From 8da81fdf9e0f324eb56cdad71214d4e568eeff46 Mon Sep 17 00:00:00 2001 From: Bryan Helmkamp Date: Sat, 18 Apr 2026 16:01:45 -0400 Subject: [PATCH] fix(release): build musl targets via cargo-zigbuild to fix arm64 SIGSEGV The shipped aarch64-unknown-linux-musl binary segfaulted at startup on every arm64 runtime (Apple Silicon, Graviton, Ampere, Docker arm64). Root cause: a glibc-vs-musl .init_array calling-convention mismatch -- a C static library in the dep graph has an __attribute__((constructor)) that expects (argc, argv, envp) per glibc, but musl on aarch64 calls it with no args, so register garbage propagates into pointer arithmetic and faults before main runs. Switch the musl compile steps to cargo-zigbuild (zig 0.13.0). Zig's bundled cc + lld produce working static-PIE binaries for both musl targets, sidestepping Ubuntu musl-tools' -no-pie quirk and the init_array ordering that triggered the crash. Drop the CARGO_TARGET_* linker overrides and the musl-tools apt install -- zig handles both. bin/dev/docker-build.sh mirrors the same toolchain so the local Docker image build matches CI. Verified by running fabro version from the resulting arm64 image on ghcr.io/fabro-sh/dhi-alpine-base:3.23-dev, alpine:3.22, and debian:stable-slim -- all print the version banner with exit 0. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/release.yml | 32 ++++++++++++++++++++------------ bin/dev/docker-build.sh | 35 ++++++++++++++++++++++------------- docs/changelog/2026-04-18.mdx | 1 + 3 files changed, 43 insertions(+), 25 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a0801c1e3..bd53c4a22 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -54,10 +54,6 @@ jobs: runner: ubuntu-24.04-arm-32-cores musl: true env: - CC_x86_64_unknown_linux_musl: musl-gcc - CC_aarch64_unknown_linux_musl: musl-gcc - CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc - CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc LIBZ_SYS_STATIC: "1" steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -70,26 +66,38 @@ jobs: sudo apt-get update sudo apt-get install -y build-essential pkg-config libssl-dev - - name: Install musl toolchain - if: matrix.musl - run: sudo apt-get install -y musl-tools - - name: Set up Rust uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable with: targets: ${{ matrix.target }} + - name: Set up zig + if: matrix.musl + uses: mlugg/setup-zig@8d6198c65fb0feaa111df26e6b467fea8345e46f # v2.0.5 + with: + version: 0.13.0 + + - name: Install cargo-zigbuild + if: matrix.musl + uses: taiki-e/install-action@773334c0e05d7e699e4d78234494308223f3a2cf # v2 + with: + tool: cargo-zigbuild + - uses: taiki-e/install-action@773334c0e05d7e699e4d78234494308223f3a2cf # nextest - name: Test - # aarch64-musl binaries SIGSEGV at startup when launched on the - # ubuntu-24.04-arm runner (glibc host + retrofitted musl loader). - # The shipped binary targets Alpine via the Docker image, which - # runs natively. x86_64-musl tests still run for coverage. + # aarch64-musl test runs have not been validated on the compile + # runner yet; shipping binary is exercised via Docker smoke tests. + # Re-enable after verifying the workspace passes on this target. if: matrix.target != 'aarch64-unknown-linux-musl' run: cargo nextest run --workspace --target ${{ matrix.target }} --release --status-level slow --profile ci + - name: Build (musl via cargo-zigbuild) + if: matrix.musl + run: cargo zigbuild --target ${{ matrix.target }} --release -p fabro-cli + - name: Build + if: ${{ !matrix.musl }} run: cargo build --target ${{ matrix.target }} --release -p fabro-cli - name: Package diff --git a/bin/dev/docker-build.sh b/bin/dev/docker-build.sh index ee5b8be4b..a714c154f 100755 --- a/bin/dev/docker-build.sh +++ b/bin/dev/docker-build.sh @@ -2,10 +2,9 @@ # Build a