Update base image to trixie

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: 3.11
+  PYTHON_VERSION: 3.13
 
 jobs:
   amd64_build:
@@ -77,7 +77,12 @@ jobs:
             rpi.tags=${{ steps.setup.outputs.image-name }}-rpi
             *.cache-from=type=registry,ref=${{ steps.setup.outputs.cache-name }}-arm64
             *.cache-to=type=registry,ref=${{ steps.setup.outputs.cache-name }}-arm64,mode=max
+  # Disabled: the Jetson image is based on NVIDIA's Ubuntu L4T base with
+  # Python 3.11 from deadsnakes, and NVIDIA does not provide a cp313
+  # onnxruntime-gpu wheel for JetPack. Deprecated until a community member
+  # updates it for Python 3.13.
   jetson_jp6_build:
+    if: false
     runs-on: ubuntu-22.04-arm
     name: Jetson Jetpack 6
     steps:
@@ -147,7 +152,10 @@ jobs:
             rocm.tags=${{ steps.setup.outputs.image-name }}-rocm
             *.cache-to=type=registry,ref=${{ steps.setup.outputs.cache-name }}-rocm,mode=max
             *.cache-from=type=registry,ref=${{ steps.setup.outputs.cache-name }}-rocm
+  # Disabled: rknn-toolkit2 / rknn-toolkit-lite2 publish wheels only up to
+  # cp312; re-enable once Rockchip ships cp313 wheels.
   arm64_extra_builds:
+    if: false
     runs-on: ubuntu-22.04-arm
     name: ARM Extra Build
     needs:
@@ -172,7 +180,10 @@ jobs:
           set: |
             rk.tags=${{ steps.setup.outputs.image-name }}-rk
             *.cache-from=type=gha
+  # Disabled: the synap-python vendor wheel is cp311-only (0.0.4-preview);
+  # re-enable once Synaptics ships a cp313 build.
   synaptics_build:
+    if: false
     runs-on: ubuntu-22.04-arm
     name: Synaptics Build
     needs:

.github/workflows/pull_request.yml

@@ -9,7 +9,7 @@ on:
       - ".github/ISSUE_TEMPLATE/**"
 
 env:
-  DEFAULT_PYTHON: 3.11
+  DEFAULT_PYTHON: 3.13
 
 jobs:
   web_lint:

.github/workflows/release.yml

@@ -39,14 +39,14 @@ jobs:
           STABLE_TAG=${BASE}:stable
           PULL_TAG=${BASE}:${BUILD_TAG}
           docker run --rm -v $HOME/.docker/config.json:/config.json quay.io/skopeo/stable:latest copy --authfile /config.json --multi-arch all docker://${PULL_TAG} docker://${VERSION_TAG}
-          for variant in standard-arm64 tensorrt tensorrt-jp6 rk rocm synaptics; do
+          for variant in standard-arm64 tensorrt rocm; do
             docker run --rm -v $HOME/.docker/config.json:/config.json quay.io/skopeo/stable:latest copy --authfile /config.json --multi-arch all docker://${PULL_TAG}-${variant} docker://${VERSION_TAG}-${variant}
           done
 
           # stable tag
           if [[ "${BUILD_TYPE}" == "stable" ]]; then
             docker run --rm -v $HOME/.docker/config.json:/config.json quay.io/skopeo/stable:latest copy --authfile /config.json --multi-arch all docker://${PULL_TAG} docker://${STABLE_TAG}
-            for variant in standard-arm64 tensorrt tensorrt-jp6 rk rocm synaptics; do
+            for variant in standard-arm64 tensorrt rocm; do
               docker run --rm -v $HOME/.docker/config.json:/config.json quay.io/skopeo/stable:latest copy --authfile /config.json --multi-arch all docker://${PULL_TAG}-${variant} docker://${STABLE_TAG}-${variant}
             done
           fi

docker/main/Dockerfile

@@ -6,8 +6,8 @@ ARG DEBIAN_FRONTEND=noninteractive
 # Globally set pip break-system-packages option to avoid having to specify it every time
 ARG PIP_BREAK_SYSTEM_PACKAGES=1
 
