From ce3a2048ca24e842ad0885af879473d75c0a35f0 Mon Sep 17 00:00:00 2001 From: Francois Massot Date: Sun, 19 Jul 2026 14:57:41 +0200 Subject: [PATCH 1/7] fix(ci): repair cross image builds --- Makefile | 3 ++- build/cross-images/aarch64-unknown-linux-gnu.dockerfile | 9 +++++++++ build/cross-images/aarch64-unknown-linux-musl.dockerfile | 5 ++++- build/cross-images/x86_64-unknown-linux-gnu.dockerfile | 8 ++++++++ 4 files changed, 23 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 4f2da23cd93..2d765eba28d 100644 --- a/Makefile +++ b/Makefile @@ -71,7 +71,8 @@ IMAGE_TAGS = x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu x86_64-unknown-l .PHONY: cross-images cross-images: - @for tag in ${IMAGE_TAGS}; do \ + @set -e; \ + for tag in ${IMAGE_TAGS}; do \ docker build --tag quickwit/cross:$$tag --file ./build/cross-images/$$tag.dockerfile ./build/cross-images; \ docker push quickwit/cross:$$tag; \ done diff --git a/build/cross-images/aarch64-unknown-linux-gnu.dockerfile b/build/cross-images/aarch64-unknown-linux-gnu.dockerfile index db0908faf59..60d22b84c55 100644 --- a/build/cross-images/aarch64-unknown-linux-gnu.dockerfile +++ b/build/cross-images/aarch64-unknown-linux-gnu.dockerfile @@ -16,10 +16,19 @@ RUN dpkg --add-architecture arm64 && \ apt-get update && \ apt-get install -y --no-install-recommends \ binutils-aarch64-linux-gnu \ + g++-10-aarch64-linux-gnu \ + gcc-10-aarch64-linux-gnu \ libsasl2-dev:arm64 \ unzip && \ rm -rf /var/lib/apt/lists/* +# GCC 9.4 is affected by https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189. +# aws-lc cannot execute its compiler probe while cross-compiling, so select the +# verified GCC 10.5 toolchain explicitly for both compilation and linking. +ENV CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc-10 \ + CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++-10 \ + CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc-10 + RUN curl -fLO $PBC_URL && \ unzip protoc-21.5-linux-x86_64.zip -d ./protobuf && \ mv ./protobuf/bin/protoc /usr/bin/ && \ diff --git a/build/cross-images/aarch64-unknown-linux-musl.dockerfile b/build/cross-images/aarch64-unknown-linux-musl.dockerfile index 3a2be3e81bf..5a5eaefe610 100644 --- a/build/cross-images/aarch64-unknown-linux-musl.dockerfile +++ b/build/cross-images/aarch64-unknown-linux-musl.dockerfile @@ -11,6 +11,7 @@ FROM rustembedded/cross:aarch64-unknown-linux-musl@sha256:22627e0ba533781062127b # ALSO UPDATE hooks/build! ARG OPENSSL_VERSION=1.1.1i ARG ZLIB_VERSION=1.2.11 +ARG ZLIB_SHA256=629380c90a77b964d896ed37163f5c3a34f6e6d897311f1df2a7016355c45eff RUN echo "Building OpenSSL" && \ cd /tmp && \ @@ -26,7 +27,9 @@ RUN echo "Building OpenSSL" && \ RUN echo "Building zlib" && \ cd /tmp && \ - curl -fLO "https://zlib.net/fossils/zlib-$ZLIB_VERSION.tar.gz" && \ + curl -fL --retry 3 -o "zlib-$ZLIB_VERSION.tar.gz" \ + "https://github.com/madler/zlib/archive/refs/tags/v$ZLIB_VERSION.tar.gz" && \ + echo "$ZLIB_SHA256 zlib-$ZLIB_VERSION.tar.gz" | sha256sum --check - && \ tar xzf "zlib-$ZLIB_VERSION.tar.gz" && cd "zlib-$ZLIB_VERSION" && \ AR=aarch64-linux-musl-ar CC=aarch64-linux-musl-gcc ./configure --static --prefix=/usr/local/aarch64-linux-musl && \ make && make install && \ diff --git