support aarch64 linux and standalone musl release packaging

.github/workflows/release.yml

@@ -38,16 +38,30 @@ jobs:
     name: Package Linux x86-64
     needs: publish-metadata
     runs-on: ubuntu-22.04
+    container:
+      image: ubuntu:20.04@sha256:c664f8f86ed5a386b0a340d981b8f81714e21a8b9c73f658c4bea56aa179d54a
     timeout-minutes: 75
     steps:
-      - uses: actions/checkout@v5
-
       - name: Install dependencies
         run: |
-          sudo apt-get update
-          sudo DEBIAN_FRONTEND=noninteractive apt-get install --yes \
-            bubblewrap build-essential ca-certificates cmake curl git \
+          apt-get update
+          DEBIAN_FRONTEND=noninteractive apt-get install --yes \
+            binutils bubblewrap build-essential ca-certificates cmake curl file git \
             libicu-dev libssl-dev libz-dev libzstd-dev pkg-config
+          mkdir -p -m 755 /etc/apt/keyrings
+          curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg |
+            tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null
+          chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" |
+            tee /etc/apt/sources.list.d/github-cli.list > /dev/null
+          apt-get update
+          DEBIAN_FRONTEND=noninteractive apt-get install --yes gh
+          git config --system --add safe.directory '*'
+
+      - uses: actions/checkout@v5
+
+      - name: Configure safe directory
+        run: git config --global --add safe.directory '*'
 
       - name: Install Rust
         run: |
@@ -59,6 +73,12 @@ jobs:
       - name: Package Linux release
         run: ./script/ci-package-release dist/
 
+      - name: Validate Linux release
+        run: |
+          ./script/validate-linux-release-artifact \
+            dist/autolith-"$GITHUB_REF_NAME"-x86_64-linux.tar.gz \
+            x86_64-linux x86_64 /lib64/ld-linux-x86-64.so.2
+
       - name: Upload Linux release artifacts
         env:
           GH_TOKEN: ${{ github.token }}
@@ -68,6 +88,135 @@ jobs:
             dist/autolith-"$GITHUB_REF_NAME"-x86_64-linux.tar.gz.sha256 \
             --clobber
 
