fix(packaging): build pywhispercpp at the portable x86-64 baseline (#959)

* fix(packaging): build pywhispercpp at the portable x86-64 baseline

Every packaged channel shipped a libggml-cpu compiled for AVX2+FMA:
the manylinux PyPI wheel itself carries -mavx2 -mfma -mbmi2 code, so
any package that bundles it dies with SIGILL when whisper.cpp loads a
model on a pre-Haswell CPU (the reporter's i5-3337U). GGML_NATIVE=OFF
alone is not the portable baseline either; while the native default
is on, ggml turns every GGML_* SIMD option on, so each is pinned off.

- Snap: force the sdist (PIP_NO_BINARY) with the flag floor via
  CMAKE_ARGS in the part's build-environment.
- Flatpak: extend the module's CMAKE_ARGS with the same floor.
- Native .deb/.rpm: the build still vendors the wheels, then rebuilds
  libggml-cpu alone from the same hash-pinned sdist and swaps it into
  the vendored copies, asserting no AVX/FMA survives; the container
  image gains cmake, g++, make and binutils.
- AppImage: extract the pinned-sdist reinstall into a shared helper
  and route every CPU-only fallback of the Vulkan path through a new
  baseline rebuild at the same floor; the Vulkan compile keeps its
  own flags via the same helper. Keeping the wheel on those paths was
  the bug's exact binary.

Fixes #957

* style(tests): apply black/isort to the new packaging guards

* fix(native): keep the wheel's libggml providers, alias its base/gomp sonames

Swapping the whole libggml set for the baseline build broke the import
smoke: the wheel's auditwheel-mangled core lib doubles as the
extension's __cxa_call_terminate provider, and its NEEDED entries are
the mangled names. Swap only libggml-cpu, and satisfy the baseline
library's own unmangled NEEDEDs (libggml-base.so.0, libgomp.so.1) with
aliases of the vendored copies, which carry no generated SIMD and are
the same upstream version. Fail closed when the vendored set has
restructured instead of silently shipping the AVX2 wheel.

* fix(packaging): fail builds that lose the speech engine, unblock the ISA assert

Greptile findings on the baseline work:

- A failed baseline rebuild in the AppImage returned success after
  remove_appdir_pywhispercpp, so the bundle would ship with no speech
  engine at all while logging that the wheel was kept. Propagate the
  failure through every CPU-only fallback so the build stops instead.
- The native libggml-cpu assertion used grep -q under pipefail, where
  grep's early exit SIGPIPEs objdump and the pipeline reports a miss,
  letting an AVX2 library through. Read the full disassembly instead.

* fix(installer): build pywhispercpp from sdist on the CPU path

install_cpu_pywhispercpp let pip pick the manylinux wheel, whose
libggml-cpu is compiled for AVX2+FMA and SIGILLs on pre-Haswell CPUs
(#957). Pass --no-binary pywhispercpp like the Vulkan/CUDA paths so the
sdist compiles against this machine's own instruction set.

* fix(installer): install C++ toolchain on distros that ship without one

Forcing the pywhispercpp sdist on the CPU path needs a compiler, and the
fedora, mageia, alpine, void and solus package maps did not request one.
Add gcc-c++/make (rpm), build-base (alpine), base-devel (void) and
gcc/g++/make (solus) so source installs compile on minimal systems.

---------

Co-authored-by: Jatin K Malik <jatinkrmalik@gmail.com>

packaging/native/build.sh

@@ -102,6 +102,63 @@ for VENDOR_WHEEL in "$TOOLS"/wheels/*/*.whl; do
     python3 -m zipfile -e "$VENDOR_WHEEL" "$PAYLOAD/usr/lib/vocalinux/vendor/"
 done
 
