Add FreeTDS, libffi and Python to rocky9

Same pinned versions and options as debian13, installed under lib64
(Python keeps its standard library and lib-dynload in lib/python3.14).
Note in INCLUDED_LIBRARIES.md that alpine3.24 does not build them yet.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -10,6 +10,7 @@
 - Append new dependency build steps after all existing dependency build steps. Do not insert or reorder steps in the existing build sequence, so previously successful build layers remain unchanged.
 - The DuckDB `ui` extension (`duckdb-ui`) is built in the same step as DuckDB instead of a separate step. It is statically linked into the DuckDB shell and can only be compiled as part of the DuckDB source tree (via `-DDUCKDB_EXTENSION_CONFIGS`), against the matching DuckDB version. Keep its pinned commit in the same `RUN` as DuckDB and update the two together. Because DuckDB is built from a tarball, pass `-DOVERRIDE_GIT_DESCRIBE` with the DuckDB version so the extension selects the correct API.
 - The log4cplus build also takes its required `ThreadPool` dependency in the same step, as a second source archive extracted into `src/threadpool`. log4cplus `REL_2_0_5` pins `ThreadPool` to commit `cc0b6371d3963f7028c2da5fc007733f9f3bf205`; keep the two in sync and do not fetch unused log4cplus submodules.
+- Sources that ship one archive per architecture (such as Rust) go in their own `sources/<name>/` directory, keeping the architecture in the file name. `fetch-sources.sh` downloads the archive for `uname -m`, and the Dockerfile mounts the whole directory (`source=<name>`) and selects the file with `$(uname -m)` in the same `RUN`. Do not create architecture-neutral hard links or symlinks, and do not mount the whole `sources` root, because that would invalidate the cache of existing layers whenever any source is added.
 
 ## System Development Packages
 
@@ -20,6 +21,8 @@
 - On Rocky Linux 9, `glibc-devel`, `kernel-headers`, and `libstdc++-devel` may be installed directly or as compiler dependencies because they are foundational C/C++ platform and toolchain components.
 - On Alpine Linux, `musl-dev` and `linux-headers` may be installed directly or as compiler dependencies because they are foundational C/C++ platform and toolchain components.
 
+- The `rocky9-system` image is the exception to the rules above: it deliberately installs third-party libraries and their `-devel` packages from the Rocky Linux 9, CRB and EPEL repositories instead of building them from source, with Protobuf (`v3.21.12`, installed under `/usr/local`) as the only library built from source. Other libraries use distribution versions and are not pinned. Libraries missing from those repositories (for example `magic_enum`) are skipped, not built from source.
+
 ## Meta Libraries
 
 - Pin all Meta/Facebook ecosystem libraries to the same date-based release tag.

INCLUDED_LIBRARIES.md

@@ -34,7 +34,7 @@
 | CZMQ | `4.2.1` |
 | JsonCpp | `1.9.8` |
 | librdkafka | `2.15.0` |
-| json-c | `0.19` |
+| json-c | `0.18` |
 | RapidJSON | `1.1.0` |
 | curl | `8.21.0` |
 | hiredis | `1.4.1` |
@@ -50,9 +50,14 @@
 | Snappy | `1.2.2` |
 | LZ4 | `v1.10.0` |
 | Apache Arrow / Parquet | `25.0.1` |
+| SQLite | `3.54.1` |
+| FreeTDS | `1.5.21` |
+| libffi | `3.8.0` |
+| Python | `3.14.10` |
+| wireguard-tools (`wg`, `wg-quick` CLI) | `v1.0.20260223` |
 
 The image includes position-independent static builds of these libraries. Protobuf and libxml2 enable zlib support, and LibDwarf enables compressed debug section support using zlib and Zstd. ZeroMQ enables CURVE security using static libsodium. CZMQ enables UUID support using static util-linux libuuid while disabling undeclared optional integrations. librdkafka includes SSL, zlib, Zstd, and bundled LZ4 support while disabling undeclared optional integrations. spdlog uses external fmt, glog uses gflags, and all Meta libraries share the same release tag. Apache Arrow is built with Parquet (including OpenSSL-based Parquet encryption) and Snappy, LZ4, zlib, and Zstd compression using only the pinned system dependencies above (`ARROW_DEPENDENCY_SOURCE=SYSTEM`), with the bundled jemalloc and mimalloc allocators disabled. Apache Thrift only builds its C++ library, and its headers sit next to fbthrift's under `include/thrift` without overlapping.
 
-**Pending on rocky9 and alpine3.24:** xsimd, Apache Thrift, Snappy, LZ4, and Apache Arrow / Parquet are currently built only in the `debian13` image.
+**Pending on alpine3.24:** xsimd, Apache Thrift, Snappy, LZ4, Apache Arrow / Parquet, FreeTDS, libffi, and Python are currently built only in the `debian13` and `rocky9` images; wireguard-tools is currently built only in the `rocky9` image.
 
 **Alpine-only exception:** the `alpine3.24` image does not build Folly, Fizz, Wangle, mvfst, fbthrift, or CacheLib. These aren't on Meta's supported-OS list, and Folly's portability layer reaches for glibc-only macros/symbols with no musl branch (e.g. `off64_t`/`lseek64`/`pread64` in `folly/portability/Unistd.h`, `__ELF_NATIVE_CLASS` in `folly/debugging/symbolizer/Elf.cpp`), so patching each one as it surfaces risks introducing subtle bugs in code this project doesn't own. `debian13` and `rocky9` are glibc-based and build the full list above, Meta libraries included.

README.md

@@ -10,6 +10,7 @@ Each build script automatically selects Docker or Podman:
 ./build-all.sh
 ./debian13/build.sh
 ./rocky9/build.sh
+./rocky9-system/build.sh
 ./alpine3.24/build.sh
 ```
 
@@ -19,10 +20,20 @@ Use environment variables to select the container engine or override image names
 CONTAINER_ENGINE=podman IMAGE_NAME=my-build-env ./rocky9/build.sh
 ```
 
+The Debian 13 and Rocky Linux 9 images install every library under `/opt/local` by default. Set `PREFIX` to install them elsewhere; the build environment variables (`PATH`, `PKG_CONFIG_PATH`, `CMAKE_PREFIX_PATH`, `CMAKE_INSTALL_PREFIX`, and so on) follow it. Rust is a build tool rather than a library, so it always lives under `/usr/local` and is not affected by `PREFIX`. The Alpine image does not support `PREFIX`.
+
+```sh
+PREFIX=/opt/stack ./debian13/build.sh
+PREFIX=/opt/stack ./rocky9/build.sh
+```
+
+The `rocky9-system` image uses the libraries shipped by Rocky Linux 9 (BaseOS, AppStream, CRB and EPEL) instead of building them from source, except Protobuf, which is built from source (`v3.21.12`, under `/usr/local`). Libraries that those repositories do not provide are simply left out.
+
 ## Run
 
 ```sh
 docker run --rm -it debian13-source-stack
 docker run --rm -it rocky9-source-stack
+docker run --rm -it rocky9-system-stack
 docker run --rm -it alpine3.24-source-stack
 ```

alpine3.24/Dockerfile

@@ -388,7 +388,7 @@ RUN --mount=type=bind,from=sources,source=librdkafka-v2.15.0.tar.gz,target=/tmp/
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src
 
-RUN --mount=type=bind,from=sources,source=json-c-json-c-0.19-20260627.tar.gz,target=/tmp/json-c.tar.gz \
+RUN --mount=type=bind,from=sources,source=json-c-json-c-0.18-20240915.tar.gz,target=/tmp/json-c.tar.gz \
     mkdir src \
     && tar --extract --gzip --file=/tmp/json-c.tar.gz --directory=src --strip-components=1 \
     && cmake -G Ninja -S src -B build -DCMAKE_BUILD_TYPE=Release \
@@ -461,7 +461,7 @@ RUN --mount=type=bind,from=sources,source=gmp-6.3.0.tar.xz,target=/tmp/gmp.tar.x
     mkdir src \
     && tar --extract --xz --file=/tmp/gmp.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS="-fPIC -std=gnu17" ./configure --prefix=/usr/local --disable-shared --enable-static \
+    && CFLAGS="-fPIC -std=gnu17" ./configure --prefix=/usr/local --disable-shared --enable-static --enable-fat \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -607,4 +607,14 @@ RUN --mount=type=bind,from=sources,source=makeself-release-2.7.1.tar.gz,target=/
     && ln -s makeself.sh /usr/local/bin/makeself \
     && rm -rf src
 