a/build/cross-images/x86_64-unknown-linux-gnu.dockerfile b/build/cross-images/x86_64-unknown-linux-gnu.dockerfile index 0e50e6ed366..eda4d1d8199 100644 --- a/build/cross-images/x86_64-unknown-linux-gnu.dockerfile +++ b/build/cross-images/x86_64-unknown-linux-gnu.dockerfile @@ -9,10 +9,18 @@ ARG PBC_URL="https://github.com/protocolbuffers/protobuf/releases/download/v21.5 RUN apt-get update && \ apt-get install -y --no-install-recommends \ + g++-10 \ + gcc-10 \ libsasl2-dev \ unzip && \ rm -rf /var/lib/apt/lists/* +# GCC 9.4 is affected by https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189, +# which aws-lc correctly rejects because it can miscompile memcmp at -O3. +ENV CC_x86_64_unknown_linux_gnu=gcc-10 \ + CXX_x86_64_unknown_linux_gnu=g++-10 \ + CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=gcc-10 + RUN curl -fLO $PBC_URL && \ unzip protoc-21.5-linux-x86_64.zip -d ./protobuf && \ mv ./protobuf/bin/protoc /usr/bin/ && \ From 45dcddb46d68a939740270b9246fb75361d09583 Mon Sep 17 00:00:00 2001 From: Francois Massot Date: Sun, 19 Jul 2026 15:33:16 +0200 Subject: [PATCH 2/7] fix(ci): expose Lambda artifact to cross builds --- .github/workflows/publish_release_packages.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish_release_packages.yml b/.github/workflows/publish_release_packages.yml index f71cf22bdcf..6fc0d94641f 100644 --- a/.github/workflows/publish_release_packages.yml +++ b/.github/workflows/publish_release_packages.yml @@ -107,12 +107,12 @@ jobs: uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ needs.build-lambda.outputs.artifact-name }} - # Must be within the workspace so cross can mount it into the build container. - path: ./lambda-artifact + # `cross` mounts the Rust workspace (`quickwit/`) at `/project` in the container. + path: ./quickwit/lambda-artifact - name: Set LAMBDA_ZIP_PATH run: | - ZIP=$(ls lambda-artifact/*.zip) - echo "LAMBDA_ZIP_PATH=$(pwd)/$ZIP" >> $GITHUB_ENV + ZIP=$(ls quickwit/lambda-artifact/*.zip) + echo "LAMBDA_ZIP_PATH=/project/lambda-artifact/$(basename "$ZIP")" >> "$GITHUB_ENV" - uses: ./.github/actions/cross-build-binary with: target: ${{ matrix.target }} From a8e48a9cfa1ae235c5737779e9e1b1f6b6a34b42 Mon Sep 17 00:00:00 2001 From: Francois Massot Date: Sun, 19 Jul 2026 16:11:26 +0200 Subject: [PATCH 3/7] fix(ci): add curl headers to GNU cross images --- build/cross-images/aarch64-unknown-linux-gnu.dockerfile | 2 ++ build/cross-images/x86_64-unknown-linux-gnu.dockerfile | 2 ++ 2 files changed, 4 insertions(+) diff --git a/build/cross-images/aarch64-unknown-linux-gnu.dockerfile b/build/cross-images/aarch64-unknown-linux-gnu.dockerfile index 60d22b84c55..5e71e003433 100644 --- a/build/cross-images/aarch64-unknown-linux-gnu.dockerfile +++ b/build/cross-images/aarch64-unknown-linux-gnu.dockerfile @@ -12,12 +12,14 @@ ARG PBC_URL="https://github.com/protocolbuffers/protobuf/releases/download/v21.5 # `rdkafka/gssapi-vendored` feature when there is a release including: # https://github.com/MaterializeInc/rust-sasl/pull/48 +# librdkafka 2.12.1 includes curl/curl.h even when OIDC support is disabled. RUN dpkg --add-architecture arm64 && \ apt-get update && \ apt-get install -y --no-install-recommends \ binutils-aarch64-linux-gnu \ g++-10-aarch64-linux-gnu \ gcc-10-aarch64-linux-gnu \ + libcurl4-openssl-dev:arm64 \ libsasl2-dev:arm64 \ unzip && \ rm -rf /var/lib/apt/lists/* diff --git a/build/cross-images/x86_64-unknown-linux-gnu.dockerfile b/build/cross-images/x86_64-unknown-linux-gnu.dockerfile index eda4d1d8199..6280c492c2f 100644 --- a/build/cross-images/x86_64-unknown-linux-gnu.dockerfile +++ b/build/cross-images/x86_64-unknown-linux-gnu.dockerfile @@ -7,10 +7,12 @@ FROM ghcr.io/cross-rs/x86_64-unknown-linux-gnu:main@sha256:2431cbfcf2499f8a00570 ARG PBC_URL="https://github.com/protocolbuffers/protobuf/releases/download/v21.5/protoc-21.5-linux-x86_64.zip" +# librdkafka 2.12.1 includes curl/curl.h even when OIDC support is disabled. RUN apt-get update && \ apt-get install -y --no-install-recommends \ g++-10 \ gcc-10 \ + libcurl4-openssl-dev \ libsasl2-dev \ unzip && \ rm -rf /var/lib/apt/lists/* From aac5f29e2374435d9f6d6e5e3f6709792ea0e324 Mon Sep 17 00:00:00 2001 From: Francois Massot Date: Sun, 19 Jul 2026 17:15:58 +0200 Subject: [PATCH 4/7] fix(ci): expose ARM64 Zlib to CMake --- build/cross-images/aarch64-unknown-linux-gnu.dockerfile | 7 ++++++- build/cross-images/x86_64-unknown-linux-gnu.dockerfile | 4 +++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/build/cross-images/aarch64-unknown-linux-gnu.dockerfile b/build/cross-images/aarch64-unknown-linux-gnu.dockerfile index 5e71e003433..bf673137259 100644 --- a/build/cross-images/aarch64-unknown-linux-gnu.dockerfile +++ b/build/cross-images/aarch64-unknown-linux-gnu.dockerfile @@ -12,7 +12,8 @@ ARG PBC_URL="https://github.com/protocolbuffers/protobuf/releases/download/v21.5 # `rdkafka/gssapi-vendored` feature when there is a release including: # https://github.com/MaterializeInc/rust-sasl/pull/48 -# librdkafka 2.12.1 includes curl/curl.h even when OIDC support is disabled. +# librdkafka 2.12.1 includes curl/curl.h even when OIDC support is disabled and +# its CMake build requires a target Zlib installation. RUN dpkg --add-architecture arm64 && \ apt-get update && \ apt-get install -y --no-install-recommends \ @@ -21,7 +22,11 @@ RUN dpkg --add-architecture arm64 && \ gcc-10-aarch64-linux-gnu \ libcurl4-openssl-dev:arm64 \ libsasl2-dev:arm64 \ + zlib1g-dev:arm64 \ unzip && \ + ln -s /usr/include/zlib.h /usr/aarch64-linux-gnu/include/zlib.h && \ + ln -s /usr/include/zconf.h /usr/aarch64-linux-gnu/include/zconf.h && \ + ln -s /usr/lib/aarch64-linux-gnu/libz.a /usr/aarch64-linux-gnu/lib/libz.a && \ rm -rf /var/lib/apt/lists/* # GCC 9.4 is affected by https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189. diff --git a/build/cross-images/x86_64-unknown-linux-gnu.dockerfile b/build/cross-images/x86_64-unknown-linux-gnu.dockerfile index 6280c492c2f..143889d0cee 100644 --- a/build/cross-images/x86_64-unknown-linux-gnu.dockerfile +++ b/build/cross-images/x86_64-unknown-linux-gnu.dockerfile @@ -7,13 +7,15 @@ FROM ghcr.io/cross-rs/x86_64-unknown-linux-gnu:main@sha256:2431cbfcf2499f8a00570 ARG PBC_URL="https://github.com/protocolbuffers/protobuf/releases/download/v21.5/protoc-21.5-linux-x86_64.zip" -# librdkafka 2.12.1 includes curl/curl.h even when OIDC support is disabled. +# librdkafka 2.12.1 includes curl/curl.h even when OIDC support is disabled and +# its CMake build