild,
+  python3,
+  ninja,
+  git,
+  cpio,
+  pkg-config,
+  glib,
+  alsa-lib,
+  pulseaudio,
+  nasm,
+  brotli,
+  fontconfig,
+  freetype,
+  harfbuzz,
+  icu,
+  jsoncpp,
+  libpng,
+  libwebp,
+  libxml2,
+  libxslt,
+  minizip,
+  ffmpeg_6,
+  libepoxy,
+  libgbm,
+  libGL,
+  libxcomposite,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxrandr,
+  libxtst,
+  libx11,
+  libxi,
+  pipewire,
+  xorg,
+}:
+let
+  platformMap = {
+    "x86_64" = "x64";
+    "i686" = "x86";
+    "arm" = "arm";
+    "aarch64" = "arm64";
+  };
+  cpuName = stdenv.hostPlatform.parsed.cpu.name;
+  gnArch = platformMap."${cpuName}" or (throw "unsupported arch ${cpuName}");
+  gnOs =
+    if stdenv.hostPlatform.isLinux then
+      "linux"
+    else if stdenv.hostPlatform.isDarwin then
+      "mac"
+    else
+      throw "unknown platform ${stdenv.hostPlatform.config}";
+  boringSslSymbols = fetchurl {
+    url = "https://raw.githubusercontent.com/livekit/rust-sdks/refs/tags/webrtc-dac8015-6/webrtc-sys/libwebrtc/boringssl_prefix_symbols.txt";
+    hash = "sha256-dAweArv8zjsFPENEKi9mNBQkt4y+hh3rCqG6QZjRC20=";
+  };
+  gnSystemLibraries = import ./mkSystemLibraries.nix {
+    inherit
+      brotli
+      fontconfig
+      freetype
+      harfbuzz
+      icu
+      jsoncpp
+      libpng
+      libwebp
+      libxml2
+      libxslt
+      minizip
+      ffmpeg_6
+      ;
+  };
+in
+stdenv.mkDerivation {
+  pname = "livekit-libwebrtc";
+  version = "137-unstable-2025-11-24";
+
+  # libwebrtc loads libEGL/libGL at runtime via dlopen() in the Wayland
+  # screencast path, so they are not visible as ordinary DT_NEEDED edges.
+  # Keep an explicit rpath so the shared object can resolve them at runtime.
+  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isLinux
+    "-rpath ${lib.makeLibraryPath [ libGL ]}";
+
+  # Prevent fixup from stripping the rpath above as "unused".
+  dontPatchELF = stdenv.hostPlatform.isLinux;
+
+  gclientDeps = gclient2nix.importGclientDeps ./sources.json;
+  sourceRoot = "src";
+
+  patches = [
+    # Adds missing dependencies to generated LICENSE
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/add_licenses.patch";
+      hash = "sha256-9A4KyRW1K3eoQxsTbPX0vOnj66TCs2Fxjpsu5wO8mGI=";
+    })
+    # Fixes the certificate chain, required for Let's Encrypt certs
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/ssl_verify_callback_with_native_handle.patch";
+      hash = "sha256-RBvRcJzoKItpEbqpe07YZe1D1ZVGS12EnDSISldGy+0=";
+    })
+    # Adds dependencies and features required by livekit
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/add_deps.patch";
+      hash = "sha256-DwRtGdU5sppmiFsVuyhJoVCQrRl5JFmZJfxgUPhYXBg=";
+    })
+    # Fix gcc-related errors
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/force_gcc.patch";
+      hash = "sha256-1d73Pi1HkbunjYvp1NskUNE4xXbCmnh++rC6NrCJHbY=";
+      stripLen = 1;
+      extraPrefix = "build/";
+    })
+    # fix a gcc-related dav1d compile option
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/david_disable_gun_source_macro.patch";
+      hash = "sha256-RCZpeeSQHaxkL3dY2oFFXDjYeU0KHw7idQFONGge8+0=";
+      stripLen = 1;
+      extraPrefix = "third_party/";
+    })
+    # Required for dynamically linking to ffmpeg libraries, exposing symbols,
+    # and hiding PipeWire symbols via version script (Linux only) to prevent
+    # SIGSEGV when ALSA's PipeWire plugin is loaded.
