Conversation
PostgreSQL Package Dependency Analysis: PR #2436
SummaryNo packages had MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Dependency ChangesExtracting PostgreSQL 15 dependencies...
Runtime Closure Size
Raw Dependency ClosurePostgreSQL 17 Dependency ChangesExtracting PostgreSQL 17 dependencies...
Runtime Closure Size
Raw Dependency Closure |
The fallback silently re-resolved strtol to its default (newest) version if the GLIBC_2.17 lookup ever failed, defeating the whole point of the patch. GLIBC_2.17 is strtol's only version node in modern glibc (the 2.38 one is a distinct symbol, __isoc23_strtol, from the C23 variant of atoi/stdlib.h), and it's already comfortably below the project's glibc 2.31 floor, so no version bump is needed here. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
GLIBC_2.17 isn't a valid version node for dlvsym/strtol on x86_64 (verified via objdump against the real glibc: x86_64's nodes are 2.2.5/2.34, since that symbol's ABI never changed at 2.17 there). It only worked on aarch64 because aarch64 support was added in glibc 2.17, making that its earliest possible tag. Pin per-arch: 2.2.5 on x86_64, 2.17 on aarch64. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
PostgreSQL Extension Dependency Analysis: PR #2436
SummaryNo extensions had dependencies with MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Extension DependenciesPostgreSQL 17 Extension DependenciesOrioleDB 17 Extension Dependencies |
brainrake
marked this pull request as ready for review
September 18, 2026 01:16
brainrake
marked this pull request as draft
September 18, 2026 01:19
GLIBC_2.17 exists on both x86_64 and aarch64 (aarch64 support starts there), so one version node covers both instead of branching per-arch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
brainrake
marked this pull request as ready for review
September 18, 2026 01:28
1 task
x86_64 CI failed link with "no symbol version section for versioned symbol dlvsym@GLIBC_2.17" — x86_64 glibc's dlvsym has no 2.17 version node (it's 2.2.5 there); aarch64's dlvsym only exists from 2.17 onward. No shared version <=2.31 covers dlvsym on both arches, so the original per-arch split is required. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
brainrake
changed the title
Both .so files are dlopen'd into a process that already links glibc, so the nix-store glibc RPATH patchelf bakes in is unnecessary and risks a version mismatch. dontStrip also leaked the full build-time toolchain (gcc, postgresql, systemd-dev) into supautils' runtime closure via embedded debug-info paths; separateDebugInfo keeps the symbols without that (closure: 666 MiB -> 78.9 MiB). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
brainrake
changed the title
…namic tag patchelf --remove-rpath only clears the DT_RUNPATH entry; the store-path string itself stays live in .dynstr, so nix's reference scanner still pulled glibc/gcc/postgresql into the runtime closure. NIX_DONT_SET_RPATH stops the linker writing it in the first place; zeroing the remaining PGXS-injected rpath bytes covers what that doesn't catch. supautils closure: 666 MiB -> 80.7 KiB, no glibc reference. gatekeeper closure: 74.6 MiB -> 9.7 MiB, no glibc/pam reference (residual is Go's own tzdata/mailcap/iana-etc path constants, unrelated to dlopen). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…e-discard mechanism unsafeDiscardReferences is the nix-native way to tell the closure scanner to ignore a spurious match, instead of manually zeroing bytes in .dynstr. gatekeeper never needed it in the first place: NIX_DONT_SET_RPATH already left its rpath empty, so the removal step there was dead code. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…alone is enough Verified empirically: with NIX_DONT_SET_RPATH set, PGXS's own link step already writes an empty RUNPATH, not one patchelf needs to clean up after. No dead strings, no discarded references, same 80.7 KiB closure. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
NIX_DONT_SET_RPATH already leaves the RUNPATH empty; the removal call never had anything to do. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
gatekeeper builds on darwin too (unlike supautils, which is already Linux-gated at the site-env.nix call site), and the flag is a no-op there either way -- Mach-O linking always embeds full dylib paths regardless. Scope it the same as supautils for consistency. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…eeds more than that Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
brainrake
enabled auto-merge
September 30, 2026 20:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Match build of production supautils (from supautils releases) more closely, so we can deploy it from here.
dlopened into old postgres with old glibcRelated MPG-17