requires a Zlib installation. RUN apt-get update && \ apt-get install -y --no-install-recommends \ g++-10 \ gcc-10 \ libcurl4-openssl-dev \ libsasl2-dev \ + zlib1g-dev \ unzip && \ rm -rf /var/lib/apt/lists/* From 6cd39519cd2d9f6056170b3e2fa8967dc510c19c Mon Sep 17 00:00:00 2001 From: Francois Massot Date: Sun, 19 Jul 2026 18:21:16 +0200 Subject: [PATCH 5/7] fix(ci): preserve Cargo CMake dependency prefixes --- .../aarch64-unknown-linux-gnu.dockerfile | 12 ++++++------ .../cross-images/x86_64-unknown-linux-gnu.dockerfile | 4 +--- 2 files changed, 7 insertions(+), 9 deletions(-) diff --git a/build/cross-images/aarch64-unknown-linux-gnu.dockerfile b/build/cross-images/aarch64-unknown-linux-gnu.dockerfile index bf673137259..0da8de13d60 100644 --- a/build/cross-images/aarch64-unknown-linux-gnu.dockerfile +++ b/build/cross-images/aarch64-unknown-linux-gnu.dockerfile @@ -12,8 +12,7 @@ ARG PBC_URL="https://github.com/protocolbuffers/protobuf/releases/download/v21.5 # `rdkafka/gssapi-vendored` feature when there is a release including: # https://github.com/MaterializeInc/rust-sasl/pull/48 -# librdkafka 2.12.1 includes curl/curl.h even when OIDC support is disabled and -# its CMake build requires a target Zlib installation. +# librdkafka 2.12.1 includes curl/curl.h even when OIDC support is disabled. RUN dpkg --add-architecture arm64 && \ apt-get update && \ apt-get install -y --no-install-recommends \ @@ -22,13 +21,14 @@ RUN dpkg --add-architecture arm64 && \ gcc-10-aarch64-linux-gnu \ libcurl4-openssl-dev:arm64 \ libsasl2-dev:arm64 \ - zlib1g-dev:arm64 \ unzip && \ - ln -s /usr/include/zlib.h /usr/aarch64-linux-gnu/include/zlib.h && \ - ln -s /usr/include/zconf.h /usr/aarch64-linux-gnu/include/zconf.h && \ - ln -s /usr/lib/aarch64-linux-gnu/libz.a /usr/aarch64-linux-gnu/lib/libz.a && \ rm -rf /var/lib/apt/lists/* +# cmake-rs passes vendored dependency prefixes in the CMAKE_PREFIX_PATH +# environment variable. Materialize that colon-separated value before the +# cross-rs toolchain constructs its target-only search roots. +RUN sed -i '/set(CMAKE_FIND_ROOT_PATH /i\ string(REPLACE ":" ";" CMAKE_PREFIX_PATH "$ENV{CMAKE_PREFIX_PATH}")' /opt/toolchain.cmake + # GCC 9.4 is affected by https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189. # aws-lc cannot execute its compiler probe while cross-compiling, so select the # verified GCC 10.5 toolchain explicitly for both compilation and linking. diff --git a/build/cross-images/x86_64-unknown-linux-gnu.dockerfile b/build/cross-images/x86_64-unknown-linux-gnu.dockerfile index 143889d0cee..6280c492c2f 100644 --- a/build/cross-images/x86_64-unknown-linux-gnu.dockerfile +++ b/build/cross-images/x86_64-unknown-linux-gnu.dockerfile @@ -7,15 +7,13 @@ FROM ghcr.io/cross-rs/x86_64-unknown-linux-gnu:main@sha256:2431cbfcf2499f8a00570 ARG PBC_URL="https://github.com/protocolbuffers/protobuf/releases/download/v21.5/protoc-21.5-linux-x86_64.zip" -# librdkafka 2.12.1 includes curl/curl.h even when OIDC support is disabled and -# its CMake build requires a Zlib installation. +# librdkafka 2.12.1 includes curl/curl.h even when OIDC support is disabled. RUN apt-get update && \ apt-get install -y --no-install-recommends \ g++-10 \ gcc-10 \ libcurl4-openssl-dev \ libsasl2-dev \ - zlib1g-dev \ unzip && \ rm -rf /var/lib/apt/lists/* From be0ffc3f31b848054cba97597bd99cb8260752fc Mon Sep 17 00:00:00 2001 From: Francois Massot Date: Sun, 19 Jul 2026 19:28:08 +0200 Subject: [PATCH 6/7] fix(ci): link resolver for ARM64 releases --- .github/actions/cross-build-binary/action.