+    ./0001-shared-libraries.patch
+    # Borrow a patch from chromium to prevent a build failure due to missing libclang libraries
+    ./chromium-129-rust.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace .gn \
+      --replace-fail "vpython3" "python3"
+
+    substituteInPlace tools/generate_shim_headers/generate_shim_headers.py \
+      --replace-fail "OFFICIAL_BUILD" "GOOGLE_CHROME_BUILD"
+
+    substituteInPlace BUILD.gn \
+      --replace-fail "rtc_static_library" "rtc_shared_library" \
+      --replace-fail "complete_static_lib = true" ""
+
+    substituteInPlace webrtc.gni \
+      --replace-fail "!build_with_chromium && is_component_build" "false"
+
+    substituteInPlace rtc_tools/BUILD.gn \
+      --replace-fail "\":frame_analyzer\"," ""
+
+    for lib in ${toString (builtins.attrNames gnSystemLibraries)}; do
+      if [ -d "third_party/$lib" ]; then
+        find "third_party/$lib" -type f \
+          \! -path "third_party/$lib/chromium/*" \
+          \! -path "third_party/$lib/google/*" \
+          \! -path "third_party/harfbuzz-ng/utils/hb_scoped.h" \
+          \! -regex '.*\.\(gn\|gni\|isolate\)' \
+          \! -name 'LICENSE*' \
+          \! -name 'COPYING*' \
+          -delete
+      fi
+    done
+
+    # Trick the update_rust.py script into thinking we have *this specific* rust available.
+    # It isn't actually needed for the libwebrtc build, but GN will fail if it isn't there.
+    mkdir -p third_party/rust-toolchain
+    (python3 tools/rust/update_rust.py --print-package-version || true) \
+      | head -n 1 \
+      | sed 's/.* expected Rust version is \([^ ]*\) .*/rustc 1.0 1234 (\1 chromium)/' \
+      > third_party/rust-toolchain/VERSION
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    mkdir -p buildtools/linux64
+    ln -sf ${lib.getExe gn} buildtools/linux64/gn
+    cp ${./libwebrtc.version} libwebrtc.version
+    substituteInPlace build/toolchain/linux/BUILD.gn \
+      --replace 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p buildtools/mac
+    ln -sf ${lib.getExe gn} buildtools/mac/gn
+    chmod +x build/toolchain/apple/linker_driver.py
+    patchShebangs build/toolchain/apple/linker_driver.py
+    substituteInPlace build/toolchain/apple/toolchain.gni --replace-fail "/bin/cp -Rc" "cp -a"
+  '';
+
+  outputs = [
+    "dev"
+    "out"
+  ];
+
+  nativeBuildInputs =
+    (builtins.concatLists (
+      lib.mapAttrsToList (
+        _: library: if (library.package ? dev) then [ library.package.dev ] else [ ]
+      ) gnSystemLibraries
+    ))
+    ++ [
+      gclient2nix.gclientUnpackHook
+      gn
+      (python3.withPackages (ps: [ ps.setuptools ]))
+      ninja
+      git
+      cpio
+      pkg-config
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
+
+  buildInputs = [
+    nasm
+  ]
+  ++ (lib.mapAttrsToList (_: library: library.package) gnSystemLibraries)
+  ++ (lib.optionals stdenv.hostPlatform.isLinux [
+    glib
+    alsa-lib
+    pulseaudio
+    libepoxy
+    libgbm
+    libGL
+    libxcomposite
+    libxdamage
+    libxext
+    libxfixes
+    libxrandr
+    libxtst
+    pipewire
+    libx11
+    libxi
+  ]);
+
+  preConfigure = ''
+    echo "generate_location_tags = true" >> build/config/gclient_args.gni
+    echo "0" > build/util/LASTCHANGE.committime
+
+    python build/linux/unbundle/replace_gn_files.py \
+        --system-libraries ${toString (builtins.attrNames gnSystemLibraries)}
+  '';
+
+  gnFlags = [
+    "is_debug=false"
+    "rtc_include_tests=false"
