From d555434fa726ad58c7567bcb263af19ea54411fd Mon Sep 17 00:00:00 2001 From: Emily Albini Date: Tue, 11 Aug 2026 11:20:09 +0200 Subject: [PATCH 1/3] build linux binaries on musl --- .github/buildomat/jobs/client-linux.sh | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/buildomat/jobs/client-linux.sh b/.github/buildomat/jobs/client-linux.sh index 004f88e..503be2c 100644 --- a/.github/buildomat/jobs/client-linux.sh +++ b/.github/buildomat/jobs/client-linux.sh @@ -1,7 +1,7 @@ #!/bin/bash #: name = "client (linux)" #: variety = "basic" -#: target = "ubuntu-22.04" +#: target = "ubuntu-26.04" #: rust_toolchain = true #: output_rules = ["=/work/sush"] #: access_repos = ["oxidecomputer/permission-slip"] @@ -15,6 +15,13 @@ set -o errexit set -o pipefail set -o xtrace +# We build the client binary with MUSL to be compatible with any Linux distribution, regardless of +# whether it uses an older glibc version than this CI job. This also makes the binary work on NixOS. +TARGET=x86_64-unknown-linux-musl +rustup target install "$TARGET" + +DEBIAN_FRONTEND=noninteractive sudo apt-get install -y musl-tools + cargo --version rustc --version @@ -24,5 +31,5 @@ export CARGO_INCREMENTAL=0 mkdir -p /work -cargo build --release --locked --package sush-client --features permslip -cp target/release/sush /work/sush +cargo build --target "$TARGET" --release --locked --package sush-client --features permslip +cp "target/$TARGET/release/sush" /work/sush From ee55c2d9336f2e67e3b4945e6d54846023853dc9 Mon Sep 17 00:00:00 2001 From: Emily Albini Date: Tue, 11 Aug 2026 11:26:13 +0200 Subject: [PATCH 2/3] fix compilation failure on linux --- .github/buildomat/jobs/client-linux.sh | 2 +- Cargo.lock | 1 + Cargo.toml | 1 + client/Cargo.toml | 1 + 4 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/buildomat/jobs/client-linux.sh b/.github/buildomat/jobs/client-linux.sh index 503be2c..7e9aebe 100644 --- a/.github/buildomat/jobs/client-linux.sh +++ b/.github/buildomat/jobs/client-linux.sh @@ -31,5 +31,5 @@ export CARGO_INCREMENTAL=0 mkdir -p /work -cargo build --target "$TARGET" --release --locked --package sush-client --features permslip +cargo build --target "$TARGET" --release --locked --package sush-client --features permslip --features openssl/vendored cp "target/$TARGET/release/sush" /work/sush diff --git a/Cargo.lock b/Cargo.lock index ae549ab..4150e4c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3560,6 +3560,7 @@ dependencies = [ "humantime", "indicatif", "memmap2", + "openssl", "p256", "pem-rfc7468", "permission-slip-client", diff --git a/Cargo.toml b/Cargo.toml index db34c69..714d7f7 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -25,6 +25,7 @@ indicatif = "0.18" libc = "0.2" lru = "0.18" memmap2 = "0.9" +openssl = "0.10" p256 = { version = "0.13", features = ["ecdsa"] } pem-rfc7468 = { version = "0.7", features = ["std"] } permission-slip-client = { git = "https://github.com/oxidecomputer/permission-slip" } diff --git a/client/Cargo.toml b/client/Cargo.toml index c95a0c8..a6016a0 100644 --- a/client/Cargo.toml +++ b/client/Cargo.toml @@ -31,6 +31,7 @@ http-range-header.workspace = true humantime.workspace = true indicatif.workspace = true memmap2.workspace = true +openssl.workspace = true # Needed to build the client with `--features `openssl/vendored`. p256.workspace = true pem-rfc7468.workspace = true permission-slip-client = { workspace = true, optional = true } From 759de3dcb549999ca331e94abadc66059277bf09 Mon Sep 17 00:00:00 2001 From: Alex Plotnick Date: Wed, 12 Aug 2026 02:01:27 +0000 Subject: [PATCH 3/3] Build the Linux client with MUSL alone Drop the vendored openssl arrangements. They compensate for the old permission-slip pin, whose reqwest drags in openssl-sys. The pin moves to reqwest 0.13 when the omicron-integration branch lands, and nothing needs openssl after that. Hold this commit until then. --- .github/buildomat/jobs/client-linux.sh | 2 +- Cargo.lock | 1 - Cargo.toml | 1 - client/Cargo.toml | 1 - 4 files changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/buildomat/jobs/client-linux.sh b/.github/buildomat/jobs/client-linux.sh index 7e9aebe..503be2c 100644 --- a/.github/buildomat/jobs/client-linux.sh +++ b/.github/buildomat/jobs/client-linux.sh @@ -31,5 +31,5 @@ export CARGO_INCREMENTAL=0 mkdir -p /work -cargo build --target "$TARGET" --release --locked --package sush-client --features permslip --features openssl/vendored +cargo build --target "$TARGET" --release --locked --package sush-client --features permslip cp "target/$TARGET/release/sush" /work/sush diff --git a/Cargo.lock b/Cargo.lock index 4150e4c..ae549ab 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3560,7 +3560,6 @@ dependencies = [ "humantime", "indicatif", "memmap2", - "openssl", "p256", "pem-rfc7468", "permission-slip-client", diff --git a/Cargo.toml b/Cargo.toml index 714d7f7..db34c69 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -25,7 +25,6 @@ indicatif = "0.18" libc = "0.2" lru = "0.18" memmap2 = "0.9" -openssl = "0.10" p256 = { version = "0.13", features = ["ecdsa"] } pem-rfc7468 = { version = "0.7", features = ["std"] } permission-slip-client = { git = "https://github.com/oxidecomputer/permission-slip" } diff --git a/client/Cargo.toml b/client/Cargo.toml index a6016a0..c95a0c8 100644 --- a/client/Cargo.toml +++ b/client/Cargo.toml @@ -31,7 +31,6 @@ http-range-header.workspace = true humantime.workspace = true indicatif.workspace = true memmap2.workspace = true -openssl.workspace = true # Needed to build the client with `--features `openssl/vendored`. p256.workspace = true pem-rfc7468.workspace = true permission-slip-client = { workspace = true, optional = true }