Add FreeTDS, libffi and Python to rocky9

Same pinned versions and options as debian13, installed under lib64
(Python keeps its standard library and lib-dynload in lib/python3.14).
Note in INCLUDED_LIBRARIES.md that alpine3.24 does not build them yet.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

INCLUDED_LIBRARIES.md

@@ -51,10 +51,13 @@
 | LZ4 | `v1.10.0` |
 | Apache Arrow / Parquet | `25.0.1` |
 | SQLite | `3.54.1` |
+| FreeTDS | `1.5.21` |
+| libffi | `3.8.0` |
+| Python | `3.14.10` |
 | wireguard-tools (`wg`, `wg-quick` CLI) | `v1.0.20260223` |
 
 The image includes position-independent static builds of these libraries. Protobuf and libxml2 enable zlib support, and LibDwarf enables compressed debug section support using zlib and Zstd. ZeroMQ enables CURVE security using static libsodium. CZMQ enables UUID support using static util-linux libuuid while disabling undeclared optional integrations. librdkafka includes SSL, zlib, Zstd, and bundled LZ4 support while disabling undeclared optional integrations. spdlog uses external fmt, glog uses gflags, and all Meta libraries share the same release tag. Apache Arrow is built with Parquet (including OpenSSL-based Parquet encryption) and Snappy, LZ4, zlib, and Zstd compression using only the pinned system dependencies above (`ARROW_DEPENDENCY_SOURCE=SYSTEM`), with the bundled jemalloc and mimalloc allocators disabled. Apache Thrift only builds its C++ library, and its headers sit next to fbthrift's under `include/thrift` without overlapping.
 
-**Pending on alpine3.24:** xsimd, Apache Thrift, Snappy, LZ4, and Apache Arrow / Parquet are currently built only in the `debian13` and `rocky9` images; wireguard-tools is currently built only in the `rocky9` image.
+**Pending on alpine3.24:** xsimd, Apache Thrift, Snappy, LZ4, Apache Arrow / Parquet, FreeTDS, libffi, and Python are currently built only in the `debian13` and `rocky9` images; wireguard-tools is currently built only in the `rocky9` image.
 
 **Alpine-only exception:** the `alpine3.24` image does not build Folly, Fizz, Wangle, mvfst, fbthrift, or CacheLib. These aren't on Meta's supported-OS list, and Folly's portability layer reaches for glibc-only macros/symbols with no musl branch (e.g. `off64_t`/`lseek64`/`pread64` in `folly/portability/Unistd.h`, `__ELF_NATIVE_CLASS` in `folly/debugging/symbolizer/Elf.cpp`), so patching each one as it surfaces risks introducing subtle bugs in code this project doesn't own. `debian13` and `rocky9` are glibc-based and build the full list above, Meta libraries included.

debian13/Dockerfile

@@ -829,6 +829,40 @@ RUN --mount=type=bind,from=sources,source=sqlite-autoconf-3540100.tar.gz,target=
     && cd .. \
     && rm -rf src
 
+RUN --mount=type=bind,from=sources,source=freetds-1.5.21.tar.gz,target=/tmp/freetds.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/freetds.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) \
+        --disable-shared --enable-static --with-openssl=${PREFIX} \
+        --disable-odbc --disable-apps --disable-server --disable-pool --disable-libiconv \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=libffi-3.8.0.tar.gz,target=/tmp/libffi.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/libffi.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --disable-shared --enable-static --disable-docs --disable-multi-os-directory \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=Python-3.14.10.tgz,target=/tmp/python.tgz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/python.tgz --directory=src --strip-components=1 \
+    && cd src \
+    && ./configure --prefix=${PREFIX} --with-ensurepip=install \
+        LIBSQLITE3_CFLAGS="$(pkg-config --cflags sqlite3)" \
+        LIBSQLITE3_LIBS="$(pkg-config --static --libs sqlite3)" \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
 COPY source-stack.cmake.in /tmp/
 RUN mkdir -p ${PREFIX}/share/source-stack \
     && sed "s|@MULTIARCH@|$(gcc -dumpmachine)|" /tmp/source-stack.cmake.in \

fetch-sources.sh

@@ -166,3 +166,9 @@ fetch sqlite-autoconf-3540100.tar.gz \
     https://www.sqlite.org/2026/sqlite-autoconf-3540100.tar.gz
 fetch wireguard-tools-v1.0.20260223.tar.xz \
     https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-v1.0.20260223.tar.xz
+fetch freetds-1.5.21.tar.gz \
+    https://www.freetds.org/files/stable/freetds-1.5.21.tar.gz
+fetch libffi-3.8.0.tar.gz \
+    https://github.com/libffi/libffi/releases/download/v3.8.0/libffi-3.8.0.tar.gz
+fetch Python-3.14.10.tgz \
+    https://www.python.org/ftp/python/3.14.10/Python-3.14.10.tgz

rocky9/Dockerfile

@@ -831,6 +831,40 @@ RUN --mount=type=bind,from=sources,source=wireguard-tools-v1.0.20260223.tar.xz,t
     && make --directory=src/src install PREFIX=${PREFIX} WITH_WGQUICK=yes WITH_SYSTEMDUNITS=no WITH_BASHCOMPLETION=no \
     && rm -rf src
 
+RUN --mount=type=bind,from=sources,source=freetds-1.5.21.tar.gz,target=/tmp/freetds.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/freetds.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
+        --disable-shared --enable-static --with-openssl=${PREFIX} \
+        --disable-odbc --disable-apps --disable-server --disable-pool --disable-libiconv \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=libffi-3.8.0.tar.gz,target=/tmp/libffi.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/libffi.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static --disable-docs --disable-multi-os-directory \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=Python-3.14.10.tgz,target=/tmp/python.tgz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/python.tgz --directory=src --strip-components=1 \
+    && cd src \
+    && ./configure --prefix=${PREFIX} --with-ensurepip=install \
+        LIBSQLITE3_CFLAGS="$(pkg-config --cflags sqlite3)" \
+        LIBSQLITE3_LIBS="$(pkg-config --static --libs sqlite3)" \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
 COPY source-stack.cmake ${PREFIX}/share/source-stack/source-stack.cmake
 
 CMD ["/bin/bash"]