ci: gate nix linux packages on required glibc <= 2.31

nix/checks.nix

@@ -571,7 +571,7 @@
                 # running server as pg_regress (--use-existing). These specs target
                 # core/heap + contrib concurrency behaviour. Skipped on:
                 #   - CLI variants: portable build runs only a test subset.
-                #   - orioledb ships its own isolation suite for its storage-engine 
+                #   - orioledb ships its own isolation suite for its storage-engine
                 #     concurrency semantics.
                 #shellcheck disable=SC2193
                 if ${lib.boolToString isCliVariant}; then
@@ -954,6 +954,21 @@
             postgresql_17_src
             ;
           psql_orioledb-17_exts_orioledb_debug = self'.legacyPackages.psql_orioledb-17.exts.orioledb.debug;
+          glibc-version-check =
+            let
+              checkScript = pkgs.writers.writeNuBin "check-glibc-version" (
+                builtins.readFile ./tools/check-glibc-version.nu
+              );
+            in
+            pkgs.runCommand "glibc-version-check"
+              {
+                nativeBuildInputs = [ pkgs.binutils ];
+                paths = lib.collect lib.isDerivation (self'.legacyPackages // self'.packages);
+              }
+              ''
+                ${lib.getExe checkScript} 2.31 $paths
+                touch $out
+              '';
         };
     };
 }

nix/tools/check-glibc-version.nu

@@ -0,0 +1,38 @@
+#!/usr/bin/env nu
+
+def parse-version [] {
+    split row "." | each { into int }
+}
+
+def is-elf []: path -> bool {
+    (open --raw $in | bytes at 0..<4) == ("\u{7f}ELF" | into binary)
+}
+
+def max-glibc-version [path: path] {
+    ^objdump -T $path | complete | get stdout
+    | parse -r 'GLIBC_(?<ver>[0-9.]+)' | get ver
+    | each { parse-version }
+    | sort
+    | last
+}
+
+# Fails if any file under the given paths requires a newer glibc than max_version.
+def main [max_version: string, ...paths: path] {
+    let offenders = (
+        $paths
+        | each { glob $"($in)/**/*" } | flatten
+        | where { ($in | path type) == file }
+        | where { is-elf }
+        | par-each { |f| { file: $f, version: (max-glibc-version $f) } }
+        | compact version
+        | where version > ($max_version | parse-version)
+    )
+
+    if ($offenders | is-empty) {
+        print $"glibc version OK \(<= ($max_version)\)"
+        exit 0
+    }
+
+    print $offenders
+    exit 1
+}