Add libffi 3.8.0 and Python 3.14.10 to debian13

Python is built from the python.org tarball against the pinned OpenSSL,
zlib, Zstd, SQLite and libffi; it does not pass --libdir because the
standard library and lib-dynload must stay under lib/python3.14. SQLite
is static, so its link flags are taken from pkg-config --static.
libffi is built with --disable-multi-os-directory so it installs into
the multiarch directory instead of lib/lib.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -21,6 +21,8 @@
 - On Rocky Linux 9, `glibc-devel`, `kernel-headers`, and `libstdc++-devel` may be installed directly or as compiler dependencies because they are foundational C/C++ platform and toolchain components.
 - On Alpine Linux, `musl-dev` and `linux-headers` may be installed directly or as compiler dependencies because they are foundational C/C++ platform and toolchain components.
 
+- The `rocky9-system` image is the exception to the rules above: it deliberately installs third-party libraries and their `-devel` packages from the Rocky Linux 9, CRB and EPEL repositories instead of building them from source, with Protobuf (`v3.21.12`, installed under `/usr/local`) as the only library built from source. Other libraries use distribution versions and are not pinned. Libraries missing from those repositories (for example `magic_enum`) are skipped, not built from source.
+
 ## Meta Libraries
 
 - Pin all Meta/Facebook ecosystem libraries to the same date-based release tag.

INCLUDED_LIBRARIES.md

@@ -34,7 +34,7 @@
 | CZMQ | `4.2.1` |
 | JsonCpp | `1.9.8` |
 | librdkafka | `2.15.0` |
-| json-c | `0.19` |
+| json-c | `0.18` |
 | RapidJSON | `1.1.0` |
 | curl | `8.21.0` |
 | hiredis | `1.4.1` |
@@ -50,9 +50,14 @@
 | Snappy | `1.2.2` |
 | LZ4 | `v1.10.0` |
 | Apache Arrow / Parquet | `25.0.1` |
+| SQLite | `3.54.1` |
+| FreeTDS | `1.5.21` |
+| libffi | `3.8.0` |
+| Python | `3.14.10` |
+| wireguard-tools (`wg`, `wg-quick` CLI) | `v1.0.20260223` |
 
 The image includes position-independent static builds of these libraries. Protobuf and libxml2 enable zlib support, and LibDwarf enables compressed debug section support using zlib and Zstd. ZeroMQ enables CURVE security using static libsodium. CZMQ enables UUID support using static util-linux libuuid while disabling undeclared optional integrations. librdkafka includes SSL, zlib, Zstd, and bundled LZ4 support while disabling undeclared optional integrations. spdlog uses external fmt, glog uses gflags, and all Meta libraries share the same release tag. Apache Arrow is built with Parquet (including OpenSSL-based Parquet encryption) and Snappy, LZ4, zlib, and Zstd compression using only the pinned system dependencies above (`ARROW_DEPENDENCY_SOURCE=SYSTEM`), with the bundled jemalloc and mimalloc allocators disabled. Apache Thrift only builds its C++ library, and its headers sit next to fbthrift's under `include/thrift` without overlapping.
 
-**Pending on alpine3.24:** xsimd, Apache Thrift, Snappy, LZ4, and Apache Arrow / Parquet are currently built only in the `debian13` and `rocky9` images.
+**Pending on alpine3.24:** xsimd, Apache Thrift, Snappy, LZ4, and Apache Arrow / Parquet are currently built only in the `debian13` and `rocky9` images; wireguard-tools is currently built only in the `rocky9` image.
 
 **Alpine-only exception:** the `alpine3.24` image does not build Folly, Fizz, Wangle, mvfst, fbthrift, or CacheLib. These aren't on Meta's supported-OS list, and Folly's portability layer reaches for glibc-only macros/symbols with no musl branch (e.g. `off64_t`/`lseek64`/`pread64` in `folly/portability/Unistd.h`, `__ELF_NATIVE_CLASS` in `folly/debugging/symbolizer/Elf.cpp`), so patching each one as it surfaces risks introducing subtle bugs in code this project doesn't own. `debian13` and `rocky9` are glibc-based and build the full list above, Meta libraries included.

