Skip to content

Commit d080568

Browse files
toolchain: sync vendored v0.10.0
Single non-merge commit (archive replace, not subtree pull) so the update stays rebase-mergeable. git-subtree-dir: toolchain git-subtree-split: 6a4c4597d1042c631beb181c76723701a19fde69
1 parent d295635 commit d080568

9 files changed

Lines changed: 100 additions & 26 deletions

File tree

template/build/fetch-toolchain.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ fetch_bin bpftool
8080
fetch_bin veristat
8181
fetch_bin esbuild
8282
fetch_bin git
83+
fetch_bin gh
8384

8485
# libbpf program headers: arch-independent, one copy per version, beside the
8586
# per-arch tool dirs ($key/include/bpf/*.h).

template/build/toolchain.lock

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
# sets it to the next semver tag it computes from the [bump:*] commit markers
88
# (default minor; see the README). A release is cut only when build/ or the
99
# vendor workflow changes.
10-
TOOLCHAIN_VERSION=0.8.0
10+
TOOLCHAIN_VERSION=0.10.0
1111

1212
# Where a consumer fetches assets from: the version-tagged release. The fetch
1313
# appends `/v<TOOLCHAIN_VERSION>/<tool>-<arch>`.
@@ -29,7 +29,7 @@ CLANG_SHA256_aarch64=105fb2d324095127a127bcba56702a86229ed8892ce6429802d30585fa2
2929
BPFTOOL_VERSION=7.7.0
3030
BPFTOOL_SHA256_x86_64=74bd16335aa1c40714fb50287a42766c6faa4958f969cce32fef89485ce4934c
3131
BPFTOOL_SHA256_aarch64=2b3fc4dd5e4e40bd8d670c5f1fa9693b3f879a122c0f6a3eb806dfc6735da6b7
32-
LIBBPF_HEADERS_SHA256=dba9a3583076fce1ab2739b6edba1460f64327accda449202892108e9d1a3c65
32+
LIBBPF_HEADERS_SHA256=d712858662168e4e04cdc35e4a962a6056c429ed57461b974ec59b819c60e3c3
3333

3434
# veristat — BPF verifier statistics tool, used to check that built `*.bpf.o`
3535
# programs load and to track verifier complexity. Official static binary from
@@ -61,6 +61,14 @@ ESBUILD_VERSION=0.28.1
6161
ESBUILD_SHA256_x86_64=0c6588b092a2c291a72bab90659f3c9e0e25e0fe59c9ac12b4dae4d945e5548c
6262
ESBUILD_SHA256_aarch64=51e829ba36f36be6d9aea6e329ddc4f9350302339b16aaca96a3cb97f64a8ebb
6363

64+
# gh — the GitHub CLI, for release/PR automation (CI and consumer tooling).
65+
# Official static (Go) binary from cli/cli, re-hosted on our "toolchain"
66+
# release like esbuild. CI records the per-arch binary checksum (consumers
67+
# verify the binary, not the upstream tarball).
68+
GH_VERSION=2.95.0
69+
GH_SHA256_x86_64=62c11fbaa08835168c3d1acf8a645ac6268a13a5682c73581388c9df0c622617
70+
GH_SHA256_aarch64=706b030846db08d0dac0392d6f74416e0bbf0d9ac5ecbd54c9046305c10eac59
71+
6472
# qemu — NOT part of the build toolchain: a fully-static qemu-system for the
6573
# optional kernel-matrix test runner (boots lvh kernel images). Built per-arch
6674
# from source (see Dockerfile.qemu / build-qemu.sh), trimmed to the binary plus
@@ -81,8 +89,8 @@ LVH_SHA256_x86_64=ca3b958ffc08a4b65e4c6c8d29a4dad077acd11f146bc84f75a30ecaa031e9
8189
LVH_SHA256_aarch64=49b7cef6376c445c0ab23465ecc984a771e06b3b37c39b486a4fed7fb1ded476
8290
# Per-arch checksum of the published qemu-<arch>.tar.gz (binary + minimal
8391
# share/qemu blobs). CI records these; the matrix runner verifies the tarball.
84-
QEMU_SHA256_x86_64=0add524e0dd366ead34332aed0dafb4f11bc75f17884896aedb91faa28176dc2
85-
QEMU_SHA256_aarch64=be362492c2054c734bac78a776f17c0e0511f317d1dd8c924e82e00f8a7b2137
92+
QEMU_SHA256_x86_64=2e26722e965018c145bab180cee8feace50f91841bf51b350f14527c0d5da637
93+
QEMU_SHA256_aarch64=6fe353ef43918c14088c7a3741bfac54e6c17084ea462454a5b2a525ba0aa330
8694

