{"id":51026349,"url":"https://github.com/norandom/xrdp-fleet","last_synced_at":"2026-06-21T20:01:14.860Z","repository":{"id":364723282,"uuid":"1268958890","full_name":"norandom/xrdp-fleet","owner":"norandom","description":"PERSONAL USE xrdp 0.10.x (RemoteFX + H.264) built per-distro and served as a signed GitHub Pages apt repo for an Ubuntu/Mint fleet. DO NOT USE WITHOUT 3x CHECKING!","archived":false,"fork":false,"pushed_at":"2026-06-14T07:30:54.000Z","size":2258,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-14T09:05:25.057Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/norandom.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-14T06:10:42.000Z","updated_at":"2026-06-14T07:25:45.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/norandom/xrdp-fleet","commit_stats":null,"previous_names":["norandom/xrdp-fleet"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/norandom/xrdp-fleet","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/norandom%2Fxrdp-fleet","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/norandom%2Fxrdp-fleet/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/norandom%2Fxrdp-fleet/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/norandom%2Fxrdp-fleet/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/norandom","download_url":"https://codeload.github.com/norandom/xrdp-fleet/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/norandom%2Fxrdp-fleet/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34623906,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-21T02:00:05.568Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-21T20:01:14.006Z","updated_at":"2026-06-21T20:01:14.850Z","avatar_url":"https://github.com/norandom.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# xrdp-fleet\n\nBuild custom xrdp 0.10.6 `.deb` packages with RemoteFX and H.264 (GFX), then\nserve them from a signed GitHub Pages apt repository. Client machines install\nand update through normal `apt` commands.\n\nThis is for a small fleet of Ubuntu, Linux Mint, and Kali machines where stock\nxrdp uses too much bandwidth. The Ubuntu/Debian xrdp 0.9.x packages do not have\nworking H.264 support. The encoder is only a stub there; real H.264 support\nstarts in xrdp 0.10.2. This repo rebuilds Debian's 0.10.6 packaging with both\ncodecs enabled for each target distro release.\n\n\u003e **Architectural limitation -- full-screen snapshots.** `xorgxrdp` captures\n\u003e the entire screen as a bitmap on every frame, encoding it in 64x64 tiles.\n\u003e Unlike Windows RDP, where the GDI subsystem tells the protocol exactly which\n\u003e screen region changed and how to draw it, Linux xrdp has no equivalent\n\u003e fine-grained damage tracking. This means every frame carries full-screen\n\u003e pixel data regardless of what actually changed. The H.264 graphics pipeline\n\u003e (GFX / x264) is **not** more effective than RemoteFX 24-bit in this\n\u003e architecture -- both still encode a full-screen snapshot per frame.\n\u003e [IronRDP](https://github.com/Devolutions/IronRDP) implements a mix of RFX\n\u003e and H.264 that could improve this, but there is no IronRDP-based Linux RDP\n\u003e server yet. Capping the frame rate is the most effective bandwidth knob\n\u003e available today. This project cannot overcome these architectural limits; it\n\u003e only ensures both codecs are actually compiled in (unlike distro packages\n\u003e that ship a stub encoder).\n\n\u003e Want the codec/bandwidth tuning details? See [docs/TUNING.md](docs/TUNING.md).\n\n## How it controls \"dependency explosion\"\n\nThe thing that makes cross-distro `.deb` builds blow up is `dpkg-shlibdeps`\nbaking in the library versions present at build time. This repo avoids that in\nthree ways:\n\n1. Build inside the target distro. Each `.deb` is compiled in an\n   `ubuntu:24.04` or `ubuntu:22.04` container, so its `Depends:` only ever\n   reference libraries that exist on that release. A noble build is published\n   only to the noble suite; a jammy build only to jammy.\n2. Use per-codename apt suites and pools. `dists/noble` and `dists/jammy` each\n   index only their own `pool/\u003ccodename\u003e/`, so a jammy machine can never be\n   offered a noble-built package.\n3. Use `--no-install-recommends` and apt pinning on the client. Installing xrdp\n   does not drag in optional extras, and your build keeps priority over the\n   distro package.\n\n## Repository layout\n\n```\nconfig.env                  # single source of truth: versions, codenames, identity\nMakefile                    # make keygen / build / repo / clean\nscripts/\n  build-deb.sh              # (in-container) fetch Debian source, set codec build, dpkg-buildpackage\n  build-local.sh            # (host) drive Docker per codename -\u003e ./out/\u003ccn\u003e/*.deb\n  make-repo.sh              # assemble ./repo, apt-ftparchive, GPG-sign Release/InRelease\n  gpg-keygen.sh             # one-time signing key + export for CI secret\n.github/workflows/release.yml  # CI: matrix build -\u003e sign -\u003e publish gh-pages\nclient/\n  install-client.sh         # run on each machine: add repo, pin, install\n  fleet-xrdp.sources        # deb822 reference\n  90-fleet-xrdp.pref        # apt pin reference\ndocs/TUNING.md              # codec + bandwidth tuning\n```\n\nNothing from upstream xrdp is vendored. `build-deb.sh` fetches the pinned Debian\nsource packages, `xrdp_0.10.6-5` and `xorgxrdp_0.10.5-2`, at build time.