Conversation
Guards against binaries silently requiring a newer glibc than customer AMIs ship. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Runs as checks.<system>.glibc-floor, auto-discovered by the existing nix-eval matrix generator, so no workflow changes are needed. Scans every legacyPackages derivation instead of one step per matrix leg. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Same find/objdump/version-compare logic, packaged via pkgs.writers.writeNuBin. Verified standalone against a fake objdump (pass/fail/no-match cases) since the local linux-builder VM's clock is currently skewed and blocking real nix builds unrelated to this change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Drop the single-worst summary line; print one line per file that exceeds the floor (deduped to its own worst symbol version), plus a short pass line when nothing offends. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
PostgreSQL Extension Dependency Analysis: PR #2437
SummaryNo extensions had dependencies with MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Extension DependenciesPostgreSQL 17 Extension DependenciesOrioleDB 17 Extension Dependencies |
PostgreSQL Package Dependency Analysis: PR #2437
SummaryNo packages had MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Dependency ChangesExtracting PostgreSQL 15 dependencies...
Runtime Closure Size
Raw Dependency ClosurePostgreSQL 17 Dependency ChangesExtracting PostgreSQL 17 dependencies...
Runtime Closure Size
Raw Dependency Closure |
Print offenders as a table instead of hand-formatted strings, run
objdump via par-each, drop the do{}/exit_code plumbing (a failing
objdump naturally yields no stdout, so it's already filtered out).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
packages is missing site-extensions-versions-* and only exposes flat psql_X/bin (not individual .exts.*), so union both trees rather than choosing one and risking a coverage gap. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Packages contain far more non-ELF files (docs, control files, SQL, scripts) than ELF ones. Checking the magic bytes natively in nushell avoids spawning an objdump process per file that could never match. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
is-elf now guards its own path-type check, collapsing the two where clauses into one. Also tried adding a `-> list<int>` return type to ver-key, but nushell's static checker rejects `>` on that type even though it works fine at runtime on inferred lists, so left it untyped. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
[] | last returns null rather than erroring, so building the record unconditionally and filtering null versions out in one where clause replaces the separate if/else + compact step. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Renamed away from "floor" terminology (the function computes each file's max required glibc version, not a floor) across the nix check attribute, script filename, and its docstring/output text. Also rewrote the check logic itself in idiomatic nushell: is-elf and max-glibc-version as named helpers, ELF detection via magic-byte check (skips non-ELF files instead of shelling out to objdump for every file), version comparison via parsed int lists, and offending files printed as a table. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
brainrake
marked this pull request as ready for review
September 14, 2026 09:08
brainrake
changed the title
Collaborator
|
There's no explanation for why we want to have this functionality. It also seems to me that we use libc from nix for most binaries so this enforcement doesn't make sense in those cases right? |
Collaborator
|
Also https://github.com/fzakaria/sqlelf is worth a look too ;) |
brainrake
marked this pull request as draft
September 14, 2026 19:54
Collaborator
Author
|
@mmlb updated description to show why we need this. It's a tricky one. |
brainrake
marked this pull request as ready for review
September 17, 2026 17:05
brainrake
marked this pull request as draft
September 17, 2026 17:06
brainrake
marked this pull request as ready for review
September 18, 2026 01:06
nativeBuildInputs on the outer runCommand already puts objdump on PATH for the wrapped script's process, so wrapping checkScript itself was unnecessary — it has no other callers. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
Supautils is
dlopened into running postgresql and resolvesglibcfrom the one that is already loaded. So it needs to be compatible with oldglibc. See #2436What
Adds a step to both Linux package matrix jobs that scans every built
legacyPackages.*artifact forobjdump -TGLIBC symbol versions and fails if any exceed 2.31 (Ubuntu 20.04 / Debian 11 floor).Test plan
MPG-126