This repository was archived by the owner on Jan 30, 2026. It is now read-only.
feat: add musl static binaries for linux#200
Merged
infiniteregrets merged 1 commit intomainfrom Jan 20, 2026
Merged
Conversation
Greptile SummaryThis PR adds support for building static musl binaries for Linux on both x86_64 and aarch64 architectures, enabling better portability across different Linux distributions. Key Changes:
Security Concern:
Confidence Score: 3/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant GH as GitHub Actions
participant Build as Build Job
participant Rust as Rust Toolchain
participant Deps as Dependencies
participant Cargo as Cargo Build
participant Artifact as Artifact Storage
Note over GH,Artifact: New: musl targets added
GH->>Build: Trigger on tag push
Build->>Rust: Setup Rust with target
alt x86_64-musl target
Build->>Deps: Install musl-tools via apt
else aarch64-musl target
Build->>Deps: Download aarch64-musl-cross toolchain
Deps->>Deps: Extract and add to PATH
Build->>Build: Set CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER
end
Build->>Cargo: cargo build --release --target
Cargo-->>Build: Binary artifact
Build->>Build: Zip binary
Build->>Artifact: Upload artifact
Note over GH,Artifact: Artifacts used by create_release job
|
| deps: | | ||
| sudo apt-get update | ||
| sudo apt-get install -y wget | ||
| wget -q https://musl.cc/aarch64-linux-musl-cross.tgz |
There was a problem hiding this comment.
logic: Downloading toolchain from external source without checksum verification. Consider verifying the archive's integrity or pinning to a specific checksum to prevent supply chain attacks.
Suggested change
| wget -q https://musl.cc/aarch64-linux-musl-cross.tgz | |
| wget -q https://musl.cc/aarch64-linux-musl-cross.tgz | |
| echo "EXPECTED_SHA256 aarch64-linux-musl-cross.tgz" | sha256sum -c - |
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/release.yml
Line: 33:33
Comment:
**logic:** Downloading toolchain from external source without checksum verification. Consider verifying the archive's integrity or pinning to a specific checksum to prevent supply chain attacks.
```suggestion
wget -q https://musl.cc/aarch64-linux-musl-cross.tgz
echo "EXPECTED_SHA256 aarch64-linux-musl-cross.tgz" | sha256sum -c -
```
How can I resolve this? If you propose a fix, please make it concise.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
S2-916
When someone tries to run the binary on a system with an older glibc version:
they may get this:
s2: /lib/aarch64-linux-gnu/libc.so.6: version `GLIBC_2.38' not found (required by s2)
so we can provide statically linked binaries