+RUN --mount=type=bind,from=sources,source=sqlite-autoconf-3540100.tar.gz,target=/tmp/sqlite.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/sqlite.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=/usr/local --libdir=/usr/local/lib --disable-shared --enable-static \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
 CMD ["/bin/sh"]

build-all.sh

@@ -6,4 +6,5 @@ SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 
 "$SCRIPT_DIR/debian13/build.sh"
 "$SCRIPT_DIR/rocky9/build.sh"
+"$SCRIPT_DIR/rocky9-system/build.sh"
 "$SCRIPT_DIR/alpine3.24/build.sh"

debian13/Dockerfile

@@ -21,11 +21,27 @@ RUN sed -i 's|deb.debian.org|mirrors.ustc.edu.cn|g' /etc/apt/sources.list.d/debi
         aria2 \
     && rm -rf /var/lib/apt/lists/*
 
-RUN git config --global url."https://wangguofang.net/github.com/".insteadOf "https://github.com/"
+# Install prefix of every dependency, and the Debian multiarch directory name (`gcc -dumpmachine`)
+# its libraries are installed under; build.sh derives the latter from `uname -m`.
+ARG PREFIX=/opt/local
+ARG MULTIARCH=x86_64-linux-gnu
 
-RUN --mount=type=bind,from=sources,source=rust-1.99.1.tar.xz,target=/tmp/rust.tar.xz \
+# Make the compiler, CMake, pkg-config and the shell find earlier dependencies under a prefix other
+# than the default /opt/local. CMake (>= 3.29) takes its default install prefix from the environment.
+ENV PATH=${PREFIX}/bin:${PATH} \
+    C_INCLUDE_PATH=${PREFIX}/include \
+    CPLUS_INCLUDE_PATH=${PREFIX}/include \
+    LIBRARY_PATH=${PREFIX}/lib/${MULTIARCH}:${PREFIX}/lib \
+    PKG_CONFIG_PATH=${PREFIX}/lib/${MULTIARCH}/pkgconfig:${PREFIX}/lib/pkgconfig:${PREFIX}/share/pkgconfig \
+    CMAKE_PREFIX_PATH=${PREFIX} \
+    CMAKE_INSTALL_PREFIX=${PREFIX}
+
+RUN test "$(cmake --version | sed -n '1s/[^0-9]*//p' | cut -d. -f2)" -ge 29
+
+# Rust is a build tool, not a library, so it is installed under /usr/local regardless of ${PREFIX}.
+RUN --mount=type=bind,from=sources,source=rust,target=/tmp/rust \
     mkdir rust-src \
-    && tar -xJf /tmp/rust.tar.xz -C rust-src --strip-components=1 \
+    && tar -xJf "/tmp/rust/rust-1.99.1-$(uname -m)-unknown-linux-gnu.tar.xz" -C rust-src --strip-components=1 \
     && rust-src/install.sh --prefix=/usr/local --without=rust-docs \
     && rm -rf rust-src
 
@@ -33,7 +49,7 @@ RUN --mount=type=bind,from=sources,source=boost_1_83_0.tar.bz2,target=/tmp/boost
     mkdir src \
     && tar --extract --bzip2 --file=/tmp/boost.tar.bz2 --directory=src --strip-components=1 \
     && cd src \
-    && ./bootstrap.sh --prefix=/usr/local --libdir=/usr/local/lib/$(gcc -dumpmachine) \
+    && ./bootstrap.sh --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) \
     && ./b2 --jobs="$(nproc)" \
         --with-atomic \
         --with-chrono \
@@ -59,7 +75,7 @@ RUN --mount=type=bind,from=sources,source=openssl-openssl-3.0.15.tar.gz,target=/
     mkdir src \
     && tar --extract --gzip --file=/tmp/openssl.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && ./Configure --prefix=/usr/local --libdir=lib/$(gcc -dumpmachine) no-shared no-tests -fPIC \
+    && ./Configure --prefix=${PREFIX} --libdir=lib/$(gcc -dumpmachine) no-shared no-tests -fPIC \
     && make --jobs="$(nproc)" \
     && make install_sw \
     && cd .. \
@@ -99,7 +115,7 @@ RUN --mount=type=bind,from=sources,source=zlib-v1.3.1.tar.gz,target=/tmp/zlib.ta
     mkdir src \
     && tar --extract --gzip --file=/tmp/zlib.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib/$(gcc -dumpmachine) --static \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -199,7 +215,7 @@ RUN --mount=type=bind,from=sources,source=gflags-v2.3.1.tar.gz,target=/tmp/gflag
         -DINSTALL_HEADERS=ON \
         -DINSTALL_SHARED_LIBS=OFF \
         -DINSTALL_STATIC_LIBS=ON \
-        -DLIBRARY_INSTALL_DIR=/usr/local/lib/$(gcc -dumpmachine) \
+        -DLIBRARY_INSTALL_DIR=${PREFIX}/lib/$(gcc -dumpmachine) \
         -DREGISTER_INSTALL_PREFIX=OFF \
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src
@@ -223,7 +239,7 @@ RUN --mount=type=bind,from=sources,source=liburing-liburing-2.15.tar.gz,target=/
     mkdir src \
     && tar --extract --gzip --file=/tmp/liburing.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib/$(gcc -dumpmachine) --libdevdir=/usr/local/lib/$(gcc -dumpmachine) \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --libdevdir=${PREFIX}/lib/$(gcc -dumpmachine) \
     && make --jobs="$(nproc)" ENABLE_SHARED=0 library \
     && make ENABLE_SHARED=0 install \
     && cd .. \
@@ -233,7 +249,7 @@ RUN --mount=type=bind,from=sources,source=libaio_0.3.113.orig.tar.gz,target=/tmp
     mkdir src \
     && tar --extract --gzip --file=/tmp/libaio.tar.gz --directory=src --strip-components=1 \
     && make --directory=src --jobs="$(nproc)" ENABLE_SHARED=0 \
-    && make --directory=src ENABLE_SHARED=0 prefix=/usr/local libdir=/usr/local/lib/$(gcc -dumpmachine) install \
+    && make --directory=src ENABLE_SHARED=0 prefix=${PREFIX} libdir=${PREFIX}/lib/$(gcc -dumpmachine) install \
     && rm -rf src
 
 RUN --mount=type=bind,from=sources,source=libdwarf-code-v2.3.2.tar.gz,target=/tmp/libdwarf-code.tar.gz \
@@ -257,7 +273,7 @@ RUN --mount=type=bind,from=sources,source=libsodium-1.0.20-RELEASE.tar.gz,target
     && tar --extract --gzip --file=/tmp/libsodium.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./autogen.sh \
-    && ./configure --prefix=/usr/local --libdir=/usr/local/lib/$(gcc -dumpmachine) --disable-shared --enable-static --with-pic \
+    && ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --disable-shared --enable-static --with-pic \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -293,7 +309,7 @@ RUN --mount=type=bind,from=sources,source=numactl-v2.0.19.tar.gz,target=/tmp/num
     && tar --extract --gzip --file=/tmp/numactl.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./autogen.sh \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib/$(gcc -dumpmachine) --disable-shared --enable-static \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --disable-shared --enable-static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -393,7 +409,7 @@ RUN --mount=type=bind,from=sources,source=util-linux-2.42.2.tar.xz,target=/tmp/u
     mkdir src \
     && tar --extract --xz --file=/tmp/util-linux.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib/$(gcc -dumpmachine) \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) \
         --disable-all-programs \
         --disable-bash-completion \
         --disable-makeinstall-chown \
@@ -477,7 +493,7 @@ RUN --mount=type=bind,from=sources,source=librdkafka-v2.15.0.tar.gz,target=/tmp/
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src
 
