From a1c93a043ae3913a86375bf68eafdab064025515 Mon Sep 17 00:00:00 2001
From: Alex Crichton <alex@alexcrichton.com>
Date: Mon, 10 Nov 2025 12:03:31 -0600
Subject: [PATCH] Lower linux glibc requirement from 2.31 to 2.28 (#575)

In componentize-py Joel's building custom wasi-sdk binaries for more
Linux compat which is what maturin, the build tool use there, desires. I
don't think there's a concrete reason to have a higher Linux version
here, so let's lower it in wasi-sdk itself.

This commit switches the build container from Ubuntu 20.04 (glibc 2.31)
to AlmaLinux 8 (glibc 2.28). The AlmaLinux container is what Wasmtime
uses, for example, and has supported security updates to 2029 and is I
believe intended to be used for purposes such as this.
---
 ci/docker/Dockerfile        | 27 +++++++++------------------
 ci/docker/install-ccache.sh | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 18 deletions(-)
 create mode 100755 ci/docker/install-ccache.sh

diff --git a/ci/docker/Dockerfile b/ci/docker/Dockerfile
index 9188fc2..a5da2c8 100644
--- a/ci/docker/Dockerfile
+++ b/ci/docker/Dockerfile
@@ -1,40 +1,31 @@
 # Use a relatively old/stable distro here to maximize the supported platforms
 # and avoid depending on more recent version of, say, libc.
-# Here we choose Ubuntu 20.04.
+# Here we choose AlmaLinux 8
 
-FROM ubuntu:20.04
+FROM almalinux:8
 
 # Various build tooling and such necessary to build LLVM and a wasi-sysroot
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
-  ccache \
+RUN dnf install -y \
   curl \
   ca-certificates \
-  build-essential \
   clang \
   python3 \
   git \
   unzip \
-  xz-utils
+  cmake
 
-# Install a more recent version of CMake than what 18.04 has since that's what
-# LLVM requires.
-RUN ARCH=$(uname -m) \
-  && curl -sSLO https://github.com/Kitware/CMake/releases/download/v3.29.5/cmake-3.29.5-linux-${ARCH}.tar.gz \
-  && tar xf cmake-3.29.5-linux-${ARCH}.tar.gz \
-  && rm cmake-3.29.5-linux-${ARCH}.tar.gz \
-  && mkdir -p /opt \
-  && mv cmake-3.29.5-linux-${ARCH} /opt/cmake
+COPY ./install-ccache.sh .
+RUN ./install-ccache.sh
 
-ENV PATH /opt/cmake/bin:$PATH
+ENV PATH /opt/ccache/bin:$PATH
 
-# As with CMake install a later version of Ninja than waht 18.04 has.
+# AlmaLinux 8 doesn't seem to have ninja, so install it manually.
 RUN ARCH=$(uname -m) \
   && if [ "$ARCH" = "aarch64"  ]; then SUFFIX=-aarch64; fi \
   && curl -sSL -o ninja.zip https://github.com/ninja-build/ninja/releases/download/v1.12.1/ninja-linux${SUFFIX}.zip \
   && unzip ninja.zip \
   && rm *.zip \
-  && mv ninja /opt/cmake/bin
+  && mv ninja /opt/ccache/bin
 
 # Tell programs to cache in a location that both isn't a `--volume` mounted root
 # and isn't `/root` in the container as that won't be writable during the build.
diff --git a/ci/docker/install-ccache.sh b/ci/docker/install-ccache.sh
new file mode 100755
index 0000000..e70fb64
--- /dev/null
+++ b/ci/docker/install-ccache.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+# AlmaLinux 8, the container this script runs in, does not have ccache in its
+# package repositories. The ccache project publishes both x86_64 and aarch64
+# binaries, however. The x86_64 binaries for ccache are themselves built in
+# AlmaLinux 8 so they're compatible, but the aarch64 binaries are built in a
+# newer container and don't run on AlmaLinux 8.
+#
+# Thus this script downloads precompiled binaries for x86_64 but builds from
+# source on aarch64.
+
+ARCH=$(uname -m)
+ver=4.12.1
+
+if [ "x$ARCH" = "x86_64" ]; then
+  curl -sSLO https://github.com/ccache/ccache/releases/download/v${ver}/ccache-${ver}-linux-${ARCH}.tar.xz
+  tar -xf ccache-${ver}-linux-${ARCH}.tar.xz
+  rm ccache-${ver}-linux-${ARCH}.tar.xz
+  mv ccache-${ver}-linux-${ARCH} /opt/ccache/bin
+else
+  curl -sSLO https://github.com/ccache/ccache/releases/download/v${ver}/ccache-${ver}.tar.xz
+  tar -xf ccache-${ver}.tar.xz
+
+  cd ccache-${ver}
+  mkdir build
+  cd build
+  cmake .. \
+    -DCMAKE_INSTALL_PREFIX=/opt/ccache \
+    -DCMAKE_BUILD_TYPE=Release \
+    -DHTTP_STORAGE_BACKEND=OFF \
+    -DENABLE_TESTING=OFF \
+    -DREDIS_STORAGE_BACKEND=OFF
+  make -j$(nproc)
+  make install
+fi