Update to 0.11.2

Prepare for ffmpeg 9 update

.gitignore

@@ -4,3 +4,13 @@
 /waypipe-v0.7.1.tar.gz
 /waypipe-v0.8.0.tar.gz
 /waypipe-v0.8.2.tar.gz
+/waypipe-v0.8.4.tar.gz
+/waypipe-v0.8.6.tar.gz
+/waypipe-v0.9.0.tar.gz
+/waypipe-v0.9.1.tar.gz
+/waypipe-v0.10.4.tar.gz
+/waypipe-v0.10.5.tar.gz
+/waypipe-v0.10.6.tar.gz
+/waypipe-v0.11.0.tar.gz
+/waypipe-v0.11.1.tar.gz
+/waypipe-v0.11.2.tar.gz

0001-Cargo.toml-features-remove-test_proto-from-defaults.patch

@@ -0,0 +1,25 @@
+From fa4d12296de749eafb06f8dfb7e53a7ce8699876 Mon Sep 17 00:00:00 2001
+From: Dominique Martinet <asmadeus@codewreck.org>
+Date: Sun, 7 Dec 2025 11:57:55 +0000
+Subject: [PATCH 1/2] Cargo.toml: features: remove test_proto from defaults
+
+---
+ Cargo.toml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Cargo.toml b/Cargo.toml
+index 9213b3a94500..4d5fb42494b9 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -20,7 +20,7 @@ path = "src/test_proto.rs"
+ required-features = ["test_proto"]
+ 
+ [features]
+-default = ["video", "dmabuf", "lz4", "zstd", "gbmfallback", "test_proto"]
++default = ["video", "dmabuf", "lz4", "zstd", "gbmfallback"]
+ video = ["dep:waypipe-ffmpeg-wrapper", "dep:waypipe-shaders", "dmabuf"]
+ dmabuf = ["dep:ash"]
+ lz4 = ["dep:waypipe-lz4-wrapper"]
+-- 
+2.52.0
+

0002-Cargo.toml-features-remove-video-from-defaults-for-r.patch

@@ -0,0 +1,26 @@
+From eed41ad0ef6ae0784b30df8e20b7293846610f23 Mon Sep 17 00:00:00 2001
+From: Dominique Martinet <asmadeus@codewreck.org>
+Date: Sun, 7 Dec 2025 11:58:21 +0000
+Subject: [PATCH 2/2] Cargo.toml: features: remove video from defaults (for
+ rhel)
+
+---
+ Cargo.toml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Cargo.toml b/Cargo.toml
+index 4d5fb42494b9..75e4845750af 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -20,7 +20,7 @@ path = "src/test_proto.rs"
+ required-features = ["test_proto"]
+ 
+ [features]
+-default = ["video", "dmabuf", "lz4", "zstd", "gbmfallback"]
++default = ["dmabuf", "lz4", "zstd", "gbmfallback"]
+ video = ["dep:waypipe-ffmpeg-wrapper", "dep:waypipe-shaders", "dmabuf"]
+ dmabuf = ["dep:ash"]
+ lz4 = ["dep:waypipe-lz4-wrapper"]
+-- 
+2.52.0
+

changelog

@@ -0,0 +1,72 @@
+* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.6-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sat Sep 30 2023 Neal Gompa <ngompa@fedoraproject.org> - 0.8.6-4
+- Enable video support for non-RHEL (#2241572)
+
+* Mon Sep 11 2023 Olivier Fourdan <ofourdan@redhat.com> - 0.8.6-3
+- migrated to SPDX license
+
+* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.6-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Sun Apr 09 2023 Dominique Martinet <asmadeus@codewreck.org> - 0.8.6-1
+- Update to 0.8.6
+
+* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Wed Nov 02 2022 Olivier Fourdan <ofourdan@redhat.com> - 0.8.4-1
+- Update to 0.8.4
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Tue Apr 05 2022 Olivier Fourdan <ofourdan@redhat.com> - 0.8.2-1
+- Update to 0.8.2
+
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Sat Apr 03 2021 Dominique Martinet <asmadeus@codewreck.org> - 0.8.0-1
+- Update to 0.8.0
+
+* Fri Feb 19 2021 Olivier Fourdan <ofourdan@redhat.com> - 0.7.1-3
+- Provide a pre-built man page on RHEL to avoid pulling scdoc
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Fri Nov 06 2020 Dominique Martinet <asmadeus@codewreck.org> - 0.7.1-1
+- Update to 0.7.1
+
+* Tue Nov 03 2020 Dominique Martinet <asmadeus@codewreck.org> - 0.7.0-1
+- Update to version 0.7.0
+
+* Mon Sep 28 2020 Jeff Law <law@redhat.com> - 0.6.1-7
+- Re-enable LTO as upstream GCC target/96939 has been fixed
+
+* Mon Aug 10 2020 Jeff Law <law@redhat.com> - 0.6.1-6
+- Disable LTO for now.
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.1-5
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.1-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon May 11 2020 Dominique Martinet <asmadeus@codewreck.org> - 0.6.1-3
+- Fix FTBS (test failure)
+
+* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Wed Aug 28 2019 Lubomir Rintel <lkundrak@v3.sk> - 0.6.1-1
+- Update to version 0.6.1
+
+* Thu Aug 22 2019 Lubomir Rintel <lkundrak@v3.sk> - 0.6.0-1
+- Initial packaging