-RUN --mount=type=bind,from=sources,source=json-c-json-c-0.19-20260627.tar.gz,target=/tmp/json-c.tar.gz \
+RUN --mount=type=bind,from=sources,source=json-c-json-c-0.18-20240915.tar.gz,target=/tmp/json-c.tar.gz \
     mkdir src \
     && tar --extract --gzip --file=/tmp/json-c.tar.gz --directory=src --strip-components=1 \
     && cmake -G Ninja -S src -B build -DCMAKE_BUILD_TYPE=Release \
@@ -497,7 +513,7 @@ RUN --mount=type=bind,from=sources,source=rapidjson-v1.1.0.tar.gz,target=/tmp/ra
     && tar --extract --gzip --file=/tmp/rapidjson.tar.gz --directory=src --strip-components=1 \
     && git -C src apply /tmp/rapidjson-generic-string-ref-assignment.patch \
     && cmake -G Ninja -S src -B build -DCMAKE_BUILD_TYPE=Release \
-        -DLIB_INSTALL_DIR=/usr/local/lib/$(gcc -dumpmachine) \
+        -DLIB_INSTALL_DIR=${PREFIX}/lib/$(gcc -dumpmachine) \
         -DRAPIDJSON_BUILD_DOC=OFF \
         -DRAPIDJSON_BUILD_EXAMPLES=OFF \
         -DRAPIDJSON_BUILD_TESTS=OFF \
@@ -550,7 +566,7 @@ RUN --mount=type=bind,from=sources,source=gmp-6.3.0.tar.xz,target=/tmp/gmp.tar.x
     mkdir src \
     && tar --extract --xz --file=/tmp/gmp.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib/$(gcc -dumpmachine) --disable-shared --enable-static \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --disable-shared --enable-static --enable-fat \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -560,7 +576,7 @@ RUN --mount=type=bind,from=sources,source=nettle-3.10.2.tar.gz,target=/tmp/nettl
     mkdir src \
     && tar --extract --gzip --file=/tmp/nettle.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib/$(gcc -dumpmachine) \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) \
         --disable-documentation \
         --disable-shared \
         --enable-static \
@@ -573,7 +589,7 @@ RUN --mount=type=bind,from=sources,source=gnutls-3.8.13.tar.xz,target=/tmp/gnutl
     mkdir src \
     && tar --extract --xz --file=/tmp/gnutls.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib/$(gcc -dumpmachine) \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) \
         --with-included-libtasn1 \
         --with-included-unistring \
         --disable-cxx \
@@ -613,7 +629,7 @@ RUN --mount=type=bind,from=sources,source=libyaml-0.2.5.tar.gz,target=/tmp/libya
     && tar --extract --gzip --file=/tmp/libyaml.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./bootstrap \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib/$(gcc -dumpmachine) --disable-shared --enable-static \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --disable-shared --enable-static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -653,7 +669,7 @@ RUN --mount=type=bind,from=sources,source=libunwind-v1.8.3.tar.gz,target=/tmp/li
     && tar --extract --gzip --file=/tmp/libunwind.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && autoreconf --install \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib/$(gcc -dumpmachine) \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) \
         --disable-shared \
         --enable-static \
         --disable-tests \
@@ -670,7 +686,7 @@ RUN --mount=type=bind,from=sources,source=jemalloc-5.3.1.tar.gz,target=/tmp/jema
     && tar --extract --gzip --file=/tmp/jemalloc.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./autogen.sh \
-    && CFLAGS=-fPIC CXXFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib/$(gcc -dumpmachine) \
+    && CFLAGS=-fPIC CXXFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) \
         --disable-doc \
         --disable-shared \
         --enable-static \
@@ -685,8 +701,8 @@ RUN --mount=type=bind,from=sources,source=libproxyprotocol-v1.3.3.tar.gz,target=
     mkdir src \
     && tar --extract --gzip --file=/tmp/libproxyprotocol.tar.gz --directory=src --strip-components=1 \
     && gcc -fPIC -c -o src/src/proxy_protocol.o src/src/proxy_protocol.c \
-    && ar rcs /usr/local/lib/$(gcc -dumpmachine)/libproxyprotocol.a src/src/proxy_protocol.o \
-    && cp src/src/proxy_protocol.h /usr/local/include/ \
+    && ar rcs ${PREFIX}/lib/$(gcc -dumpmachine)/libproxyprotocol.a src/src/proxy_protocol.o \
+    && cp src/src/proxy_protocol.h ${PREFIX}/include/ \
     && rm -rf src
 
 RUN --mount=type=bind,from=sources,source=xsimd-14.2.0.tar.gz,target=/tmp/xsimd.tar.gz \
@@ -706,10 +722,10 @@ RUN --mount=type=bind,from=sources,source=thrift-v0.22.0.tar.gz,target=/tmp/thri
         -DBUILD_SHARED_LIBS=OFF \
         -DBUILD_TESTING=OFF \
         -DBUILD_TUTORIALS=OFF \
-        -DCMAKE_INSTALL_DIR=/usr/local/lib/$(gcc -dumpmachine)/cmake \
+        -DCMAKE_INSTALL_DIR=${PREFIX}/lib/$(gcc -dumpmachine)/cmake \
         -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
-        -DLIB_INSTALL_DIR=/usr/local/lib/$(gcc -dumpmachine) \
-        -DPKGCONFIG_INSTALL_DIR=/usr/local/lib/$(gcc -dumpmachine)/pkgconfig \
+        -DLIB_INSTALL_DIR=${PREFIX}/lib/$(gcc -dumpmachine) \
+        -DPKGCONFIG_INSTALL_DIR=${PREFIX}/lib/$(gcc -dumpmachine)/pkgconfig \
         -DWITH_AS3=OFF \
         -DWITH_C_GLIB=OFF \
         -DWITH_CPP=ON \
@@ -723,7 +739,7 @@ RUN --mount=type=bind,from=sources,source=thrift-v0.22.0.tar.gz,target=/tmp/thri
         -DWITH_ZLIB=OFF \
     && cmake --build build --parallel "$(nproc)" --target install \
     && sed -i 's|^libdir=.*|libdir=${prefix}/lib/'"$(gcc -dumpmachine)"'|' \
-        /usr/local/lib/$(gcc -dumpmachine)/pkgconfig/thrift.pc \
+        ${PREFIX}/lib/$(gcc -dumpmachine)/pkgconfig/thrift.pc \
     && rm -rf build src
 
 RUN --mount=type=bind,from=sources,source=snappy-1.2.2.tar.gz,target=/tmp/snappy.tar.gz \
@@ -803,4 +819,52 @@ RUN --mount=type=bind,from=sources,source=duckdb-v1.5.6.tar.gz,target=/tmp/duckd
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src ui-src
 
-CMD ["/bin/bash"]
+RUN --mount=type=bind,from=sources,source=sqlite-autoconf-3540100.tar.gz,target=/tmp/sqlite.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/sqlite.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --disable-shared --enable-static \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=freetds-1.5.21.tar.gz,target=/tmp/freetds.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/freetds.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) \
+        --disable-shared --enable-static --with-openssl=${PREFIX} \
+        --disable-odbc --disable-apps --disable-server --disable-pool --disable-libiconv \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=libffi-3.8.0.tar.gz,target=/tmp/libffi.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/libffi.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --disable-shared --enable-static --disable-docs --disable-multi-os-directory \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=Python-3.14.10.tgz,target=/tmp/python.tgz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/python.tgz --directory=src --strip-components=1 \
+    && cd src \
+    && ./configure --prefix=${PREFIX} --with-ensurepip=install \
+        LIBSQLITE3_CFLAGS="$(pkg-config --cflags sqlite3)" \
+        LIBSQLITE3_LIBS="$(pkg-config --static --libs sqlite3)" \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+COPY source-stack.cmake.in /tmp/
+RUN mkdir -p ${PREFIX}/share/source-stack \
+    && sed "s|@MULTIARCH@|$(gcc -dumpmachine)|" /tmp/source-stack.cmake.in \
+        > ${PREFIX}/share/source-stack/source-stack.cmake \
+    && rm /tmp/source-stack.cmake.in

debian13/build.sh

@@ -3,6 +3,7 @@
 set -eu
 
 IMAGE_NAME="${IMAGE_NAME:-debian13-source-stack}"
+PREFIX="${PREFIX:-/opt/local}"
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 SOURCES_DIR="${SOURCES_DIR:-$SCRIPT_DIR/../sources}"
 FETCH_SCRIPT="$SCRIPT_DIR/../fetch-sources.sh"
@@ -14,5 +15,11 @@ fi
 
 SOURCES_DIR="$SOURCES_DIR" "$FETCH_SCRIPT"
 
