[sineld]

Builds on #24: the first three commits are that PR's. Only the last one, feat: build PostgreSQL, Valkey and Redis for Linux, is new here, and I'll rebase once #24 is in.

This builds PostgreSQL (14–18), Valkey (9.1) and Redis (7.2, 7.4, 8.4, 8.10) from source for linux-x64 and linux-arm64, the services Flock on Linux (flock-php/flock#12) can't get by mirroring.

How

• Build container: build-service.yml builds them in the manylinux_2_28 container (AlmaLinux 8, the image Python wheels are built in), so the binaries need glibc 2.28: Debian 10, Ubuntu 20.04, RHEL 8 and later. PHP (feat: Linux packages: PHP for x64 and arm64, and the mirrored services #24) targets glibc 2.17 through static-php-cli's own container; the services have no such tooling, and 2.28 keeps current compilers and maintained package repositories.
• Valkey and Redis: packages/{valkey,redis}/linux/build.sh are the macOS scripts with nproc: src/ only, no TLS, no systemd, libc's malloc. The bundled jemalloc is built for the build machine's page size, and arm64 kernels with 16K or 64K pages exist. They need nothing but glibc.
• PostgreSQL (packages/postgres/linux/build.sh) mirrors the macOS script:
  • A static OpenSSL (scripts/linux/openssl.sh, the same OPENSSL_VERSION), built with no-dso: nothing loads OpenSSL modules here. Without it, every library that links libcrypto.a would also need -ldl on glibc 2.28; MariaDB's client plugins hit that.
  • The same nm wrapper for the libpq exit-function check.
  • zlib, libuuid (uuid-ossp) and libedit (psql) come from the container's packages.
• scripts/linux/bundle.sh is the Linux counterpart of scripts/macos/relocate.sh.
  • It copies every library a binary needs beyond glibc's own, libgcc_s and libstdc++ to lib/: for PostgreSQL that's libz, libuuid, libedit and libtinfo.
  • It copies their license files from the RPMs. ncurses-libs has none of its own, so they come from the package built from the same source, ncurses-base.
  • It gives every binary an $ORIGIN-relative RUNPATH; other rpaths are dropped.
• scripts/verify-linux.sh now also accepts libraries that resolve into the package, and RUNPATHs that start with $ORIGIN. It still rejects anything else and any glibc symbol above MIN_GLIBC (2.28 here, in each package's env).
• Smoke test: smoke-service.sh runs unchanged in an almalinux:8 container, as the runner's user with its /etc/passwd mounted: PostgreSQL refuses root, and initdb looks the user up.
• scripts/lib.sh: --retry-all-errors is only passed when curl knows it (7.71+; AlmaLinux 8 has 7.61).

Testing

All of this ran on my fork with publish off (https://github.com/sineld/binaries/actions/workflows/build-service.yml):

Package	Versions	linux-x64	linux-arm64
postgres	14.24, 15.19, 16.15, 17.11, 18.6	✓ build, readelf, smoke on AlmaLinux 8	✓
redis	7.2.16, 7.4.11, 8.4.7, 8.10.2	✓	✓
valkey	9.1.2	✓	✓

• PostgreSQL 18.6 x64 was built again after the no-dso change and passed.
• PostgreSQL smoke test: initdb, a query, the contrib extensions (pgcrypto, uuid-ossp, pg_trgm, hstore, citext), createdb, pg_dump | pg_restore and pg_ctl stop all pass.
• The 18.6 arm64 package passed the same smoke test outside a container on Ubuntu 24.04. It's 34 MB, and its 126 ELF files need glibc ≤ 2.28 and otherwise only libraries from lib/.
• Local runs: Valkey 9.1.2 and Redis 8.10.2 also built and passed on my arm64 machine with the same scripts. bundle.sh bundled curl's 29 libraries in a local test, after which curl still ran from the package.
• flockrel: go test passes. A plan dry run lists the 20 Linux service builds.

Not in this PR

• FrankenPHP: feat(frankenphp): build FrankenPHP for Linux #26.
• MySQL and MongoDB: feat: mirror MySQL and MongoDB for Linux #27. They are mirrored; MySQL gets libaio, libnuma and ncurses added to its lib/private/.
• MariaDB: feat: build MariaDB for Linux #28, built like PostgreSQL here. That PR also has bundle.sh publish the source of a bundled LGPL library.

[sineld]

Closing: superseded by #34, see #24 (comment).