From 01d5a5ee0609b21c8a8002a640a5b9981c9c7500 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Breiter?= Date: Wed, 9 Sep 2026 15:50:42 +0200 Subject: [PATCH 1/3] Update debian 11 docker images Debian 11 is EOL since 2026.08.31. On linux-rust switch to ubuntu 22.04 (EOL 2027.06) to support glibc 2.35. Debian 12 uses glibc 2.36 which would not work on 22.04. openwrt-rust switch to debian latest (trixie), same as other cross compilation targets which are not affected by glibc. aar-jdk-17 switch to trixie. Use temurin JDK from adoptium (part of eclipse fundation) since OpenJDK 11 and 17 are not available anymore. --- builders/build-linux-rust/Dockerfile | 45 +++++++++++++++++++++++++- builders/build-openwrt-rust/Dockerfile | 2 +- builders/package-aar-jdk-17/Dockerfile | 23 +++++++++---- 3 files changed, 62 insertions(+), 8 deletions(-) diff --git a/builders/build-linux-rust/Dockerfile b/builders/build-linux-rust/Dockerfile index d6da632..be81176 100644 --- a/builders/build-linux-rust/Dockerfile +++ b/builders/build-linux-rust/Dockerfile @@ -1,4 +1,4 @@ -FROM rust:1.89.0-bullseye +FROM buildpack-deps:22.04 ARG REVISION @@ -14,6 +14,49 @@ COPY --from=ghcr.io/nordsecurity/uniffi-generators:v0.28.3-4 /bin/uniffi-bindgen ENV QDK_TAG=v2.3.14 +# Rust installation is based on https://github.com/rust-lang/docker-rust/blob/master/stable/trixie/Dockerfile +# Builds equivalent of rust:RUST_VERSION-ubuntu22.04. +# Ubuntu 22.04 is selected to support glibc 2.35 (debian 12 is 2.36). +# It can be moved to separate base image but right now build-linux-rust is the only user of it. +# Other crosscompilation platforms can use newer os. +ENV RUSTUP_HOME=/usr/local/rustup \ + CARGO_HOME=/usr/local/cargo \ + PATH=/usr/local/cargo/bin:$PATH \ + RUST_VERSION=1.89.0 + +RUN set -eux; \ + \ + arch="$(dpkg --print-architecture)"; \ + case "$arch" in \ + 'amd64') \ + rustArch='x86_64-unknown-linux-gnu'; \ + rustupSha256='4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10'; \ + ;; \ + 'arm64'|'aarch64') \ + rustArch='aarch64-unknown-linux-gnu'; \ + rustupSha256='9732d6c5e2a098d3521fca8145d826ae0aaa067ef2385ead08e6feac88fa5792'; \ + ;; \ + *) \ + echo >&2 "unsupported rustup architecture: $arch"; \ + exit 1; \ + ;; \ + esac; \ + \ + url="https://static.rust-lang.org/rustup/archive/1.29.0/${rustArch}/rustup-init"; \ + wget --progress=dot:giga "$url"; \ + echo "${rustupSha256} *rustup-init" | sha256sum -c -; \ + \ + chmod +x rustup-init; \ + ./rustup-init -y --no-modify-path --profile minimal --default-toolchain $RUST_VERSION --default-host ${rustArch}; \ + rm rustup-init; \ + chmod -R a+w $RUSTUP_HOME $CARGO_HOME; \ + \ + rustup --version; \ + cargo --version; \ + rustc --version; +# end of rust installation + + # Multilib is not present in an arm64 debian but is used by libtelio RUN set -eux; \ export DEBIAN_FRONTEND=noninteractive; \ diff --git a/builders/build-openwrt-rust/Dockerfile b/builders/build-openwrt-rust/Dockerfile index a8a538c..d65f5ed 100644 --- a/builders/build-openwrt-rust/Dockerfile +++ b/builders/build-openwrt-rust/Dockerfile @@ -1,4 +1,4 @@ -FROM rust:1.89.0-bullseye +FROM rust:1.89.0 ARG REVISION diff --git a/builders/package-aar-jdk-17/Dockerfile b/builders/package-aar-jdk-17/Dockerfile index d4efa50..fbdc2a2 100644 --- a/builders/package-aar-jdk-17/Dockerfile +++ b/builders/package-aar-jdk-17/Dockerfile @@ -1,4 +1,4 @@ -FROM debian:bullseye-slim +FROM debian:trixie-slim ARG REVISION @@ -16,21 +16,32 @@ ENV ANDROID_SDK_ROOT /root/android-sdk-linux/ ENV WORKDIR /root WORKDIR ${WORKDIR} -# Install Android SDK -RUN apt-get update && apt-get install -y \ - openjdk-17-jdk \ - openjdk-11-jdk \ +RUN export DEBIAN_FRONTEND=noninteractive \ + && apt-get update \ + && apt-get install -y \ + apt-transport-https \ bash \ curl \ git \ + gnupg \ python3 \ python3-requests \ python3-pip \ unzip \ wget \ + && . /etc/os-release \ + && install -d -m 0755 /etc/apt/keyrings \ + && wget -qO- https://packages.adoptium.net/artifactory/api/gpg/key/public \ + | gpg --dearmor -o /etc/apt/keyrings/adoptium.gpg \ + && printf 'Types: deb\nURIs: https://packages.adoptium.net/artifactory/deb\nSuites: %s\nComponents: main\nSigned-By: /etc/apt/keyrings/adoptium.gpg\n' \ + "$VERSION_CODENAME" > /etc/apt/sources.list.d/adoptium.sources \ + && apt-get update \ + && apt-get install -y \ + temurin-17-jdk \ + temurin-11-jdk \ && rm -rf /var/lib/apt/lists/* -ENV JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64 +ENV JAVA_HOME=/usr/lib/jvm/temurin-17-jdk-amd64 RUN ARCH=$(uname -m) && \ case $ARCH in \ From b0878e631322f3642e9f1e53e1a7052f81b7b569 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Breiter?