guofang/source-stack
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

merge into: guofang/source-stack:ws2tcp-local-entrypoint
guofang/source-stack:main guofang/source-stack:ws2tcp-local-entrypoint guofang/source-stack:default-prefix-opt-local
..
pull from: guofang/source-stack:main
guofang/source-stack:main guofang/source-stack:ws2tcp-local-entrypoint guofang/source-stack:default-prefix-opt-local
4 Commits
ws2tcp-local-entrypoint .. main
Author SHA1 Message Date
GuofangandClaude Sonnet 5.5 3d3a0190ce Add FreeTDS, libffi and Python to rocky9 
Same pinned versions and options as debian13, installed under lib64
(Python keeps its standard library and lib-dynload in lib/python3.14).
Note in INCLUDED_LIBRARIES.md that alpine3.24 does not build them yet.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
 2026-11-13 13:56:37 +08:00
GuofangandClaude Sonnet 5.5 70351db908 Add libffi 3.8.0 and Python 3.14.10 to debian13 
Python is built from the python.org tarball against the pinned OpenSSL,
zlib, Zstd, SQLite and libffi; it does not pass --libdir because the
standard library and lib-dynload must stay under lib/python3.14. SQLite
is static, so its link flags are taken from pkg-config --static.
libffi is built with --disable-multi-os-directory so it installs into
the multiarch directory instead of lib/lib.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
 2026-11-13 13:51:03 +08:00
GuofangandClaude Sonnet 5.5 d23bd42892 Add FreeTDS 1.5.21 to debian13 
Build the static client libraries (libsybdb, libct) from the official
release tarball with OpenSSL; ODBC, the command-line apps, server and
pool are disabled.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
 2026-11-13 13:51:03 +08:00
GuofangandClaude Sonnet 5.5 3ca7753bd1 Add wireguard-tools v1.0.20260223 to rocky9 
Build the wg and wg-quick CLI from the upstream tag snapshot; only the
rocky9 image builds it for now.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
 2026-11-13 10:46:28 +08:00
5 changed files with 89 additions and 58 deletions
Expand all files Collapse all files

No files matched your search

INCLUDED_LIBRARIES.md
+5 -1
View File
@@ -51,9 +51,13 @@
| LZ4 | `v1.10.0` |
| Apache Arrow / Parquet | `25.0.1` |
| SQLite | `3.54.1` |
| FreeTDS | `1.5.21` |
| libffi | `3.8.0` |
| Python | `3.14.10` |
| wireguard-tools (`wg`, `wg-quick` CLI) | `v1.0.20260223` |
The image includes position-independent static builds of these libraries. Protobuf and libxml2 enable zlib support, and LibDwarf enables compressed debug section support using zlib and Zstd. ZeroMQ enables CURVE security using static libsodium. CZMQ enables UUID support using static util-linux libuuid while disabling undeclared optional integrations. librdkafka includes SSL, zlib, Zstd, and bundled LZ4 support while disabling undeclared optional integrations. spdlog uses external fmt, glog uses gflags, and all Meta libraries share the same release tag. Apache Arrow is built with Parquet (including OpenSSL-based Parquet encryption) and Snappy, LZ4, zlib, and Zstd compression using only the pinned system dependencies above (`ARROW_DEPENDENCY_SOURCE=SYSTEM`), with the bundled jemalloc and mimalloc allocators disabled. Apache Thrift only builds its C++ library, and its headers sit next to fbthrift's under `include/thrift` without overlapping.
**Pending on alpine3.24:** xsimd, Apache Thrift, Snappy, LZ4, and Apache Arrow / Parquet are currently built only in the `debian13` and `rocky9` images.
**Pending on alpine3.24:** xsimd, Apache Thrift, Snappy, LZ4, Apache Arrow / Parquet, FreeTDS, libffi, and Python are currently built only in the `debian13` and `rocky9` images; wireguard-tools is currently built only in the `rocky9` image.
**Alpine-only exception:** the `alpine3.24` image does not build Folly, Fizz, Wangle, mvfst, fbthrift, or CacheLib. These aren't on Meta's supported-OS list, and Folly's portability layer reaches for glibc-only macros/symbols with no musl branch (e.g. `off64_t`/`lseek64`/`pread64` in `folly/portability/Unistd.h`, `__ELF_NATIVE_CLASS` in `folly/debugging/symbolizer/Elf.cpp`), so patching each one as it surfaces risks introducing subtle bugs in code this project doesn't own. `debian13` and `rocky9` are glibc-based and build the full list above, Meta libraries included.
