From 8b980cbbf11324caed680069c4b55e8ea992034d Mon Sep 17 00:00:00 2001 From: mscasso-scanoss Date: Thu, 29 Oct 2026 16:57:11 +0100 Subject: [PATCH 1/2] Build release binaries on EL8 so packages run on every supported distro Release binaries were built on Ubuntu 22.04 (glibc 2.35), so scanoss required glibc 2.33/2.34: the .rpm could not be installed on RHEL/Rocky/Alma 8 (glibc 2.28) and the .deb not on Debian 11 (2.31). - Compile ldb and the engine in a rockylinux:8 container (glibc 2.28 baseline) and fail the release if the binary requires a newer glibc. - Package with package.sh directly: make prepare_*_package rebuilds on the runner. - Depend on libgcrypt20 >= 1.8.0 (Debian 11 ships 1.8.x; EL8 builds only need 1.8 symbols). - Allow manual runs (workflow_dispatch), which upload the packages as workflow artifacts instead of creating a release. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yml | 41 ++++++++++++++++++++++++++++++----- scripts/debpkg/DEBIAN/control | 2 +- 2 files changed, 36 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 804dcfc..7842894 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -2,6 +2,7 @@ name: "tagged-release" on: + workflow_dispatch: push: tags: - "v*.*.*" @@ -28,12 +29,27 @@ jobs: path: ldb fetch-depth: 0 - - name: Build & Install ldb - run: cd ldb && git checkout $(git describe --tags $(git rev-list --tags --max-count=1)) && make all && sudo make install + - name: Checkout latest ldb release + run: cd ldb && git checkout $(git describe --tags $(git rev-list --tags --max-count=1)) - - name: Build engine + # Built on EL8 (glibc 2.28) so the same binary, .deb and .rpm run on + # Debian 11+, Ubuntu 22.04+, RHEL/Rocky/Alma 8+ and Fedora. ldb is + # installed in the container because the engine links against libldb. + - name: Build ldb & engine (EL8, glibc 2.28 baseline) + run: | + docker run --rm -v "$PWD:/src" -w /src -e SUDO_USER=root rockylinux:8 bash -c ' + dnf install -y -q gcc make bc findutils zlib-devel libgcrypt-devel && + (cd ldb && make all && make install) && ldconfig && make all' + sudo chown -R "$(id -u):$(id -g)" . + + - name: Check glibc baseline + run: | + max=$(objdump -T scanoss | grep -o 'GLIBC_[0-9.]*' | sed 's/GLIBC_//' | sort -uV | tail -1) + echo "scanoss requires glibc $max" + [ "$(printf '%s\n' "$max" 2.28 | sort -V | tail -1)" = "2.28" ] || { echo "scanoss requires glibc > 2.28"; exit 1; } + + - name: Collect artifacts run: | - make all mkdir -p ./artifacts cp scanoss ./artifacts/scanoss cp LICENSES/GPL-2.0-only.txt ./artifacts/LICENSE @@ -44,13 +60,14 @@ jobs: - name: Prepare deb package id: build_deb + # package.sh directly: make prepare_*_package would rebuild on the runner run: | - make prepare_deb_package + ./package.sh deb "$(./version.sh)" echo "debpkg_file_name=$(ls *.deb)" >> $GITHUB_OUTPUT - name: Prepare rpm package run: | - make prepare_rpm_package + ./package.sh rpm "$(./version.sh)" echo "rpmpkg_file_name=$(ls dist/rpm/RPMS/x86_64/*.rpm)" >> $GITHUB_OUTPUT - name: Show the artifacts @@ -61,6 +78,18 @@ jobs: ls -al "${PWD}" ls -al "${PWD}/dist/rpm/RPMS/x86_64/" + # Manual runs (workflow_dispatch) don't create a release: keep the packages + # as workflow artifacts so they can be tested + - name: Upload packages + if: github.ref_type != 'tag' + uses: actions/upload-artifact@v4 + with: + name: packages + path: | + ./*.tar.gz + ./*.deb + ./dist/rpm/RPMS/x86_64/*.rpm + - name: Create Draft Release ${{ github.ref_type }} - ${{ github.ref_name }} if: github.ref_type == 'tag' uses: softprops/action-gh-release@v1 diff --git a/scripts/debpkg/DEBIAN/control b/scripts/debpkg/DEBIAN/control index 17cc3ef..b6ca7ca 100644 --- a/scripts/debpkg/DEBIAN/control +++ b/scripts/debpkg/DEBIAN/control @@ -2,7 +2,7 @@ Package: scanoss Version: ENGINE_VERSION Maintainer: SCANOSS Architecture: amd64 -Depends: libgcrypt20 (>= 1.9.0), libc6 (>= 2.4), zlib1g (>= 1:1.1.4) +Depends: libgcrypt20 (>= 1.8.0), libc6 (>= 2.4), zlib1g (>= 1:1.1.4) Description: SCANOSS Engine SCANOSS is an open, configurable OSS engine that was built specifically for developers, empowering them to confidently produce compliant code from the moment they begin writing, while delivering greater license and usage visibility for the broader DevOps team and supply chain partners. License: GPL-2+ From 3e2e4363df324d7e92754fa82a014880b410b24b Mon Sep 17 00:00:00 2001 From: mscasso-scanoss Date: Thu, 29 Oct 2026 17:07:22 +0100 Subject: [PATCH 2/2] Use a file-safe ref name for the tarball, so manual runs on branches work Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7842894..c410755 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -56,7 +56,7 @@ jobs: echo "Produced artifact at ${PWD}/artifacts/scanoss" - name: 'Tar files' - run: tar czvf scanoss-engine-${{ github.ref_name }}-linux-amd64.tar.gz -C ./artifacts/ . + run: tar czvf "scanoss-engine-${GITHUB_REF_NAME//\//-}-linux-amd64.tar.gz" -C ./artifacts/ . - name: Prepare deb package id: build_deb