Breadway/breadarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci: link breadarrd/breadarr-tui against hestia's glibc, not the CI container's
All checks were successful
dev release / build (push) Successful in 2m39s
Details

Browse source 
hestia (the actual deployment target) runs Ubuntu 24.04 (glibc 2.39);
the shared Arch CI image tracks a much newer glibc (currently 2.43).
A binary linked normally there requires GLIBC_2.43 symbols and refuses
to start on hestia at all (glibc symbol versioning is forward-only) —
this is what crashed breadarrd in production after its first
bakery-managed install.

Fix: ci/build.sh now pulls a real glibc + gcc-libs (for libstdc++)
package pair from the Arch Linux Archive, matching hestia's actual
versions, and links against them via --sysroot instead of the
container's native ones. cargo-zigbuild (targeting an older glibc via
zig's cross-linker) was tried first and doesn't work here: zig has no
version database for libstdc++ specifically, and onnxruntime --
statically linked in by the ort crate -- needs a real, complete one.
A real archived glibc+gcc-libs pair sidesteps that entirely.

reqwest's native-tls now vendors (statically builds) OpenSSL instead
of dynamically linking the build host's, since the old sysroot has no
libssl/libcrypto of its own — also means the shipped binary no longer
depends on the target system's OpenSSL version at all.

Verified end-to-end on hestia's actual self-hosted runner: real
ci/build.sh, real bread-ci:breadarr image, real docker build/run —
produced binary requires GLIBC up to 2.39 and GLIBCXX up to 3.4.30
only, and actually starts and runs on hestia.
This commit is contained in:
Breadway 2026-08-12 14:12:08 +08:00
parent 624b63da3f
commit 812b70d4b7
4 changed files with 59 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
breadarrd/Cargo.toml
View file

@ -25,3 +25,10 @@ scraper.workspace = true
chrono.workspace = true
fastrand.workspace = true
nix.workspace = true
# Forces reqwest's native-tls backend to statically build and link its own
# OpenSSL instead of dynamically linking whatever libssl/libcrypto happens
# to be on the build host — CI (see ci/build.sh) links against an archived
# old-glibc sysroot for hestia compatibility, which has no libssl/libcrypto
# of its own to dynamically link against. Also means the shipped binary no
# longer depends on the target system's OpenSSL version at all.
openssl-sys = { version = "0.9", features = ["vendored"] }