debian13/Dockerfile
+34 -10
View File
@@ -829,18 +829,42 @@ RUN --mount=type=bind,from=sources,source=sqlite-autoconf-3540100.tar.gz,target=
&& cd .. \
&& rm -rf src
RUN --mount=type=bind,from=sources,source=freetds-1.5.21.tar.gz,target=/tmp/freetds.tar.gz \
mkdir src \
&& tar --extract --gzip --file=/tmp/freetds.tar.gz --directory=src --strip-components=1 \
&& cd src \
&& CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) \
--disable-shared --enable-static --with-openssl=${PREFIX} \
--disable-odbc --disable-apps --disable-server --disable-pool --disable-libiconv \
&& make --jobs="$(nproc)" \
&& make install \
&& cd .. \
&& rm -rf src
RUN --mount=type=bind,from=sources,source=libffi-3.8.0.tar.gz,target=/tmp/libffi.tar.gz \
mkdir src \
&& tar --extract --gzip --file=/tmp/libffi.tar.gz --directory=src --strip-components=1 \
&& cd src \
&& CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --disable-shared --enable-static --disable-docs --disable-multi-os-directory \
&& make --jobs="$(nproc)" \
&& make install \
&& cd .. \
&& rm -rf src
RUN --mount=type=bind,from=sources,source=Python-3.14.10.tgz,target=/tmp/python.tgz \
mkdir src \
&& tar --extract --gzip --file=/tmp/python.tgz --directory=src --strip-components=1 \
&& cd src \
&& ./configure --prefix=${PREFIX} --with-ensurepip=install \
LIBSQLITE3_CFLAGS="$(pkg-config --cflags sqlite3)" \
LIBSQLITE3_LIBS="$(pkg-config --static --libs sqlite3)" \
&& make --jobs="$(nproc)" \
&& make install \
&& cd .. \
&& rm -rf src
COPY source-stack.cmake.in /tmp/
RUN mkdir -p ${PREFIX}/share/source-stack \
&& sed "s|@MULTIARCH@|$(gcc -dumpmachine)|" /tmp/source-stack.cmake.in \
> ${PREFIX}/share/source-stack/source-stack.cmake \
&& rm /tmp/source-stack.cmake.in
RUN useradd --create-home develop
USER develop
ENV CLAUDE_CONFIG_DIR="$HOME/my-claude"
ENV DISABLE_AUTOUPDATER="1"
RUN bash -c 'curl -fsSL https://claude.ai/install.sh | bash'
ARG CLAUDE_CODE_OAUTH_TOKEN
ENV CLAUDE_CODE_OAUTH_TOKEN=${CLAUDE_CODE_OAUTH_TOKEN}
debian13/build.sh
+1 -47
View File
@@ -1,38 +1,10 @@
#!/bin/sh
# Usage:
# ./build.sh build the image, asking for the password that unlocks the token
# ./build.sh --encrypt encrypt a token and print the value to paste into ENCRYPTED_TOKEN
set -eu
IMAGE_NAME="${IMAGE_NAME:-debian13-source-stack}"
PREFIX="${PREFIX:-/opt/local}"
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
# CLAUDE_CODE_OAUTH_TOKEN encrypted with AES-256-CBC (PBKDF2, base64). Generate with --encrypt.
ENCRYPTED_TOKEN='U2FsdGVkX1/BCTASs0tR40hsT+sngp46zANCbGZnklLN1M0wSJs/DxbQ6JDg593G09A+cVtVius4hJHRzB6caOO2KwBV0/+i7yUjr/PfreZksrdkz1DnFc7oorxXfvB7azuNEkQfAE2fZg8cnYL5jy3/LKRdAm11SUm83fU8ke8='
OPENSSL_ARGS="enc -aes-256-cbc -pbkdf2 -iter 600000 -a -A"
if ! command -v openssl >/dev/null 2>&1; then
echo "Error: OpenSSL is required." >&2
exit 1
fi
# read_secret PROMPT VARNAME: read the input with echo on, so it stays visible while typing.
read_secret() {
printf '%s' "$1" >&2
IFS= read -r "$2"
}
if [ "${1:-}" = "--encrypt" ]; then
read_secret "OAuth token: " token
read_secret "Password: " BUILD_PASSWORD
export BUILD_PASSWORD
printf '%s' "$token" | openssl $OPENSSL_ARGS -pass env:BUILD_PASSWORD
echo
exit 0
fi
SOURCES_DIR="${SOURCES_DIR:-$SCRIPT_DIR/../sources}"
FETCH_SCRIPT="$SCRIPT_DIR/../fetch-sources.sh"
@@ -41,22 +13,6 @@ if ! command -v podman >/dev/null 2>&1; then
exit 1
fi
if [ -z "$ENCRYPTED_TOKEN" ]; then
echo "Error: ENCRYPTED_TOKEN is empty; run './build.sh --encrypt' and paste the output into build.sh." >&2
exit 1
fi
read_secret "Password for CLAUDE_CODE_OAUTH_TOKEN: " BUILD_PASSWORD
export BUILD_PASSWORD
if ! CLAUDE_CODE_OAUTH_TOKEN=$(printf '%s' "$ENCRYPTED_TOKEN" | openssl $OPENSSL_ARGS -d -pass env:BUILD_PASSWORD 2>/dev/null); then
echo "Error: wrong password or corrupted token." >&2
exit 1
fi
unset BUILD_PASSWORD
# Exported so podman reads the value from the environment and it never appears in the command line.
export CLAUDE_CODE_OAUTH_TOKEN
SOURCES_DIR="$SOURCES_DIR" "$FETCH_SCRIPT"