+  package-linux-aarch64:
+    name: Package Linux aarch64
+    needs: publish-metadata
+    runs-on: ubuntu-24.04-arm
+    container:
+      image: ubuntu:20.04@sha256:722ea796ac2d57eeb3627c58a582fc1acc58be51faf815e1bce1682ae5c092f7
+    timeout-minutes: 90
+    steps:
+      - name: Install system dependencies
+        run: |
+          apt-get update
+          DEBIAN_FRONTEND=noninteractive apt-get install --yes \
+            binutils bubblewrap build-essential ca-certificates cmake curl file git \
+            libicu-dev libssl-dev libz-dev libzstd-dev pkg-config sbcl
+          mkdir -p -m 755 /etc/apt/keyrings
+          curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg |
+            tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null
+          chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" |
+            tee /etc/apt/sources.list.d/github-cli.list > /dev/null
+          apt-get update
+          DEBIAN_FRONTEND=noninteractive apt-get install --yes gh
+          git config --system --add safe.directory '*'
+
+      - uses: actions/checkout@v5
+
+      - name: Configure safe directory
+        run: git config --global --add safe.directory '*'
+
+      - name: Install Rust
+        run: |
+          curl --fail --location --show-error --retry 3 --proto '=https' --tlsv1.2 \
+            https://sh.rustup.rs |
+            sh -s -- -y --default-toolchain 1.97.1 --profile minimal
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Package Linux release
+        env:
+          AUTOLITH_HOST_BOOTSTRAP: "1"
+        run: ./script/ci-package-release dist/
+
+      - name: Validate Linux release
+        run: |
+          ./script/validate-linux-release-artifact \
+            dist/autolith-"$GITHUB_REF_NAME"-aarch64-linux.tar.gz \
+            aarch64-linux aarch64 /lib/ld-linux-aarch64.so.1
+
+      - name: Upload Linux release artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload "$GITHUB_REF_NAME" \
+            dist/autolith-"$GITHUB_REF_NAME"-aarch64-linux.tar.gz \
+            dist/autolith-"$GITHUB_REF_NAME"-aarch64-linux.tar.gz.sha256 \
+            --clobber
+
+  package-linux-x86_64-musl:
+    name: Package Linux x86-64 (musl)
+    needs: publish-metadata
+    runs-on: ubuntu-22.04
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Package and validate Linux musl release
+        run: |
+          docker run --rm -e GITHUB_REF_NAME -v "$PWD":/workspace -w /workspace \
+            alpine:3.22.5@sha256:7c8cb692ae09657cbc4a3f3cbd0e8d5a2690ba38386aaaf252dbb060bf5eb2e6 \
+            sh -c '
+              set -eu
+              apk add --no-cache bash binutils build-base bubblewrap ca-certificates cmake \
+                coreutils curl file git grep icu-dev linux-headers openssl-dev pkgconfig \
+                sbcl tar zlib-dev zstd-dev
+              curl --fail --location --show-error --retry 3 --proto "=https" --tlsv1.2 \
+                https://sh.rustup.rs |
+                sh -s -- -y --default-toolchain 1.97.1 --profile minimal
+              export PATH=/root/.cargo/bin:$PATH
+              git config --global --add safe.directory "*"
+              AUTOLITH_HOST_BOOTSTRAP=1 ./script/ci-package-release dist/
+              ./script/validate-linux-release-artifact \
+                dist/autolith-"$GITHUB_REF_NAME"-x86_64-linux-musl.tar.gz \
+                x86_64-linux-musl x86_64 /lib/ld-musl-x86_64.so.1
+            '
+
+      - name: Upload Linux musl release artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload "$GITHUB_REF_NAME" \
+            dist/autolith-"$GITHUB_REF_NAME"-x86_64-linux-musl.tar.gz \
+            dist/autolith-"$GITHUB_REF_NAME"-x86_64-linux-musl.tar.gz.sha256 \
+            --clobber
+
+  package-linux-aarch64-musl:
+    name: Package Linux aarch64 (musl)
+    needs: publish-metadata
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Package and validate Linux musl release
+        run: |
+          docker run --rm -e GITHUB_REF_NAME -v "$PWD":/workspace -w /workspace \
+            alpine:3.22.5@sha256:2c9d26f410d032d5b1525aa8a873e238b05b90c4ae8618743d4311f0cc827e37 \
+            sh -c '
+              set -eu
+              apk add --no-cache bash binutils build-base bubblewrap ca-certificates cmake \
+                coreutils curl file git grep icu-dev linux-headers openssl-dev pkgconfig \
+                sbcl tar zlib-dev zstd-dev
+              curl --fail --location --show-error --retry 3 --proto "=https" --tlsv1.2 \
+                https://sh.rustup.rs |
+                sh -s -- -y --default-toolchain 1.97.1 --profile minimal
+              export PATH=/root/.cargo/bin:$PATH
+              git config --global --add safe.directory "*"
+              AUTOLITH_HOST_BOOTSTRAP=1 ./script/ci-package-release dist/
+              ./script/validate-linux-release-artifact \
+                dist/autolith-"$GITHUB_REF_NAME"-aarch64-linux-musl.tar.gz \
+                aarch64-linux-musl aarch64 /lib/ld-musl-aarch64.so.1
+            '
+
+      - name: Upload Linux musl release artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload "$GITHUB_REF_NAME" \
+            dist/autolith-"$GITHUB_REF_NAME"-aarch64-linux-musl.tar.gz \
+            dist/autolith-"$GITHUB_REF_NAME"-aarch64-linux-musl.tar.gz.sha256 \
+            --clobber
   package-macos-arm64:
     name: Package macOS arm64
     needs: publish-metadata

bin/autolith-release

@@ -60,6 +60,18 @@ release_tag_valid_p()
   [[ $1 =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
 }
 