sources

@@ -1 +1 @@
-SHA512 (waypipe-v0.8.2.tar.gz) = c942b04a1f8cea60b226533b3c300120257d1264e3c0ed929cc79e35a3d8ba7ca215e52b46fc004a042016f5d492fa0291cec3a547b696fad4c99ae7bf5544bf
+SHA512 (waypipe-v0.11.2.tar.gz) = e1b475f6c4b41cdc15ac1765a6a0dbb865f1bdc384d7f7393660e39baf38a375a501d7ec7493a82cd8aaeef9faba67422164e26d56f19737949f8578495ca5f1

waypipe.1

@@ -1,123 +1,112 @@
-.\" Generated by scdoc 1.11.1
+.\" Generated by scdoc 1.11.3
 .\" Complete documentation for this program is not available as a GNU info page
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .nh
 .ad l
 .\" Begin generated content:
-.TH "waypipe" "1" "2021-02-19"
-.P
+.TH "waypipe" "1" "2025-10-12"
+.PP
 .SH NAME
-.P
+.PP
 waypipe - A transparent proxy for Wayland applications
-.P
+.PP
 .SH SYNOPSIS
-.P
-\fBwaypipe\fR [options.\&.\&.\&] client
+.PP
+\fBwaypipe\fR [options.\&.\&.\&] \fBssh\fR [ssh options] \fIdestination\fR \fIcommand.\&.\&.\&\fR
+.PP
+\fBwaypipe\fR [options.\&.\&.\&] \fBclient\fR
 .br
-\fBwaypipe\fR [options.\&.\&.\&] server -- \fIcommand.\&.\&.\&\fR
+\fBwaypipe\fR [options.\&.\&.\&] \fBserver\fR -- \fIcommand.\&.\&.\&\fR
 .br
-\fBwaypipe\fR [options.\&.\&.\&] recon \fIcontrol_pipe\fR \fInew_socket_path\fR
+\fBwaypipe\fR \fBbench\fR
 .br
-\fBwaypipe\fR [options.\&.\&.\&] ssh .\&.\&.\&
-.br
-\fBwaypipe\fR [options.\&.\&.\&] bench \fIbandwidth\fR
-.P
+\fBwaypipe\fR [\fB--version\fR] [\fB-h\fR, \fB--help\fR]
+.PP
+[options.\&.\&.\&] = [\fB-c\fR, \fB--compress\fR C] [\fB-d\fR, \fB--debug\fR] [\fB-n\fR, \fB--no-gpu\fR] [\fB-o\fR, \fB--oneshot\fR] [\fB-s\fR, \fB--socket\fR S] [\fB--display\fR D] [\fB--drm-node\fR R] [\fB--remote-node\fR R] [\fB--remote-bin\fR R] [\fB--remote-socket\fR S] [\fB--login-shell\fR] [\fB--threads\fR T] [\fB--title-prefix\fR P] [\fB--unlink-socket\fR] [\fB--video\fR V] [\fB--vsock\fR] [\fB--secctx S\fR]
+.PP
+.PP
 .SH DESCRIPTION
-.P
-waypipe is a proxy for Wayland clients, with the aim of supporting behavior
+.PP
+Waypipe is a proxy for Wayland clients, with the aim of supporting behavior
 like \fBssh -X\fR.\&
-.P
+.PP
+Prefixing an \fBssh .\&.\&.\&\fR command to become \fBwaypipe ssh .\&.\&.\&\fR will automatically
+run \fBwaypipe\fR both locally and remotely, and modify the ssh command to set up
+forwarding between the two instances of \fBwaypipe\fR.\& The remote instance
+will act like a Wayland compositor, letting Wayland applications that are
+run remotely be displayed locally.\&
+.PP
 When run as \fBwaypipe client\fR, it will open a socket (by default at
 \fI/tmp/waypipe-client.\&sock\fR) and will connect to the local Wayland compositor
 and forward all Wayland applications which were linked to it over the socket
 by a matching \fBwaypipe server\fR instance.\&
-.P
+.PP
 When run as \fBwaypipe server\fR, it will run the command that follows in its
 command line invocation, set up its own Wayland compositor socket, and
 try to connect to its matching \fBwaypipe client\fR socket (by default
 \fI/tmp/waypipe-server.\&sock\fR) and try to forward all the Wayland clients
 that connect to fake compositor socket to the matching \fBwaypipe client\fR.\&
-.P
-The \fBwaypipe recon\fR mode is used to reconnect a \fBwaypipe server\fR instance
-which has had a control pipe (option \fB--control\fR) set.\& The new socket path
-should indicate a Unix socket whose connections are forwarded to the \fBwaypipe
-client\fR that the \fBwaypipe server\fR was initially connected to.\&
-.P
-Next, prefixing an \fBssh .\&.\&.\&\fR command to become \fBwaypipe ssh .\&.\&.\&\fR will
-automatically set up local and remote copies of \fBwaypipe\fR, as well as
-forwarding between their sockets, so that Wayland applications run remotely
-will be displayed locally.\&
-.P
-Finally, the \fBwaypipe bench\fR mode can be used to estimate, given a specific
-connection \fIbandwidth\fR in MB/sec, which compression options produce the
-lowest latency.\& It tests two synthetic images, one made to be roughly as
+.PP
+The \fBwaypipe bench\fR mode can be used to estimate which compression options
+produce the lowest latency, for a given connection bandwidth and number of