README.md

@@ -10,6 +10,7 @@ Each build script automatically selects Docker or Podman:
 ./build-all.sh
 ./debian13/build.sh
 ./rocky9/build.sh
+./rocky9-system/build.sh
 ./alpine3.24/build.sh
 ```
 
@@ -26,10 +27,13 @@ PREFIX=/opt/stack ./debian13/build.sh
 PREFIX=/opt/stack ./rocky9/build.sh
 ```
 
+The `rocky9-system` image uses the libraries shipped by Rocky Linux 9 (BaseOS, AppStream, CRB and EPEL) instead of building them from source, except Protobuf, which is built from source (`v3.21.12`, under `/usr/local`). Libraries that those repositories do not provide are simply left out.
+
 ## Run
 
 ```sh
 docker run --rm -it debian13-source-stack
 docker run --rm -it rocky9-source-stack
+docker run --rm -it rocky9-system-stack
 docker run --rm -it alpine3.24-source-stack
 ```

alpine3.24/Dockerfile

@@ -388,7 +388,7 @@ RUN --mount=type=bind,from=sources,source=librdkafka-v2.15.0.tar.gz,target=/tmp/
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src
 
-RUN --mount=type=bind,from=sources,source=json-c-json-c-0.19-20260627.tar.gz,target=/tmp/json-c.tar.gz \
+RUN --mount=type=bind,from=sources,source=json-c-json-c-0.18-20240915.tar.gz,target=/tmp/json-c.tar.gz \
     mkdir src \
     && tar --extract --gzip --file=/tmp/json-c.tar.gz --directory=src --strip-components=1 \
     && cmake -G Ninja -S src -B build -DCMAKE_BUILD_TYPE=Release \
@@ -607,4 +607,14 @@ RUN --mount=type=bind,from=sources,source=makeself-release-2.7.1.tar.gz,target=/
     && ln -s makeself.sh /usr/local/bin/makeself \
     && rm -rf src
 
+RUN --mount=type=bind,from=sources,source=sqlite-autoconf-3540100.tar.gz,target=/tmp/sqlite.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/sqlite.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=/usr/local --libdir=/usr/local/lib --disable-shared --enable-static \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
 CMD ["/bin/sh"]

build-all.sh

@@ -6,4 +6,5 @@ SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 
 "$SCRIPT_DIR/debian13/build.sh"
 "$SCRIPT_DIR/rocky9/build.sh"
+"$SCRIPT_DIR/rocky9-system/build.sh"
 "$SCRIPT_DIR/alpine3.24/build.sh"

debian13/Dockerfile

@@ -493,7 +493,7 @@ RUN --mount=type=bind,from=sources,source=librdkafka-v2.15.0.tar.gz,target=/tmp/
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src
 
-RUN --mount=type=bind,from=sources,source=json-c-json-c-0.19-20260627.tar.gz,target=/tmp/json-c.tar.gz \
+RUN --mount=type=bind,from=sources,source=json-c-json-c-0.18-20240915.tar.gz,target=/tmp/json-c.tar.gz \
     mkdir src \
     && tar --extract --gzip --file=/tmp/json-c.tar.gz --directory=src --strip-components=1 \
     && cmake -G Ninja -S src -B build -DCMAKE_BUILD_TYPE=Release \
@@ -819,6 +819,50 @@ RUN --mount=type=bind,from=sources,source=duckdb-v1.5.6.tar.gz,target=/tmp/duckd
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src ui-src
 
+RUN --mount=type=bind,from=sources,source=sqlite-autoconf-3540100.tar.gz,target=/tmp/sqlite.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/sqlite.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --disable-shared --enable-static \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=freetds-1.5.21.tar.gz,target=/tmp/freetds.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/freetds.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) \
+        --disable-shared --enable-static --with-openssl=${PREFIX} \
+        --disable-odbc --disable-apps --disable-server --disable-pool --disable-libiconv \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=libffi-3.8.0.tar.gz,target=/tmp/libffi.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/libffi.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --disable-shared --enable-static --disable-docs --disable-multi-os-directory \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=Python-3.14.10.tgz,target=/tmp/python.tgz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/python.tgz --directory=src --strip-components=1 \
+    && cd src \
+    && ./configure --prefix=${PREFIX} --with-ensurepip=install \
+        LIBSQLITE3_CFLAGS="$(pkg-config --cflags sqlite3)" \
+        LIBSQLITE3_LIBS="$(pkg-config --static --libs sqlite3)" \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
 COPY source-stack.cmake.in /tmp/
 RUN mkdir -p ${PREFIX}/share/source-stack \
     && sed "s|@MULTIARCH@|$(gcc -dumpmachine)|" /tmp/source-stack.cmake.in \