-echo "Building image $IMAGE_NAME with podman ..."
-exec podman build --build-context sources="$SOURCES_DIR" --tag "$IMAGE_NAME" "$SCRIPT_DIR"
+# macOS reports arm64 where Linux (and Debian multiarch) call it aarch64.
+ARCH=$(uname -m)
+[ "$ARCH" = arm64 ] && ARCH=aarch64
+
+echo "Building image $IMAGE_NAME with podman (prefix $PREFIX) ..."
+exec podman build --build-context sources="$SOURCES_DIR" \
+    --build-arg PREFIX="$PREFIX" --build-arg MULTIARCH="$ARCH-linux-gnu" \
+    --tag "$IMAGE_NAME" "$SCRIPT_DIR"

debian13/source-stack.cmake.in

@@ -0,0 +1,52 @@
+# Generated into the image at ${PREFIX}/share/source-stack/source-stack.cmake.
+#
+# Points CMake at the dependencies installed by this image. It mirrors the
+# Dockerfile's ENV block (PATH, PKG_CONFIG_PATH, CMAKE_PREFIX_PATH,
+# C_INCLUDE_PATH/CPLUS_INCLUDE_PATH, LIBRARY_PATH) for CMake's own lookups.
+# The prefix is derived from this file's location, so it also works when the
+# prefix is moved. Include it after project(), before the first find_package().
+#
+#   GW_SOURCE_STACK_ONLY  resolve libraries and packages only below the prefix
+
+option(GW_SOURCE_STACK_ONLY
+    "Resolve libraries and packages only below the source-stack prefix" OFF)
+
+get_filename_component(_ss_p "${CMAKE_CURRENT_LIST_DIR}/../.." ABSOLUTE)
+set(_ss_multiarch "@MULTIARCH@")
+
+list(PREPEND CMAKE_PREFIX_PATH "${_ss_p}")
+list(PREPEND CMAKE_PROGRAM_PATH "${_ss_p}/bin")
+list(PREPEND CMAKE_INCLUDE_PATH "${_ss_p}/include")
+list(PREPEND CMAKE_LIBRARY_PATH "${_ss_p}/lib/${_ss_multiarch}" "${_ss_p}/lib")
+
+# pkg_check_modules() reads PKG_CONFIG_PATH at call time.
+set(_ss_pc "${_ss_p}/lib/${_ss_multiarch}/pkgconfig:${_ss_p}/lib/pkgconfig:${_ss_p}/share/pkgconfig")
+if(GW_SOURCE_STACK_ONLY)
+    # PKG_CONFIG_LIBDIR replaces the default search path, so system .pc files are ignored.
+    set(ENV{PKG_CONFIG_LIBDIR} "${_ss_pc}")
+    set(ENV{PKG_CONFIG_PATH} "")
+    # Build tools come from the system; look them up before system paths are switched off.
+    find_program(PKG_CONFIG_EXECUTABLE NAMES pkg-config pkgconf)
+    set(CMAKE_FIND_USE_CMAKE_SYSTEM_PATH OFF)
+    set(CMAKE_FIND_USE_SYSTEM_ENVIRONMENT_PATH OFF)
+    set(CMAKE_FIND_ROOT_PATH "${_ss_p}")
+    set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY)
+    set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
+    set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
+else()
+    if(NOT "$ENV{PKG_CONFIG_PATH}" STREQUAL "")
+        set(ENV{PKG_CONFIG_PATH} "${_ss_pc}:$ENV{PKG_CONFIG_PATH}")
+    else()
+        set(ENV{PKG_CONFIG_PATH} "${_ss_pc}")
+    endif()
+endif()
+
+# protoc installed next to the libraries, unless the caller chose one.
+if(NOT Protobuf_PROTOC_EXECUTABLE AND EXISTS "${_ss_p}/bin/protoc")
+    set(Protobuf_PROTOC_EXECUTABLE "${_ss_p}/bin/protoc" CACHE FILEPATH "protoc")
+endif()
+
+message(STATUS "source-stack: ${_ss_p} (${_ss_multiarch})")
+unset(_ss_p)
+unset(_ss_multiarch)
+unset(_ss_pc)

fetch-sources.sh

@@ -33,7 +33,9 @@ fetch() {
 
 fetch boost_1_83_0.tar.bz2 \
     https://mirrors.aliyun.com/blfs/conglomeration/boost/boost_1_83_0.tar.bz2 \
-    https://archives.boost.io/release/1.83.0/source/boost_1_83_0.tar.bz2
+    https://archives.boost.io/release/1.83.0/source/boost_1_83_0.tar.bz2 \
+    https://ftp.osuosl.org/pub/blfs/conglomeration/boost/boost_1_83_0.tar.bz2 \
+    https://downloads.sourceforge.net/project/boost/boost/1.83.0/boost_1_83_0.tar.bz2
 fetch openssl-openssl-3.0.15.tar.gz \
     https://wangguofang.net/github.com/openssl/openssl/archive/openssl-3.0.15.tar.gz
 fetch libevent-release-2.1.12-stable.tar.gz \
@@ -94,8 +96,8 @@ fetch jsoncpp-1.9.8.tar.gz \
     https://wangguofang.net/github.com/open-source-parsers/jsoncpp/archive/1.9.8.tar.gz
 fetch librdkafka-v2.15.0.tar.gz \
     https://wangguofang.net/github.com/confluentinc/librdkafka/archive/v2.15.0.tar.gz
-fetch json-c-json-c-0.19-20260627.tar.gz \
-    https://wangguofang.net/github.com/json-c/json-c/archive/json-c-0.19-20260627.tar.gz
+fetch json-c-json-c-0.18-20240915.tar.gz \
+    https://wangguofang.net/github.com/json-c/json-c/archive/json-c-0.18-20240915.tar.gz
 fetch rapidjson-v1.1.0.tar.gz \
     https://wangguofang.net/github.com/Tencent/rapidjson/archive/v1.1.0.tar.gz
 fetch curl-curl-8_21_0.tar.gz \
@@ -135,16 +137,19 @@ fetch lz4-v1.10.0.tar.gz \
 fetch arrow-apache-arrow-25.0.1.tar.gz \
     https://wangguofang.net/github.com/apache/arrow/archive/apache-arrow-25.0.1.tar.gz
 # Rust ships one standalone tarball per architecture, named after `uname -m` (x86_64, aarch64).
-# The Dockerfiles mount it under the architecture-neutral name rust-1.99.1.tar.xz (a hard link
-# that is refreshed on every run, so switching architectures never leaves a stale archive).
-rust_triple="$(uname -m)-unknown-linux-gnu"
-fetch "rust-1.99.1-$rust_triple.tar.xz" \
+# It lives in its own sources/rust/ directory, which the Dockerfiles mount as a whole and pick the
+# archive from by architecture, so adding other sources never invalidates the Rust build layer.
+rust_arch="$(uname -m)"
+# macOS reports arm64 where Linux (and Rust) call it aarch64.
+[ "$rust_arch" = arm64 ] && rust_arch=aarch64
+rust_triple="$rust_arch-unknown-linux-gnu"
+mkdir -p rust
+fetch "rust/rust-1.99.1-$rust_triple.tar.xz" \
     "https://mirrors.cloud.tencent.com/rustup/dist/rust-1.99.1-$rust_triple.tar.xz" \
     "https://mirrors.tuna.tsinghua.edu.cn/rustup/dist/2026-10-15/rust-1.99.1-$rust_triple.tar.xz" \
     "https://repo.huaweicloud.com/rustup/dist/rust-1.99.1-$rust_triple.tar.xz" \
     "https://mirrors.ustc.edu.cn/rust-static/dist/rust-1.99.1-$rust_triple.tar.xz" \
     "https://static.rust-lang.org/dist/rust-1.99.1-$rust_triple.tar.xz"
-ln -f "rust-1.99.1-$rust_triple.tar.xz" rust-1.99.1.tar.xz
 fetch duckdb-v1.5.6.tar.gz \
     https://wangguofang.net/github.com/duckdb/duckdb/archive/v1.5.6.tar.gz
 fetch duckdb-ui-0628932f74b1e2e9eaf68a05b22d737455541dca.tar.gz \
@@ -157,3 +162,13 @@ fetch log4cplus-REL_2_0_5.tar.gz \
     https://wangguofang.net/github.com/log4cplus/log4cplus/archive/REL_2_0_5.tar.gz
 fetch ThreadPool-cc0b6371d3963f7028c2da5fc007733f9f3bf205.tar.gz \
     https://wangguofang.net/github.com/log4cplus/ThreadPool/archive/cc0b6371d3963f7028c2da5fc007733f9f3bf205.tar.gz
+fetch sqlite-autoconf-3540100.tar.gz \
+    https://www.sqlite.org/2026/sqlite-autoconf-3540100.tar.gz
+fetch wireguard-tools-v1.0.20260223.tar.xz \
+    https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-v1.0.20260223.tar.xz
+fetch freetds-1.5.21.tar.gz \
+    https://www.freetds.org/files/stable/freetds-1.5.21.tar.gz
+fetch libffi-3.8.0.tar.gz \
+    https://github.com/libffi/libffi/releases/download/v3.8.0/libffi-3.8.0.tar.gz
+fetch Python-3.14.10.tgz \
+    https://www.python.org/ftp/python/3.14.10/Python-3.14.10.tgz