+legacy_release_platform_p()
+{
+  case $1 in
+    x86_64-linux|arm64-darwin|x86_64-freebsd|x86_64-netbsd|x86_64-openbsd)
+      return 0
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
 semantic_version_newer_p()
 {
   local candidate=$1
@@ -94,6 +106,7 @@ release_update()
 {
   local requested_tag=${1:-}
   local updated_launcher
+  local -a install_arguments
 
   if [[ -z $requested_tag ]]; then
     if ! requested_tag=$(release_latest_tag); then
@@ -108,9 +121,12 @@ release_update()
     printf 'Autolith %s is already the newest release.\n' "$release_version" >&2
     release_restart
   fi
+  install_arguments=(--without-command-link --version "$requested_tag")
+  if [[ $release_platform == *-linux-musl ]]; then
+    install_arguments=(--musl "${install_arguments[@]}")
+  fi
   if ! AUTOLITH_INSTALL_ROOT="$install_root" \
-       "$source_root/script/install" \
-       --without-command-link --version "$requested_tag"; then
+       "$source_root/script/install" "${install_arguments[@]}"; then
     printf 'Autolith could not install %s. Continuing with %s.\n' \
       "${requested_tag#v}" "$release_version" >&2
     release_restart
@@ -142,7 +158,7 @@ release_images_usable_p()
   active_manifest=$(dirname -- "$active_core")/manifest.sexp
   recovery_manifest=$(dirname -- "$recovery_core")/manifest.sexp
   [[ -r $image_marker ]] || return 1
-  [[ $(<"$image_marker") == "$release_tag" ]] || return 1
+  [[ $(<"$image_marker") == "$release_tag:$release_platform" ]] || return 1
   [[ -f $active_core && -f $active_manifest ]] || return 1
   [[ -f $recovery_core && -f $recovery_manifest ]] || return 1
   grep -Eq '^\(:ACTIVE-IMAGE :VERSION 1([[:space:]]|$)' \
@@ -169,45 +185,57 @@ release_images_build()
   marker_directory=$(dirname -- "$image_marker")
   mkdir -p -- "$marker_directory"
   temporary_marker=$marker_directory/.release-images.$$
-  printf '%s\n' "$release_tag" > "$temporary_marker"
+  printf '%s:%s\n' "$release_tag" "$release_platform" > "$temporary_marker"
   chmod 600 "$temporary_marker"
   mv -f -- "$temporary_marker" "$image_marker"
 }
 