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/actions/cross-build-binary/action.yml b/.github/actions/cross-build-binary/action.yml index 0f23b17aa22..8ef1c63daa2 100644 --- a/.github/actions/cross-build-binary/action.yml +++ b/.github/actions/cross-build-binary/action.yml @@ -36,6 +36,12 @@ runs: echo "QW_COMMIT_HASH=$(git rev-parse HEAD)" >> $GITHUB_ENV echo "QW_COMMIT_TAGS=$(git tag --points-at HEAD | tr '\n' ',')" >> $GITHUB_ENV shell: bash + # sasl2-sys omits libresolv when HOST != TARGET, but its vendored Kerberos + # archive still references resolver symbols when cross-compiling for Linux. + - name: Configure ARM64 Linux linker flags + if: inputs.target == 'aarch64-unknown-linux-gnu' + run: echo "RUSTFLAGS=-C link-arg=-lresolv" >> $GITHUB_ENV + shell: bash - name: Build Quickwit run: cross build --release --features release-feature-vendored-set --target ${{ inputs.target }} --bin quickwit shell: bash From d2f17c205bc007410440f704dcadad7fcb723cf7 Mon Sep 17 00:00:00 2001 From: Francois Massot Date: Sun, 19 Jul 2026 19:48:40 +0200 Subject: [PATCH 7/7] fix(ci): preserve ARM64 release Rust flags --- .cargo/config.toml | 12 ++++++++++-- .github/actions/cross-build-binary/action.yml | 6 ------ 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/.cargo/config.toml b/.cargo/config.toml index 57766cbecde..493077312e1 100644 --- a/.cargo/config.toml +++ b/.cargo/config.toml @@ -13,5 +13,13 @@ rustflags = ["-C", "target-cpu=x86-64-v3", "--cfg", "tokio_unstable"] # Targeting neoverse-n1 covers AWS Graviton2+ and GCP T2A (Ampere Altra). # Key gains over generic ARMv8-A: LSE atomics (better concurrency), dot # product instructions, and ARMv8.2 crypto extensions. -rustflags = ["-C", "target-cpu=neoverse-n1", "--cfg", "tokio_unstable"] - +# sasl2-sys omits libresolv when HOST != TARGET, but its vendored Kerberos +# archive still references resolver symbols when cross-compiling for Linux. +rustflags = [ + "-C", + "target-cpu=neoverse-n1", + "-C", + "link-arg=-lresolv", + "--cfg", + "tokio_unstable", +] diff --git a/.github/actions/cross-build-binary/action.yml b/.github/actions/cross-build-binary/action.yml index 8ef1c63daa2..0f23b17aa22 100644 --- a/.github/actions/cross-build-binary/action.yml +++ b/.github/actions/cross-build-binary/action.yml @@ -36,12 +36,6 @@ runs: echo "QW_COMMIT_HASH=$(git rev-parse HEAD)" >> $GITHUB_ENV echo "QW_COMMIT_TAGS=$(git tag --points-at HEAD | tr '\n' ',')" >> $GITHUB_ENV shell: bash - # sasl2-sys omits libresolv when HOST != TARGET, but its vendored Kerberos - # archive still references resolver symbols when cross-compiling for Linux. - - name: Configure ARM64 Linux linker flags - if: inputs.target == 'aarch64-unknown-linux-gnu' - run: echo "RUSTFLAGS=-C link-arg=-lresolv" >> $GITHUB_ENV - shell: bash - name: Build Quickwit run: cross build --release --features release-feature-vendored-set --target ${{ inputs.target }} --bin quickwit shell: bash