rocky9-system/Dockerfile

@@ -0,0 +1,111 @@
+FROM docker.io/library/rockylinux:9
+
+# Toolchain and build tools, same as the rocky9 image.
+RUN dnf install --assumeyes --enablerepo=crb \
+        autoconf \
+        automake \
+        bzip2 \
+        ca-certificates \
+        cmake \
+        curl-minimal \
+        gcc \
+        gcc-c++ \
+        libasan \
+        gcc-toolset-15-gcc-c++ \
+        gcc-toolset-15-libasan-devel \
+        git \
+        libtool \
+        make \
+        ninja-build \
+        patch \
+        perl-core \
+        pkgconf-pkg-config \
+        rpm-build \
+        tar \
+        xz \
+        which \
+        epel-release \
+    && sed \
+        -e 's!^metalink=!#metalink=!g' \
+        -e 's!^#baseurl=!baseurl=!g' \
+        -e 's!https\?://download\.example/pub/epel!https://mirrors.ustc.edu.cn/epel!g' \
+        -i /etc/yum.repos.d/epel.repo /etc/yum.repos.d/epel-testing.repo \
+    && dnf install --assumeyes \
+        makeself \
+    && dnf upgrade --assumeyes \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
+
+RUN git config --global url."https://wangguofang.net/github.com/".insteadOf "https://github.com/"
+
+RUN test "$(cmake --version | sed -n '1s/[^0-9]*//p' | cut -d. -f2)" -ge 29
+
+# Libraries come from the distribution (Rocky Linux 9, CRB and EPEL) instead of being built from
+# source, except Protobuf (below). A package that is not available in these repositories is skipped, not an error.
+RUN dnf install --assumeyes --enablerepo=crb,epel \
+        --setopt=skip_missing_names_on_install=True \
+        --skip-broken \
+        boost-devel \
+        cyrus-sasl-devel \
+        fast_float-devel \
+        fmt-devel \
+        folly-devel \
+        gflags-devel \
+        glog-devel \
+        gmock-devel \
+        gmp-devel \
+        gnutls-devel \
+        gtest-devel \
+        hiredis-devel \
+        jsoncpp-devel \
+        json-c-devel \
+        libaio-devel \
+        libcurl-devel \
+        libdwarf-devel \
+        libevent-devel \
+        libmaxminddb-devel \
+        libsodium-devel \
+        liburing-devel \
+        libuuid-devel \
+        libxml2-devel \
+        libyaml-devel \
+        libzstd-devel \
+        log4cplus-devel \
+        lz4-devel \
+        magic_enum-devel \
+        nettle-devel \
+        numactl-devel \
+        openssl-devel \
+        rapidjson-devel \
+        librdkafka-devel \
+        snappy-devel \
+        spdlog-devel \
+        sqlite-devel \
+        thrift-devel \
+        tsl-sparse-map-devel \
+        xsimd-devel \
+        xxhash-devel \
+        zeromq-devel \
+        czmq-devel \
+        zlib-devel \
+        libarrow-devel \
+        parquet-libs-devel \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
+
+# Protobuf is the only library built from source; it is installed under /usr/local, which takes
+# precedence over the system packages in /usr.
+RUN --mount=type=bind,from=sources,source=protobuf-v3.21.12.tar.gz,target=/tmp/protobuf.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/protobuf.tar.gz --directory=src --strip-components=1 \
+    && cmake -G Ninja -S src -B build -Dprotobuf_BUILD_TESTS=OFF \
+        -Dprotobuf_BUILD_SHARED_LIBS=OFF \
+        -Dprotobuf_WITH_ZLIB=ON \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DBUILD_SHARED_LIBS=OFF \
+        -DCMAKE_INSTALL_PREFIX=/usr/local \
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+    && cmake --build build --parallel "$(nproc)" --target install \
+    && rm -rf build src
+
+CMD ["/bin/bash"]

rocky9-system/build.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set -eu
+
+IMAGE_NAME="${IMAGE_NAME:-rocky9-system-stack}"
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+SOURCES_DIR="${SOURCES_DIR:-$SCRIPT_DIR/../sources}"
+FETCH_SCRIPT="$SCRIPT_DIR/../fetch-sources.sh"
+
+if ! command -v podman >/dev/null 2>&1; then
+    echo "Error: Podman is required." >&2
+    exit 1
+fi
+
+SOURCES_DIR="$SOURCES_DIR" "$FETCH_SCRIPT"
+
+echo "Building image $IMAGE_NAME with podman ..."
+exec podman build --build-context sources="$SOURCES_DIR" \
+    --tag "$IMAGE_NAME" "$SCRIPT_DIR"

rocky9/Dockerfile

@@ -9,8 +9,9 @@ RUN dnf install --assumeyes --enablerepo=crb \
         curl-minimal \
         gcc \
         gcc-c++ \
-        gcc-toolset-15-gcc-c++ \
         libasan \
+        gcc-toolset-15-gcc-c++ \
+        gcc-toolset-15-libasan-devel \
         git \
         libtool \
         make \
@@ -36,9 +37,25 @@ RUN dnf install --assumeyes --enablerepo=crb \
 
 RUN git config --global url."https://wangguofang.net/github.com/".insteadOf "https://github.com/"
 
-RUN --mount=type=bind,from=sources,source=rust-1.99.1.tar.xz,target=/tmp/rust.tar.xz \
+# Install prefix of every dependency. Libraries are installed under ${PREFIX}/lib64.
+ARG PREFIX=/opt/local
+
+# Make the compiler, CMake, pkg-config and the shell find earlier dependencies under a prefix other
+# than the default /opt/local. CMake (>= 3.29) takes its default install prefix from the environment.
+ENV PATH=${PREFIX}/bin:${PATH} \
+    C_INCLUDE_PATH=${PREFIX}/include \
+    CPLUS_INCLUDE_PATH=${PREFIX}/include \
+    LIBRARY_PATH=${PREFIX}/lib64:${PREFIX}/lib \
+    PKG_CONFIG_PATH=${PREFIX}/lib64/pkgconfig:${PREFIX}/lib/pkgconfig:${PREFIX}/share/pkgconfig \
+    CMAKE_PREFIX_PATH=${PREFIX} \
+    CMAKE_INSTALL_PREFIX=${PREFIX}
+
+RUN test "$(cmake --version | sed -n '1s/[^0-9]*//p' | cut -d. -f2)" -ge 29
+
+# Rust is a build tool, not a library, so it is installed under /usr/local regardless of ${PREFIX}.
+RUN --mount=type=bind,from=sources,source=rust,target=/tmp/rust \
     mkdir rust-src \
-    && tar -xJf /tmp/rust.tar.xz -C rust-src --strip-components=1 \
+    && tar -xJf "/tmp/rust/rust-1.99.1-$(uname -m)-unknown-linux-gnu.tar.xz" -C rust-src --strip-components=1 \
     && rust-src/install.sh --prefix=/usr/local --without=rust-docs \
     && rm -rf rust-src
 
@@ -46,7 +63,7 @@ RUN --mount=type=bind,from=sources,source=boost_1_83_0.tar.bz2,target=/tmp/boost
     mkdir src \
     && tar --extract --bzip2 --file=/tmp/boost.tar.bz2 --directory=src --strip-components=1 \
     && cd src \
-    && ./bootstrap.sh --prefix=/usr/local --libdir=/usr/local/lib64 \
+    && ./bootstrap.sh --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
     && ./b2 --jobs="$(nproc)" \
         --with-atomic \
         --with-chrono \
@@ -72,7 +89,7 @@ RUN --mount=type=bind,from=sources,source=openssl-openssl-3.0.15.tar.gz,target=/
     mkdir src \
     && tar --extract --gzip --file=/tmp/openssl.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && ./Configure --prefix=/usr/local no-shared no-tests -fPIC \
+    && ./Configure --prefix=${PREFIX} no-shared no-tests -fPIC \
     && make --jobs="$(nproc)" \
     && make install_sw \
     && cd .. \
@@ -110,7 +127,7 @@ RUN --mount=type=bind,from=sources,source=zlib-v1.3.1.tar.gz,target=/tmp/zlib.ta
     mkdir src \
     && tar --extract --gzip --file=/tmp/zlib.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --static \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -203,7 +220,7 @@ RUN --mount=type=bind,from=sources,source=gflags-v2.3.1.tar.gz,target=/tmp/gflag
         -DINSTALL_HEADERS=ON \
         -DINSTALL_SHARED_LIBS=OFF \
         -DINSTALL_STATIC_LIBS=ON \
-        -DLIBRARY_INSTALL_DIR=/usr/local/lib64 \
+        -DLIBRARY_INSTALL_DIR=${PREFIX}/lib64 \
         -DREGISTER_INSTALL_PREFIX=OFF \
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src
@@ -226,7 +243,7 @@ RUN --mount=type=bind,from=sources,source=liburing-liburing-2.15.tar.gz,target=/
     mkdir src \
     && tar --extract --gzip --file=/tmp/liburing.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --libdevdir=/usr/local/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --libdevdir=${PREFIX}/lib64 \
     && make --jobs="$(nproc)" ENABLE_SHARED=0 library \
     && make ENABLE_SHARED=0 install \
     && cd .. \
@@ -236,7 +253,7 @@ RUN --mount=type=bind,from=sources,source=libaio_0.3.113.orig.tar.gz,target=/tmp
     mkdir src \
     && tar --extract --gzip --file=/tmp/libaio.tar.gz --directory=src --strip-components=1 \
     && make --directory=src --jobs="$(nproc)" ENABLE_SHARED=0 \
-    && make --directory=src ENABLE_SHARED=0 prefix=/usr/local libdir=/usr/local/lib64 install \
+    && make --directory=src ENABLE_SHARED=0 prefix=${PREFIX} libdir=${PREFIX}/lib64 install \
     && rm -rf src
 