+threads.\& It tests two synthetic images, one made to be roughly as
 compressible as images containing text, and one made to be roughly as
 compressible as images containing pictures.\&
-.P
+.PP
 .SH OPTIONS
-.P
+.PP
 \fB-c C, --compress C\fR
 .RS 4
 Select the compression method applied to data transfers.\& Options are
 \fInone\fR (for high-bandwidth networks), \fIlz4\fR (intermediate), \fIzstd\fR
-(slow connection).\& The default compression is \fInone\fR.\& The compression
+(slow connection).\& The default compression is \fIlz4\fR.\&† The compression
 level can be chosen by appending = followed by a number.\& For example,
 if \fBC\fR is \fIzstd=7\fR, waypipe will use level 7 Zstd compression.\&
-.P
+.PP
+† Unless \fBwaypipe\fR is built without LZ4 support, in which case the default
+compression will be \fInone\fR.\&
+.PP
 .RE
 \fB-d, --debug\fR
 .RS 4
 Print debug log messages.\&
-.P
+.PP
 .RE
 \fB-h, --help\fR
 .RS 4
 Show help message and quit.\&
-.P
+.PP
 .RE
 \fB-n, --no-gpu\fR
 .RS 4
 Block protocols like wayland-drm and linux-dmabuf which require access
 to e.\&g.\& render nodes.\&
-.P
+.PP
 .RE
 \fB-o, --oneshot\fR
 .RS 4
 Only permit a single connection, and exit when it is closed.\&
-.P
+.PP
 .RE
 \fB-s S, --socket S\fR
 .RS 4
 Use \fBS\fR as the path for the Unix socket.\& The default socket path for
 server mode is \fI/tmp/waypipe-server.\&sock\fR; for client mode, it is
 \fI/tmp/waypipe-client.\&sock\fR; and in ssh mode, \fBS\fR gives the prefix used by
-both the client and the server for their socket paths.\&
-.P
+both the client and the server for their socket paths.\& (The actual socket
+paths in ssh mode add a randomized suffix to \fBS\fR.\&) The default prefix in ssh
+mode is \fI/tmp/waypipe\fR.\&
+.PP
+When vsock is enabled use \fBS\fR to specify a CID and a port number.\&
+.PP
 .RE
-\fB-v, --version\fR
+\fB--version\fR
 .RS 4
-Print the version number and quit.\&
-.P
-.RE
-\fB--allow-tiled\fR
-.RS 4
-By default, waypipe filters out all advertised DMABUF formats which have
-format layout modifiers, as CPU access to these formats may be very slow.\&
-Setting this flag disables the filtering.\& Since tiled images often permit
-faster GPU operations, most OpenGL applications will select tiling modifiers
-when they are available.\&
-.P
-.RE
-\fB--control C\fR
-.RS 4
-For server or ssh mode, provide the path to the "control pipe" that will
-be created the the server.\& Writing (with \fBwaypipe recon C T\fR, or
-'echo -n T > C') a new socket path to this pipe will make the server
-instance replace all running connections with connections to the new
-Unix socket.\& The new socket should ultimately forward data to the same
-waypipe client that the server was connected to before.\&
-.P
+Briefly describe Waypipe'\&s version and the features it was built with,
+then quit.\& Possible features: LZ4 compression support, ZSTD compression
+support, ability to transfer DMABUFs, video compression support.\&
+.PP
 .RE
 \fB--display D\fR
 .RS 4
@@ -125,72 +114,141 @@ For server or ssh mode, provide \fIWAYLAND_DISPLAY\fR and let waypipe configure
 its Wayland display socket to have a matching path.\& (If \fBD\fR is not an
 absolute path, the socket will be created in the folder given by the
 environment variable \fIXDG_RUNTIME_DIR\fR.\&)
-.P
+.PP
 .RE
 \fB--drm-node R\fR
 .RS 4
 Specify the path \fBR\fR to the drm device that this instance of waypipe should
 use and (in server mode) notify connecting applications about.\&
-.P
+.PP
 .RE
 \fB--remote-node R\fR
 .RS 4
 In ssh mode, specify the path \fBR\fR to the drm device that the remote instance
 of waypipe (running in server mode) should use.\&
-.P
+.PP
 .RE
 \fB--remote-bin R\fR
 .RS 4
 In ssh mode, specify the path \fBR\fR to the waypipe binary on the remote
 computer, or its name if it is available in \fIPATH\fR.\& It defaults to
 \fBwaypipe\fR if this option isn’t passed.\&
-.P
+.PP
+.RE
+\fB--remote-socket R\fR
+.RS 4
+In ssh mode, specify the prefix used by the remote \fBwaypipe server\fR for
+its socket path.\& This overrides the \fB--socket\fR option, on the server side
+only.\&