8795
# Alpine base used for the musl-static clang build.
8896
ALPINE_TAG=alpine:3.21

template/build/toolchain.mk

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Resolve the static build toolchain (clang, bpftool, veristat, esbuild, git) — included
1+
# Resolve the static build toolchain (clang, bpftool, veristat, esbuild, git, gh) — included
22
# by the project Makefile before build/bpf.mk, so the tools are set before any
33
# rule uses them. A `make CLANG=…` CLI override beats this.
44
#
@@ -11,7 +11,7 @@
1111
# Falls back to host tools on PATH when no lock is present.
1212
#
1313
# The vendored binaries are Linux musl-static, so the cache is only used on
14-
# Linux. On any other host (macOS, BSD) we leave CLANG/BPFTOOL/ESBUILD/GIT
14+
# Linux. On any other host (macOS, BSD) we leave CLANG/BPFTOOL/ESBUILD/GIT/GH
1515
# unset, falling through to host tools on PATH — macOS is an edit-here,
1616
# build-on-Linux host for BPF work.
1717

@@ -36,6 +36,7 @@ ifneq ($(TOOLCHAIN_LOCK),)
3636
VERISTAT ?= $(TOOLCHAIN_DIR)/veristat
3737
ESBUILD ?= $(TOOLCHAIN_DIR)/esbuild
3838
GIT ?= $(TOOLCHAIN_DIR)/git
39+
GH ?= $(TOOLCHAIN_DIR)/gh
3940
# libbpf program headers are arch-independent: one copy per version key,
4041
# beside the per-arch tool dirs.
4142
BPF_SYSINCLUDE ?= $(YEET_CACHE_DIR)/toolchain/$(TOOLCHAIN_KEY)/include
@@ -45,6 +46,7 @@ endif
4546
VERISTAT ?= veristat
4647
ESBUILD ?= esbuild
4748
GIT ?= git
49+
GH ?= gh
4850

4951
# Fill the cache for this arch, downloading any missing tool once. A no-op
5052
# when no lock is present (PATH case).