 [[ -n $home ]] || fail "HOME is not set."
-platform=
+host_platform=
 os=$(uname -s)
 arch=$(uname -m)
 case $os in
   Linux)
     case $arch in
-      x86_64|amd64) platform=x86_64-linux ;;
+      x86_64|amd64) host_platform=x86_64-linux ;;
+      aarch64|arm64) host_platform=aarch64-linux ;;
     esac
+    if [[ -n $host_platform ]]; then
+      command -v ldd >/dev/null 2>&1 ||
+        fail "Linux libc could not be identified because ldd is unavailable."
+      libc_description=$(ldd /bin/sh 2>&1 || true)
+      if grep -iq musl <<< "$libc_description"; then
+        host_platform=${host_platform}-musl
+      elif ! grep -Eiq 'glibc|gnu libc|ld-linux|libc\.so\.6' \
+             <<< "$libc_description"; then
+        fail "Linux libc could not be identified as glibc or musl."
+      fi
+    fi
     ;;
   Darwin)
     case $arch in
-      arm64|aarch64) platform=arm64-darwin ;;
+      arm64|aarch64) host_platform=arm64-darwin ;;
     esac
     ;;
   FreeBSD)
     case $arch in
-      amd64|x86_64) platform=x86_64-freebsd ;;
+      amd64|x86_64) host_platform=x86_64-freebsd ;;
     esac
     ;;
   NetBSD)
     case $arch in
-      amd64|x86_64) platform=x86_64-netbsd ;;
+      amd64|x86_64) host_platform=x86_64-netbsd ;;
     esac
     ;;
   OpenBSD)
     case $arch in
-      amd64|x86_64) platform=x86_64-openbsd ;;
+      amd64|x86_64) host_platform=x86_64-openbsd ;;
     esac
     ;;
 esac
-[[ -n $platform ]] ||
-  fail "binary releases currently support Linux x86-64, macOS arm64, FreeBSD x86-64, NetBSD x86-64, and OpenBSD x86-64 only."
-if [[ $platform == arm64-darwin ]]; then
+[[ -n $host_platform ]] ||
+  fail "binary releases currently support Linux x86-64, Linux aarch64, macOS arm64, FreeBSD x86-64, NetBSD x86-64, and OpenBSD x86-64 only."
+if [[ $host_platform == arm64-darwin ]]; then
   fff_library=$release_root/lib/libfff_c.dylib
   colorlisp_library=$release_root/lib/libcolorlisp-tree-sitter.dylib
 else
@@ -222,27 +250,38 @@ release_commit=$(release_field commit)
 semantic_version_valid_p "$release_version" || fail "RELEASE has an invalid version."
 [[ $release_tag == "v$release_version" ]] || fail "RELEASE has an inconsistent tag."
 [[ $release_commit =~ ^[0-9a-f]{40}$ ]] || fail "RELEASE has an invalid commit."
+if grep -q '^platform=' "$release_record"; then
+  release_platform=$(release_field platform)
+  [[ -n $release_platform ]] || fail "RELEASE has an invalid platform."
+else
+  legacy_release_platform_p "$host_platform" ||
+    fail "RELEASE lacks platform identity for this release variant."
+  release_platform=$host_platform
+fi
+[[ $release_platform == "$host_platform" ]] ||
+  fail "RELEASE platform $release_platform does not match host $host_platform."
 [[ -x $sbcl_command ]] || fail "the bundled SBCL runtime is missing."
 [[ -f $runtime_source_root/version.lisp-expr ]] ||
   fail "the bundled SBCL source is missing."
 [[ -f $source_root/autolith.asd && -f $source_root/.qlot/setup.lisp ]] ||
   fail "the bundled Autolith source or dependencies are missing."
 [[ -x $source_root/script/install ]] || fail "the bundled installer is missing."
-if [[ $platform == x86_64-linux ]]; then
+if [[ $release_platform == *-linux* ]]; then
   [[ -x $sandbox_helper ]] || fail "the private sandbox helper is missing."
 fi
 [[ -f $fff_library ]] || fail "the private search library is missing."
 [[ -f $colorlisp_library ]] || fail "the private syntax library is missing."
 command -v git >/dev/null 2>&1 || fail "Git is required."
-if [[ $platform == x86_64-linux ]]; then
+if [[ $release_platform == *-linux* ]]; then
   command -v bwrap >/dev/null 2>&1 || fail "Bubblewrap is required."
 fi
 
 releases_root=$(CDPATH= cd -P -- "$release_root/.." && pwd)
 install_root=$(CDPATH= cd -P -- "$releases_root/.." && pwd)
 selected_release_p=false
 current_selected=$(resolve_path "$install_root/current" 2>/dev/null || true)
-if [[ ${release_root##*/} == "$release_tag" &&
+if [[ (${release_root##*/} == "$release_tag" ||
+       ${release_root##*/} == "$release_tag-$release_platform") &&
       ${releases_root##*/} == releases &&
       "$current_selected" == "$release_root" ]]; then
   selected_release_p=true
@@ -260,7 +299,7 @@ export AUTOLITH_FFF_LIBRARY=$fff_library
 export COLORLISP_NATIVE_LIBRARY=$colorlisp_library
 export AUTOLITH_ACTIVE_CORE=$active_core
 export AUTOLITH_RECOVERY_CORE=$recovery_core
-if [[ $platform == x86_64-linux ]]; then
+if [[ $release_platform == *-linux* ]]; then
   export CL_EXEC_SANDBOX_BWRAP
   CL_EXEC_SANDBOX_BWRAP=$(command -v bwrap)
   export CL_EXEC_SANDBOX_HELPER=$sandbox_helper
@@ -269,8 +308,8 @@ export GIT_OPTIONAL_LOCKS=0
 
 remaining_arguments=("$@")
 if [[ ${1:-} == --autolith-release-probe ]]; then
-  printf 'version=%s\ntag=%s\ncommit=%s\nsource=%s\nruntime=%s\n' \
-    "$release_version" "$release_tag" "$release_commit" \
+  printf 'version=%s\ntag=%s\ncommit=%s\nplatform=%s\nsource=%s\nruntime=%s\n' \
+    "$release_version" "$release_tag" "$release_commit" "$release_platform" \
     "$source_root" "$sbcl_command"
   exit 0
 fi