 RUN --mount=type=bind,from=sources,source=libdwarf-code-v2.3.2.tar.gz,target=/tmp/libdwarf-code.tar.gz \
@@ -259,7 +276,7 @@ RUN --mount=type=bind,from=sources,source=libsodium-1.0.20-RELEASE.tar.gz,target
     && tar --extract --gzip --file=/tmp/libsodium.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./autogen.sh \
-    && ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --disable-shared --enable-static --with-pic \
+    && ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static --with-pic \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -293,7 +310,7 @@ RUN --mount=type=bind,from=sources,source=numactl-v2.0.19.tar.gz,target=/tmp/num
     && tar --extract --gzip --file=/tmp/numactl.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./autogen.sh \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --disable-shared --enable-static \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -396,7 +413,7 @@ RUN --mount=type=bind,from=sources,source=util-linux-2.42.2.tar.xz,target=/tmp/u
     mkdir src \
     && tar --extract --xz --file=/tmp/util-linux.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
         --disable-all-programs \
         --disable-bash-completion \
         --disable-makeinstall-chown \
@@ -477,7 +494,7 @@ RUN --mount=type=bind,from=sources,source=librdkafka-v2.15.0.tar.gz,target=/tmp/
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src
 
-RUN --mount=type=bind,from=sources,source=json-c-json-c-0.19-20260627.tar.gz,target=/tmp/json-c.tar.gz \
+RUN --mount=type=bind,from=sources,source=json-c-json-c-0.18-20240915.tar.gz,target=/tmp/json-c.tar.gz \
     mkdir src \
     && tar --extract --gzip --file=/tmp/json-c.tar.gz --directory=src --strip-components=1 \
     && cmake -G Ninja -S src -B build -DCMAKE_BUILD_TYPE=Release \
@@ -496,7 +513,7 @@ RUN --mount=type=bind,from=sources,source=rapidjson-v1.1.0.tar.gz,target=/tmp/ra
     && tar --extract --gzip --file=/tmp/rapidjson.tar.gz --directory=src --strip-components=1 \
     && git -C src apply /tmp/rapidjson-generic-string-ref-assignment.patch \
     && cmake -G Ninja -S src -B build -DCMAKE_BUILD_TYPE=Release \
-        -DLIB_INSTALL_DIR=/usr/local/lib64 \
+        -DLIB_INSTALL_DIR=${PREFIX}/lib64 \
         -DRAPIDJSON_BUILD_DOC=OFF \
         -DRAPIDJSON_BUILD_EXAMPLES=OFF \
         -DRAPIDJSON_BUILD_TESTS=OFF \
@@ -547,7 +564,7 @@ RUN --mount=type=bind,from=sources,source=gmp-6.3.0.tar.xz,target=/tmp/gmp.tar.x
     mkdir src \
     && tar --extract --xz --file=/tmp/gmp.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --disable-shared --enable-static \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static --enable-fat \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -557,7 +574,7 @@ RUN --mount=type=bind,from=sources,source=nettle-3.10.2.tar.gz,target=/tmp/nettl
     mkdir src \
     && tar --extract --gzip --file=/tmp/nettle.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
         --disable-documentation \
         --disable-shared \
         --enable-static \
@@ -570,7 +587,7 @@ RUN --mount=type=bind,from=sources,source=gnutls-3.8.13.tar.xz,target=/tmp/gnutl
     mkdir src \
     && tar --extract --xz --file=/tmp/gnutls.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
         --with-included-libtasn1 \
         --with-included-unistring \
         --disable-cxx \
@@ -609,7 +626,7 @@ RUN --mount=type=bind,from=sources,source=libyaml-0.2.5.tar.gz,target=/tmp/libya
     && tar --extract --gzip --file=/tmp/libyaml.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./bootstrap \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --disable-shared --enable-static \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -647,7 +664,7 @@ RUN --mount=type=bind,from=sources,source=libunwind-v1.8.3.tar.gz,target=/tmp/li
     && tar --extract --gzip --file=/tmp/libunwind.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && autoreconf --install \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
         --disable-shared \
         --enable-static \
         --disable-tests \
@@ -664,7 +681,7 @@ RUN --mount=type=bind,from=sources,source=jemalloc-5.3.1.tar.gz,target=/tmp/jema
     && tar --extract --gzip --file=/tmp/jemalloc.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./autogen.sh \
-    && CFLAGS=-fPIC CXXFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
+    && CFLAGS=-fPIC CXXFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
         --disable-doc \
         --disable-shared \
         --enable-static \
@@ -679,10 +696,103 @@ RUN --mount=type=bind,from=sources,source=libproxyprotocol-v1.3.3.tar.gz,target=
     mkdir src \
     && tar --extract --gzip --file=/tmp/libproxyprotocol.tar.gz --directory=src --strip-components=1 \
     && gcc -fPIC -c -o src/src/proxy_protocol.o src/src/proxy_protocol.c \
-    && ar rcs /usr/local/lib64/libproxyprotocol.a src/src/proxy_protocol.o \
-    && cp src/src/proxy_protocol.h /usr/local/include/ \
+    && ar rcs ${PREFIX}/lib64/libproxyprotocol.a src/src/proxy_protocol.o \
+    && cp src/src/proxy_protocol.h ${PREFIX}/include/ \
     && rm -rf src
 