+    ''target_os="${gnOs}"''
+    ''target_cpu="${gnArch}"''
+    "treat_warnings_as_errors=false"
+    "rtc_enable_protobuf=false"
+    "rtc_include_tests=false"
+    "rtc_build_examples=false"
+    "rtc_build_tools=false"
+    "rtc_libvpx_build_vp9=true"
+    "enable_libaom=true"
+    "use_dummy_lastchange=true"
+    "is_component_build=true"
+    "enable_stripping=true"
+    "rtc_use_h264=true"
+    "rtc_use_h265=true"
+    "use_custom_libcxx=false"
+    "use_rtti=true"
+  ]
+  ++ (lib.optionals stdenv.hostPlatform.isLinux [
+    "rtc_use_pipewire=true"
+    "symbol_level=0"
+    "enable_iterator_debugging=false"
+    "rtc_use_x11=true"
+    "use_sysroot=false"
+    "use_custom_libcxx_for_host=false"
+    "use_libcxx_modules=false"
+    "use_llvm_libatomic=false"
+    "is_clang=false"
+  ])
+  ++ (lib.optionals stdenv.hostPlatform.isDarwin [
+    ''mac_deployment_target="${stdenv.hostPlatform.darwinMinVersion}"''
+    "rtc_enable_symbol_export=true"
+    "rtc_enable_objc_symbol_export=true"
+    "rtc_include_dav1d_in_internal_decoder_factory=true"
+    "clang_use_chrome_plugins=false"
+    "use_lld=false"
+    ''clang_base_path="${clang}"''
+  ]);
+
+  ninjaFlags = [
+    ":default"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "api/audio_codecs:builtin_audio_decoder_factory"
+    "api/task_queue:default_task_queue_factory"
+    "sdk:native_api"
+    "sdk:default_codec_factory_objc"
+    "pc:peer_connection"
+    "sdk:videocapture_objc"
+    "sdk:mac_framework_objc"
+    "desktop_capture_objc"
+  ];
+
+  postBuild =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      objcopy --redefine-syms="${boringSslSymbols}" "libwebrtc.so"
+    ''
+    + ''
+      # Generate licenses
+      python3 "../../tools_webrtc/libs/generate_licenses.py" \
+          --target ${if stdenv.hostPlatform.isDarwin then ":webrtc" else ":default"} $PWD $PWD
+    '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    mkdir -p $dev/include
+
+    install -m0644 obj/webrtc.ninja obj/modules/desktop_capture/desktop_capture.ninja args.gn LICENSE.md $dev
+
+    pushd ../..
+    find . -name "*.h" -print | cpio -pd $dev/include
+    find . -name "*.inc" -print | cpio -pd $dev/include
+    popd
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    install -m0644 libwebrtc.so libthird_party_boringssl.so $out/lib
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    install -m0644 WebRTC.framework/Versions/A/WebRTC $out/lib/libwebrtc.dylib
+    install -m0644 libthird_party_boringssl.dylib $out/lib
+  ''
+  + ''
+    ln -s $out/lib $dev/lib
+
+    runHook postInstall
+  '';
+
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    boringssl="$out/lib/libthird_party_boringssl.dylib"
+    webrtc="$out/lib/libwebrtc.dylib"
+
+    install_name_tool -id "$boringssl" "$boringssl"
+    install_name_tool -id "$webrtc" "$webrtc"
+    install_name_tool -change @rpath/libthird_party_boringssl.dylib "$boringssl" "$webrtc"
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "WebRTC library used by livekit";
+    homepage = "https://github.com/livekit/rust-sdks/";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      WeetHet
+      niklaskorz
+    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+}

nix/livekit-libwebrtc/sources.json

@@ -0,0 +1,372 @@
+{
+    "src": {
+        "args": {
+            "hash": "sha256-+PgmOZD2Fi+SC66nguixhSwDsoXi4Sz693qOZZrLXm8=",
+            "owner": "webrtc-sdk",
+            "repo": "webrtc",