# macOS reports arm64 where Linux (and Debian multiarch) call it aarch64.
@@ -64,8 +20,6 @@ ARCH=$(uname -m)
[ "$ARCH" = arm64 ] && ARCH=aarch64
echo "Building image $IMAGE_NAME with podman (prefix $PREFIX) ..."
exec podman build \
--build-arg CLAUDE_CODE_OAUTH_TOKEN \
--build-context sources="$SOURCES_DIR" \
exec podman build --build-context sources="$SOURCES_DIR" \
--build-arg PREFIX="$PREFIX" --build-arg MULTIARCH="$ARCH-linux-gnu" \
--tag "$IMAGE_NAME" "$SCRIPT_DIR"
fetch-sources.sh
+8
View File
@@ -164,3 +164,11 @@ fetch ThreadPool-cc0b6371d3963f7028c2da5fc007733f9f3bf205.tar.gz \
https://wangguofang.net/github.com/log4cplus/ThreadPool/archive/cc0b6371d3963f7028c2da5fc007733f9f3bf205.tar.gz
fetch sqlite-autoconf-3540100.tar.gz \
https://www.sqlite.org/2026/sqlite-autoconf-3540100.tar.gz
fetch wireguard-tools-v1.0.20260223.tar.xz \
https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-v1.0.20260223.tar.xz
fetch freetds-1.5.21.tar.gz \
https://www.freetds.org/files/stable/freetds-1.5.21.tar.gz
fetch libffi-3.8.0.tar.gz \
https://github.com/libffi/libffi/releases/download/v3.8.0/libffi-3.8.0.tar.gz
fetch Python-3.14.10.tgz \
https://www.python.org/ftp/python/3.14.10/Python-3.14.10.tgz
rocky9/Dockerfile
+41
View File
@@ -824,6 +824,47 @@ RUN --mount=type=bind,from=sources,source=sqlite-autoconf-3540100.tar.gz,target=
&& cd .. \
&& rm -rf src
RUN --mount=type=bind,from=sources,source=wireguard-tools-v1.0.20260223.tar.xz,target=/tmp/wireguard-tools.tar.xz \
mkdir src \
&& tar --extract --xz --file=/tmp/wireguard-tools.tar.xz --directory=src --strip-components=1 \
&& make --directory=src/src --jobs="$(nproc)" \
&& make --directory=src/src install PREFIX=${PREFIX} WITH_WGQUICK=yes WITH_SYSTEMDUNITS=no WITH_BASHCOMPLETION=no \
&& rm -rf src
RUN --mount=type=bind,from=sources,source=freetds-1.5.21.tar.gz,target=/tmp/freetds.tar.gz \
mkdir src \
&& tar --extract --gzip --file=/tmp/freetds.tar.gz --directory=src --strip-components=1 \
&& cd src \
&& CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
--disable-shared --enable-static --with-openssl=${PREFIX} \
--disable-odbc --disable-apps --disable-server --disable-pool --disable-libiconv \
&& make --jobs="$(nproc)" \
&& make install \
&& cd .. \
&& rm -rf src
RUN --mount=type=bind,from=sources,source=libffi-3.8.0.tar.gz,target=/tmp/libffi.tar.gz \
mkdir src \
&& tar --extract --gzip --file=/tmp/libffi.tar.gz --directory=src --strip-components=1 \
&& cd src \
&& CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static --disable-docs --disable-multi-os-directory \
&& make --jobs="$(nproc)" \
&& make install \
&& cd .. \
&& rm -rf src
RUN --mount=type=bind,from=sources,source=Python-3.14.10.tgz,target=/tmp/python.tgz \
mkdir src \
&& tar --extract --gzip --file=/tmp/python.tgz --directory=src --strip-components=1 \
&& cd src \
&& ./configure --prefix=${PREFIX} --with-ensurepip=install \
LIBSQLITE3_CFLAGS="$(pkg-config --cflags sqlite3)" \
LIBSQLITE3_LIBS="$(pkg-config --static --libs sqlite3)" \
&& make --jobs="$(nproc)" \
&& make install \
&& cd .. \
&& rm -rf src
COPY source-stack.cmake ${PREFIX}/share/source-stack/source-stack.cmake
CMD ["/bin/bash"]