toolchain/.github/workflows/vendor.yml

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: vendor-toolchain
33
# Build and publish the static toolchain for x86_64 and aarch64: clang, make
44
# and git are compiled from source on NATIVE runners per arch (no QEMU — the
55
# multi-hour x86_64 LLVM build runs here in normal CI time), while bpftool,
6-
# esbuild and the libbpf headers are re-hosted from upstream. All are published
6+
# esbuild, gh and the libbpf headers are re-hosted from upstream. All are published
77
# as version-addressed assets on the `toolchain` release, with checksums
88
# recorded back into build/versions.env.
99
#
@@ -84,7 +84,8 @@ jobs:
8484
tagpat="^v${mm}(\.[0-9]+)?$" ;;
8585
*) tagpat='^v[0-9]+\.[0-9]+(\.[0-9]+)?$' ;;
8686
esac
87-
prev="$(git tag -l 'v[0-9]*' | grep -E "$tagpat" | sed 's/^v//' | sort -V | tail -1)"
87+
# `|| true` so an empty tag set (no match) doesn't fail under pipefail.
88+
prev="$(git tag -l 'v[0-9]*' | { grep -E "$tagpat" || true; } | sed 's/^v//' | sort -V | tail -1)"
8889
prevtag=""
8990
[ -n "$prev" ] && prevtag="v$prev"
9091
echo "prevtag=$prevtag" >> "$GITHUB_OUTPUT"
@@ -226,7 +227,7 @@ jobs:
226227
strategy:
227228
fail-fast: false
228229
matrix:
229-
tool: [bpftool, veristat, lvh, esbuild]
230+
tool: [bpftool, veristat, lvh, esbuild, gh]
230231
arch:
231232
- { platform: amd64, name: x86_64 }
232233
- { platform: arm64, name: aarch64 }
@@ -268,7 +269,7 @@ jobs:
268269
# <tool>-<arch> holding one file, so install them all the same way.
269270
# qemu is the exception (a bin/+share tree), packed separately below.
270271
for a in x86_64 aarch64; do
271-
for t in clang make git bpftool veristat lvh esbuild; do
272+
for t in clang make git bpftool veristat lvh esbuild gh; do
272273
install -Dm755 "artifacts/${t}-${a}/${t}" "${a}/${t}"
273274
done
274275
done
@@ -327,7 +328,8 @@ jobs:
327328
esac
328329
# Clean tags on this line only; suffixed tags (vX.Y.Z-<flavor>) are
329330
# unordered variants and never advance the line.
330-
latest="$(git tag -l 'v[0-9]*' | grep -E "$tagpat" | sed 's/^v//' | sort -V | tail -1)"
331+
# `|| true` so an empty tag set (no match) doesn't fail under pipefail.
332+
latest="$(git tag -l 'v[0-9]*' | { grep -E "$tagpat" || true; } | sed 's/^v//' | sort -V | tail -1)"
331333
flavor="${FLAVOR:-}"
332334
if [ -n "$flavor" ]; then
333335
# A flavor build is an unordered VARIANT of an existing release: it
@@ -380,7 +382,7 @@ jobs:
380382
# Record the checksum of every binary we publish, so a consumer
381383
# verifies the exact artifact it downloads from our release.
382384
for arch in x86_64 aarch64; do
383-
for tool in clang make bpftool veristat lvh esbuild git; do
385+
for tool in clang make bpftool veristat lvh esbuild git gh; do
384386
s="$(sha256sum "$arch/$tool" | awk '{print $1}')"
385387
key="$(echo "$tool" | tr a-z A-Z)_SHA256_${arch}"
386388
sed -i "s|^${key}=.*|${key}=${s}|" build/versions.env
@@ -429,17 +431,24 @@ jobs:
429431
# Consumers pin this one tag.
430432
mkdir -p dist
431433
for a in x86_64 aarch64; do
432-
for t in clang make bpftool veristat lvh esbuild git; do cp "$a/$t" "dist/${t}-${a}"; done
434+
for t in clang make bpftool veristat lvh esbuild git gh; do cp "$a/$t" "dist/${t}-${a}"; done
433435
done
434436
cp libbpf-headers.tar.gz dist/libbpf-headers.tar.gz
435437
# qemu for the optional kernel-matrix runner (fetched on demand, not by `make`).
436438
for a in x86_64 aarch64; do cp "qemu-$a.tar.gz" "dist/qemu-$a.tar.gz"; done
437-
# Flavored tags (vX.Y.Z-<flavor>) are opt-in variants — mark them
438-
# prerelease so GitHub never surfaces one as "Latest".
439-
prerelease=""; case "$tag" in *-*) prerelease="--prerelease" ;; esac
439+
# Pick the "Latest" flag explicitly (GitHub's default is recency-based,
440+
# so a release/* back-port cut after a newer mainline release would
441+
# otherwise steal the badge):
442+
# * flavor (vX.Y.Z-<flavor>) -> --prerelease (GitHub never marks it Latest)
443+
# * mainline (master) -> --latest (newest mainline IS Latest)
444+
# * release/* back-port -> --latest=false (can't steal it)
445+
case "$tag" in
446+
*-*) flags="--prerelease --latest=false" ;;
447+
*) if [ "${GITHUB_REF_NAME}" = master ]; then flags="--latest"; else flags="--latest=false"; fi ;;
448+
esac
440449
gh release view "$tag" >/dev/null 2>&1 \
441-
|| gh release create "$tag" --title "$tag" $prerelease \
442-
--notes "Static build toolchain $tag — clang/make/git built from source; bpftool/esbuild/libbpf headers re-hosted; qemu for the kernel-matrix runner."
450+
|| gh release create "$tag" --title "$tag" $flags \
451+
--notes "Static build toolchain $tag — clang/make/git built from source; bpftool/veristat/esbuild/gh/libbpf headers re-hosted; qemu for the kernel-matrix runner."
443452
# --clobber so a same-version re-run refreshes assets.
444453
gh release upload "$tag" dist/* --clobber
445454