+            "rev": "624fa1dce239af785fc5fa9ca3b21b9250d3f835"
+        },
+        "fetcher": "fetchFromGitHub"
+    },
+    "src/base": {
+        "args": {
+            "hash": "sha256-MTG+pjMPY6/dqeEUy+xJVxPuICETtV98S+h/lFwGItg=",
+            "rev": "86c814633cf284bc8057a539bc722e2a672afe2f",
+            "url": "https://chromium.googlesource.com/chromium/src/base"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/build": {
+        "args": {
+            "hash": "sha256-qFZ12YFX4qxFEHU+VWOG+HDYYPXodgGz+iJ7WEc7cD8=",
+            "owner": "webrtc-sdk",
+            "repo": "build",
+            "rev": "01021e6c12636951a6b4e5342e16b2101b352367"
+        },
+        "fetcher": "fetchFromGitHub"
+    },
+    "src/buildtools": {
+        "args": {
+            "hash": "sha256-YWtmMKL1ydueNJ4XM/Pq+8OpqIFe5A6/vYyfZTv7/EI=",
+            "rev": "0f32cb9025766951122d4ed19aba87a94ded3f43",
+            "url": "https://chromium.googlesource.com/chromium/src/buildtools"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/testing": {
+        "args": {
+            "hash": "sha256-s65cABkyMo+FkAmilS67qM3VnrT7iYZg9scycrXzxyE=",
+            "rev": "a89c37d36bf80c05963727e28b9916835ae88d3a",
+            "url": "https://chromium.googlesource.com/chromium/src/testing"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party": {
+        "args": {
+            "hash": "sha256-q+xVOFlpC0vnLMSF9Z6ZRL7mb/cu8jBpsWjDNFFgiKM=",
+            "rev": "8062e0e102496ff14a8c58b586f014527424953d",
+            "url": "https://chromium.googlesource.com/chromium/src/third_party"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/boringssl/src": {
+        "args": {
+            "hash": "sha256-5Efqc8pLs4ZskXQGpFdTb5cw//v3+DR285m/DsrWSWA=",
+            "rev": "34492c89a8e381e0e856a686cc71b1eb5bd728db",
+            "url": "https://boringssl.googlesource.com/boringssl.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/breakpad/breakpad": {
+        "args": {
+            "hash": "sha256-0ynZuxIqBIpNkfD3Y9XdPFQr7HeQcsUO3lhnqvH+k8c=",
+            "rev": "232a723f5096ab02d53d87931efa485fa77d3b03",
+            "url": "https://chromium.googlesource.com/breakpad/breakpad.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/catapult": {
+        "args": {
+            "hash": "sha256-FIJZE1Qu1MLZA4qxB68k1NjhgSbFTjf57YF85JicVZw=",
+            "rev": "000f47cfa393d7f9557025a252862e2a61a60d44",
+            "url": "https://chromium.googlesource.com/catapult.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/ced/src": {
+        "args": {
+            "hash": "sha256-ySG74Rj2i2c/PltEgHVEDq+N8yd9gZmxNktc56zIUiY=",
+            "rev": "ba412eaaacd3186085babcd901679a48863c7dd5",
+            "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/clang-format/script": {
+        "args": {
+            "hash": "sha256-d9uweklBffiuCWEb03ti1eFLnMac2qRtvggzXY1n/RU=",
+            "rev": "37f6e68a107df43b7d7e044fd36a13cbae3413f2",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/colorama/src": {
+        "args": {
+            "hash": "sha256-6ZTdPYSHdQOLYMSnE+Tp7PgsVTs3U2awGu9Qb4Rg/tk=",
+            "rev": "3de9f013df4b470069d03d250224062e8cf15c49",
+            "url": "https://chromium.googlesource.com/external/colorama.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/compiler-rt/src": {
+        "args": {
+            "hash": "sha256-yo7BFGgwJNScsXwnCAu8gFBdZVS8/HJplzUk2e73mVg=",
