From d555434fa726ad58c7567bcb263af19ea54411fd Mon Sep 17 00:00:00 2001 From: Emily Albini Date: Tue, 11 Aug 2026 11:20:09 +0200 Subject: [PATCH 1/3] build linux binaries on musl --- .github/buildomat/jobs/client-linux.sh | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/buildomat/jobs/client-linux.sh b/.github/buildomat/jobs/client-linux.sh index 004f88e5..503be2c1 100644 --- a/.github/buildomat/jobs/client-linux.sh +++ b/.github/buildomat/jobs/client-linux.sh @@ -1,7 +1,7 @@ #!/bin/bash #: name = "client (linux)" #: variety = "basic" -#: target = "ubuntu-22.04" +#: target = "ubuntu-26.04" #: rust_toolchain = true #: output_rules = ["=/work/sush"] #: access_repos = ["oxidecomputer/permission-slip"] @@ -15,6 +15,13 @@ set -o errexit set -o pipefail set -o xtrace +# We build the client binary with MUSL to be compatible with any Linux distribution, regardless of +# whether it uses an older glibc version than this CI job. This also makes the binary work on NixOS. +TARGET=x86_64-unknown-linux-musl +rustup target install "$TARGET" + +DEBIAN_FRONTEND=noninteractive sudo apt-get install -y musl-tools + cargo --version rustc --version @@ -24,5 +31,5 @@ export CARGO_INCREMENTAL=0 mkdir -p /work -cargo build --release --locked --package sush-client --features permslip -cp target/release/sush /work/sush +cargo build --target "$TARGET" --release --locked --package sush-client --features permslip +cp "target/$TARGET/release/sush" /work/sush From ee55c2d9336f2e67e3b4945e6d54846023853dc9 Mon Sep 17 00:00:00 2001 From: Emily Albini Date: Tue, 11 Aug 2026 11:26:13 +0200 Subject: [PATCH 2/3] fix compilation failure on linux --- .github/buildomat/jobs/client-linux.sh | 2 +- Cargo.lock | 1 + Cargo.toml | 1 + client/Cargo.toml | 1 + 4 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/buildomat/jobs/client-linux.sh b/.github/buildomat/jobs/client-linux.sh index 503be2c1..7e9aebe6 100644 --- a/.github/buildomat/jobs/client-linux.sh +++ b/.github/buildomat/jobs/client-linux.sh @@ -31,5 +31,5 @@ export CARGO_INCREMENTAL=0 mkdir -p /work -cargo build --target "$TARGET" --release --locked --package sush-client --features permslip +cargo build --target "$TARGET" --release --locked --package sush-client --features permslip --features openssl/vendored cp "target/$TARGET/release/sush" /work/sush diff --git a/Cargo.lock b/Cargo.lock index ae549ab7..4150e4c5 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3560,6 +3560,7 @@ dependencies = [ "humantime", "indicatif", "memmap2", + "openssl", "p256", "pem-rfc7468", "permission-slip-client", diff --git a/Cargo.toml b/Cargo.toml index db34c692..714d7f76 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -25,6 +25,7 @@ indicatif = "0.18" libc = "0.2" lru = "0.18" memmap2 = "0.9" +openssl = "0.10" p256 = { version = "0.13", features = ["ecdsa"] } pem-rfc7468 = { version = "0.7", features = ["std"] } permission-slip-client = { git = "https://github.com/oxidecomputer/permission-slip" } diff --git a/client/Cargo.toml b/client/Cargo.toml index c95a0c8d..a6016a0e 100644 --- a/client/Cargo.toml +++ b/client/Cargo.toml @@ -31,6 +31,7 @@ http-range-header.workspace = true humantime.workspace = true indicatif.workspace = true memmap2.workspace = true +openssl.workspace = true # Needed to build the client with `--features `openssl/vendored`. p256.workspace = true pem-rfc7468.workspace = true permission-slip-client = { workspace = true, optional = true } From 759de3dcb549999ca331e94abadc66059277bf09 Mon Sep 17 00:00:00 2001 From: Alex Plotnick Date: Wed, 12 Aug 2026 02:01:27 +0000 Subject: [PATCH 3/3] Build the Linux client with MUSL alone Drop the vendored openssl arrangements. They compensate for the old permission-slip pin, whose reqwest drags in openssl-sys. The pin moves to reqwest 0.13 when the omicron-integration branch lands, and nothing needs openssl after that. Hold this commit until then. --- .github/buildomat/jobs/client-linux.sh | 2 +- Cargo.lock | 1 - Cargo.toml | 1 - client/Cargo.toml | 1 - 4 files changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/buildomat/jobs/client-linux.sh b/.github/buildomat/jobs/client-linux.sh index 7e9aebe6..503be2c1 100644 --- a/.github/buildomat/jobs/client-linux.sh +++ b/.github/buildomat/jobs/client-linux.sh @@ -31,5 +31,5 @@ export CARGO_INCREMENTAL=0 mkdir -p /work -cargo build --target "$TARGET" --release --locked --package sush-client --features permslip --features openssl/vendored +cargo build --target "$TARGET" --release --locked --package sush-client --features permslip cp "target/$TARGET/release/sush" /work/sush diff --git a/Cargo.lock b/Cargo.lock index 4150e4c5..ae549ab7 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3560,7 +3560,6 @@ dependencies = [ "humantime", "indicatif", "memmap2", - "openssl", "p256", "pem-rfc7468", "permission-slip-client", diff --git a/Cargo.toml b/Cargo.toml index 714d7f76..db34c692 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -25,7 +25,6 @@ indicatif = "0.18" libc = "0.2" lru = "0.18" memmap2 = "0.9" -openssl = "0.10" p256 = { version = "0.13", features = ["ecdsa"] } pem-rfc7468 = { version = "0.7", features = ["std"] } permission-slip-client = { git = "https://github.com/oxidecomputer/permission-slip" } diff --git a/client/Cargo.toml b/client/Cargo.toml index a6016a0e..c95a0c8d 100644 --- a/client/Cargo.toml +++ b/client/Cargo.toml @@ -31,7 +31,6 @@ http-range-header.workspace = true humantime.workspace = true indicatif.workspace = true memmap2.workspace = true -openssl.workspace = true # Needed to build the client with `--features `openssl/vendored`. p256.workspace = true pem-rfc7468.workspace = true permission-slip-client = { workspace = true, optional = true }