openvino: update to 2026.2.1

Bump from 2024.4.1. Repin all seven bundled deps to the exact commits
openvino references at this tag (submodule gitlinks), downloaded uniformly
as archive/<sha> tarballs, and switch flatbuffers/onnx/ittapi/protobuf from
version tags to commit SHAs for consistency.

Refactor the per-dep extract/symlink blocks into a single bundle_dep helper
that derives each dep's directory from the tarball, so future bumps only
touch the COMMIT_* vars and .info, not the extract logic.

Drop pybind11 from REQUIRES: now satisfied by stock python-pybind11.

Add a .gitleaksignore entry for a dep commit SHA that trips the
generic-api-key entropy rule (a public commit hash, not a secret).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

3 files changed, 54 insertions, 73 deletions

diff --git a/.gitleaksignore b/.gitleaksignore
new file mode 100644
index 0000000..e87847b
--- /dev/null
+++ b/.gitleaksignore
@@ -0,0 +1,4 @@
+# openvino bundles deps pinned to upstream git commit SHAs. gitleaks'
+# generic-api-key entropy rule occasionally flags a 40-hex commit hash as a
+# secret. These are public commit hashes, not credentials.
+openvino/openvino.SlackBuild:generic-api-key:36
diff --git a/openvino/openvino.SlackBuild b/openvino/openvino.SlackBuild
index 2f82443..e4c68f3 100644
--- a/openvino/openvino.SlackBuild
+++ b/openvino/openvino.SlackBuild
@@ -25,14 +25,16 @@
 cd $(dirname $0) ; CWD=$(pwd)
 
 PRGNAM=openvino
-VERSION=${VERSION:-2024.4.1}
-VERSION_FLATBUFFERS=24.3.25
-VERSION_ONNX=1.16.0
-VERSION_ITTAPI=3.24.4
-VERSION_PROTOBUF=21.12
-COMMIT_ONEDNN=c8ae8d96e963bd04214858319fa334968e5e73c9
-COMMIT_ONEDNN_GPU=4ccd07e3a10e1c08075cf824ac14708245fbc334
+VERSION=${VERSION:-2026.2.1}
+# All bundled deps are pinned to the exact commit openvino references at this
+# tag (its git submodule gitlinks), downloaded as archive/<sha> tarballs.
 COMMIT_MLAS=d1bc25ec4660cddd87804fcf03b2411b5dfb2e94
+COMMIT_ONEDNN=87f65fdd1927b1d0cbdf0ea37728146abfbffb52
+COMMIT_ONEDNN_GPU=20db47e2d3c4df1b66e93bed2e97d30da175512d
+COMMIT_FLATBUFFERS=595bf0007ab1929570c7671f091313c8fc20644e
+COMMIT_ONNX=e709452ef2bbc1d113faf678c24e6d3467696e83
+COMMIT_ITTAPI=ca45fef1a12cef3316e6ff362a4d36571270e392
+COMMIT_PROTOBUF=f0dc78d7e6e331b8c6bb2d5283e06aa26883ca7c
 BUILD=${BUILD:-2}
 TAG=${TAG:-_SBo}
 PKGTYPE=${PKGTYPE:-tgz}
@@ -93,55 +95,30 @@ find -L . \
 patch -p1 < $CWD/010-openvino-disable-werror.patch
 patch -p1 < $CWD/020-openvino-use-protobuf-shared-libs.patch
 