+            "rev": "57213f125d03209892fed26189feb3b736e96735",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/crc32c/src": {
+        "args": {
+            "hash": "sha256-KBraGaO5LmmPP+p8RuDogGldbTWdNDK+WzF4Q09keuE=",
+            "rev": "d3d60ac6e0f16780bcfcc825385e1d338801a558",
+            "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/dav1d/libdav1d": {
+        "args": {
+            "hash": "sha256-+DY4p41VuAlx7NvOfXjWzgEhvtpebjkjbFwSYOzSjv4=",
+            "rev": "8d956180934f16244bdb58b39175824775125e55",
+            "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/depot_tools": {
+        "args": {
+            "hash": "sha256-DWQyYtpAAGiryeGJzIWlUwY5yn4cNwXY957vlPDUNak=",
+            "rev": "fa8fc854e1766b86f10c9a15902cf3cc23adaac2",
+            "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/ffmpeg": {
+        "args": {
+            "hash": "sha256-hNzQZQxaa2Wtl7GWWF852cFmmXy4pc15Pp0d59TTfnI=",
+            "rev": "01f23648c6b84de6c0f717fa4e1816f53b9ee72e",
+            "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/flatbuffers/src": {
+        "args": {
+            "hash": "sha256-tbc45o0MbMvK5XqRUJt5Eg8BU6+TJqlmwFgQhHq6wRM=",
+            "rev": "8db59321d9f02cdffa30126654059c7d02f70c32",
+            "url": "https://chromium.googlesource.com/external/github.com/google/flatbuffers.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/fontconfig/src": {
+        "args": {
+            "hash": "sha256-W5WIgC6A52kY4fNkbsDEa0o+dfd97Rl5NKfgnIRpI00=",
+            "rev": "14d466b30a8ab4a9d789977ed94f2c30e7209267",
+            "url": "https://chromium.googlesource.com/external/fontconfig.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/freetype/src": {
+        "args": {
+            "hash": "sha256-Vlin6Z+QisUyj6R+TclVOm8x6673YhUIWob9Ih6gzC8=",
+            "rev": "1da283b8ae6d6b94f34a5c4b8c1227adc9dbb1d8",
+            "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/fuzztest/src": {
+        "args": {
+            "hash": "sha256-L2QG0pUmGjGdtdlivxYfxSqO9YaVHpIT6lvJwBMTxMw=",
+            "rev": "b10387fdbbca18192f85eaa5323a59f44bf9c468",
+            "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/google_benchmark/src": {
+        "args": {
+            "hash": "sha256-cH8s1gP6kCcojAAfTt5iQCVqiAaSooNk4BdaILujM3w=",
+            "rev": "761305ec3b33abf30e08d50eb829e19a802581cc",
+            "url": "https://chromium.googlesource.com/external/github.com/google/benchmark.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/googletest/src": {
+        "args": {
+            "hash": "sha256-QT9PQ9bF+eCPfRLkcHpH4jc0UZfGPc98fHf8QDV5bZg=",
+            "rev": "cd430b47a54841ec45d64d2377d7cabaf0eba610",
+            "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/grpc/src": {
+        "args": {
+            "hash": "sha256-xivmP36VCSbiMAV3PDUjzCrF+AJzFXJdMe5e2q9yW/k=",
+            "rev": "957c9f95224b1e1318c0ecb98d0e7584ea5ccff2",
+            "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/gtest-parallel": {
+        "args": {
+            "hash": "sha256-VUuk5tBTh+aU2dxVWUF1FePWlKUJaWSiGSXk/J5zgHw=",
+            "rev": "96f4f904922f9bf66689e749c40f314845baaac8",
+            "url": "https://chromium.googlesource.com/external/github.com/google/gtest-parallel"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/harfbuzz-ng/src": {
+        "args": {
+            "hash": "sha256-lNnCtgIegUy4DLhYaGZXcEaFw83KWAHoKpz69AEsWp4=",
+            "rev": "9f83bbbe64654b45ba5bb06927ff36c2e7588495",
