From b797231e2ec690bcf1be9f4dacb0527d452e96e8 Mon Sep 17 00:00:00 2001
From: mscasso-scanoss <mariano.scasso@scanoss.com>
Date: Thu, 29 Oct 2026 16:56:33 +0100
Subject: [PATCH 1/2] Build release binaries on EL8 so packages run on every
 supported distro

Release binaries were built on Ubuntu 22.04 (glibc 2.35), so ldb and
libldb.so required glibc 2.33/2.34: the .rpm could not be installed on
RHEL/Rocky/Alma 8 (glibc 2.28) and the .deb not on Debian 11 (2.31).

- Compile in a rockylinux:8 container (glibc 2.28 baseline) and fail
  the release if any binary requires a newer glibc.
- Package with package.sh directly: make prepare_*_package rebuilds on
  the runner.
- Depend on libgcrypt20 >= 1.8.0 (Debian 11 ships 1.8.x; EL8 builds
  only need 1.8 symbols).
- Upload the packages as workflow artifacts on manual runs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 36 +++++++++++++++++++++++++++++++----
 scripts/debpkg/DEBIAN/control |  2 +-
 2 files changed, 33 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bcd0679..7969e16 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,9 +24,24 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Build
+      # Built on EL8 (glibc 2.28) so the same binaries, .deb and .rpm run on
+      # Debian 11+, Ubuntu 22.04+, RHEL/Rocky/Alma 8+ and Fedora.
+      - name: Build (EL8, glibc 2.28 baseline)
+        run: |
+          docker run --rm -v "$PWD:/src" -w /src rockylinux:8 bash -c '
+            dnf install -y -q gcc make zlib-devel libgcrypt-devel && make all'
+          sudo chown -R "$(id -u):$(id -g)" .
+
+      - name: Check glibc baseline
+        run: |
+          for bin in ldb libldb.so; do
+            max=$(objdump -T "$bin" | grep -o 'GLIBC_[0-9.]*' | sed 's/GLIBC_//' | sort -uV | tail -1)
+            echo "$bin requires glibc $max"
+            [ "$(printf '%s\n' "$max" 2.28 | sort -V | tail -1)" = "2.28" ] || { echo "$bin requires glibc > 2.28"; exit 1; }
+          done
+
+      - name: Collect artifacts
         run: |
-          make all
           mkdir -p ./artifacts/
           cp ldb ./artifacts/ldb
           cp libldb.so ./artifacts/libldb.so
@@ -37,13 +52,14 @@ jobs:
 
       - name: Prepare deb package
         id: build_deb
+        # package.sh directly: make prepare_*_package would rebuild on the runner
         run: |
-          make prepare_deb_package
+          ./package.sh deb "$(./version.sh)"
           echo "debpkg_file_name=$(ls *.deb)" >> $GITHUB_OUTPUT
 
       - name: Prepare rpm package
         run: |
-          make prepare_rpm_package
+          ./package.sh rpm "$(./version.sh)"
           echo "rpmpkg_file_name=$(ls dist/rpm/RPMS/x86_64/*.rpm)" >> $GITHUB_OUTPUT
 
       - name: Show the artifacts
@@ -54,6 +70,18 @@ jobs:
           ls -al "${PWD}"
           ls -al "${PWD}/dist/rpm/RPMS/x86_64/"
 
+      # Manual runs (workflow_dispatch) don't create a release: keep the packages
+      # as workflow artifacts so they can be tested
+      - name: Upload packages
+        if: github.ref_type != 'tag'
+        uses: actions/upload-artifact@v4
+        with:
+          name: packages
+          path: |
+            ./*.tar.gz
+            ./*.deb
+            ./dist/rpm/RPMS/x86_64/*.rpm
+
       - name: Create Draft Release ${{ github.ref_type }} - ${{ github.ref_name }}
         if: github.ref_type == 'tag'
         uses: softprops/action-gh-release@v1
diff --git a/scripts/debpkg/DEBIAN/control b/scripts/debpkg/DEBIAN/control
index debc4fa..ee42176 100644
--- a/scripts/debpkg/DEBIAN/control
+++ b/scripts/debpkg/DEBIAN/control
@@ -2,7 +2,7 @@ Package: ldb
 Version: LDB_VERSION
 Maintainer: SCANOSS <support@scanoss.com>
 Architecture: amd64
-Depends: libgcrypt20 (>= 1.9.0), libc6 (>= 2.4), zlib1g (>= 1:1.1.4)
+Depends: libgcrypt20 (>= 1.8.0), libc6 (>= 2.4), zlib1g (>= 1:1.1.4)
 Description: SCANOSS LDB
   The LDB (Linked-list database) is a headless database management system focused in single-key, read-only application on vast amounts of data, while maintaining a minimal footprint and keeping system calls to a bare minimum. Information is structured using linked lists.
 License: GPL-2+

From eed28ecd5c909129e6d57257e3172a7102f31c3c Mon Sep 17 00:00:00 2001
From: mscasso-scanoss <mariano.scasso@scanoss.com>
Date: Thu, 29 Oct 2026 17:07:19 +0100
Subject: [PATCH 2/2] Use a file-safe ref name for the tarball, so manual runs
 on branches work

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7969e16..763eeac 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -48,7 +48,7 @@ jobs:
           echo "Produced artifact at ${PWD}/artifacts/ldb"
 
       - name: 'Tar files'
-        run: tar czvf ldb-${{ github.ref_name }}-linux-amd64.tar.gz -C artifacts/ .
+        run: tar czvf "ldb-${GITHUB_REF_NAME//\//-}-linux-amd64.tar.gz" -C artifacts/ .
 
       - name: Prepare deb package
         id: build_deb