Backport release/v6.7: Attach a static linux/arm64 seid binary to releases - #4047
Conversation
Releases carry `linux/amd64` only. #3932 arch-split the musl link path, which made an arm64 static build possible; this wires it through the build script, the CI gate and goreleaser so the archive actually ships. ## Verified end to end `goreleaser release --snapshot` on this branch: ``` • archiving name=dist/sei-chain_..._linux_arm64.tar.gz • archiving name=dist/sei-chain_..._linux_x86_64.tar.gz sei-chain_..._linux_arm64.tar.gz: OK -> ELF 64-bit LSB executable, ARM aarch64 sei-chain_..._linux_x86_64.tar.gz: OK -> ELF 64-bit LSB executable, x86-64 ``` Both archives are listed in `checksums.txt`, `sha256sum -c --ignore-missing` reports OK for both, and each archive contains a binary of the matching architecture. That last check matters because `--ignore-missing` exits 0 silently for a file that is present but unlisted, so an out of band upload would give operators a verification step that verifies nothing. ## The toolchain pin is needed on both architectures The gcc>=12 unwind b-tree that crashed the amd64 binary at the genesis wasm store is not amd64 specific. `ATOMIC_FDE_FAST_PATH` is gated on atomics support rather than a target allowlist, and an unpinned arm64 build SIGSEGVs on the **first** boot under `RAYON_NUM_THREADS=1`, reproduced on native arm64 hardware. So the Alpine 3.15 gcc 10.3.1 libgcc is now vendored for both, each in its own subdirectory, with provenance and checksums in the README. With the pin applied, the arm64 binary carries zero b-tree symbols and boots 8/8 clean at 4 CPUs. ## Build script `build-static.sh` takes a target architecture and writes `build/seid-<arch>`, so the two builds do not overwrite each other on one runner. The libgcc directory and the checksums it verifies are both derived from that one argument, so a build cannot verify one architecture's archives while linking another's. It also asserts the ELF machine of the output matches what was requested. Two guards that were failing open are now closed: - The `nm` b-tree assertion materialises the symbol table before grepping. Reading `nm` through a pipe reported **grep's** exit status, so a failing `nm` printed "pre-b-tree unwinder confirmed" and passed. - `boot-smoke.sh` refuses a binary built for another architecture. It previously reached `seid init`, died with an exec-format error, and reported "did not reach the ABCI handshake", which reads as a crashing binary rather than the wrong file being passed in. ## Where the arm64 binary gets booted The release runner is amd64 and cannot execute the arm64 binary, so the goreleaser hook boots only the amd64 one. The arm64 8-boot gauntlet runs in the new `Linux ARM64 (static)` job on native `ubuntu-24.04-arm` hardware. The link between them is reproducibility: the static build produces a byte-identical binary for a given commit (measured, identical `sha256` across independent runs), so the binary CI boots is the one that ships. The release job builds arm64 under emulation via binfmt, which costs roughly 45 minutes and is why the boot gate lives on native hardware instead. ## Notes for review - No `uci` change needed. Docker and privileged runs already work on the release runner, so binfmt registration is just another `before:` hook. - The workflow file changes cannot be carried by the backport bot and need a manual cherry-pick for release branches. - Docs are drafted separately in sei-protocol/sei-docs#64, held in draft until an arm64 tarball exists on a published release. --------- Co-authored-by: Masih H. Derkani <m@derkani.org> (cherry picked from commit fc586f4)
PR SummaryMedium Risk Overview Build & packaging: CI & safety: Cross-arch workflow gains a native Linux ARM64 (static) job (8-boot Vendoring: Pinned gcc 10 libgcc archives are split into Reviewed by Cursor Bugbot for commit e7f5a62. Bugbot is set up for automated code reviews on this repo. Configure here. |
![seidroid[bot]](https://avatars.githubusercontent.com/in/2745135?s=60&v=4){kind=small}
|
The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release/v6.7 #4047 +/- ##
================================================
- Coverage 61.28% 60.29% -1.00%
================================================
Files 2163 2064 -99
Lines 188768 177173 -11595
================================================
- Hits 115690 106823 -8867
+ Misses 62351 60563 -1788
+ Partials 10727 9787 -940
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
3 participants
Backport of #4004 to
release/v6.7.