-ARG BASE_IMAGE=debian:12
-ARG SLIM_BASE=debian:12-slim
+ARG BASE_IMAGE=debian:13
+ARG SLIM_BASE=debian:13-slim
 
 # A hook that allows us to inject commands right after the base images
 ARG BASE_HOOK=
@@ -18,7 +18,7 @@ ARG BASE_HOOK
 
 RUN sh -c "$BASE_HOOK"
 
-FROM --platform=${BUILDPLATFORM} debian:12 AS base_host
+FROM --platform=${BUILDPLATFORM} debian:13 AS base_host
 ARG PIP_BREAK_SYSTEM_PACKAGES
 
 FROM ${SLIM_BASE} AS slim-base
@@ -52,14 +52,6 @@ RUN --mount=type=tmpfs,target=/tmp --mount=type=tmpfs,target=/var/cache/apt \
     --mount=type=cache,target=/root/.ccache \
     /deps/build_sqlite_vec.sh
 
-# Build intel-media-driver from source against bookworm's system libva so it
-# works with Debian 12's glibc/libstdc++ (pre-built noble/trixie packages
-# require glibc 2.38 which is not available on bookworm).
-FROM base AS intel-media-driver
-ARG DEBIAN_FRONTEND
-RUN --mount=type=bind,source=docker/main/build_intel_media_driver.sh,target=/deps/build_intel_media_driver.sh \
-    /deps/build_intel_media_driver.sh
-
 FROM scratch AS go2rtc
 ARG TARGETARCH
 WORKDIR /rootfs/usr/local/go2rtc/bin
@@ -84,7 +76,8 @@ ARG DEBIAN_FRONTEND
 # Install OpenVINO for model conversion
 COPY docker/main/requirements-ov.txt /requirements-ov.txt
 RUN apt-get -qq update \
-    && apt-get -qq install -y wget python3 python3-distutils \
+    && apt-get -qq install -y wget python3.13 \
+    && update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.13 1 \
     && wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
     && sed -i 's/args.append("setuptools")/args.append("setuptools==77.0.3")/' get-pip.py \
     && python3 get-pip.py "pip" \
@@ -164,13 +157,13 @@ RUN apt-get -qq update \
     apt-transport-https wget unzip \
     && apt-get -qq update \
     && apt-get -qq install -y \
-    python3.11 \
-    python3.11-dev \
+    python3.13 \
+    python3.13-dev \
     # opencv dependencies
     build-essential cmake git pkg-config libgtk-3-dev \
     libavcodec-dev libavformat-dev libswscale-dev libv4l-dev \
     libxvidcore-dev libx264-dev libjpeg-dev libpng-dev libtiff-dev \
-    gfortran openexr libatlas-base-dev libssl-dev\
+    gfortran openexr libssl-dev \
     libtbbmalloc2 libtbb-dev libdc1394-dev libopenexr-dev \
     libgstreamer-plugins-base1.0-dev libgstreamer1.0-dev \
     # sqlite3 dependencies
@@ -179,7 +172,7 @@ RUN apt-get -qq update \
     gcc gfortran libopenblas-dev liblapack-dev && \
     rm -rf /var/lib/apt/lists/*
 
-RUN update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 1
+RUN update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.13 1
 
 RUN wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
     && sed -i 's/args.append("setuptools")/args.append("setuptools==77.0.3")/' get-pip.py \
@@ -190,16 +183,16 @@ COPY docker/main/requirements-dev.txt /requirements-dev.txt
 
 RUN pip3 install -r /requirements.txt
 
-# Build pysqlite3 from source
-COPY docker/main/build_pysqlite3.sh /build_pysqlite3.sh
-RUN /build_pysqlite3.sh
-
 COPY docker/main/requirements-wheels.txt /requirements-wheels.txt
 RUN pip3 wheel --wheel-dir=/wheels -r /requirements-wheels.txt && \
     if [ "$DEBUG" = "true" ]; then \
         pip3 wheel --wheel-dir=/wheels -r /requirements-dev.txt; \
     fi
 