toolchain/README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ before merge, so a typo can't silently mis-version a release.
4040
| `bpftool` | `vmlinux.h` (BTF dump) + link BPF objects | official static release, re-hosted |
4141
| `veristat`| check `*.bpf.o` load + BPF verifier statistics | official static release, re-hosted |
4242
| `esbuild` | bundle the JS entry | official static (Go) binary, re-hosted |
43+
| `gh` | release/PR automation (CI + consumer tooling) | official static (Go) binary, re-hosted |
4344
| `bpf/*.h` | libbpf program headers (`<bpf/bpf_helpers.h>`, …) | libbpf bundled with bpftool |
4445

4546
The table above is the **build** toolchain — what `make` resolves. The same
@@ -81,7 +82,7 @@ from this repo's release, checksum-verified. Pull updates with
8182
Change a tool pin in [`build/versions.env`](build/versions.env) and push — the
8283
[`vendor-toolchain`](.github/workflows/vendor.yml) workflow rebuilds clang/make/
8384
git (and the test-runner qemu) on native x86_64 and arm64 runners, re-hosts
84-
bpftool/veristat/lvh/esbuild/headers,
85+
bpftool/veristat/lvh/esbuild/gh/headers,
8586
**computes the next semver tag** (highest existing, bumped by the level the
8687
commit messages ask for — minor by default), publishes all assets to
8788
that immutable release, and records the version + checksums into `versions.env`.
@@ -134,5 +135,5 @@ Build a single tool locally:
134135

135136
```sh
136137
build/build-clang.sh arm64 # or amd64; also build-make.sh / build-git.sh / build-qemu.sh
137-
build/fetch-bpftool.sh # prebuilt; also fetch-veristat.sh / fetch-lvh.sh / fetch-esbuild.sh / fetch-libbpf-headers.sh
138+
build/fetch-bpftool.sh # prebuilt; also fetch-veristat.sh / fetch-lvh.sh / fetch-esbuild.sh / fetch-gh.sh / fetch-libbpf-headers.sh
138139
```

toolchain/build/fetch-gh.sh

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/bin/sh
2+
# Producer step: pull the official static gh (GitHub CLI) binary from cli/cli
3+
# into v/<arch>/gh so CI can re-host it on our toolchain release. gh is a single
4+
# fully-static Go binary, so we re-host it like esbuild/veristat rather than
5+
# build it. The consumer-facing integrity check is the published binary's
6+
# checksum (versions.env, verified by build/fetch-toolchain.sh), so this
7+
# upstream fetch — run in CI from the official release over TLS — isn't pinned.
8+
#
9+
# build/fetch-gh.sh [amd64|arm64] (default: both)
10+
11+
set -eu
12+
13+
HERE="$(cd "$(dirname "$0")" && pwd)"
14+
V="$(dirname "$HERE")"
15+
. "$HERE/versions.env"
16+
17+
fetch() {
18+
plat="$1"
19+
case "$plat" in
20+
amd64) arch=x86_64 ;;
21+
arm64) arch=aarch64 ;;
22+
*) echo "error: unknown arch '$plat'" >&2; exit 1 ;;
23+
esac
24+
url="https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${plat}.tar.gz"
25+
tmp="$(mktemp -d)"
26+
echo ">> fetching gh ${GH_VERSION} for ${plat}"
27+
curl -fSL -o "$tmp/gh.tar.gz" "$url"
28+
mkdir -p "$V/$arch"
29+
tar xzf "$tmp/gh.tar.gz" -C "$tmp"
30+
# Tarball extracts to gh_<ver>_linux_<plat>/bin/gh; glob the version dir.
31+
cp "$tmp"/gh_*/bin/gh "$V/$arch/gh"
32+
chmod +x "$V/$arch/gh"
33+
rm -rf "$tmp"
34+
echo ">> done: $V/$arch/gh"
35+
}
36+
37+
if [ "$#" -eq 0 ]; then
38+
fetch amd64
39+
fetch arm64
40+
else
41+
fetch "$1"
42+
fi

toolchain/build/versions.env

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
# sets it to the next semver tag it computes from the [bump:*] commit markers
88
# (default minor; see the README). A release is cut only when build/ or the
99
# vendor workflow changes.
10-
TOOLCHAIN_VERSION=0.8.0
10+
TOOLCHAIN_VERSION=0.10.0
1111