+.PP
 .RE
 \fB--login-shell\fR
 .RS 4
 Only for server mode; if no command is being run, open a login shell.\&
-.P
+.PP
 .RE
 \fB--threads T\fR
 .RS 4
 Set the number of total threads (including the main thread) which a \fBwaypipe\fR
 instance will create.\& These threads will be used to parallelize compression
 operations.\& This flag is passed on to \fBwaypipe server\fR when given to \fBwaypipe
-ssh\fR.\& The flag also controls the thread count for \fBwaypipe bench\fR.\&
-.P
+ssh\fR.\& The flag also controls the thread count for \fBwaypipe bench\fR.\& The default
+behavior (choosable by setting \fBT\fR to \fI0\fR) is to use half as many threads
+as the computer has hardware threads available.\&
+.PP
+.RE
+\fB--title-prefix P\fR
+.RS 4
+Prepend \fBP\fR to any window titles specified using the XDG shell protocol.\& In
+ssh mode, the prefix is applied only on the client side.\&
+.PP
 .RE
 \fB--unlink-socket\fR
 .RS 4
 Only for server mode; on shutdown, unlink the Unix socket that waypipe connects to.\&
-.P
+.PP
 .RE
-\fB--video\fR
+\fB--video V\fR
 .RS 4
 Compress specific DMABUF formats using a lossy video codec.\& Opaque, 10-bit, and
-multiplanar formats, among others, are not supported.\&
-.P
-.RE
-\fB--hwvideo\fR
+multiplanar formats, among others, are not supported.\& \fBV\fR is a comma separated 
+list of options to control the video encoding.\& (For example: \fB--video av1,hw\fR.\&)
+Later options supersede earlier ones.\&
+.PP
+\fBnone\fR
 .RS 4
-Sets the \fB--video\fR option, and also specifies that hardware video encoding and decoding
-should be used if possible.\& Whether this option improves bandwidth use and latency
-is hardware dependent.\&
-.P
-.P
+Do not use video encoding.\&
+.PP
+.RE
+\fBh264\fR
+.RS 4
+Use H.\&264 encoded video.\&
+.PP
+.RE
+\fBvp9\fR
+.RS 4
+Use VP9 encoded video.\&
+.PP
+.RE
+\fBav1\fR
+.RS 4
+Use VP9 encoded video.\&
+.PP
+.RE
+\fBsw\fR, \fBswenc\fR, \fBswdec\fR
+.RS 4
+Use software encoding or decoding, when available.\&
+.PP
+.RE
+\fBhw\fR, \fBhwenc\fR, \fBhwdec\fR
+.RS 4
+Use hardware encoding or decoding, when available.\&
+.PP
+.RE
+\fBbpf=B\fR
+.RS 4
+Set the target bit rate of the video encoder, in units of bits per frame.\&
+\fBB\fR can be written as an integer or with exponential notation; thus
+\fB--video=bpf=7.\&5e5\fR is equivalent to \fB--video=bpf=750000\fR.\&
+.PP
+.RE
+.RE
+\fB--vsock\fR
+.RS 4
+Use vsock instead of unix sockets.\& This is used when waypipe is running in
+virtual machines.\& With this option enabled specify a CID and a port number in \fBS\fR.\&
+CID is only used in the server mode and can be omitted when connecting from a
+guest virtual machine to host.\&
+.PP
+.RE
+\fB--secctx S\fR
+.RS 4
+Enable the Wayland security context protocol (client or ssh modes).\& Specify
+an application ID \fBS\fR that will be attached to the security context.\&
+.PP
+.RE
+\fB--control C\fR
+.br
+\fB--hwvideo\fR
+.br
+\fB--allow-tiled\fR
+.RS 4
+Options present in older versions of Waypipe that were removed.\&
+.PP
 .RE
 .SH EXAMPLE 
-.P
+.PP
 The following \fBwaypipe ssh\fR subcommand will attempt to run \fBweston-flower\fR on
 the server \fIexserv\fR, displaying the result on the local system.\&
-.P
+.PP
 .nf
 .RS 4
 	waypipe ssh user@exserv weston-flower
 .fi
 .RE
-.P
+.PP
 One can obtain similar behavior by explicitly running waypipe and ssh:
-.P
+.PP
 .nf
 .RS 4
 	waypipe --socket /tmp/socket-client client  &
@@ -199,10 +257,10 @@ One can obtain similar behavior by explicitly running waypipe and ssh:
 	kill %1
 .fi
 .RE
-.P
-Waypipe may be run locally without an ssh connection by specifying matching
+.PP
+Waypipe may be run locally without an SSH connection by specifying matching
 socket paths.\& For example:
-.P
+.PP
 .nf
 .RS 4
 	waypipe --socket /tmp/waypipe\&.sock client &
@@ -211,68 +269,173 @@ socket paths.\& For example:
 	rm /tmp/waypipe\&.sock
 .fi
 .RE
-.P
+.PP
+Using transports other than SSH is a bit more complicated.\& A recipe with ncat
+to connect to \fIremote\fR from computer \fIlocal\fR:
+.PP
+.nf
+.RS 4
+    $ waypipe --socket /tmp/waypipe-remote\&.sock client &