local fabro Docker image from the current working tree. # # The Docker image uses musl binaries for a small Alpine-based runtime. We -# compile fabro-cli for the target musl triple inside rust:1-bookworm so the -# binary matches what the Alpine runtime expects, regardless of host OS. -# Cargo registry and target dir are cached in named volumes so subsequent -# runs are incremental. +# compile fabro-cli for the target musl triple inside rust:1-bookworm using +# cargo-zigbuild (zig as the C compiler + linker). Cargo registry and target +# dir are cached in named volumes so subsequent runs are incremental. # # Usage: # bin/dev/docker-build.sh # host arch, build image at end @@ -46,26 +45,36 @@ if [ -z "$arch" ]; then fi case "$arch" in - amd64) target=x86_64-unknown-linux-musl cc_var=CC_x86_64_unknown_linux_musl linker_var=CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER ;; - arm64) target=aarch64-unknown-linux-musl cc_var=CC_aarch64_unknown_linux_musl linker_var=CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER ;; + amd64) target=x86_64-unknown-linux-musl zig_arch=x86_64 ;; + arm64) target=aarch64-unknown-linux-musl zig_arch=aarch64 ;; *) echo "unsupported arch: $arch (expected amd64 or arm64)" >&2; exit 1 ;; esac -echo "Building fabro-cli for $target inside rust:1-bookworm..." +ZIG_VERSION=0.13.0 + +echo "Building fabro-cli for $target inside rust:1-bookworm via cargo-zigbuild..." docker run --rm --platform "linux/$arch" \ -v "$PWD:/src" \ -v fabro-docker-cargo-registry:/usr/local/cargo/registry \ -v "fabro-docker-cargo-target-$arch:/target" \ + -v "fabro-docker-zig-$arch:/opt/zig" \ + -v "fabro-docker-cargo-tools-$arch:/opt/cargo-tools" \ -w /src \ -e CARGO_TARGET_DIR=/target \ - -e "$cc_var=musl-gcc" \ - -e "$linker_var=musl-gcc" \ -e LIBZ_SYS_STATIC=1 \ rust:1-bookworm \ - sh -c " - apt-get update -qq && apt-get install -y -qq musl-tools pkg-config perl make >/dev/null && - rustup target add $target && - cargo build --release -p fabro-cli --target $target + bash -c " + set -e + apt-get update -qq && apt-get install -y -qq pkg-config perl make cmake xz-utils curl >/dev/null + if [ ! -x /opt/zig/zig-linux-$zig_arch-$ZIG_VERSION/zig ]; then + curl -fsSL https://ziglang.org/download/$ZIG_VERSION/zig-linux-$zig_arch-$ZIG_VERSION.tar.xz | tar -xJ -C /opt/zig + fi + export PATH=/opt/cargo-tools/bin:/opt/zig/zig-linux-$zig_arch-$ZIG_VERSION:\$PATH + if ! command -v cargo-zigbuild >/dev/null; then + cargo install --locked --root /opt/cargo-tools cargo-zigbuild + fi + rustup target add $target + cargo zigbuild --release -p fabro-cli --target $target " echo "Extracting binary from builder cache..." diff --git a/docs/changelog/2026-04-18.mdx b/docs/changelog/2026-04-18.mdx index 1d275a322..caf21e39a 100644 --- a/docs/changelog/2026-04-18.mdx +++ b/docs/changelog/2026-04-18.mdx @@ -25,4 +25,5 @@ A new `docker-compose.prod.yaml` stands up a Caddy 2 sidecar that handles auto-H - Fixed Gemini API keys being sent as URL query parameters; they now go through the `x-goog-api-key` header so they don't leak into access logs, proxies, or request traces - Hardened the `fabro-demo` cookie with `HttpOnly` unconditionally and `Secure` when the web URL is HTTPS - Fixed a path-traversal issue where authenticated users could send percent-encoded `..` segments in the GitHub repo lookup endpoint and redirect the server's privileged token to an unintended GitHub API path; owner and repo now require `[A-Za-z0-9._-]` with length caps +- Fixed SIGSEGV at startup on the `aarch64-unknown-linux-musl` target (Apple Silicon, Graviton, Ampere) caused by a glibc-vs-musl `.init_array` calling-convention mismatch; the release pipeline now uses `cargo-zigbuild` for musl targets, producing binaries that start cleanly on arm64 Alpine, Debian, and DHI runtimes