From fe3ef7f25ef7c8b743088b6fc5959f9fd5cce646 Mon Sep 17 00:00:00 2001 From: jasonwitty Date: Sun, 23 Aug 2026 09:42:39 -0700 Subject: [PATCH] fix(ci): pin deb builds to ubuntu-22.04 and enforce the fleet glibc floor (#41) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(ci): pin deb builds to ubuntu-22.04 and enforce the fleet glibc floor The v1.60.0 debs failed to install on Raspberry Pi OS bookworm: socktop : Depends: libc6 (>= 2.39) but 2.36-9+rpt2+deb12u14 is to be installed Cross-compiled binaries link against the RUNNER's (multiarch) glibc, so the runner picks the minimum glibc the packages demand. ubuntu-latest migrated from 22.04 (glibc 2.35) to 24.04 (glibc 2.39) between the 1.50.x releases and now, silently raising the requirement past the Debian-12 fleet. Pin the build job to ubuntu-22.04 (2.35 — satisfied by bookworm's 2.36) and add a post-build gate that reads each .deb's computed libc6 requirement and fails the run if it exceeds the fleet floor, so the next runner migration turns into a red build instead of a fleet-wide apt error. Co-Authored-By: Claude Fable 5 * fix(ci): extract the libc6 version, not the 6 in 'libc6' The floor gate's second grep matched the trailing digit of the package name before the version ('libc6 (>= 2.34)' -> '6'), failing every target. sed capture group instead; verified against realistic Depends strings. Co-Authored-By: Claude Fable 5 * chore: bump all crates to 1.60.1 The 1.60.0 debs were built against glibc 2.39 and never installed on the bookworm fleet; rather than force-moving the tag, the rebuilt release ships as 1.60.1. Nothing was published to crates.io at 1.60.0. Co-Authored-By: Claude Fable 5 --------- Co-authored-by: Claude Fable 5 --- .github/workflows/build-deb.yml | 26 +++++++++++++++++++++++++- CHANGELOG.md | 10 ++++++++-- Cargo.lock | 6 +++--- socktop/Cargo.toml | 4 ++-- socktop_agent/Cargo.toml | 2 +- socktop_connector/Cargo.toml | 2 +- 6 files changed, 40 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml index 032c499..20a9475 100644 --- a/.github/workflows/build-deb.yml +++ b/.github/workflows/build-deb.yml @@ -18,7 +18,15 @@ env: jobs: build-deb: name: Build .deb for ${{ matrix.target }} - runs-on: ubuntu-latest + # PINNED, not ubuntu-latest: the binaries link against this runner's + # (multiarch) glibc, so the runner sets the MINIMUM glibc the .debs demand + # at install time. ubuntu-latest moved to 24.04/glibc 2.39 and the packages + # stopped installing on Debian 12/RPi OS bookworm (glibc 2.36). 22.04 links + # 2.35, which bookworm satisfies. The "enforce glibc floor" step below + # turns any future violation into a red build instead of a fleet-wide apt + # failure — if this pin ever has to move past bookworm's glibc, that step + # is the contract to renegotiate first. + runs-on: ubuntu-22.04 strategy: matrix: include: @@ -159,6 +167,22 @@ jobs: mkdir -p debs cp target/${{ matrix.target }}/debian/*.deb debs/ + - name: Enforce glibc floor (Debian 12 / RPi OS bookworm fleet) + run: | + # The fleet's oldest supported glibc. A .deb that demands newer libc6 + # than this will not install on the Pis — fail HERE, not at apt time. + FLOOR="2.36" + fail=0 + for deb in debs/*.deb; do + req=$(dpkg-deb -f "$deb" Depends | sed -n 's/.*libc6 (>= \([0-9.]*\)).*/\1/p' | head -1) + echo "$deb -> libc6 >= ${req:-none}" + if [ -n "$req" ] && [ "$(printf '%s\n' "$req" "$FLOOR" | sort -V | tail -1)" != "$FLOOR" ]; then + echo "::error::$deb requires libc6 >= $req, exceeding the fleet floor $FLOOR (bookworm). The build runner's glibc is too new — see the runs-on pin comment." + fail=1 + fi + done + exit $fail + - name: List generated packages run: ls -lh debs/ diff --git a/CHANGELOG.md b/CHANGELOG.md index b532fc6..7c52bf7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,8 +1,14 @@ # Changelog -## 1.60.0 — unreleased +## 1.60.1 — unreleased -Everything since `v1.50.0`. Applies to all three crates (`socktop`, `socktop_agent`, `socktop_connector`), which move to 1.60.0 together. +Identical to 1.60.0 plus rebuilt Debian packages: the 1.60.0 debs were linked +against glibc 2.39 (a GitHub runner migration) and would not install on +Debian 12 / Raspberry Pi OS bookworm. CI now pins the build environment and +gates every package against the fleet's glibc floor. 1.60.0 was never +published to crates.io. + +Everything since `v1.50.0`. Applies to all three crates (`socktop`, `socktop_agent`, `socktop_connector`), which move to 1.60.1 together. ### Security diff --git a/Cargo.lock b/Cargo.lock index 7cb3fbd..f132b57 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2412,7 +2412,7 @@ dependencies = [ [[package]] name = "socktop" -version = "1.60.0" +version = "1.60.1" dependencies = [ "anyhow", "assert_cmd", @@ -2432,7 +2432,7 @@ dependencies = [ [[package]] name = "socktop_agent" -version = "1.60.0" +version = "1.60.1" dependencies = [ "anyhow", "assert_cmd", @@ -2464,7 +2464,7 @@ dependencies = [ [[package]] name = "socktop_connector" -version = "1.60.0" +version = "1.60.1" dependencies = [ "flate2", "futures-util", diff --git a/socktop/Cargo.toml b/socktop/Cargo.toml index 9ba09d1..d1c61e0 100644 --- a/socktop/Cargo.toml +++ b/socktop/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "socktop" -version = "1.60.0" +version = "1.60.1" authors = ["Jason Witty "] description = "Remote system monitor over WebSocket, TUI like top" edition = "2024" @@ -11,7 +11,7 @@ repository = "https://github.com/jasonwitty/socktop" [dependencies] # socktop connector for agent communication -socktop_connector = { version = "1.60.0", path = "../socktop_connector" } +socktop_connector = { version = "1.60.1", path = "../socktop_connector" } tokio = { workspace = true } futures-util = { workspace = true } diff --git a/socktop_agent/Cargo.toml b/socktop_agent/Cargo.toml index ff700c5..fdece34 100644 --- a/socktop_agent/Cargo.toml +++ b/socktop_agent/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "socktop_agent" -version = "1.60.0" +version = "1.60.1" authors = ["Jason Witty "] description = "Socktop agent daemon. Serves host metrics over WebSocket." edition = "2024" diff --git a/socktop_connector/Cargo.toml b/socktop_connector/Cargo.toml index 63ddff7..4097def 100644 --- a/socktop_connector/Cargo.toml +++ b/socktop_connector/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "socktop_connector" -version = "1.60.0" +version = "1.60.1" edition = "2024" license = "MIT" description = "WebSocket connector library for socktop agent communication"