+    $ ncat --ssl -lk 12345 --sh-exec \&'ncat -U /tmp/waypipe-remote\&.sock\&' &
+    $ ssh user@remote
+
+    > ncat -lkU /tmp/waypipe-local\&.sock --sh-exec \&'ncat --ssl local 12345\&' &
+    > waypipe --display wayland-local \\
+                --socket /tmp/waypipe-local\&.sock server -- sleep inf &
+    > WAYLAND_DISPLAY=wayland-local application
+.fi
+.RE
+.PP
+Given a certificate file, socat can also provide an encrypted connection
+(remove '\&verify=0'\& to check certificates):
+.PP
+.nf
+.RS 4
+    $ waypipe --socket /tmp/waypipe-remote\&.sock client &
+    $ socat openssl-listen:12345,reuseaddr,cert=certificate\&.pem,verify=0,fork \\
+        unix-connect:/tmp/waypipe-remote\&.sock
+    $ ssh user@remote
+
+    > socat unix-listen:/tmp/waypipe-local\&.sock,reuseaddr,fork \\
+        openssl-connect:local:12345,verify=0 &
+    > waypipe --socket /tmp/waypipe-local\&.sock server -- application
+.fi
+.RE
+.PP
 Many applications require specific environment variables to use Wayland instead
-of X11.\& If ssh isn't configured to support loading \fI~/.\&ssh/environment\fR,
-one can use \fIenv\fR to set the needed variables each time; or run waypipe without
-a command, to use the login shell environment.\&
-.P
+of X11.\& If ssh isn'\&t configured to support loading \fI~/.\&ssh/environment\fR, or
+to allow specific variables to be set with \fIAcceptEnv\fR/\fISetEnv\fR, one can run
+\fBwaypipe ssh\fR without a command (and thereby open a login shell), or use \fBenv\fR
+to set the needed variables each time:
+.PP
 .nf
 .RS 4
 	 waypipe ssh user@host env XDG_SESSION_TYPE=wayland dolphin
 .fi
 .RE
-.P
-Waypipe has support for reconnecting a \fBwaypipe client\fR and a \fBwaypipe server\fR
-instance when whatever was used to transfer data between their sockets fails.\&
-For this to work, waypipe must still be running on both sides of the connection.\&
-As the \fBwaypipe ssh\fR wrapper will automatically close both the \fBwaypipe client\fR
-and the \fBwaypipe server\fR when the connection fails, the client and server modes
-must be run seprately.\& For example, to persistently forward applications running
-on server \fIrserv\fR to a local Wayland compositor running on \fIlserv\fR, one would
-first set up a waypipe client instance on \fIlserv\fR,
-.P
+.PP
+In some cases, one may wish to set environment variables for the \fBwaypipe
+server\fR process itself; the above trick with \fBenv\fR will not do this, because the
+\fBenv\fR process will be a child of \fBwaypipe server\fR, not the other way around.\&
+Instead, one can use \fI~/.\&ssh/environment\fR, or use the \fB--remote-bin\fR option to
+change the remote Waypipe instance to a shell script that sets the environment
+before running the actual \fBwaypipe\fR program.\&
+.PP
+.SS Running waypipe in virtual machines
+.PP
+When running waypipe in virtual machines on the same host it is possible to use vsock
+for efficient inter-vm communication.\& The following scenarios are supported:
+.PP
+.PD 0
+.IP \(bu 4
+Running applications on host from guest.\&
+.PD
+.PP
 .nf
 .RS 4
-	waypipe -s /tmp/waypipe\&.sock client &
+	host> waypipe --vsock -s 1234 client
+	guest> waypipe --vsock -s 1234 server weston-terminal
 .fi
 .RE
-.P
-and on server \fIrserv\fR, establish socket forwarding and run the server
-.P
+.PP
+.PD 0
+.IP \(bu 4
+Running applications in a guest virtual machine from host.\&
+.PD
+.PP
 .nf
 .RS 4
-	ssh -fN -L /tmp/waypipe-lserv\&.sock:/tmp/waypipe\&.sock user@lserv
-	waypipe -s /tmp/waypipe-lserv\&.sock --control /tmp/ctrl-lserv\&.pipe \\
-		--display wayland-lserv server -- sleep inf &
+	guest> waypipe --vsock -s 1234 client
+	host> waypipe --vsock -s 3:1234 server weston-terminal
 .fi
 .RE
-.P
-then set \fIWAYLAND_DISPLAY=wayland-lserv\fR and run the desired applications.\&
-When the ssh forwarding breaks, on \fIrserv\fR, reconnect with
-.P
+.PP
+In this example waypipe server connects to a virtual machine with CID 3 on port 1234.\&
+.PP
+.PD 0
+.IP \(bu 4
+Running applications in a guest virtual machine from other guest virtual machines.\&
+.PD
+When running both client and server in virtual machines it is possble to enable the