+# Build norfair separately with its numpy pin lifted
+RUN --mount=type=bind,source=docker/main/build_norfair.sh,target=/deps/build_norfair.sh \
+    /deps/build_norfair.sh
+
 # Install HailoRT & Wheels
 RUN --mount=type=bind,source=docker/main/install_hailort.sh,target=/deps/install_hailort.sh \
     /deps/install_hailort.sh
@@ -208,7 +201,6 @@ RUN --mount=type=bind,source=docker/main/install_hailort.sh,target=/deps/install
 FROM scratch AS deps-rootfs
 COPY --from=nginx /usr/local/nginx/ /usr/local/nginx/
 COPY --from=sqlite-vec /usr/local/lib/ /usr/local/lib/
-COPY --from=intel-media-driver /rootfs/ /
 COPY --from=go2rtc /rootfs/ /
 COPY --from=libusb-build /usr/local/lib /usr/local/lib
 COPY --from=tempio /rootfs/ /

docker/main/build_nginx.sh

@@ -8,9 +8,8 @@ SECURE_TOKEN_MODULE_VERSION="1.5"
 SET_MISC_MODULE_VERSION="v0.33"
 NGX_DEVEL_KIT_VERSION="v0.3.3"
 
-source /etc/os-release
-
-if [[ "$VERSION_ID" == "12" ]]; then
+# enable deb-src entries in either deb822 or legacy sources format
+if [[ -f /etc/apt/sources.list.d/debian.sources ]]; then
     sed -i '/^Types:/s/deb/& deb-src/' /etc/apt/sources.list.d/debian.sources
 else
     cp /etc/apt/sources.list /etc/apt/sources.list.d/sources-src.list

docker/main/build_norfair.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+
+# norfair 2.3.0 declares numpy < 2 and rich < 15 in its wheel metadata, but
+# the code is compatible with both. Build it without deps and lift the pins
+# until upstream publishes updated requirements.
+
+set -euxo pipefail
+
+norfair_version="2.3.0"
+
+pip3 wheel --wheel-dir=/norfair-wheel --no-deps "norfair==${norfair_version}"
+
+python3 - <<'EOF'
+import glob
+import os
+import re
+import zipfile
+
+path = glob.glob("/norfair-wheel/norfair-*.whl")[0]
+patched = path + ".patched"
+
+with zipfile.ZipFile(path) as zin, zipfile.ZipFile(patched, "w", zipfile.ZIP_DEFLATED) as zout:
+    for item in zin.infolist():
+        data = zin.read(item.filename)
+        if item.filename.endswith(".dist-info/METADATA"):
+            data = re.sub(
+                rb"Requires-Dist: numpy.*",
+                b"Requires-Dist: numpy (>=1.23.0)",
+                data,
+            )
+            data = re.sub(
+                rb"Requires-Dist: rich.*",
+                b"Requires-Dist: rich (>=9.10.0)",
+                data,
+            )
+        zout.writestr(item, data)
+
+os.replace(patched, path)
+EOF
+
+mv /norfair-wheel/*.whl /wheels/

docker/main/build_sqlite_vec.sh

@@ -4,9 +4,8 @@ set -euxo pipefail
 
 SQLITE_VEC_VERSION="0.1.9"
 
-source /etc/os-release
-
-if [[ "$VERSION_ID" == "12" ]]; then
+# enable deb-src entries in either deb822 or legacy sources format
+if [[ -f /etc/apt/sources.list.d/debian.sources ]]; then
     sed -i '/^Types:/s/deb/& deb-src/' /etc/apt/sources.list.d/debian.sources
 else
     cp /etc/apt/sources.list /etc/apt/sources.list.d/sources-src.list