feat: make client sources upstream-independent

[bashrusakh]

Summary

• Replaces the libs/hbb_common submodule with tracked source.
• Migrates locked Cargo git package roots and Flutter git packages to owned local paths.
• Localizes the TopMostWindow workflow source and preserves the existing build hardening.
• Adds fail-closed source ownership, Cargo source, vendor provenance, integrity, and workflow validation.
• Preserves canonical vendor line endings for the intentional CRLF vendor files.
• Integrates the current active workflow base rustqs/workflows at e5e196651b7a288a9153f77ea0d15be61482c77c after PR workflow: sync active branch with fork master for 1.4.9 #6.
• Synchronizes tracked libs/hbb_common with verified active-base commit f124c0a5d49a4a13381902124b65364ff28fa541, retaining the upstream-independent tracked-source layout.

Scope and limitations

This PR covers the source-ownership migration and validation scaffolding. It does not claim final offline independence:

• the full repository-relative Cargo registry vendor/ tree is intentionally not included;
• Flutter dependency/build validation is deferred to GitHub Actions/F-Droid workflows;
• no accepted network-isolated build matrix has been performed;
• copied hwcodec SDK/SDL inputs remain subject to maintainer redistribution/license review;
• inherited/copied third-party whitespace remains present in the historical source migration.

Merge resolution

The PR was integrated with the active workflow base without reverting its source-ownership goal:

• libs/hbb_common remains tracked source, synchronized to the active base's verified f124c0a5 contents;
• the source includes wayland_probe, protobuf switch_code, and the 256 MiB zstd decompression bound;
• local Flutter and Cargo sources were retained;
• the active pinned workflow checkout was preserved;
• the active workflow's fuser Git source was not reintroduced into the independent-source dependency graph.

Validation

Passed locally:

• python3 -m unittest scripts/test-check-flutter-source-ownership.py -v — unit tests;
• python3 scripts/check-cargo-git-sources.py — 54 manifests and 9 lockfiles;
• cargo metadata --locked --no-deps --format-version 1;
• cargo check --locked -p hbb_common --features wayland_probe;
• cargo test --locked -p hbb_common — 101 passed;
• focused YAML, lockfile, workflow, provenance, artifact, and negative integrity checks;
• portable reproducibility tests — 8/8 passed;
• merge conflict and working-tree checks — no unmerged paths; clean tree.

Blocked or still open:

• full Flutter source-ownership verification fails on the pre-existing third_party/flutter/window_size mismatch: 175 files / 796365 bytes vs expected 181 / 797361; the six missing files are ignored generated macOS example files;
• vendor provenance checks require refreshed evidence and currently report stale Cargo.lock/Cargo.toml hashes plus missing bindgen 0.72.1 evidence;
• cargo check --locked -p scrap --features drm requires unavailable local glib-2.0 system metadata;
• full CI/build execution and the registry-vendor/offline matrix remain open gates;
• strict total source independence still has the inherited pinned rustdesk-org/libdrmtap fetch in build.py:395-407.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d114d6b3-a4d8-4e68-9d13-b254818fe642

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}