+VMADDR_FLAG_TO_HOST flag for sibling communication by prefixing the CID with an s:
+.PP
 .nf
 .RS 4
-	ssh -fN -L /tmp/waypipe-lserv-2\&.sock:/tmp/waypipe\&.sock user@lserv
-	waypipe recon /tmp/ctrl-lserv\&.pipe /tmp/waypipe-lserv-2\&.sock
+	guest> waypipe --vsock -s 1234 client
+	guest> waypipe --vsock -s s3:1234 server weston-terminal
 .fi
 .RE
-.P
+.PP
+In this case all packets will be routed to host where they can be forwarded to another
+virtual machine with a vhost-device-vsock device or some other utility.\&
+.PP
 .SH ENVIRONMENT
-.P
+.PP
 When running as a server, by default \fIWAYLAND_DISPLAY\fR will be set for the
 invoked process.\&
-.P
+.PP
 If the \fB--oneshot\fR flag is set, waypipe will instead set \fIWAYLAND_SOCKET\fR and
 inherit an already connected socketpair file descriptor to the invoked (child)
 process.\& Some programs open and close a Wayland connection repeatedly as part
 of their initialization, and will not work correctly with this flag.\&
-.P
+.PP
 .SH EXIT STATUS
-.P
+.PP
 \fBwaypipe ssh\fR will exit with the exit status code from the remote command, or
 with return code 1 if there has been an error.\&
-.P
+.PP
+.SH SECURITY
+.PP
+Waypipe does not provide any strong security guarantees, and connecting to
+untrusted servers is not recommended.\& It does not filter which Wayland
+protocols the compositor makes available to the client (with a few exceptions
+for protocols that require file descriptors which Waypipe cannot yet handle).\&
+For example, if a Wayland compositor gives all its clients access to a
+screenshot or lock-screen protocol, then proxied clients run under Waypipe
+can also make screenshots or lock the screen.\&
+.PP
+In general, applications are not well tested against malicious compositors,
+and compositors are not well tested against malicious clients.\& Waypipe can
+connect the two, and may blindly forward denial-of-service and other attacks.\&
+.PP
+Waypipe itself is written in C and links to compression, graphics, and video
+libraries; both it and these libraries may have security bugs.\& Some risk
+can be avoided by building Waypipe with DMABUF support turned off, or
+running Waypipe with the \fB--no-gpu\fR flag so that it does not expose graphics
+libraries.\&
+.PP
+\fBwaypipe ssh\fR has no explicit protections against timing attacks; an observer
+to the resulting network traffic may, by studying the size and timing of
+packets, learn information about the user'\&s interaction with a Wayland client
+proxied through \fBwaypipe ssh\fR.\& For example: a lack of activity suggests the
+user is not currently using the application, while an intermittant stream of
+messages from the compositor to the client may indicate mouse movement (or
+maybe something else: the contents of the messages are protected by \fBssh\fR.\&)
+.PP
+The memory used by Waypipe processes may, at a given time, include Wayland
+messages encoding user input, and the contents of current and recent frames
+drawn for application windows.\& Swap should be encrypted to prevent this data
+from being leaked to disk.\&
+.PP
+.SH BUGS
+.PP
+File bug reports at: https://gitlab.\&freedesktop.\&org/mstoeckl/waypipe/
+.PP
+.SS Common issues
+.PP
+Some programs (gnome-terminal, firefox, kate, among others) have special
+mechanisms to ensure that only one process is running at a time.\& Starting
+those programs under Waypipe while they are running under a different
+Wayland compositor may silently open a window or tab in the original
+instance of the program.\& Such programs may have a command line argument
+to create a new instance.\&
+.PP
+The \fBwaypipe ssh\fR command requires that the \fBssh\fR executable supports Unix
+socket forwarding; this is only supported in OpenSSH since version 6.\&7 (from
+2014), and may require specific configuration.\& Other implementations of SSH may
+not be able to forward Unix sockets; see the EXAMPLE section above for how to
+use non-SSH transports.\&
+.PP
 .SH SEE ALSO
-.P
-\fBweston\fR(1), \fBssh\fR(1)
+.PP
+\fBweston\fR(1), \fBssh\fR(1), \fBsocat(1)\fR, \fBncat(1)\fR

