Repository navigation
release: build .deb and .rpm packages - #271
Merged
Merged
Conversation
congwang-mk
force-pushed
the
embed-restore-stub
branch
from
October 2, 2026 22:20
a66245a to
f14894a
Compare
congwang-mk
force-pushed
the
nfpm-packages
branch
2 times, most recently
from
October 2, 2026 22:57
7b972b3 to
f4ff18b
Compare
The template hardcoded ${exec_prefix}/lib, which is wrong for RPM-based
distros, where 64-bit libraries live in /usr/lib64. libdir is now an
@LIBDIR@ placeholder; the Makefile fills in the same ${exec_prefix}/lib
as before, so the Go library tree it stages is unchanged.
Signed-off-by: Cong Wang <cwang@multikernel.io>
Attach .deb and .rpm packages per arch to each GitHub Release, so users on Debian/Ubuntu and Fedora/RHEL can install sandlock with their package manager instead of unpacking a tarball. They are built from the existing release binaries with nfpm (pinned by version and checksum) and are not submitted to any distro. The CLI does not link libsandlock_ffi, so the library ships separately: sandlock carries the CLI, sandlock-oci and the license, and sandlock-dev (sandlock-devel for .rpm) carries libsandlock_ffi.so with sandlock.h and sandlock.pc for C and Go SDK builds. The library has no SONAME, so there is no versioned runtime library to split off from the header. The library and .pc file go to /usr/lib for .deb and /usr/lib64 for .rpm, since Fedora and RHEL only search the latter. The binaries need glibc 2.34, which covers Ubuntu 22.04, Debian 12 and RHEL 9 onwards. On x86_64 the job installs both packages, the .rpm in a Rocky 9 container, and runs a sandboxed command before the release picks them up. riscv64 packages are experimental, like the riscv64 build. Signed-off-by: Cong Wang <cwang@multikernel.io>
congwang-mk
force-pushed
the
nfpm-packages
branch
from
October 2, 2026 23:27
f4ff18b to
4010ebf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Attaches
.deband.rpmpackages per arch to each GitHub Release, so users on Debian/Ubuntu and Fedora/RHEL can install sandlock with their package manager instead of unpacking a tarball. The packages are built in our release CI and are not submitted to any distro.Packages
The CLI does not link
libsandlock_ffi, so the library, its header and its pkg-config file ship in a separate development package:sandlocksandlock-dev(.deb) /sandlock-devel(.rpm)/usr/bin/sandlock,/usr/bin/sandlock-ocilibsandlock_ffi.so,sandlock.pc,/usr/include/sandlock.h/usr/lib(.deb),/usr/lib64(.rpm)/usr/share/doc/<pkg>/copyright(.deb),/usr/share/licenses/<pkg>/LICENSE(.rpm)libc6 (>= 2.34),libgcc-s1/glibc >= 2.34,libgccThe usual three-way split (versioned runtime library,
-devwith the unversioned symlink) needs a SONAME, whichlibsandlock_ffi.sodoes not have, so a program built with the C or Go SDK needssandlock-devinstalled at runtime too. Fedora and RHEL only search/usr/lib64for 64-bit libraries, hence the per-format library dir. The release binaries only need glibc 2.34 symbols, which covers Ubuntu 22.04, Debian 12, and RHEL/Rocky/Alma 9 onwards. The.debdev package activates dpkg'sldconfigtrigger; on the.rpmside glibc's file trigger already refreshes the cache for/usr/lib64.Commits
sandlock.pc.intakes its libdir from the caller. The template hardcoded${exec_prefix}/lib. It is now an@LIBDIR@placeholder; the Makefile fills in the same value, and the Go library tree it stages is byte-identical.packaging/nfpm.yaml(CLI) andpackaging/nfpm-dev.yaml(library) describe the packages, andpackaging/build.shstages a release build and runs nfpm for both formats, so CI and a local build use the same path. A newpackagesjob inrelease.ymlbuilds them from the existing per-arch release tarballs with nfpm (pinned by version and sha256), andgithub-releaseattaches them. riscv64 is experimental, like its build.Testing
.debpackages on the runner and the.rpmpackages in a Rocky 9 container, then runs a sandboxed command and checkspkg-configand the linker cache.sandlockpackage alone runs a sandbox and installs no header or library.🤖 Generated with Claude Code