CI

.github/workflows/ci.yml

@@ -5,7 +5,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/staex-io/cijail-ci:latest@sha256:d0b8c1face1d71971bbddd7f934409c212e077555e0316c9ada2e6b913a97e57
+      image: ghcr.io/staex-io/cijail-ci:latest@sha256:433d5abd1315ae254cc820447b5c3ea95ff7384f8904217a2ddbc8bad4be6a34
       credentials:
         username: token
         password: ${{ secrets.GHCR_TOKEN }}

ci/Dockerfile

@@ -1,4 +1,6 @@
-FROM rust:1.76.0
+FROM rust:1.76.0-bullseye
+# NB: We need debian stable to have the oldest possible glibc
+# otherwise cijail may not work on old distributions.
 
 RUN apt-get -qq update \
     && apt-get -qq install --no-install-recommends \
@@ -11,7 +13,7 @@ RUN apt-get -qq update \
     clang \
     && rm -rf /var/lib/apt/lists/*
 
-RUN pip3 install --quiet --no-cache-dir --no-input --break-system-packages lcov_cobertura==2.0.*
+RUN pip3 install --quiet --no-cache-dir --no-input lcov_cobertura==2.0.*
 
 ENV CARGO_HOME=/usr/local/cargo \
     RUSTUP_HOME=/usr/local/rustup \

ci/binaries.sh

@@ -21,15 +21,14 @@ set -ex
 rootdir="$PWD"
 workdir="$(mktemp -d)"
 rust_flags="-Ccodegen-units=1 -Cstrip=symbols -Copt-level=3 -Cincremental=false -Clto=yes -Cembed-bitcode=yes"
-target=x86_64-unknown-linux-musl
+target=x86_64-unknown-linux-gnu
 export LIBSECCOMP_LINK_TYPE=static
 export LIBSECCOMP_LIB_PATH=/usr/lib/x86_64-linux-gnu
-apt-get update -qq
-apt-get install clang -y
+glibc_version="$(getconf GNU_LIBC_VERSION | sed 's/ /-/g')"
 env RUSTFLAGS="$rust_flags" \
     cargo build \
     --quiet \
     --release \
     --target "$target" \
     --no-default-features
-mv target/"$target"/release/cijail cijail
+mv target/"$target"/release/cijail cijail-"$glibc_version"