fetch-sources.sh

@@ -96,8 +96,8 @@ fetch jsoncpp-1.9.8.tar.gz \
     https://wangguofang.net/github.com/open-source-parsers/jsoncpp/archive/1.9.8.tar.gz
 fetch librdkafka-v2.15.0.tar.gz \
     https://wangguofang.net/github.com/confluentinc/librdkafka/archive/v2.15.0.tar.gz
-fetch json-c-json-c-0.19-20260627.tar.gz \
+fetch json-c-json-c-0.18-20240915.tar.gz \
-    https://wangguofang.net/github.com/json-c/json-c/archive/json-c-0.19-20260627.tar.gz
+    https://wangguofang.net/github.com/json-c/json-c/archive/json-c-0.18-20240915.tar.gz
 fetch rapidjson-v1.1.0.tar.gz \
     https://wangguofang.net/github.com/Tencent/rapidjson/archive/v1.1.0.tar.gz
 fetch curl-curl-8_21_0.tar.gz \
@@ -162,3 +162,13 @@ fetch log4cplus-REL_2_0_5.tar.gz \
     https://wangguofang.net/github.com/log4cplus/log4cplus/archive/REL_2_0_5.tar.gz
 fetch ThreadPool-cc0b6371d3963f7028c2da5fc007733f9f3bf205.tar.gz \
     https://wangguofang.net/github.com/log4cplus/ThreadPool/archive/cc0b6371d3963f7028c2da5fc007733f9f3bf205.tar.gz
+fetch sqlite-autoconf-3540100.tar.gz \
+    https://www.sqlite.org/2026/sqlite-autoconf-3540100.tar.gz
+fetch wireguard-tools-v1.0.20260223.tar.xz \
+    https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-v1.0.20260223.tar.xz
+fetch freetds-1.5.21.tar.gz \
+    https://www.freetds.org/files/stable/freetds-1.5.21.tar.gz
+fetch libffi-3.8.0.tar.gz \
+    https://github.com/libffi/libffi/releases/download/v3.8.0/libffi-3.8.0.tar.gz
+fetch Python-3.14.10.tgz \
+    https://www.python.org/ftp/python/3.14.10/Python-3.14.10.tgz

rocky9-system/Dockerfile

@@ -0,0 +1,111 @@
+FROM docker.io/library/rockylinux:9
+
+# Toolchain and build tools, same as the rocky9 image.
+RUN dnf install --assumeyes --enablerepo=crb \
+        autoconf \
+        automake \
+        bzip2 \
+        ca-certificates \
+        cmake \
+        curl-minimal \
+        gcc \
+        gcc-c++ \
+        libasan \
+        gcc-toolset-15-gcc-c++ \
+        gcc-toolset-15-libasan-devel \
+        git \
+        libtool \
+        make \
+        ninja-build \
+        patch \
+        perl-core \
+        pkgconf-pkg-config \
+        rpm-build \
+        tar \
+        xz \
+        which \
+        epel-release \
+    && sed \
+        -e 's!^metalink=!#metalink=!g' \
+        -e 's!^#baseurl=!baseurl=!g' \
+        -e 's!https\?://download\.example/pub/epel!https://mirrors.ustc.edu.cn/epel!g' \
+        -i /etc/yum.repos.d/epel.repo /etc/yum.repos.d/epel-testing.repo \
+    && dnf install --assumeyes \
+        makeself \
+    && dnf upgrade --assumeyes \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
+
+RUN git config --global url."https://wangguofang.net/github.com/".insteadOf "https://github.com/"
+
+RUN test "$(cmake --version | sed -n '1s/[^0-9]*//p' | cut -d. -f2)" -ge 29
+
+# Libraries come from the distribution (Rocky Linux 9, CRB and EPEL) instead of being built from
+# source, except Protobuf (below). A package that is not available in these repositories is skipped, not an error.
+RUN dnf install --assumeyes --enablerepo=crb,epel \
+        --setopt=skip_missing_names_on_install=True \
+        --skip-broken \
+        boost-devel \
+        cyrus-sasl-devel \
+        fast_float-devel \
+        fmt-devel \
+        folly-devel \
+        gflags-devel \
+        glog-devel \
+        gmock-devel \
+        gmp-devel \
+        gnutls-devel \
+        gtest-devel \
+        hiredis-devel \
+        jsoncpp-devel \
+        json-c-devel \
+        libaio-devel \
+        libcurl-devel \
+        libdwarf-devel \
+        libevent-devel \
+        libmaxminddb-devel \
+        libsodium-devel \
+        liburing-devel \
+        libuuid-devel \
+        libxml2-devel \
+        libyaml-devel \
+        libzstd-devel \
+        log4cplus-devel \
+        lz4-devel \
+        magic_enum-devel \
+        nettle-devel \
+        numactl-devel \
+        openssl-devel \
+        rapidjson-devel \
+        librdkafka-devel \
+        snappy-devel \
+        spdlog-devel \
+        sqlite-devel \
+        thrift-devel \
+        tsl-sparse-map-devel \
+        xsimd-devel \
+        xxhash-devel \
+        zeromq-devel \
+        czmq-devel \
+        zlib-devel \
+        libarrow-devel \
+        parquet-libs-devel \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
+
+# Protobuf is the only library built from source; it is installed under /usr/local, which takes
+# precedence over the system packages in /usr.
+RUN --mount=type=bind,from=sources,source=protobuf-v3.21.12.tar.gz,target=/tmp/protobuf.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/protobuf.tar.gz --directory=src --strip-components=1 \
+    && cmake -G Ninja -S src -B build -Dprotobuf_BUILD_TESTS=OFF \
+        -Dprotobuf_BUILD_SHARED_LIBS=OFF \
+        -Dprotobuf_WITH_ZLIB=ON \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DBUILD_SHARED_LIBS=OFF \
+        -DCMAKE_INSTALL_PREFIX=/usr/local \
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+    && cmake --build build --parallel "$(nproc)" --target install \
+    && rm -rf build src
+
+CMD ["/bin/bash"]

