You've already forked runc
mirror of
https://github.com/opencontainers/runc.git
synced 2026-10-23 19:49:01 +03:00
78c3b60426
When cross-building libseccomp, build_libseccomp resets CFLAGS to an empty value (if it was unset) before each architecture, and set_cross_vars exports it. Autoconf only applies its default CFLAGS (-g -O2) when CFLAGS is unset, so the per-architecture libseccomp builds (which are what release binaries link against, including for the native architecture) end up unoptimized. The only reason CFLAGS was touched at all is that set_cross_vars puts -m32 -march=... there for 386, which is why callers had to save and restore it. Pass these flags via CC instead (as autoconf documentation suggests for multilib builds), so set_cross_vars no longer modifies CFLAGS, and remove the now-unneeded save/restore dance from both build-seccomp.sh and release_build.sh. This way, a user-provided CFLAGS is passed as is, and if it is unset, configure uses its defaults for all architectures, including 386. Note that go build does not use CFLAGS (cgo uses CGO_CFLAGS), and it handles CC with arguments just fine. Reported-by: Ciprian Hacman <ciprian@hakman.dev> Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
70 lines
1.9 KiB
Bash
Executable File
70 lines
1.9 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -e -u -o pipefail
|
|
|
|
# shellcheck source=./script/lib.sh
|
|
source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
|
|
|
|
# sha256 checksums for seccomp release tarballs.
|
|
declare -A SECCOMP_SHA256=(
|
|
["2.5.5"]=248a2c8a4d9b9858aa6baf52712c34afefcf9c9e94b76dce02c1c9aa25fb3375
|
|
["2.5.6"]=04c37d72965dce218a0c94519b056e1775cf786b5260ee2b7992956c4ee38633
|
|
["2.6.0"]=83b6085232d1588c379dc9b9cae47bb37407cf262e6e74993c61ba72d2a784dc
|
|
["2.6.1"]=501f66c667225d53791b97e1d7cf85ab764c297d04881f60f38f451c4b0ee1be
|
|
)
|
|
|
|
# Due to libseccomp being LGPL we must include its sources,
|
|
# so download, install and build against it.
|
|
# Parameters:
|
|
# $1 -- libseccomp version to download and build.
|
|
# $2 -- destination directory.
|
|
# $@ -- additional architectures to cross-compile for.
|
|
function build_libseccomp() {
|
|
local ver="$1"
|
|
shift
|
|
local dest="$1"
|
|
shift
|
|
local arches=("$@")
|
|
local tar="libseccomp-${ver}.tar.gz"
|
|
|
|
# Download, check, and extract.
|
|
curl -fsSL --retry 5 --remote-name-all \
|
|
"https://github.com/seccomp/libseccomp/releases/download/v${ver}/${tar}"{,.asc}
|
|
sha256sum --strict --check - <<<"${SECCOMP_SHA256[${ver}]} *${tar}"
|
|
|
|
local srcdir
|
|
srcdir="$(mktemp -d)"
|
|
tar xf "$tar" -C "$srcdir"
|
|
pushd "$srcdir/libseccomp-$ver" || return
|
|
|
|
# Install native version for Dockerfile builds.
|
|
./configure \
|
|
--prefix="$dest" --libdir="$dest/lib" \
|
|
--enable-static --enable-shared
|
|
make install
|
|
make clean
|
|
|
|
# Build and install for all requested architectures.
|
|
local arch
|
|
for arch in "${arches[@]}"; do
|
|
set_cross_vars "$arch"
|
|
./configure --host "$HOST" \
|
|
--prefix="$dest/$arch" --libdir="$dest/$arch/lib" \
|
|
--enable-static --enable-shared
|
|
make install
|
|
make clean
|
|
done
|
|
|
|
# Place the source tarball to $dest/src.
|
|
popd || return
|
|
mkdir -p "$dest"/src
|
|
mv "$tar"{,.asc} "$dest"/src
|
|
}
|
|
|
|
if [ $# -lt 2 ]; then
|
|
echo "Usage: $0 <version> <dest-dir> [<extra-arch> ...]" >&2
|
|
exit 1
|
|
fi
|
|
|
|
build_libseccomp "$@"
|