waypipe.spec

@@ -1,112 +1,99 @@
-Name:		waypipe
-Version:	0.8.2
-Release:	2%{?dist}
-Summary:	Wayland forwarding proxy
+# Generated by rust2rpm 27
+%bcond check 1
 
-License:	MIT
-URL:		https://gitlab.freedesktop.org/mstoeckl/%{name}
-Source0:	https://gitlab.freedesktop.org/mstoeckl/%{name}/-/archive/v%{version}/%{name}-v%{version}.tar.gz
+# prevent library files from being installed
+%global cargo_install_lib 0
+
+# test_proto is only needed in %%check
+%global test_features test_proto
+
+Name:           waypipe
+Version:        0.11.2
+Release:        %autorelease
+Summary:        Wayland forwarding proxy
+
+SourceLicense:  GPL-3.0-or-later
+# GPL-3.0-or-later
+# ISC
+# MIT
+# MIT OR Apache-2.0
+# (also MIT for the protocols/ directory)
+License:        GPL-3.0-or-later AND (Apache-2.0 OR MIT) AND ISC AND MIT
+# LICENSE.dependencies contains a full license breakdown
+
+URL:            https://gitlab.freedesktop.org/mstoeckl/waypipe
+Source0:        https://gitlab.freedesktop.org/mstoeckl/waypipe/-/archive/v%{version}/%{name}-v%{version}.tar.gz
+Source1:        waypipe.1
+Patch1:         0001-Cargo.toml-features-remove-test_proto-from-defaults.patch
 %if 0%{?rhel}
-Source1:	waypipe.1
+Patch2:         0002-Cargo.toml-features-remove-video-from-defaults-for-r.patch
 %endif
 
