linux-static.yml

name: Linux Build (portable glibc) — wallet + miniupnpc + zmq

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    name: glibc-portable • x86_64
    runs-on: ubuntu-latest

    # Build inside Ubuntu 20.04 for maximum downstream compatibility
    container: ubuntu:20.04

    env:
      ARTIFACT_DIR: out
      PKG_NAME: interchained-glibc-portable-x86_64-${{ github.ref_type == 'tag' && github.ref_name || github.sha }}
      D_BIN: src/interchainedd
      CLI_BIN: src/interchained-cli

    steps:
      - name: Install base deps (git + certs)
        run: |
          apt-get update
          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            git ca-certificates
          git config --global --add safe.directory "$GITHUB_WORKSPACE" || true

      - name: Checkout (with submodules)
        uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Compute parallel jobs
        run: |
          J=$( (command -v nproc >/dev/null && nproc) || getconf _NPROCESSORS_ONLN || echo 1 )
          echo "JOBS=$J" >> "$GITHUB_ENV"

      - name: Install build deps (Ubuntu 20.04)
        run: |
          apt-get update
          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            build-essential autoconf automake libtool pkg-config \
            libevent-dev libboost-all-dev libminiupnpc-dev \
            libzmq3-dev libsqlite3-dev libssl-dev \
            file curl xz-utils perl patchelf

      # ── NEDB FFI: build real Rust staticlib with native ELF objects ──────
      # Root cause (Opus-diagnosed): lto=true in [profile.release] forces
      # embed-bitcode=yes. ALL rcgu objects become LLVM bitcode-only ELF wrappers
      # — no native .text. ar x extracts them but GNU ld cannot consume them.
      # cargo rustc -- -C lto=no doesn't help because the profile decision
      # (and embed-bitcode setting) happens before -- flags are merged.
      #
      # Fix: sed-patch Cargo.toml at runtime (ephemeral container, not committed),
      # then RUSTFLAGS="-C embed-bitcode=no". ELF magic-byte verification fails
      # fast if bitcode is still present.
      - name: Install Rust (stable, minimal)
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | sh -s -- -y --profile minimal
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Build NEDB FFI — real Rust impl, lto patched out at runtime
        run: |
          . "$HOME/.cargo/env"

          # Patch Cargo.toml: lto=true → lto=false (runtime only, ephemeral container)
          sed -i 's/^lto[[:space:]]*=.*/lto = false/' nedb-ffi/Cargo.toml
          echo "Profile after patch:"; grep -E '^(lto|opt-level|codegen-units)' nedb-ffi/Cargo.toml

          cd nedb-ffi
          RUSTFLAGS="-C embed-bitcode=no" cargo rustc --release --crate-type=staticlib
          echo "libnedb_ffi.a: $(du -sh target/release/libnedb_ffi.a | cut -f1)"

          # Verify rcgu objects are native ELF, NOT LLVM bitcode
          # ELF magic: 7f454c46  Bitcode magic: 4243c0de
          TMPV=$(mktemp -d)
          (cd "$TMPV" && ar x "$(pwd)/target/release/libnedb_ffi.a" 2>/dev/null || true)
          BITCODE=0
          for f in "$TMPV"/*nedb_ffi*.o; do
            [ -f "$f" ] || continue
            magic=$(head -c4 "$f" | od -An -tx1 | tr -d ' \n')
            case "$magic" in
              7f454c46*) echo "ELF OK: $(basename $f)" ;;
              4243c0de*|42c3c0de*) echo "BITCODE: $(basename $f)"; BITCODE=1 ;;
              *) echo "UNKNOWN $magic: $(basename $f)"; BITCODE=1 ;;
            esac
          done
          rm -rf "$TMPV"
          [ "$BITCODE" -eq 0 ] || { echo "ERROR: archive still contains LLVM bitcode"; exit 1; }

          # Verify nedb_* symbols are real text-section exports and that
          # cbindgen preserved C++ compatibility in the generated header.
          SYMS=$(nm target/release/libnedb_ffi.a 2>/dev/null | grep -c ' T nedb_' || echo 0)
          echo "nedb_* T-symbols: $SYMS"
          nm target/release/libnedb_ffi.a 2>/dev/null | grep ' T nedb_' | head -10
          [ "$SYMS" -gt 0 ] || { echo "ERROR: no nedb_* T symbols — still bitcode?"; exit 1; }
          grep -q 'extern "C"' nedb.h || { echo "ERROR: generated nedb.h lacks extern C guard"; exit 1; }