-# Flatbuffers from SBo provide broken cmake files(static-lib removed but static-lib-cmake-files not removed)
-(
-cd thirdparty/flatbuffers/
-rmdir flatbuffers
-tar vxf $CWD/flatbuffers-$VERSION_FLATBUFFERS.tar.gz
-ln -s flatbuffers-$VERSION_FLATBUFFERS flatbuffers
-)
-# onnx frontend
-(
-cd thirdparty/onnx/
-rmdir onnx
-tar vxf $CWD/onnx-$VERSION_ONNX.tar.gz
-ln -s onnx-$VERSION_ONNX onnx
-)
-# ittapi
-(
-cd thirdparty/ittapi/
-rmdir ittapi
-tar vxf $CWD/ittapi-$VERSION_ITTAPI.tar.gz
-ln -s ittapi-$VERSION_ITTAPI ittapi
-)
-# protobuf
-(
-cd thirdparty/protobuf/
-rmdir protobuf
-tar vxf $CWD/protobuf-all-$VERSION_PROTOBUF.tar.gz
-ln -s protobuf-$VERSION_PROTOBUF protobuf
-)
-# mlas for cpu inference device
-(
-cd src/plugins/intel_cpu/thirdparty
-rmdir mlas
-tar vxf $CWD/mlas-$COMMIT_MLAS.tar.gz
-ln -s mlas-$COMMIT_MLAS mlas
-)
-# oneDNN for cpu inference device
-(
-cd src/plugins/intel_cpu/thirdparty
-rmdir onednn
-tar vxf $CWD/oneDNN-$COMMIT_ONEDNN.tar.gz
-ln -s oneDNN-$COMMIT_ONEDNN onednn
-)
-# oneDNN for gpu inference device
-(
-cd src/plugins/intel_gpu/thirdparty
-rmdir onednn_gpu
-tar vxf $CWD/oneDNN-$COMMIT_ONEDNN_GPU.tar.gz
-ln -s oneDNN-$COMMIT_ONEDNN_GPU onednn_gpu
-)
+# Each bundled dep ships as a git submodule; upstream leaves an empty
+# placeholder dir where it expects the source. We drop in the pinned tarball
+# and symlink the placeholder to whatever top-level dir it unpacks, so the
+# extracted dir name (a commit hash) never has to be spelled out here. Bumping
+# a dep is then just a new SHA/URL/md5 in the vars and .info, no edits below.
+# args: <parent-dir> <placeholder-name> <tarball>
+bundle_dep() {
+  ( cd "$1"
+    rmdir "$2"
+    top=$(tar tf "$CWD/$3" | head -1 | cut -d/ -f1)
+    tar xf "$CWD/$3"
+    ln -s "$top" "$2"
+  )
+}
+
+# Flatbuffers from SBo provide broken cmake files (static-lib removed but
+# static-lib-cmake-files not removed), so bundle upstream's copy.
+bundle_dep thirdparty/flatbuffers flatbuffers "flatbuffers-$COMMIT_FLATBUFFERS.tar.gz"
+bundle_dep thirdparty/onnx onnx "onnx-$COMMIT_ONNX.tar.gz"
+bundle_dep thirdparty/ittapi ittapi "ittapi-$COMMIT_ITTAPI.tar.gz"
+bundle_dep thirdparty/protobuf protobuf "protobuf-$COMMIT_PROTOBUF.tar.gz"
+bundle_dep src/plugins/intel_cpu/thirdparty mlas "mlas-$COMMIT_MLAS.tar.gz"
+bundle_dep src/plugins/intel_cpu/thirdparty onednn "oneDNN-$COMMIT_ONEDNN.tar.gz"
+bundle_dep src/plugins/intel_gpu/thirdparty onednn_gpu "oneDNN-$COMMIT_ONEDNN_GPU.tar.gz"
 
