ci: separate rustdesk-unattended-wayland deb for the drm feature

.github/workflows/flutter-build.yml

@@ -1679,6 +1679,23 @@ jobs:
                 mv "$name" /workspace/"${name%%.rpm}-suse.rpm"
             done
 
+            # --- opt-in unattended-wayland (DRM/KMS) variant: a separate deb ---
+            # Ships the privileged drmtap-helper so enabling consent-free capture
+            # is an explicit install choice (the package name states what it does).
+            # Built last so the drm relink can't leak into the stock deb/rpm above.
+            # x86_64 only (the unattended/kiosk/server use case); the package
+            # Conflicts/Replaces the stock rustdesk package (install one or other).
+            if [[ "${{ matrix.job.arch }}" == "x86_64" ]]; then
+              pushd /workspace
+              echo -e "start packaging unattended-wayland (DRM) deb"
+              cargo build --locked --lib $JOBS --features hwcodec,flutter,unix-file-copy-paste,drm --release
+              python3 ./build.py --flutter --drm --skip-cargo
+              for name in rustdesk-unattended-wayland*??.deb; do
+                mv "$name" "${name%%.deb}-${{ matrix.job.arch }}.deb"
+              done
+              popd
+            fi
+
       - name: Publish debian/rpm package
         if: env.UPLOAD_ARTIFACT == 'true'
         uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
@@ -1696,6 +1713,13 @@ jobs:
           name: rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}.deb
           path: rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}.deb
 
+      - name: Upload unattended-wayland deb
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: matrix.job.arch == 'x86_64' && env.UPLOAD_ARTIFACT == 'true'
+        with:
+          name: rustdesk-unattended-wayland-${{ env.VERSION }}-${{ matrix.job.arch }}.deb
+          path: rustdesk-unattended-wayland-${{ env.VERSION }}-${{ matrix.job.arch }}.deb
+
       # only x86_64 for arch since we can not find newest arm64 docker image to build
       # old arch image does not make sense for arch since it is "arch" which always update to date
       # and failed to makepkg arm64 on x86_64

Cargo.toml

@@ -179,7 +179,7 @@ ttf-parser = "0.25"
 [target.'cfg(target_os = "linux")'.dependencies]
 # Direct dep so build.rs receives DEP_DRMTAP_HELPER_BIN via the `links` mechanism.
 # Exact pin: the helper is a privileged TCB component, keep it on the audited version.
-libdrmtap-sys = { version = "=0.4.4", optional = true }
+libdrmtap-sys = { version = "=0.4.5", optional = true }
 libxdo-sys = "0.11"
 psimple = { package = "libpulse-simple-binding", version = "2.27" }
 pulse = { package = "libpulse-binding", version = "2.27" }

build.py

@@ -297,22 +297,29 @@ def get_features(args):
     return features
 
 
-def generate_control_file(version, extra_depends=""):
+def generate_control_file(version, extra_depends="", package_name="rustdesk"):
     control_file_path = "../res/DEBIAN/control"
     system2('/bin/rm -rf %s' % control_file_path)
 
-    content = """Package: rustdesk
+    # An alternative-build package (e.g. the opt-in unattended-wayland / DRM
+    # variant) installs the same files as the stock `rustdesk` package, so it
+    # must conflict with / replace it: you install one OR the other, not both.
+    variant_control = ""
+    if package_name != "rustdesk":
+        variant_control = "Conflicts: rustdesk\nReplaces: rustdesk\nProvides: rustdesk\n"
+
+    content = """Package: %s
 Section: net
 Priority: optional
 Version: %s
 Architecture: %s
 Maintainer: rustdesk <info@rustdesk.com>
 Homepage: https://rustdesk.com
-Depends: libgtk-3-0t64 | libgtk-3-0, libxcb-randr0, libxdo3 | libxdo4, libxfixes3, libxcb-shape0, libxcb-xfixes0, libasound2t64 | libasound2, libsystemd0, curl, libva2, libva-drm2, libva-x11-2, libgstreamer-plugins-base1.0-0, libpam0g, gstreamer1.0-pipewire%s%s
+%sDepends: libgtk-3-0t64 | libgtk-3-0, libxcb-randr0, libxdo3 | libxdo4, libxfixes3, libxcb-shape0, libxcb-xfixes0, libasound2t64 | libasound2, libsystemd0, curl, libva2, libva-drm2, libva-x11-2, libgstreamer-plugins-base1.0-0, libpam0g, gstreamer1.0-pipewire%s%s
 Recommends: libayatana-appindicator3-1
 Description: A remote control software.
 
-""" % (version, get_deb_arch(), get_deb_extra_depends(), extra_depends)
+""" % (package_name, version, get_deb_arch(), variant_control, get_deb_extra_depends(), extra_depends)
     file = open(control_file_path, "w")
     file.write(content)
     file.close()
@@ -369,17 +376,22 @@ def build_flutter_deb(version, features):
         system2('mkdir -p tmpdeb/usr/lib/rustdesk')
         system2('cp ../target/release/drmtap-helper tmpdeb/usr/lib/rustdesk/drmtap-helper')
 
+    # A DRM build ships as a separately-named, opt-in package so installing it is
+    # an explicit choice — the package name itself states what it enables. It is
+    # an alternative build of the same app, so generate_control_file marks it
+    # Conflicts/Replaces/Provides rustdesk (install one or the other).
+    package_name = 'rustdesk-unattended-wayland' if ships_helper else 'rustdesk'
     system2('mkdir -p tmpdeb/DEBIAN')
     # postinst runs setcap (from libcap2-bin) on the helper; make it a hard
     # dependency so a DRM package can't install an unusable, cap-less helper.
-    generate_control_file(version, ", libcap2-bin" if ships_helper else "")
+    generate_control_file(version, ", libcap2-bin" if ships_helper else "", package_name)
     system2('cp -a ../res/DEBIAN/* tmpdeb/DEBIAN/')
     md5_file_folder("tmpdeb/")
     system2('dpkg-deb -b tmpdeb rustdesk.deb;')
 
     system2('/bin/rm -rf tmpdeb/')
     system2('/bin/rm -rf ../res/DEBIAN/control')
-    os.rename('rustdesk.deb', '../rustdesk-%s.deb' % version)
+    os.rename('rustdesk.deb', '../%s-%s.deb' % (package_name, version))
     os.chdir("..")
 
 

libs/scrap/Cargo.toml

@@ -56,7 +56,7 @@ pkg-config = { version = "0.3.27", optional = true }
 # DRM/KMS capture bindings (statically embeds the libdrmtap C sources).
 # Enabled via the `drm` feature; not required for PipeWire/X11-only builds.
 # Exact pin: the helper is a privileged TCB component, keep it on the audited version.
-libdrmtap-sys = { version = "=0.4.4", optional = true }
+libdrmtap-sys = { version = "=0.4.5", optional = true }
 dbus = { version = "0.9", optional = true }
 tracing = { version = "0.1", optional = true }
 gstreamer = { version = "0.16", optional = true }