          # Generate the libtool wrapper consumed by src/Makefile.am LDADD.
          # This keeps libnedb_ffi.a in the app link line without leaking it
          # into helper library links through global LIBS.
          printf '%s\n' \
            '# libnedb_ffi.la - a libtool library file' \
            '# Generated by libtool for CI static linking.' \
            '#' \
            '# Please DO NOT delete this file!' \
            '# It is necessary for linking the library.' \
            '' \
            "dlname=''" \
            "library_names=''" \
            "old_library='libnedb_ffi.a'" \
            "inherited_linker_flags=''" \
            "dependency_libs=''" \
            "weak_library_names=''" \
            "current=0" \
            "age=0" \
            "revision=0" \
            "installed=no" \
            "shouldnotlink=no" \
            "dlopen=''" \
            "dlpreopen=''" \
            "libdir=''" \
            > target/release/libnedb_ffi.la
          test -f target/release/libnedb_ffi.la
      # ─────────────────────────────────────────────────────────────────────

      - name: Build Berkeley DB 4.8 (portable) from observerdev/db-4.8.30
        env:
          BDB_PREFIX: ${{ github.workspace }}/db4
        run: |
          set -eux
          git clone --depth=1 https://github.com/observerdev/db-4.8.30.git bdb-src
          sed -i 's/\b__atomic_compare_exchange\b/__db_atomic_compare_exchange/g' bdb-src/dbinc/atomic.h
          cd bdb-src/build_unix
          CFLAGS="-O2 -fPIC -Wno-builtin-declaration-mismatch -Wno-format-security" \
          ../dist/configure --prefix="$BDB_PREFIX" --enable-cxx --disable-shared --with-pic
          make -j"$JOBS"
          make install

          cd "$BDB_PREFIX"/lib
          for base in db db_cxx; do
            [ -f "lib${base}.a" ] && [ ! -f "lib${base}-4.8.a" ] && ln -s "lib${base}.a" "lib${base}-4.8.a" || true
            [ -f "lib${base}-4.8.a" ] && [ ! -f "lib${base}.a" ] && ln -s "lib${base}-4.8.a" "lib${base}.a" || true
          done

          DB_CXX="$(ls -1 libdb_cxx-4.8.a libdb_cxx.a 2>/dev/null | head -n1)"
          DB_BASE="$(ls -1 libdb-4.8.a     libdb.a     2>/dev/null | head -n1)"
          echo "BDB_LIBS_FILES=$BDB_PREFIX/lib/$DB_CXX $BDB_PREFIX/lib/$DB_BASE" >> "$GITHUB_ENV"

      - name: Configure & Build (glibc portable, C++14)
        env:
          BDB_PREFIX: ${{ github.workspace }}/db4
          BDB_CFLAGS: "-I${{ github.workspace }}/db4/include"
          CPPFLAGS: "-I${{ github.workspace }}/db4/include"
          # Portable trick: ship with static libstdc++ / libgcc, leave glibc dynamic.
          # libnedb_ffi.a is linked via $(NEDB_FFI_LIB) in Makefile.am LDADD —
          # it comes after the C++ archives so static symbol resolution is correct.
          # CI pre-builds it before ./configure runs so make never triggers cargo.
          LDFLAGS: "-L${{ github.workspace }}/db4/lib -static-libstdc++ -static-libgcc"
          CFLAGS: "-O2"
          CXXFLAGS: "-O2 -std=c++14"
        run: |
          set -eux
          ./autogen.sh
          export CPATH="$BDB_PREFIX/include:${CPATH:-}"
          [ -d "$BDB_PREFIX/include/db4" ] && export CPATH="$BDB_PREFIX/include/db4:$CPATH"

          if [ -n "${BDB_LIBS_FILES:-}" ]; then
            export BDB_LIBS="${BDB_LIBS_FILES} -pthread"
          else
            export BDB_LIBS="-L${BDB_PREFIX}/lib -ldb_cxx-4.8 -ldb-4.8 -pthread"
          fi

          ./configure \
            --enable-wallet \
            --with-incompatible-bdb \
            --without-gui \
            --disable-bench \
            --disable-tests \
            --with-zmq \
            --with-miniupnpc \
          || { echo "=== config.log ==="; cat config.log || true; exit 1; }

          # src/Makefile.am links NEDB-consuming binaries through the generated
          # libtool wrapper, keeping the FFI archive scoped to app links.
          test -f "$(pwd)/nedb-ffi/target/release/libnedb_ffi.la"
          export NEDB_LIB="$(pwd)/nedb-ffi/target/release/libnedb_ffi.a"
          test -f "$NEDB_LIB"
          nm "$NEDB_LIB" | grep ' T nedb_get'