 # npu plugin needs avx and does not build with the default x86_64 arch
 mkdir -p build
diff --git a/openvino/openvino.info b/openvino/openvino.info
index 3567d7f..604fa21 100644
--- a/openvino/openvino.info
+++ b/openvino/openvino.info
@@ -1,24 +1,24 @@
 PRGNAM="openvino"
-VERSION="2024.4.1"
+VERSION="2026.2.1"
 HOMEPAGE="https://github.com/openvinotoolkit/openvino/"
 DOWNLOAD="UNSUPPORTED"
 MD5SUM=""
-DOWNLOAD_x86_64="https://github.com/openvinotoolkit/openvino/archive/2024.4.1/openvino-2024.4.1.tar.gz \
-          https://github.com/openvinotoolkit/mlas/archive/d1bc25e/mlas-d1bc25ec4660cddd87804fcf03b2411b5dfb2e94.tar.gz \
-          https://github.com/openvinotoolkit/oneDNN/archive/c8ae8d9/oneDNN-c8ae8d96e963bd04214858319fa334968e5e73c9.tar.gz \
-          https://github.com/google/flatbuffers/archive/v24.3.25/flatbuffers-24.3.25.tar.gz \
-          https://github.com/onnx/onnx/archive/v1.16.0/onnx-1.16.0.tar.gz \
-          https://github.com/intel/ittapi/archive/v3.24.4/ittapi-3.24.4.tar.gz \
-          https://github.com/oneapi-src/oneDNN/archive/4ccd07e/oneDNN-4ccd07e3a10e1c08075cf824ac14708245fbc334.tar.gz \
-          https://github.com/protocolbuffers/protobuf/releases/download/v21.12/protobuf-all-21.12.tar.gz"
-MD5SUM_x86_64="3d9d1aa5ab807761bfe6a8d896c17d18 \
+DOWNLOAD_x86_64="https://github.com/openvinotoolkit/openvino/archive/2026.2.1/openvino-2026.2.1.tar.gz \
+          https://github.com/openvinotoolkit/mlas/archive/d1bc25ec4660cddd87804fcf03b2411b5dfb2e94/mlas-d1bc25ec4660cddd87804fcf03b2411b5dfb2e94.tar.gz \
+          https://github.com/openvinotoolkit/oneDNN/archive/87f65fdd1927b1d0cbdf0ea37728146abfbffb52/oneDNN-87f65fdd1927b1d0cbdf0ea37728146abfbffb52.tar.gz \
+          https://github.com/oneapi-src/oneDNN/archive/20db47e2d3c4df1b66e93bed2e97d30da175512d/oneDNN-20db47e2d3c4df1b66e93bed2e97d30da175512d.tar.gz \
+          https://github.com/google/flatbuffers/archive/595bf0007ab1929570c7671f091313c8fc20644e/flatbuffers-595bf0007ab1929570c7671f091313c8fc20644e.tar.gz \
+          https://github.com/onnx/onnx/archive/e709452ef2bbc1d113faf678c24e6d3467696e83/onnx-e709452ef2bbc1d113faf678c24e6d3467696e83.tar.gz \
+          https://github.com/intel/ittapi/archive/ca45fef1a12cef3316e6ff362a4d36571270e392/ittapi-ca45fef1a12cef3316e6ff362a4d36571270e392.tar.gz \
+          https://github.com/protocolbuffers/protobuf/archive/f0dc78d7e6e331b8c6bb2d5283e06aa26883ca7c/protobuf-f0dc78d7e6e331b8c6bb2d5283e06aa26883ca7c.tar.gz"
+MD5SUM_x86_64="d912a0b8f832cc526fc90e7c0fe4abbd \
         0e87473410db355fd9251a2e1337dc32 \
-        8555add7194a7a01ced2c4b69899dc75 \
-        f28f12fc16c72f4e7c22066a35405c3a \
-        5ef5a7bd4f9dad914bddc3b4335a67cd \
-        aec402d3441bb8ecb9c8e75bab6cc102 \
-        8217ab4ac4af784d7e8b029530c6ab5d \
-        7fb5fa6217646e5146346e39d9aad6f9"
-REQUIRES="xbyak pugixml tbb snappy pybind11 OpenCL-CLHPP"
+        09c8e12d3638ee7fb084035e3c99b914 \
+        e8aa621185319f2a4ad195e9380a3f2a \
+        16699a34eed210ecfe6c4d164926350c \
+        d4b12189e7665ae1211181b6a4905700 \
+        66726ae396392a1fa43156a0c764ec5e \
+        dbd2ff372e1033676a0c3798a8df4a07"
+REQUIRES="xbyak pugixml tbb snappy OpenCL-CLHPP"
 MAINTAINER="Johannes Schoepfer"
 EMAIL="slackbuilds@schoepfer.info"