brooktrails/apt-cacher-ng
Watch
1
0
Fork
You've already forked apt-cacher-ng
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: derive runtime deps via objdump; build the image in PR CI #2

Merged
rcsheets merged 2 commits from fix/image-runtime-deps into main 2026-07-24 01:50:25 +00:00
Conversation 0 Commits 2 Files changed 2 +72 -31
rcsheets commented 2026-07-24 01:43:36 +00:00
Owner
Copy link

The build-push on the #1 merge failed at the runtime-dep derivation step. Two independent problems, both fixed here:

1. ldd does not work under buildah chroot isolation. The step used ldd to find linked libraries; ldd executes the dynamic loader, which the sandbox does not support, so it produced no paths and the test -s guard failed the build. Switched to objdump -p (a static read of the ELF NEEDED entries), resolving each SONAME through the ldconfig cache.

2. merged-/usr path mismatch. ldconfig reports libraries under /lib/..., but dpkg records them under /usr/lib/..., so dpkg -S matched nothing even once paths were found. Each resolved path is now realpath-canonicalized before the lookup. (This would have bitten the ldd approach too.) Validated the full objdump -> ldconfig -> realpath -> dpkg pipeline against real binaries.

Why it reached main: PR CI (ci.yaml) only ran cmake/make and never built the image, so the Dockerfile-only bug passed the branch and failed on merge. ci.yaml now builds the real image via buildah and smoke-tests the running daemon against /acng-report.html -- the same setup build-push.yaml uses, minus the push. An image-only regression now fails the PR instead of main.

The new PR job needs the trusted-apt-cacher-ng runner (infra#213, merged) and HARBOR_REGISTRY for the base-image mirror; both are already in place since build-push ran.

🤖 Generated with Claude Code

The build-push on the #1 merge failed at the runtime-dep derivation step. Two independent problems, both fixed here: **1. ldd does not work under buildah chroot isolation.** The step used `ldd` to find linked libraries; `ldd` executes the dynamic loader, which the sandbox does not support, so it produced no paths and the `test -s` guard failed the build. Switched to `objdump -p` (a static read of the ELF `NEEDED` entries), resolving each SONAME through the `ldconfig` cache. **2. merged-/usr path mismatch.** `ldconfig` reports libraries under `/lib/...`, but dpkg records them under `/usr/lib/...`, so `dpkg -S` matched nothing even once paths were found. Each resolved path is now `realpath`-canonicalized before the lookup. (This would have bitten the ldd approach too.) Validated the full objdump -> ldconfig -> realpath -> dpkg pipeline against real binaries. **Why it reached main:** PR CI (`ci.yaml`) only ran `cmake`/`make` and never built the image, so the Dockerfile-only bug passed the branch and failed on merge. `ci.yaml` now builds the real image via buildah and smoke-tests the running daemon against `/acng-report.html` -- the same setup `build-push.yaml` uses, minus the push. An image-only regression now fails the PR instead of main. The new PR job needs the `trusted-apt-cacher-ng` runner (infra#213, merged) and `HARBOR_REGISTRY` for the base-image mirror; both are already in place since build-push ran. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
fix: derive runtime deps via objdump; build the image in PR CI
Some checks failed
ci / image (pull_request) Failing after 2m7s
Details
aceed3d1a8 
The runtime-dep step used ldd, which executes the dynamic loader -- that
does not work under buildah's chroot isolation, so it produced no paths and
the build failed the test -s guard on push-to-main. Switch to objdump (a
static ELF read of NEEDED), resolve each SONAME through the ldconfig cache,
and realpath-canonicalize before dpkg -S so lookups match on merged-/usr
(ldconfig reports /lib/..., dpkg records /usr/lib/...).

The bug reached main because PR CI only ran cmake/make and never built the
image. Replace that with a job that builds the real Dockerfile via buildah
and smoke-tests the running daemon -- the same setup build-push uses, minus
the push -- so an image-only failure now fails the PR.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
fix: scan all ELF objects for runtime deps, not just the two binaries
All checks were successful
ci / image (pull_request) Successful in 1m37s
Details
827b1a4a3a 
The image built but the daemon failed at startup: libevent_pthreads-2.1.so.7
missing. acng's networking lives in its private libsupacng.so, which is what
NEEDs libevent_pthreads; inspecting only the daemon and acngtool missed it,
so libevent-pthreads-2.1-7t64 never made it into the runtime image. Scan
every ELF object under /out (find -exec objdump) so a dependency pulled in
only through libsupacng.so is captured. The new PR smoke test caught this
before merge -- exactly its purpose.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
rcsheets deleted branch fix/image-runtime-deps 2026-07-24 01:50:25 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
brooktrails/apt-cacher-ng!2
No description provided.