+            "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/icu": {
+        "args": {
+            "hash": "sha256-eGI/6wk6IOUPvX7pRTm4VJk1CqkkxalTu84L36i/D6k=",
+            "rev": "4c8cc4b365a505ce35be1e0bd488476c5f79805d",
+            "url": "https://chromium.googlesource.com/chromium/deps/icu.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/instrumented_libs": {
+        "args": {
+            "hash": "sha256-8kokdsnn5jD9KgM/6g0NuITBbKkGXWEM4BMr1nCrfdU=",
+            "rev": "69015643b3f68dbd438c010439c59adc52cac808",
+            "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/jsoncpp/source": {
+        "args": {
+            "hash": "sha256-bSLNcoYBz3QCt5VuTR056V9mU2PmBuYBa0W6hFg2m8Q=",
+            "rev": "42e892d96e47b1f6e29844cc705e148ec4856448",
+            "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libFuzzer/src": {
+        "args": {
+            "hash": "sha256-Lb+HczYax0T7qvC0/Nwhc5l2szQTUYDouWRMD/Qz7sA=",
+            "rev": "e31b99917861f891308269c36a32363b120126bb",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt/lib/fuzzer.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libaom/source/libaom": {
+        "args": {
+            "hash": "sha256-ngVZ+xK0b+jKUmawteQ7VFAQzoebX4jqZ3hP9pW+Q0Q=",
+            "rev": "a23a4799ec2d7dd6e436c7b64a34553773014ed7",
+            "url": "https://aomedia.googlesource.com/aom.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libc++/src": {
+        "args": {
+            "hash": "sha256-lqeuVUgeAKm1pxo+w1vyUbBkBXBzLCQ+Lfu44neKLPo=",
+            "rev": "917609c669e43edc850eeb192a342434a54e1dfd",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libc++abi/src": {
+        "args": {
+            "hash": "sha256-X9cAbyd8ZPSwqOGhPYwIZ6b9E3tVwAuAYZKMgbZQxgk=",
+            "rev": "f2a7f2987f9dcdf8b04c2d8cd4dcb186641a7c3e",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libjpeg_turbo": {
+        "args": {
+            "hash": "sha256-Ig+tmprZDvlf/M72/DTar2pbxat9ZElgSqdXdoM0lPs=",
+            "rev": "e14cbfaa85529d47f9f55b0f104a579c1061f9ad",
+            "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libsrtp": {
+        "args": {
+            "hash": "sha256-bkG1+ss+1a2rCHGwZjhvf5UaNVbPPZJt9HZSIPBKGwM=",
+            "rev": "a52756acb1c5e133089c798736dd171567df11f5",
+            "url": "https://chromium.googlesource.com/chromium/deps/libsrtp.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libunwind/src": {
+        "args": {
+            "hash": "sha256-XdFKn+cGOxA0fHkVMG9UAhCmpML44ocoyHB7XnumX7o=",
+            "rev": "81e2cb40a70de2b6978e6d8658891ded9a77f7e3",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libvpx/source/libvpx": {
+        "args": {
+            "hash": "sha256-NIGpzP6elcPScHJlZmnPHJdmXsuHcbuELT0C4Ha5PcA=",
+            "rev": "ff1d193f4b9dfa9b2ced51efbb6ec7a69e58e88c",
+            "url": "https://chromium.googlesource.com/webm/libvpx.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libyuv": {
+        "args": {
+            "hash": "sha256-b/EYCWBQvsNoGhea31DPBKpG8eouf0OBi5TgdHDHs9A=",
+            "rev": "1e40e34573c3861480d107cd4a4ce290df79951f",
+            "url": "https://chromium.googlesource.com/libyuv/libyuv.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/llvm-libc/src": {
+        "args": {
+            "hash": "sha256-yNNx3gOGafMNvZ+aebDKHVj6QM8g0zt0d69PWlWLkyk=",
+            "rev": "912274164f0877ca917c06e8484ad3be1784833a",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/lss": {