= Date: Thu, 10 Sep 2026 10:04:17 +0200 Subject: [PATCH 2/3] Fix warnings in aar-jdk-17 image build "ENV key value" -> "ENV key=value" ENTRYPOINT script.sh -> CMD ["script.sh"] to handle signals and easier pass arguments in command-line --- builders/package-aar-jdk-17/Dockerfile | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/builders/package-aar-jdk-17/Dockerfile b/builders/package-aar-jdk-17/Dockerfile index fbdc2a2..1886b13 100644 --- a/builders/package-aar-jdk-17/Dockerfile +++ b/builders/package-aar-jdk-17/Dockerfile @@ -7,13 +7,13 @@ LABEL org.opencontainers.image.description="AAR packaging image" LABEL org.opencontainers.image.licenses=GPL-3.0 LABEL org.opencontainers.image.revision=$REVISION -ENV ANDROID_COMPILE_SDK 29 -ENV ANDROID_BUILD_TOOLS 29.0.2 -ENV ANDROID_SDK_TOOLS 10406996 +ENV ANDROID_COMPILE_SDK=29 +ENV ANDROID_BUILD_TOOLS=29.0.2 +ENV ANDROID_SDK_TOOLS=10406996 -ENV ANDROID_SDK_ROOT /root/android-sdk-linux/ +ENV ANDROID_SDK_ROOT=/root/android-sdk-linux/ -ENV WORKDIR /root +ENV WORKDIR=/root WORKDIR ${WORKDIR} RUN export DEBIAN_FRONTEND=noninteractive \ @@ -61,7 +61,7 @@ RUN ARCH=$(uname -m) && \ ENV PATH="$PATH:/root/.local/bin" -ENV ANDROID_SDK_CHECKSUM 8919e8752979db73d8321e9babe2caedcc393750817c1a5f56c128ec442fb540 +ENV ANDROID_SDK_CHECKSUM=8919e8752979db73d8321e9babe2caedcc393750817c1a5f56c128ec442fb540 RUN wget --output-document=android-sdk.zip https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_SDK_TOOLS}_latest.zip && \ echo "${ANDROID_SDK_CHECKSUM} android-sdk.zip" | sha256sum --check && \ mkdir android-sdk-linux && \ @@ -79,8 +79,8 @@ ENV ANDROID_HOME=${WORKDIR}/android-sdk-linux ENV PATH=${PATH}:${ANDROID_HOME}/platform-tools # Install gradle -ENV GRADLE_VERSION 9.0.0 -ENV GRADLE_CHECKSUM f759b8dd5204e2e3fa4ca3e73f452f087153cf81bac9561eeb854229cc2c5365 +ENV GRADLE_VERSION=9.0.0 +ENV GRADLE_CHECKSUM=f759b8dd5204e2e3fa4ca3e73f452f087153cf81bac9561eeb854229cc2c5365 RUN wget https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-all.zip && \ echo "${GRADLE_CHECKSUM} gradle-${GRADLE_VERSION}-all.zip" | sha256sum --check && \ @@ -88,6 +88,6 @@ RUN wget https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-all. rm gradle-${GRADLE_VERSION}-all.zip ENV PATH=${PATH}:${WORKDIR}/gradle-${GRADLE_VERSION}/bin -ENTRYPOINT /bin/bash +CMD ["/bin/bash"] -ENV WORKDIR "" +ENV WORKDIR="" From 7aa8282f7e7f8154f9bcfaac3092c24023133484 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Breiter?= Date: Fri, 11 Sep 2026 11:29:03 +0200 Subject: [PATCH 3/3] OpenWrt musl target uses musl headers not glibc aarch64 musl target used glibc headers which are not compatible with musl. Since glibc 2.38 the headers redirect strtol/sscanf to __isoc23_strtol/__isoc23_sscanf which are not present in musl. AWS_LC_SYS_INCLUDE* is not used to select includes for building. Special includes are not needed for armv7_musl - include paths are read from linker in config.toml. --- builders/build-openwrt-rust/Dockerfile | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/builders/build-openwrt-rust/Dockerfile b/builders/build-openwrt-rust/Dockerfile index d65f5ed..c368ccd 100644 --- a/builders/build-openwrt-rust/Dockerfile +++ b/builders/build-openwrt-rust/Dockerfile @@ -24,6 +24,10 @@ RUN set -eux; \ else \ apt-get install -y python3-pip; \ fi; \ + dpkg --add-architecture arm64; \ + apt-get update; \ + # for aarch64 musl headers, should not use glibc headers + apt-get install -y musl-dev:arm64; \ rm -rf /var/lib/apt/lists/* # protoc @@ -69,8 +73,8 @@ RUN rustup component add clippy rustfmt # Cargo linker config for cross-compilation COPY builders/build-openwrt-rust/cargo-config.toml ${CARGO_HOME}/config.toml -# AWS LC includes for cross-compilation -ENV AWS_LC_SYS_INCLUDES_aarch64_unknown_linux_musl="/usr/aarch64-linux-gnu/include" -ENV AWS_LC_SYS_INCLUDES_armv7_unknown_linux_musleabihf="/opt/arm-linux-musleabihf-cross/arm-linux-musleabihf/include" +# musl include for cross-compilation (needed for AWS_LC) +# rustup doesn't bundle musl includes and includes are picked from linker aarch64-linux-gnu-gcc +ENV CFLAGS_aarch64_unknown_linux_musl="-isystem /usr/include/aarch64-linux-musl" ENV BYPASS_LLT_SECRETS=1