[sineld]

Linux packages for Flock's Linux support (flock-php/flock#12): PHP for linux-x64 and linux-arm64, built like the macOS one, plus the services that are a matter of mirroring (Node.js, Meilisearch, Typesense, RustFS). Flock names these platforms since flock-php/flock#12 and needs no other change to install them.

PHP for Linux

• How it's built: with static-php-cli 2.8.5 and the same extensions as macOS (php.linux in versions.json), for PHP 8.2–8.5. The build runs in static-php-cli's glibc container (bin/spc-gnu-docker: CentOS 7, glibc 2.17, devtoolset-10).
• Why glibc and not musl: a fully static musl build can't load shared extensions, and ext/ (xdebug, imagick, pcov, mongodb, memcached, opentelemetry) is part of the package.
• Downloads run on the host. CentOS 7's curl can't reach servers that only speak TLS 1.3 (xdebug.org failed). The spc binary downloads instead, with SPC_TARGET=native-native-gnu.2.17, so it picks the pre-built libraries the container expects (<lib>-<arch>-linux-glibc-2.17.txz). Only the build runs in the container.
• RPATH is removed. The container leaves its own library path (/app/buildroot/lib) as RPATH. patchelf --remove-rpath drops it: the path is empty on a user's machine, and whoever could create it would have PHP load their libraries.
• scripts/verify-linux.sh (like verify-macos.sh) fails when a binary needs a glibc symbol newer than min_glibc (2.17), a library other than glibc's, libgcc_s and libstdc++, or has an RPATH.
• Smoke tests: the PHP smoke test runs on the build runner. It runs again in a centos:7 container, the oldest glibc we target, without anything the runner has installed. The container runs as the runner's user: as root, PHP-FPM wants a pool user.
• No PHP 8.1 on Linux. 8.1 reached its end of life before this platform existed. Its headers also need _GNU_SOURCE, which the mongodb extension's -std=c17 build doesn't get from 8.1's php_config.h (8.2 defines it there), so mongodb.so didn't build.
• OpenLDAP is pinned to 2.6.15. static-php-cli takes the newest OpenLDAP, and 2.7 declares variables right after labels, which the container's GCC 10 rejects.
• Planning and checks:
  • flockrel plan emits php_linux (both platforms per version).
  • release.yml runs build-php-linux.yml for it.
  • The weekly check also covers php.linux.minors, php.linux.spc and the xdebug/opentelemetry pins in packages/php/linux/build.sh.

The layout is the macOS one: bin/php, bin/php-fpm, ext/*.so, LICENSES/, flock-package.json (with min_glibc instead of min_os).

Mirrored services

Package	Linux asset	Check
node	node-v<V>-linux-{x64,arm64}.tar.gz	SHASUMS256.txt signed by a Node.js releaser
meilisearch	meilisearch-linux-{amd64,aarch64} (Community Edition)	GitHub's SHA-256
typesense	typesense-server-<V>-linux-{amd64,arm64}.tar.gz	the MD5 inside the tarball
rustfs	rustfs-linux-{x86_64,aarch64}-musl-v<V>.zip (static)	GitHub's SHA-256

mirror.yml tests Linux on ubuntu-24.04 and ubuntu-24.04-arm with the existing smoke-service.sh. The only change there: the code-signature check (SIGNER_MACOS, set for Node.js) only runs on macOS, since Linux binaries carry none. The Node.js archive is still checked against the signed SHASUMS256.txt.

Commits

• feat(flockrel): linux-x64 and linux-arm64 in platformExt. The plan iterates over platforms instead of a hard-coded pair.
• feat(php): php.linux, packages/php/linux/build.sh, build-php-linux.yml, scripts/verify-linux.sh, and the planner, release and check wiring.
• feat: the four mirrors for Linux, with versions.json and mirror.yml.

Not in this PR (follow-ups, each built on this one)

• feat: build PostgreSQL, Valkey and Redis for Linux #25: PostgreSQL, Valkey and Redis, built in manylinux_2_28 (glibc 2.28+).
• feat(frankenphp): build FrankenPHP for Linux #26: FrankenPHP, built like php here.
• feat: mirror MySQL and MongoDB for Linux #27: MySQL and MongoDB, mirrored.
• feat: build MariaDB for Linux #28: MariaDB, built on top of feat: build PostgreSQL, Valkey and Redis for Linux #25.

Testing

All of this ran on my fork with publish off (https://github.com/sineld/binaries/actions):

• build-php-linux.yml: PHP 8.2.34, 8.3.35, 8.4.26 and 8.5.11 on linux-x64 and linux-arm64 all pass the build, verify-linux.sh, the smoke test on the runner and the one on CentOS 7. Every compiled-in extension loads, as do xdebug, imagick, pcov, mongodb, memcached and opentelemetry (hook included).
  • A build takes 11–12 minutes with the pre-built libraries.
  • The arm64 package is 75 MB.
  • Its binaries need only glibc's libraries, libstdc++ and libgcc_s.
• End to end with Flock: the 8.4.26 arm64 package from that run was installed with flock php install --from into Flock built from feat: Linux support for the CLI and daemon flock#12, on Ubuntu 24.04 arm64. It served a site over HTTPS through PHP-FPM with 64 extensions, intl and opcache, and an outgoing HTTPS request from PHP worked.
• mirror.yml: node 22.12.0, meilisearch 1.55.0, rustfs 1.0.3 and typesense 30.1 pass on linux-x64. The same scripts mirrored and smoke-tested them for linux-arm64 on my arm64 machine.
• flockrel:
  • go test passes on every commit.
  • A plan dry run against this repository's releases lists PHP 8.2–8.5 for both Linux platforms and the Linux mirrors.
  • check against the live sources lists the Linux pins as current.

Questions

1. Are you OK with the glibc 2.17 baseline? Alpine isn't covered; a musl build without ext/ could serve it later.
2. The Linux builds start in the experimental channel like any new platform. Do you want to try them in Flock before they move on?

[sineld]

Closing this one and the PRs stacked on it (#25–#28): @lukas-frey's #34 landed Linux builds of PHP, FrankenPHP, PostgreSQL, MariaDB, Valkey and Redis and the Linux mirrors, which covers what these did, including MySQL's libaio.so.1t64 rename and the sources of its LGPL libraries.

Two things here that #34 does differently, in case they're useful later:

• glibc floor: these built PHP in static-php-cli's glibc 2.17 container and the services in manylinux_2_28 (AlmaLinux 8), so they ran on Debian 10, Ubuntu 20.04, RHEL 8 and later. Building on Ubuntu 24.04 needs its glibc 2.39, which leaves out Debian 12, Ubuntu 22.04 and RHEL 9.
• scripts/linux/bundle.sh (feat: build MariaDB for Linux #28): bundles every shared library an ELF file needs beyond glibc, libgcc_s and libstdc++, with its RPM's license files, sets $ORIGIN runpaths, and downloads the source package of a bundled LGPL library (libxcrypt) to publish next to the archive.

The branches stay on my fork.