-BuildRequires:	gcc
-BuildRequires:	meson
+BuildRequires:  cargo-rpm-macros >= 26
+BuildRequires:  bindgen-cli
+BuildRequires:  gcc
+# required for bindgen to resolve some include paths..
+BuildRequires:  clang
+BuildRequires:  meson
 %if !0%{?rhel}
-BuildRequires:	scdoc
+BuildRequires:  scdoc
 %endif
-BuildRequires:	pkgconfig(gbm)
-BuildRequires:	pkgconfig(libdrm)
-BuildRequires:	pkgconfig(liblz4)
-BuildRequires:	pkgconfig(libzstd)
-BuildRequires:	pkgconfig(libva)
-BuildRequires:	pkgconfig(wayland-protocols)
-BuildRequires:	pkgconfig(wayland-client)
-BuildRequires:	pkgconfig(wayland-server)
+BuildRequires:  pkgconfig(gbm)
+%if !0%{?rhel}
+BuildRequires:  pkgconfig(libavcodec)
+BuildRequires:  pkgconfig(libavutil)
+BuildRequires:  pkgconfig(libswscale)
+BuildRequires:  glslc
+BuildRequires:  vulkan-headers
+%endif
+BuildRequires:  pkgconfig(libdrm)
+BuildRequires:  pkgconfig(liblz4)
+BuildRequires:  pkgconfig(libzstd)
+BuildRequires:  pkgconfig(libva)
+BuildRequires:  pkgconfig(wayland-protocols)
+BuildRequires:  pkgconfig(wayland-client)
+BuildRequires:  pkgconfig(wayland-server)
 
-%description
-Waypipe is a proxy for Wayland clients. It forwards Wayland messages and
-serializes changes to shared memory buffers over a single socket. This makes
-application forwarding similar to "ssh -X" feasible.
+%global _description %{expand:
+%{summary}.}
 
+%description %{_description}
 
 %prep
-%setup -q -n %{name}-v%{version}
+%autosetup -n waypipe-v%{version} -p1
+%cargo_prep
 
+%generate_buildrequires
+%cargo_generate_buildrequires -f %{test_features}
 
 %build
-%meson -Dwith_video=disabled -Dwerror=false %{?rhel:-Dman-pages=disabled}
-%meson_build
-
-
-%install
-%meson_install
-%if 0%{?rhel}
-mkdir -p %{buildroot}%{_mandir}/man1/
-install -m 644 %{SOURCE1} %{buildroot}%{_mandir}/man1/
+%cargo_build
+%{cargo_license_summary}
+%{cargo_license} > LICENSE.dependencies
+%if !0%{?rhel}
+scdoc < waypipe.scd > waypipe.1
 %endif
 
+%install
+%cargo_install
+%if !0%{?rhel}
+install -D -p -m 0644 waypipe.1 %{buildroot}%{_mandir}/man1/waypipe.1
+%else
+install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_mandir}/man1/waypipe.1
+%endif
 
+%if %{with check}
 %check
-%meson_test
-
+%cargo_test -f %{test_features}
+%endif
 
 %files
 %{_bindir}/waypipe
 %{_mandir}/man1/waypipe.1*
 %doc CONTRIBUTING.md README.md
-%license COPYING
-
+%license LICENSE.GPLv3
+%license LICENSE.MIT
+%license LICENSE.dependencies
 
 %changelog
-* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.2-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Tue Apr 05 2022 Olivier Fourdan <ofourdan@redhat.com> - 0.8.2-1
-- Update to 0.8.2
-
-* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.0-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Sat Apr 03 2021 Dominique Martinet <asmadeus@codewreck.org> - 0.8.0-1
-- Update to 0.8.0
-
-* Fri Feb 19 2021 Olivier Fourdan <ofourdan@redhat.com> - 0.7.1-3
-- Provide a pre-built man page on RHEL to avoid pulling scdoc
-
-* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Fri Nov 06 2020 Dominique Martinet <asmadeus@codewreck.org> - 0.7.1-1
-- Update to 0.7.1
-
-* Tue Nov 03 2020 Dominique Martinet <asmadeus@codewreck.org> - 0.7.0-1
-- Update to version 0.7.0
-
-* Mon Sep 28 2020 Jeff Law <law@redhat.com> - 0.6.1-7
-- Re-enable LTO as upstream GCC target/96939 has been fixed
-
-* Mon Aug 10 2020 Jeff Law <law@redhat.com> - 0.6.1-6
-- Disable LTO for now.
-
-* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.1-5
-- Second attempt - Rebuilt for
-  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.1-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Mon May 11 2020 Dominique Martinet <asmadeus@codewreck.org> - 0.6.1-3
-- Fix FTBS (test failure)
-
-* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Wed Aug 28 2019 Lubomir Rintel <lkundrak@v3.sk> - 0.6.1-1
-- Update to version 0.6.1
-
-* Thu Aug 22 2019 Lubomir Rintel <lkundrak@v3.sk> - 0.6.0-1
-- Initial packaging
+%autochangelog