rocky9-system/build.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set -eu
+
+IMAGE_NAME="${IMAGE_NAME:-rocky9-system-stack}"
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+SOURCES_DIR="${SOURCES_DIR:-$SCRIPT_DIR/../sources}"
+FETCH_SCRIPT="$SCRIPT_DIR/../fetch-sources.sh"
+
+if ! command -v podman >/dev/null 2>&1; then
+    echo "Error: Podman is required." >&2
+    exit 1
+fi
+
+SOURCES_DIR="$SOURCES_DIR" "$FETCH_SCRIPT"
+
+echo "Building image $IMAGE_NAME with podman ..."
+exec podman build --build-context sources="$SOURCES_DIR" \
+    --tag "$IMAGE_NAME" "$SCRIPT_DIR"

rocky9/Dockerfile

@@ -494,7 +494,7 @@ RUN --mount=type=bind,from=sources,source=librdkafka-v2.15.0.tar.gz,target=/tmp/
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src
 
-RUN --mount=type=bind,from=sources,source=json-c-json-c-0.19-20260627.tar.gz,target=/tmp/json-c.tar.gz \
+RUN --mount=type=bind,from=sources,source=json-c-json-c-0.18-20240915.tar.gz,target=/tmp/json-c.tar.gz \
     mkdir src \
     && tar --extract --gzip --file=/tmp/json-c.tar.gz --directory=src --strip-components=1 \
     && cmake -G Ninja -S src -B build -DCMAKE_BUILD_TYPE=Release \
@@ -814,6 +814,23 @@ RUN --mount=type=bind,from=sources,source=duckdb-v1.5.6.tar.gz,target=/tmp/duckd
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src ui-src
 
+RUN --mount=type=bind,from=sources,source=sqlite-autoconf-3540100.tar.gz,target=/tmp/sqlite.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/sqlite.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=wireguard-tools-v1.0.20260223.tar.xz,target=/tmp/wireguard-tools.tar.xz \
+    mkdir src \
+    && tar --extract --xz --file=/tmp/wireguard-tools.tar.xz --directory=src --strip-components=1 \
+    && make --directory=src/src --jobs="$(nproc)" \
+    && make --directory=src/src install PREFIX=${PREFIX} WITH_WGQUICK=yes WITH_SYSTEMDUNITS=no WITH_BASHCOMPLETION=no \
+    && rm -rf src
+
 COPY source-stack.cmake ${PREFIX}/share/source-stack/source-stack.cmake
 
 CMD ["/bin/bash"]