+RUN --mount=type=bind,from=sources,source=xsimd-14.2.0.tar.gz,target=/tmp/xsimd.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/xsimd.tar.gz --directory=src --strip-components=1 \
+    && cmake -G Ninja -S src -B build -DCMAKE_BUILD_TYPE=Release \
+        -DBUILD_TESTS=OFF \
+        -DCMAKE_INSTALL_LIBDIR=lib64 \
+    && cmake --build build --parallel "$(nproc)" --target install \
+    && rm -rf build src
+
+RUN --mount=type=bind,from=sources,source=thrift-v0.22.0.tar.gz,target=/tmp/thrift.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/thrift.tar.gz --directory=src --strip-components=1 \
+    && cmake -G Ninja -S src -B build -DCMAKE_BUILD_TYPE=Release \
+        -DBUILD_COMPILER=OFF \
+        -DBUILD_SHARED_LIBS=OFF \
+        -DBUILD_TESTING=OFF \
+        -DBUILD_TUTORIALS=OFF \
+        -DCMAKE_INSTALL_DIR=${PREFIX}/lib64/cmake \
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DLIB_INSTALL_DIR=${PREFIX}/lib64 \
+        -DPKGCONFIG_INSTALL_DIR=${PREFIX}/lib64/pkgconfig \
+        -DWITH_AS3=OFF \
+        -DWITH_C_GLIB=OFF \
+        -DWITH_CPP=ON \
+        -DWITH_JAVA=OFF \
+        -DWITH_JAVASCRIPT=OFF \
+        -DWITH_LIBEVENT=OFF \
+        -DWITH_NODEJS=OFF \
+        -DWITH_OPENSSL=OFF \
+        -DWITH_PYTHON=OFF \
+        -DWITH_QT5=OFF \
+        -DWITH_ZLIB=OFF \
+    && cmake --build build --parallel "$(nproc)" --target install \
+    && sed -i 's|^libdir=.*|libdir=${prefix}/lib64|' \
+        ${PREFIX}/lib64/pkgconfig/thrift.pc \
+    && rm -rf build src
+
+RUN --mount=type=bind,from=sources,source=snappy-1.2.2.tar.gz,target=/tmp/snappy.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/snappy.tar.gz --directory=src --strip-components=1 \
+    && cmake -G Ninja -S src -B build -DCMAKE_BUILD_TYPE=Release \
+        -DBUILD_SHARED_LIBS=OFF \
+        -DCMAKE_INSTALL_LIBDIR=lib64 \
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DSNAPPY_BUILD_BENCHMARKS=OFF \
+        -DSNAPPY_BUILD_TESTS=OFF \
+    && cmake --build build --parallel "$(nproc)" --target install \
+    && rm -rf build src
+
+RUN --mount=type=bind,from=sources,source=lz4-v1.10.0.tar.gz,target=/tmp/lz4.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/lz4.tar.gz --directory=src --strip-components=1 \
+    && cmake -G Ninja -S src/build/cmake -B build -DCMAKE_BUILD_TYPE=Release \
+        -DBUILD_SHARED_LIBS=OFF \
+        -DBUILD_STATIC_LIBS=ON \
+        -DCMAKE_INSTALL_LIBDIR=lib64 \
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DLZ4_BUILD_CLI=OFF \
+        -DLZ4_POSITION_INDEPENDENT_LIB=ON \
+    && cmake --build build --parallel "$(nproc)" --target install \
+    && rm -rf build src
+
+RUN --mount=type=bind,from=sources,source=arrow-apache-arrow-25.0.1.tar.gz,target=/tmp/arrow.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/arrow.tar.gz --directory=src --strip-components=1 \
+    && cmake -G Ninja -S src/cpp -B build -DCMAKE_BUILD_TYPE=Release \
+        -DARROW_BUILD_BENCHMARKS=OFF \
+        -DARROW_BUILD_EXAMPLES=OFF \
+        -DARROW_BUILD_SHARED=OFF \
+        -DARROW_BUILD_STATIC=ON \
+        -DARROW_BUILD_TESTS=OFF \
+        -DARROW_BUILD_UTILITIES=OFF \
+        -DARROW_DEPENDENCY_SOURCE=SYSTEM \
+        -DARROW_DEPENDENCY_USE_SHARED=OFF \
+        -DARROW_IPC=ON \
+        -DARROW_JEMALLOC=OFF \
+        -DARROW_MIMALLOC=OFF \
+        -DARROW_PARQUET=ON \
+        -DARROW_POSITION_INDEPENDENT_CODE=ON \
+        -DARROW_WITH_BROTLI=OFF \
+        -DARROW_WITH_BZ2=OFF \
+        -DARROW_WITH_LZ4=ON \
+        -DARROW_WITH_SNAPPY=ON \
+        -DARROW_WITH_ZLIB=ON \
+        -DARROW_WITH_ZSTD=ON \
+        -DCMAKE_INSTALL_LIBDIR=lib64 \
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DPARQUET_BUILD_EXAMPLES=OFF \
+        -DPARQUET_BUILD_EXECUTABLES=OFF \
+        -DPARQUET_REQUIRE_ENCRYPTION=ON \
+    && cmake --build build --parallel "$(nproc)" --target install \
+    && rm -rf build src
+
 RUN --mount=type=bind,from=sources,source=duckdb-v1.5.6.tar.gz,target=/tmp/duckdb.tar.gz \
     --mount=type=bind,from=sources,source=duckdb-ui-0628932f74b1e2e9eaf68a05b22d737455541dca.tar.gz,target=/tmp/duckdb-ui.tar.gz \
     mkdir src \
@@ -704,4 +814,57 @@ RUN --mount=type=bind,from=sources,source=duckdb-v1.5.6.tar.gz,target=/tmp/duckd
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src ui-src
 
+RUN --mount=type=bind,from=sources,source=sqlite-autoconf-3540100.tar.gz,target=/tmp/sqlite.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/sqlite.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=wireguard-tools-v1.0.20260223.tar.xz,target=/tmp/wireguard-tools.tar.xz \
+    mkdir src \
+    && tar --extract --xz --file=/tmp/wireguard-tools.tar.xz --directory=src --strip-components=1 \
+    && make --directory=src/src --jobs="$(nproc)" \
+    && make --directory=src/src install PREFIX=${PREFIX} WITH_WGQUICK=yes WITH_SYSTEMDUNITS=no WITH_BASHCOMPLETION=no \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=freetds-1.5.21.tar.gz,target=/tmp/freetds.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/freetds.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
+        --disable-shared --enable-static --with-openssl=${PREFIX} \
+        --disable-odbc --disable-apps --disable-server --disable-pool --disable-libiconv \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=libffi-3.8.0.tar.gz,target=/tmp/libffi.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/libffi.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static --disable-docs --disable-multi-os-directory \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=Python-3.14.10.tgz,target=/tmp/python.tgz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/python.tgz --directory=src --strip-components=1 \
+    && cd src \
+    && ./configure --prefix=${PREFIX} --with-ensurepip=install \
+        LIBSQLITE3_CFLAGS="$(pkg-config --cflags sqlite3)" \
+        LIBSQLITE3_LIBS="$(pkg-config --static --libs sqlite3)" \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+COPY source-stack.cmake ${PREFIX}/share/source-stack/source-stack.cmake
+
 CMD ["/bin/bash"]

rocky9/build.sh

@@ -3,6 +3,7 @@
 set -eu
 
 IMAGE_NAME="${IMAGE_NAME:-rocky9-source-stack}"
+PREFIX="${PREFIX:-/opt/local}"
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 SOURCES_DIR="${SOURCES_DIR:-$SCRIPT_DIR/../sources}"
 FETCH_SCRIPT="$SCRIPT_DIR/../fetch-sources.sh"
@@ -14,5 +15,6 @@ fi
 
 SOURCES_DIR="$SOURCES_DIR" "$FETCH_SCRIPT"
 
-echo "Building image $IMAGE_NAME with podman ..."
-exec podman build --build-context sources="$SOURCES_DIR" --tag "$IMAGE_NAME" "$SCRIPT_DIR"
+echo "Building image $IMAGE_NAME with podman (prefix $PREFIX) ..."
+exec podman build --build-context sources="$SOURCES_DIR" \
+    --build-arg PREFIX="$PREFIX" --tag "$IMAGE_NAME" "$SCRIPT_DIR"

rocky9/source-stack.cmake

@@ -0,0 +1,50 @@
+# Installed into the image at ${PREFIX}/share/source-stack/source-stack.cmake.
+#
+# Points CMake at the dependencies installed by this image. It mirrors the
+# Dockerfile's ENV block (PATH, PKG_CONFIG_PATH, CMAKE_PREFIX_PATH,
+# C_INCLUDE_PATH/CPLUS_INCLUDE_PATH, LIBRARY_PATH) for CMake's own lookups.
+# The prefix is derived from this file's location, so it also works when the
+# prefix is moved. Include it after project(), before the first find_package().
+#
+#   GW_SOURCE_STACK_ONLY  resolve libraries and packages only below the prefix
+
+option(GW_SOURCE_STACK_ONLY
+    "Resolve libraries and packages only below the source-stack prefix" OFF)
+
+get_filename_component(_ss_p "${CMAKE_CURRENT_LIST_DIR}/../.." ABSOLUTE)
+
+list(PREPEND CMAKE_PREFIX_PATH "${_ss_p}")
+list(PREPEND CMAKE_PROGRAM_PATH "${_ss_p}/bin")
+list(PREPEND CMAKE_INCLUDE_PATH "${_ss_p}/include")
+list(PREPEND CMAKE_LIBRARY_PATH "${_ss_p}/lib64" "${_ss_p}/lib")
+
+# pkg_check_modules() reads PKG_CONFIG_PATH at call time.
+set(_ss_pc "${_ss_p}/lib64/pkgconfig:${_ss_p}/lib/pkgconfig:${_ss_p}/share/pkgconfig")
+if(GW_SOURCE_STACK_ONLY)
+    # PKG_CONFIG_LIBDIR replaces the default search path, so system .pc files are ignored.
+    set(ENV{PKG_CONFIG_LIBDIR} "${_ss_pc}")
+    set(ENV{PKG_CONFIG_PATH} "")
+    # Build tools come from the system; look them up before system paths are switched off.
+    find_program(PKG_CONFIG_EXECUTABLE NAMES pkg-config pkgconf)
+    set(CMAKE_FIND_USE_CMAKE_SYSTEM_PATH OFF)
+    set(CMAKE_FIND_USE_SYSTEM_ENVIRONMENT_PATH OFF)
+    set(CMAKE_FIND_ROOT_PATH "${_ss_p}")
+    set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY)
+    set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
+    set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
+else()
+    if(NOT "$ENV{PKG_CONFIG_PATH}" STREQUAL "")
+        set(ENV{PKG_CONFIG_PATH} "${_ss_pc}:$ENV{PKG_CONFIG_PATH}")
+    else()
+        set(ENV{PKG_CONFIG_PATH} "${_ss_pc}")
+    endif()
+endif()
+
+# protoc installed next to the libraries, unless the caller chose one.
+if(NOT Protobuf_PROTOC_EXECUTABLE AND EXISTS "${_ss_p}/bin/protoc")
+    set(Protobuf_PROTOC_EXECUTABLE "${_ss_p}/bin/protoc" CACHE FILEPATH "protoc")
+endif()
+
+message(STATUS "source-stack: ${_ss_p}")
+unset(_ss_p)
+unset(_ss_pc)