\n\n## What gets built\n\n| Package | Upstream | Codecs |\n|---|---|---|\n| `xrdp` | 0.10.6 | RemoteFX (`--enable-rfxcodec`) + H.264 (`--enable-x264` + `--enable-openh264`), plus jpeg, opus, mp3lame, fuse, pam, vsock |\n| `xorgxrdp` | 0.10.5 | matching Xorg backend for xrdp's 0.10.x ABI. Do not mix this with 0.9.x xorgxrdp. |\n\nThe Debian 0.10.6 `debian/rules` file already enables both codecs, so this repo\ndoes not patch the build rules. It only restamps the package version per\ncodename.\n\n## One-time setup\n\n```bash\ngit clone https://github.com/norandom/xrdp-fleet \u0026\u0026 cd xrdp-fleet\n\n# 1. Create the apt signing key (writes fleet-xrdp-private.asc)\nmake keygen\n\n# 2. Store the private key as a CI secret, then destroy the local export\ngh secret set GPG_PRIVATE_KEY \u003c fleet-xrdp-private.asc\nshred -u fleet-xrdp-private.asc\n\n# 3. In GitHub: Settings -\u003e Pages -\u003e Source = \"Deploy from a branch\",\n#    Branch = gh-pages / root. (The first CI run creates the branch.)\n```\n\n## Build and publish with CI\n\n```bash\ngit tag v0.10.6-fleet1 \u0026\u0026 git push --tags     # or run the workflow manually\n```\nCI builds every codename in `config.env` (noble, jammy, kali-rolling) in Docker,\nsigns the repo, and publishes it to `https://norandom.github.io/xrdp-fleet/`.\n\n## Build locally\n\nLocal builds need Docker and write `.deb` files under `./out/`:\n```bash\nmake build            # both codenames\nmake build-noble      # just one\nmake repo             # assemble + sign ./repo from ./out (needs the signing key)\n```\n\n## Install on each of your machines\n\n```bash\ncurl -fsSL https://norandom.github.io/xrdp-fleet/install-client.sh | bash\n```\nThe script detects the suite from `UBUNTU_CODENAME` on Ubuntu/Mint\n(`noble`/`jammy`) or `VERSION_CODENAME` on Kali (`kali-rolling`). It then adds\nthe signed repo, pins it, and installs `xrdp` and `xorgxrdp` without recommends.\nAfter that, `apt upgrade` keeps them current from your repo.\n\n\u003e On Kali, stock `xrdp` (from Debian) usually already includes both codecs, so\n\u003e this build is mainly for fleet uniformity/pinning rather than new capability.\n\n## Updating later\n\n- To ship a fresh rebuild of the same xrdp, bump `FLEET_REV` in `config.env`\n  (`1` to `2`), tag, and push. Clients auto-upgrade because the higher version\n  sorts higher.\n- To take a newer upstream xrdp, update `XRDP_UPSTREAM`, `XRDP_DEBREV`, and the\n  xorgxrdp values in `config.env` to the current sid version\n  (https://packages.debian.org/sid/xrdp), then tag and push.\n\n## Caveats (read these)\n\n1. xrdp and xorgxrdp must match. They talk over private local IPC and a\n   shared-memory framebuffer that changed in 0.10.x. The distro's 0.9.x\n   xorgxrdp will produce broken or garbled GFX against this xrdp. This repo\n   always builds and ships the matching `xorgxrdp 0.10.5`, and the client\n   installer installs it explicitly.\n2. jammy backport fixes are automatic. `build-deb.sh` applies two fixes for\n   Debian sid packaging on Ubuntu 22.04, gated on `jammy`:\n   - `systemd-dev` build-dep to `libsystemd-dev` (systemd-dev was split out at\n     systemd 253; jammy ships 249).\n   - `sysvinit-utils (\u003e= 3.06-4)` runtime dep to `lsb-base` (`/lib/lsb/init-functions`\n     moved into sysvinit-utils in sid; jammy still uses lsb-base).\n   noble needs neither. If a future xrdp needs `systemdsystemunitdir` and the\n   build errors on it, add `--with-systemdsystemunitdir=/lib/systemd/system` via\n   a `debian/rules` override.\n3. xrdp is installed before xorgxrdp during the build, because xorgxrdp\n   build-depends on `xrdp (\u003e= 0.10.5)`; `build-deb.sh` handles this ordering.\n4. Versions use a `~fleetN~ubuntuXX.04` suffix, which sorts below a\n   hypothetical official `0.10.6-1`. The `Pin-Priority: 1001` is what\n   guarantees your build wins regardless. Keep the pin in place.\n5. Per-codename builds are required. A noble `.deb` is not reliably installable\n   on jammy, and the reverse is also true.\n6. openh264 comes from Ubuntu universe (source-built, not the Cisco\n   binary blob). Default Ubuntu container images have universe enabled.\n7. This repo builds amd64 only (`nasm`-built RemoteFX SIMD is amd64). Extend the\n   matrix for other arches if needed.\n\n## Why not just `apt source xrdp` + edit `debian/rules`?\n\nThat was the original plan, but on the 0.9.24 source tree the H.264 flags\n(`--enable-gfx-avc444` and related flags) do not exist. Autoconf silently\nignores unknown `--enable-*` flags, so the package builds but still has no\nH.264 support. Real H.264 needs the 0.10.x line, which is what this repo builds.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnorandom%2Fxrdp-fleet","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnorandom%2Fxrdp-fleet","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnorandom%2Fxrdp-fleet/lists"}