mirror of
https://github.com/pgsty/silo.git
synced 2026-10-26 13:50:26 +00:00
Feng Ruohang
011b0df5f5
Update the server and five debugging modules, regenerate dependency credits, and refresh static curl and the native Red Hat CA mitigation. Preserve Kafka's default broker protocol and terminal widths. Copy the returned DARE plaintext when unsealing legacy keys, and cover old encrypted keys, Kafka producer exchanges, and MinKMS TLS identity with regression tests. Keep the published PGSTY component references for reproducible builds. Validated with make test, targeted race tests, module integrity and tidy checks, and govulncheck v1.9.0 source analysis. Rechecked the frozen source and artifact hashes behind the earlier whole-stack compatibility evidence. Signed-off-by: Feng Ruohang <rh@vonng.com>
51 lines
2.1 KiB
Bash
51 lines
2.1 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
# Build both release architectures from the same verified upstream source.
|
|
# The previous binary supplier stopped publishing current ARM64 builds.
|
|
CURL_VERSION=8.23.0
|
|
CURL_SHA256=8dadd7d2536a314f982ad05a651b713f426bf7d02cc2c76cffb9796f2218e6c5
|
|
|
|
case ${TARGETARCH:?TARGETARCH is required} in
|
|
amd64) expected_arch=x86_64 ;;
|
|
arm64) expected_arch=aarch64 ;;
|
|
*) echo "Unsupported cURL architecture: ${TARGETARCH}" >&2; exit 1 ;;
|
|
esac
|
|
[ "$(apk --print-arch)" = "$expected_arch" ] || {
|
|
echo "cURL must be built natively for ${TARGETARCH}" >&2
|
|
exit 1
|
|
}
|
|
|
|
# Keep security fixes in statically linked libraries, including distro backports.
|
|
apk add --no-cache --upgrade build-base curl ca-certificates \
|
|
'musl-dev>=1.2.6-r3' 'openssl-libs-static>=3.5.9-r0' \
|
|
'nghttp2-static>=1.70.0-r0' libpsl-static libidn2-static \
|
|
libunistring-static 'zlib-static>=1.3.2-r1' 'brotli-static>=1.2.1-r0' \
|
|
zstd-static 'libssh2-static>=1.11.1-r4'
|
|
|
|
work=$(mktemp -d)
|
|
trap 'rm -rf "$work"' EXIT
|
|
curl --fail --location --silent --show-error --retry 3 \
|
|
--connect-timeout 15 --max-time 180 \
|
|
"https://curl.se/download/curl-${CURL_VERSION}.tar.xz" -o "$work/curl.tar.xz"
|
|
printf '%s %s\n' "$CURL_SHA256" "$work/curl.tar.xz" | sha256sum -c -
|
|
tar -xJf "$work/curl.tar.xz" -C "$work"
|
|
cd "$work/curl-${CURL_VERSION}"
|
|
PKG_CONFIG="pkg-config --static" LDFLAGS="-static" ./configure \
|
|
--disable-shared --enable-static --with-openssl --with-libssh2 \
|
|
--with-nghttp2 --with-brotli --with-zstd --with-libidn2 --with-libpsl \
|
|
--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt --without-ca-path \
|
|
--disable-ldap --disable-ldaps
|
|
# libtool's -static only embeds libcurl; -all-static also embeds its dependencies.
|
|
make -j"${CURL_BUILD_JOBS:-4}" LDFLAGS="-all-static"
|
|
strip src/curl
|
|
if readelf -l src/curl | grep -q INTERP || readelf -d src/curl | grep -q NEEDED; then
|
|
echo "cURL still requires a dynamic loader or shared libraries" >&2
|
|
exit 1
|
|
fi
|
|
src/curl --version
|
|
mkdir -p /go/bin /go/share/curl
|
|
cp src/curl /go/bin/curl
|
|
cp COPYING /go/share/curl/COPYING
|
|
apk info -v | sort > /go/share/curl/build-packages.txt
|