test/Dockerfile

@@ -1,34 +0,0 @@
-FROM docker.io/library/rockylinux:9
-
-RUN dnf install --assumeyes --enablerepo=crb \
-        autoconf \
-        automake \
-        bzip2 \
-        ca-certificates \
-        cmake \
-        curl-minimal \
-        gcc \
-        gcc-c++ \
-        gcc-toolset-15-gcc-c++ \
-        libasan \
-        git \
-        libtool \
-        make \
-        ninja-build \
-        patch \
-        perl-core \
-        pkgconf-pkg-config \
-        rpm-build \
-        tar \
-        xz \
-        which \
-        epel-release \
-    && sed \
-        -e 's!^metalink=!#metalink=!g' \
-        -e 's!^#baseurl=!baseurl=!g' \
-        -e 's!https\?://download\.example/pub/epel!https://mirrors.ustc.edu.cn/epel!g' \
-        -i /etc/yum.repos.d/epel.repo /etc/yum.repos.d/epel-testing.repo \
-    && dnf install --assumeyes \
-        makeself \
-    && dnf clean all \
-    && rm -rf /var/cache/dnf

test/build.sh

@@ -1,14 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-IMAGE_NAME="${IMAGE_NAME:-test-source-stack}"
-SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-
-if ! command -v podman >/dev/null 2>&1; then
-    echo "Error: Podman is required." >&2
-    exit 1
-fi
-
-echo "Building image $IMAGE_NAME with podman ..."
-exec podman build --network host --tag "$IMAGE_NAME" "$SCRIPT_DIR"

test/cachelib-optional-interface.patch

@@ -1,77 +0,0 @@
-diff --git a/cachelib/CMakeLists.txt b/cachelib/CMakeLists.txt
-index 9442838..2a22ba8 100644
---- a/cachelib/CMakeLists.txt
-+++ b/cachelib/CMakeLists.txt
-@@ -43,6 +43,8 @@ set(PACKAGE_BUGREPORT "https://github.com/facebook/TBD")
- set(CMAKE_POSITION_INDEPENDENT_CODE ON)
- 
- option(BUILD_TESTS "If enabled, compile the tests." ON)
-+option(BUILD_CACHELIB_INTERFACE
-+       "Build the coroutine CacheComponent interface and cachebench." ON)
- 
- 
- set(BIN_INSTALL_DIR bin CACHE STRING
-@@ -316,11 +318,15 @@ add_subdirectory (common)
- add_subdirectory (shm)
- add_subdirectory (navy)
- add_subdirectory (allocator)
--add_subdirectory (interface)
- add_subdirectory (datatype)
- add_subdirectory (compact_cache)
- add_subdirectory (benchmarks)
--add_subdirectory (cachebench)
-+if (BUILD_CACHELIB_INTERFACE)
-+  add_subdirectory (interface)
-+  add_subdirectory (cachebench)
-+else ()
-+  message(STATUS "Skipping cachelib_interface and cachebench")
-+endif ()
- 
- # Install the source header files
- install(
-@@ -379,13 +385,18 @@ install(
- )
- 
- add_library(cachelib INTERFACE)
--target_link_libraries(cachelib INTERFACE
-+set(CACHELIB_LINK_LIBRARIES
-      cachelib_common
-      cachelib_shm
-      cachelib_navy
-      cachelib_allocator
--     cachelib_interface
-      )
-+if (BUILD_CACHELIB_INTERFACE)
-+  list(APPEND CACHELIB_LINK_LIBRARIES cachelib_interface)
-+endif ()
-+target_link_libraries(cachelib INTERFACE
-+     ${CACHELIB_LINK_LIBRARIES}
-+     )
- target_include_directories(
-   cachelib
-   INTERFACE
-@@ -405,15 +416,20 @@ install(EXPORT cachelib-exports
-         DESTINATION ${CMAKE_INSTALL_DIR})
- 
- if (BUILD_SHARED_LIBS)
--  set_target_properties(
-+  set(CACHELIB_VERSIONED_TARGETS
-     cachelib_allocator
--    cachelib_cachebench
-     cachelib_common
-     cachelib_datatype
--    cachelib_interface
-     cachelib_navy
-     cachelib_shm
--    PROPERTIES
-+  )
-+  if (BUILD_CACHELIB_INTERFACE)
-+    list(APPEND CACHELIB_VERSIONED_TARGETS
-+      cachelib_cachebench
-+      cachelib_interface)
-+  endif ()
-+  set_target_properties(
-+    ${CACHELIB_VERSIONED_TARGETS} PROPERTIES
-     SOVERSION ${CACHELIB_MAJOR_VERSION}
-     VERSION ${PACKAGE_VERSION}
-   )

test/libevent-lib64-install.patch

@@ -1,59 +0,0 @@
-diff --git a/cmake/AddEventLibrary.cmake b/cmake/AddEventLibrary.cmake
---- a/cmake/AddEventLibrary.cmake	2026-09-17 14:40:01.091049579 +0800
-+++ b/cmake/AddEventLibrary.cmake	2026-09-17 14:40:01.103049846 +0800
-@@ -31,7 +31,7 @@
-     configure_file("lib${LIB_NAME}.pc.in" "lib${LIB_NAME}.pc" @ONLY)
-     install(
-         FILES "${CMAKE_CURRENT_BINARY_DIR}/lib${LIB_NAME}.pc"
--        DESTINATION "${CMAKE_INSTALL_PREFIX}/lib/pkgconfig"
-+        DESTINATION "${CMAKE_INSTALL_PREFIX}/lib64/pkgconfig"
-     )
- endmacro()
- 
-@@ -40,9 +40,9 @@
- macro(export_install_target TYPE LIB_NAME OUTER_INCLUDES)
-     if("${LIB_NAME}" STREQUAL "event")
-         install(TARGETS "${LIB_NAME}_${TYPE}"
--            LIBRARY DESTINATION "lib" COMPONENT lib
--            ARCHIVE DESTINATION "lib" COMPONENT lib
--            RUNTIME DESTINATION "lib" COMPONENT lib
-+            LIBRARY DESTINATION "lib64" COMPONENT lib
-+            ARCHIVE DESTINATION "lib64" COMPONENT lib
-+            RUNTIME DESTINATION "lib64" COMPONENT lib
-             COMPONENT dev
-         )
-     else()
-@@ -67,9 +67,9 @@
-         )
-         install(TARGETS "${LIB_NAME}_${TYPE}"
-             EXPORT LibeventTargets-${TYPE}
--            LIBRARY DESTINATION "lib" COMPONENT lib
--            ARCHIVE DESTINATION "lib" COMPONENT lib
--            RUNTIME DESTINATION "lib" COMPONENT lib
-+            LIBRARY DESTINATION "lib64" COMPONENT lib
-+            ARCHIVE DESTINATION "lib64" COMPONENT lib
-+            RUNTIME DESTINATION "lib64" COMPONENT lib
-             COMPONENT dev
-         )
-     endif()
-@@ -181,7 +181,7 @@
-         if (NOT WIN32)
-             install(FILES
-                 "$<TARGET_FILE_DIR:${LIB_NAME}_shared>/${LIB_LINK_NAME}"
--                DESTINATION "lib"
-+                DESTINATION "lib64"
-                 COMPONENT lib)
-         endif()
-     endif()
-diff --git a/CMakeLists.txt b/CMakeLists.txt
---- a/CMakeLists.txt	2026-09-17 14:40:01.091049579 +0800
-+++ b/CMakeLists.txt	2026-09-17 14:40:01.103049846 +0800
-@@ -1453,7 +1453,7 @@
- #
- 
- set(EVENT_INSTALL_CMAKE_DIR
--    "${CMAKE_INSTALL_PREFIX}/lib/cmake/libevent")
-+    "${CMAKE_INSTALL_PREFIX}/lib64/cmake/libevent")
- 
- export(PACKAGE libevent)
-