+        "args": {
+            "hash": "sha256-rhp4EcZYdgSfu9cqn+zxxGx6v2IW8uX8V+iA0UfZhFY=",
+            "rev": "ed31caa60f20a4f6569883b2d752ef7522de51e0",
+            "url": "https://chromium.googlesource.com/linux-syscall-support.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/nasm": {
+        "args": {
+            "hash": "sha256-neYrS4kQ76ihUh22Q3uPR67Ld8+yerA922YSZU1KxJs=",
+            "rev": "9f916e90e6fc34ec302573f6ce147e43e33d68ca",
+            "url": "https://chromium.googlesource.com/chromium/deps/nasm.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/openh264/src": {
+        "args": {
+            "hash": "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg=",
+            "rev": "652bdb7719f30b52b08e506645a7322ff1b2cc6f",
+            "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/perfetto": {
+        "args": {
+            "hash": "sha256-I0qiAh3VliVop+3S2/tP6VwCAJOk0Vu7xy8vHJZ1w2A=",
+            "rev": "a54dd38d60593129ae56d400f1a72860670abea4",
+            "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/protobuf-javascript/src": {
+        "args": {
+            "hash": "sha256-zq86SrDASl6aYPFPijRZp03hJqXUFz2Al/KkiNq7i0M=",
+            "rev": "eb785a9363664a402b6336dfe96aad27fb33ffa8",
+            "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/re2/src": {
+        "args": {
+            "hash": "sha256-f/k2rloV2Nwb0KuJGUX4SijFxAx69EXcsXOG4vo+Kis=",
+            "rev": "c84a140c93352cdabbfb547c531be34515b12228",
+            "url": "https://chromium.googlesource.com/external/github.com/google/re2.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/tools": {
+        "args": {
+            "hash": "sha256-kZFZl8SC9nZIIOVtNl/5H4huw6BCBsBkJVJ4gaUmly4=",
+            "rev": "ffcbc837bbb14d80d09147c2af5302ff6bd4bd69",
+            "url": "https://chromium.googlesource.com/chromium/src/tools"
+        },
+        "fetcher": "fetchFromGitiles"
+    }
+}

nix/livekit-libwebrtc/update.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p gitMinimal curl gojq gclient2nix
+
+set -eou pipefail
+package="livekit-libwebrtc"
+pkg_dir="$(dirname "$0")"
+nixpkgs="$(git rev-parse --show-toplevel)"
+
+gh-curl () {
+  curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "$1"
+}
+
+# Get the current version part before the "-unstable-" for the branch name.
+# To manually update to a new major version, you can also invoke the script
+# with the new major version, e.g., UPDATE_MAJOR_VERSION=137.
+old_version="${UPDATE_NIX_OLD_VERSION:-$(nix-instantiate --eval -E "(import \"$nixpkgs\" { }).$package.version" | tr -d '"')}"
+major_version="${UPDATE_MAJOR_VERSION:-${old_version%%-unstable-*}}"
+branch="m${major_version}_release"
+
+# Fetch the current HEAD commit of the release branch
+head="$(gh-curl "https://api.github.com/repos/webrtc-sdk/webrtc/git/refs/heads/$branch" | gojq '.object.sha' --raw-output)"
+if gojq -e ".src.args.rev == \"$head\"" "$pkg_dir/sources.json"; then
+  echo "$package is already up-to-date: $head"
+  exit 0
+fi
+
+# Get the commit's date for the version field
+date="$(gh-curl "https://api.github.com/repos/webrtc-sdk/webrtc/git/commits/$head" | gojq '.committer.date| split("T") | .[0]' --raw-output)"
+
+echo "Updating sources.json to $head"
+gclient2nix generate --root src "https://github.com/webrtc-sdk/webrtc@$head" > "$pkg_dir/sources.json"
+
+sed -i "s|$old_version|$major_version-unstable-$date|g" "$pkg_dir/package.nix"