fix(ci): pin deb builds to ubuntu-22.04 and enforce the fleet glibc floor (#41)

* fix(ci): pin deb builds to ubuntu-22.04 and enforce the fleet glibc floor

The v1.60.0 debs failed to install on Raspberry Pi OS bookworm:

  socktop : Depends: libc6 (>= 2.39) but 2.36-9+rpt2+deb12u14 is to be installed

Cross-compiled binaries link against the RUNNER's (multiarch) glibc, so
the runner picks the minimum glibc the packages demand. ubuntu-latest
migrated from 22.04 (glibc 2.35) to 24.04 (glibc 2.39) between the
1.50.x releases and now, silently raising the requirement past the
Debian-12 fleet.

Pin the build job to ubuntu-22.04 (2.35 — satisfied by bookworm's 2.36)
and add a post-build gate that reads each .deb's computed libc6
requirement and fails the run if it exceeds the fleet floor, so the next
runner migration turns into a red build instead of a fleet-wide apt
error.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ci): extract the libc6 version, not the 6 in 'libc6'

The floor gate's second grep matched the trailing digit of the package
name before the version ('libc6 (>= 2.34)' -> '6'), failing every
target. sed capture group instead; verified against realistic Depends
strings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: bump all crates to 1.60.1

The 1.60.0 debs were built against glibc 2.39 and never installed on the
bookworm fleet; rather than force-moving the tag, the rebuilt release
ships as 1.60.1. Nothing was published to crates.io at 1.60.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/build-deb.yml

@@ -18,7 +18,15 @@ env:
 jobs:
   build-deb:
     name: Build .deb for ${{ matrix.target }}
-    runs-on: ubuntu-latest
+    # PINNED, not ubuntu-latest: the binaries link against this runner's
+    # (multiarch) glibc, so the runner sets the MINIMUM glibc the .debs demand
+    # at install time. ubuntu-latest moved to 24.04/glibc 2.39 and the packages
+    # stopped installing on Debian 12/RPi OS bookworm (glibc 2.36). 22.04 links
+    # 2.35, which bookworm satisfies. The "enforce glibc floor" step below
+    # turns any future violation into a red build instead of a fleet-wide apt
+    # failure — if this pin ever has to move past bookworm's glibc, that step
+    # is the contract to renegotiate first.
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
         include:
@@ -159,6 +167,22 @@ jobs:
           mkdir -p debs
           cp target/${{ matrix.target }}/debian/*.deb debs/
 
+      - name: Enforce glibc floor (Debian 12 / RPi OS bookworm fleet)
+        run: |
+          # The fleet's oldest supported glibc. A .deb that demands newer libc6
+          # than this will not install on the Pis — fail HERE, not at apt time.
+          FLOOR="2.36"
+          fail=0
+          for deb in debs/*.deb; do
+            req=$(dpkg-deb -f "$deb" Depends | sed -n 's/.*libc6 (>= \([0-9.]*\)).*/\1/p' | head -1)
+            echo "$deb -> libc6 >= ${req:-none}"
+            if [ -n "$req" ] && [ "$(printf '%s\n' "$req" "$FLOOR" | sort -V | tail -1)" != "$FLOOR" ]; then
+              echo "::error::$deb requires libc6 >= $req, exceeding the fleet floor $FLOOR (bookworm). The build runner's glibc is too new — see the runs-on pin comment."
+              fail=1
+            fi
+          done
+          exit $fail
+
       - name: List generated packages
         run: ls -lh debs/
 

CHANGELOG.md

@@ -1,8 +1,14 @@
 # Changelog
 
-## 1.60.0 — unreleased
+## 1.60.1 — unreleased
 
-Everything since `v1.50.0`. Applies to all three crates (`socktop`, `socktop_agent`, `socktop_connector`), which move to 1.60.0 together.
+Identical to 1.60.0 plus rebuilt Debian packages: the 1.60.0 debs were linked
+against glibc 2.39 (a GitHub runner migration) and would not install on
+Debian 12 / Raspberry Pi OS bookworm. CI now pins the build environment and
+gates every package against the fleet's glibc floor. 1.60.0 was never
+published to crates.io.
+
+Everything since `v1.50.0`. Applies to all three crates (`socktop`, `socktop_agent`, `socktop_connector`), which move to 1.60.1 together.
 
 ### Security
 

Cargo.lock

@@ -2412,7 +2412,7 @@ dependencies = [
 
 [[package]]
 name = "socktop"
-version = "1.60.0"
+version = "1.60.1"
 dependencies = [
  "anyhow",
  "assert_cmd",
@@ -2432,7 +2432,7 @@ dependencies = [
 
 [[package]]
 name = "socktop_agent"
-version = "1.60.0"
+version = "1.60.1"
 dependencies = [
  "anyhow",
  "assert_cmd",
@@ -2464,7 +2464,7 @@ dependencies = [
 
 [[package]]
 name = "socktop_connector"
-version = "1.60.0"
+version = "1.60.1"
 dependencies = [
  "flate2",
  "futures-util",

socktop/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "socktop"
-version = "1.60.0"
+version = "1.60.1"
 authors = ["Jason Witty <jasonpwitty+socktop@proton.me>"]
 description = "Remote system monitor over WebSocket, TUI like top"
 edition = "2024"
@@ -11,7 +11,7 @@ repository = "https://github.com/jasonwitty/socktop"
 
 [dependencies]
 # socktop connector for agent communication
-socktop_connector = { version = "1.60.0", path = "../socktop_connector" }
+socktop_connector = { version = "1.60.1", path = "../socktop_connector" }
 
 tokio = { workspace = true }
 futures-util = { workspace = true }

socktop_agent/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "socktop_agent"
-version = "1.60.0"
+version = "1.60.1"
 authors = ["Jason Witty <jasonpwitty+socktop@proton.me>"]
 description = "Socktop agent daemon. Serves host metrics over WebSocket."
 edition = "2024"

socktop_connector/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "socktop_connector"
-version = "1.60.0"
+version = "1.60.1"
 edition = "2024"
 license = "MIT"
 description = "WebSocket connector library for socktop agent communication"