+# --- portable libggml-cpu -------------------------------------------------
+# The pinned pywhispercpp wheels bundle a libggml-cpu compiled for AVX2+FMA,
+# which dies with SIGILL at model load on pre-Haswell CPUs (#957). Rebuild
+# the ggml libraries from the same pinned sdist at the plain x86-64 baseline —
+# GGML_NATIVE=OFF alone still compiles -mavx2 -mfma, because ggml turns every
+# GGML_* SIMD option on while its native default is on — and swap them into
+# the vendored copies. libwhisper and the Python extension carry no generated
+# SIMD, so only the libggml set needs replacing.
+SDIST_DIR="$TOOLS/pywhispercpp-sdist"
+mkdir -p "$SDIST_DIR"
+pip3 download --require-hashes --no-deps --no-binary pywhispercpp \
+    -r "$PINS_VENDOR" -d "$SDIST_DIR" >/dev/null
+tar -xzf "$SDIST_DIR"/pywhispercpp-*.tar.gz -C "$SDIST_DIR"
+WHISPER_GGML="$(echo "$SDIST_DIR"/pywhispercpp-*/whisper.cpp/ggml)"
+[ -d "$WHISPER_GGML" ] || fail "whisper.cpp/ggml missing from pywhispercpp sdist"
+# ggml.pc.in is generated upstream and absent from the sdist; it only feeds
+# the standalone install rules this build never runs.
+touch "$WHISPER_GGML/ggml.pc.in"
+cmake -S "$WHISPER_GGML" -B "$TOOLS/ggml-build" \
+    -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=ON \
+    -DGGML_NATIVE=OFF -DGGML_SSE42=OFF -DGGML_AVX=OFF -DGGML_AVX2=OFF \
+    -DGGML_BMI2=OFF -DGGML_FMA=OFF -DGGML_F16C=OFF \
+    -DGGML_BUILD_TESTS=OFF -DGGML_BUILD_EXAMPLES=OFF
+cmake --build "$TOOLS/ggml-build" --target ggml-cpu -j"$(nproc)"
+BASELINE_CPU="$(find "$TOOLS/ggml-build" -name 'libggml-cpu.so.*' -type f | sort -V | tail -1)"
+[ -f "$BASELINE_CPU" ] || fail "baseline libggml-cpu build produced no library"
+# objdump, not a feature check: the SIGILL is ISA-level, so assert no 256-bit
+# or FMA instructions survive in the library that ships. No grep -q: under
+# pipefail an early exit SIGPIPEs objdump and the pipeline reports a miss.
+if objdump -d "$BASELINE_CPU" | grep -E 'ymm|vfmadd|vfnmadd|vfmsub|vzeroupper' >/dev/null; then
+    fail "baseline libggml-cpu still carries AVX/FMA instructions"
+fi
+# The vendored wheel files carry auditwheel-mangled basenames
+# (libggml-cpu-<hash>.so.0.9.8) that the extension's NEEDED entries point at,
+# so overwrite the cpu library in place and keep its filename. Only cpu is
+# swapped: the wheel's other libggml files carry no generated SIMD, and the
+# mangled core lib doubles as the extension's __cxa_call_terminate provider —
+# replacing it with a locally built copy drops that export.
+swapped=0
+while IFS= read -r vendored; do
+    cp "$BASELINE_CPU" "$vendored"
+    swapped=$((swapped + 1))
+done < <(find "$PAYLOAD/usr/lib/vocalinux/vendor" -name 'libggml-cpu*.so*')
+[ "$swapped" -gt 0 ] || fail "found no vendored libggml-cpu to replace"
+# The baseline library's own NEEDED entries use the unmangled sonames
+# (libggml-base.so.0, libgomp.so.1), so alias the vendored copies — the same
+# upstream version, and base/gomp carry no generated SIMD anyway — under
+# those names inside pywhispercpp.libs.
+while IFS= read -r libs_dir; do
+    vendored_base="$(find "$libs_dir" -name 'libggml-base*.so*' | head -1)"
+    [ -n "$vendored_base" ] || fail "no vendored libggml-base in $libs_dir"
+    cp "$vendored_base" "$libs_dir/libggml-base.so.0"
+    vendored_gomp="$(find "$libs_dir" -name 'libgomp*.so*' | head -1)"
+    [ -n "$vendored_gomp" ] || fail "no vendored libgomp in $libs_dir"
+    cp "$vendored_gomp" "$libs_dir/libgomp.so.1"
+done < <(find "$PAYLOAD/usr/lib/vocalinux/vendor" -type d -name 'pywhispercpp.libs')
+
 # --- launchers -----------------------------------------------------------
 # Same environment install.sh's wrapper establishes: the vendored
 # pywhispercpp.libs on LD_LIBRARY_PATH, user site-packages off so they cannot

packaging/native/container-build.sh

@@ -5,7 +5,9 @@ set -euo pipefail
 
 export DEBIAN_FRONTEND=noninteractive
 apt-get update
+# cmake, g++, make and binutils rebuild the vendored libggml-cpu from the
+# pinned pywhispercpp sdist at the portable baseline in build.sh.
 apt-get install -y --no-install-recommends \
-    ca-certificates curl python3 python3-pip xz-utils
+    binutils ca-certificates cmake curl g++ make python3 python3-pip xz-utils
 
 exec bash "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/build.sh" "$@"