          # Defensive CI-only final-link override: group the Bitcoin-style C++
          # archives with the Rust FFI archive for final executable links.
          # GNU ld normally resolves static archives left-to-right once; grouping
          # makes it rescan until nedb_* references from server/wallet archives
          # are satisfied by libnedb_ffi.a even if libtool reorders .la deplibs.
          python3 - <<'PY'
          import os
          from pathlib import Path
          p = Path('src/Makefile')
          s = p.read_text()
          group_start = '-Wl,--start-group'
          group_end = '-Wl,--end-group'
          nedb = os.environ['NEDB_LIB']
          rust_syslibs = '-ldl -lpthread -lm'
          replacements = {
              'interchainedd_LDADD = $(LIBBITCOIN_SERVER) $(interchained_bin_ldadd) $(NEDB_FFI_LA)':
                  f'interchainedd_LDADD = {group_start} $(LIBBITCOIN_SERVER) $(interchained_bin_ldadd) {nedb} {rust_syslibs} {group_end}',
              'interchained_node_LDADD = $(LIBBITCOIN_SERVER) $(interchained_bin_ldadd) $(NEDB_FFI_LA)':
                  f'interchained_node_LDADD = {group_start} $(LIBBITCOIN_SERVER) $(interchained_bin_ldadd) {nedb} {rust_syslibs} {group_end}',
              'interchained_wallet_LDADD = $(LIBBITCOIN_WALLET_TOOL) $(interchained_bin_ldadd) $(NEDB_FFI_LA)':
                  f'interchained_wallet_LDADD = {group_start} $(LIBBITCOIN_WALLET_TOOL) $(interchained_bin_ldadd) {nedb} {rust_syslibs} {group_end}',
          }
          for old, new in replacements.items():
              if old not in s:
                  raise SystemExit(f'missing expected Makefile line: {old}')
              s = s.replace(old, new, 1)
          p.write_text(s)
          PY
          grep '^interchainedd_LDADD = .*--start-group.*libnedb_ffi\.a.*--end-group' src/Makefile
          grep '^interchained_wallet_LDADD = .*--start-group.*libnedb_ffi\.a.*--end-group' src/Makefile

          make -j"$JOBS" "$D_BIN" "$CLI_BIN"
          test -f "$D_BIN" && test -f "$CLI_BIN"

      - name: Verify it will run on Ubuntu (no musl interpreter)
        run: |
          set -eux
          file "$D_BIN" "$CLI_BIN"
          ! readelf -l "$D_BIN" | grep -qi 'ld-musl'
          ldd "$D_BIN" || true
          ldd "$CLI_BIN" || true

      - name: Show runtime deps (ldd)
        run: |
          set -eux
          ldd "$D_BIN" || true
          ldd "$CLI_BIN" || true

      - name: Strip & package
        run: |
          set -eux
          mkdir -p "$ARTIFACT_DIR/lib"

          # Copy binaries
          cp -v "$D_BIN" "$CLI_BIN" "$ARTIFACT_DIR"/

          # Strip (optional)
          strip "$ARTIFACT_DIR/$(basename "$D_BIN")" || true
          strip "$ARTIFACT_DIR/$(basename "$CLI_BIN")" || true

          # Collect runtime shared libraries (absolute paths from ldd)
          for bin in "$ARTIFACT_DIR/$(basename "$D_BIN")" "$ARTIFACT_DIR/$(basename "$CLI_BIN")"; do
            ldd "$bin" | awk '
              /=> \// {print $3}
              /^\// {print $1}
            ' | while read -r so; do
              [ -f "$so" ] || continue

              base="$(basename "$so")"

              # Never bundle glibc / loader / low-level system libs (must come from host)
              case "$base" in
                libc.so.*|ld-linux*.so*|libpthread.so.*|libdl.so.*|libm.so.*|libresolv.so.*|librt.so.*|libutil.so.*|libnsl.so.*|libanl.so.*|libcrypt.so.*)
                  continue
                  ;;
              esac

              # Optional: skip these because you already link them statically via -static-libstdc++/-static-libgcc
              case "$base" in
                libstdc++.so.*|libgcc_s.so.*)
                  continue
                  ;;
              esac

              cp -v "$so" "$ARTIFACT_DIR/lib/" || true
            done
          done

          # Force RPATH so indirect deps (eg. libzmq -> libpgm) also resolve from ./lib
          patchelf --force-rpath --set-rpath '$ORIGIN/lib' "$ARTIFACT_DIR/$(basename "$D_BIN")"
          patchelf --force-rpath --set-rpath '$ORIGIN/lib' "$ARTIFACT_DIR/$(basename "$CLI_BIN")"

          # Include docs if present
          [ -f README.md ] && cp README.md "$ARTIFACT_DIR"/ || true
          [ -f COPYING ] && cp COPYING "$ARTIFACT_DIR"/ || true

          # Hash and tar
          ( cd "$ARTIFACT_DIR" && sha256sum interchainedd interchained-cli > SHA256SUMS )
          tar -C "$ARTIFACT_DIR" -czf "${PKG_NAME}.tar.gz" .

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.PKG_NAME }}
          path: ${{ env.PKG_NAME }}.tar.gz
          if-no-files-found: error