1212
# Where a consumer fetches assets from: the version-tagged release. The fetch
1313
# appends `/v<TOOLCHAIN_VERSION>/<tool>-<arch>`.
@@ -29,7 +29,7 @@ CLANG_SHA256_aarch64=105fb2d324095127a127bcba56702a86229ed8892ce6429802d30585fa2
2929
BPFTOOL_VERSION=7.7.0
3030
BPFTOOL_SHA256_x86_64=74bd16335aa1c40714fb50287a42766c6faa4958f969cce32fef89485ce4934c
3131
BPFTOOL_SHA256_aarch64=2b3fc4dd5e4e40bd8d670c5f1fa9693b3f879a122c0f6a3eb806dfc6735da6b7
32-
LIBBPF_HEADERS_SHA256=dba9a3583076fce1ab2739b6edba1460f64327accda449202892108e9d1a3c65
32+
LIBBPF_HEADERS_SHA256=d712858662168e4e04cdc35e4a962a6056c429ed57461b974ec59b819c60e3c3
3333

3434
# veristat — BPF verifier statistics tool, used to check that built `*.bpf.o`
3535
# programs load and to track verifier complexity. Official static binary from
@@ -61,6 +61,14 @@ ESBUILD_VERSION=0.28.1
6161
ESBUILD_SHA256_x86_64=0c6588b092a2c291a72bab90659f3c9e0e25e0fe59c9ac12b4dae4d945e5548c
6262
ESBUILD_SHA256_aarch64=51e829ba36f36be6d9aea6e329ddc4f9350302339b16aaca96a3cb97f64a8ebb
6363

64+
# gh — the GitHub CLI, for release/PR automation (CI and consumer tooling).
65+
# Official static (Go) binary from cli/cli, re-hosted on our "toolchain"
66+
# release like esbuild. CI records the per-arch binary checksum (consumers
67+
# verify the binary, not the upstream tarball).
68+
GH_VERSION=2.95.0
69+
GH_SHA256_x86_64=62c11fbaa08835168c3d1acf8a645ac6268a13a5682c73581388c9df0c622617
70+
GH_SHA256_aarch64=706b030846db08d0dac0392d6f74416e0bbf0d9ac5ecbd54c9046305c10eac59
71+
6472
# qemu — NOT part of the build toolchain: a fully-static qemu-system for the
6573
# optional kernel-matrix test runner (boots lvh kernel images). Built per-arch
6674
# from source (see Dockerfile.qemu / build-qemu.sh), trimmed to the binary plus
@@ -81,8 +89,8 @@ LVH_SHA256_x86_64=ca3b958ffc08a4b65e4c6c8d29a4dad077acd11f146bc84f75a30ecaa031e9
8189
LVH_SHA256_aarch64=49b7cef6376c445c0ab23465ecc984a771e06b3b37c39b486a4fed7fb1ded476
8290
# Per-arch checksum of the published qemu-<arch>.tar.gz (binary + minimal
8391
# share/qemu blobs). CI records these; the matrix runner verifies the tarball.
84-
QEMU_SHA256_x86_64=0add524e0dd366ead34332aed0dafb4f11bc75f17884896aedb91faa28176dc2
85-
QEMU_SHA256_aarch64=be362492c2054c734bac78a776f17c0e0511f317d1dd8c924e82e00f8a7b2137
92+
QEMU_SHA256_x86_64=2e26722e965018c145bab180cee8feace50f91841bf51b350f14527c0d5da637
93+
QEMU_SHA256_aarch64=6fe353ef43918c14088c7a3741bfac54e6c17084ea462454a5b2a525ba0aa330
8694

8795
# Alpine base used for the musl-static clang build.
8896
ALPINE_TAG=alpine:3.21

toolchain/embed/fetch-toolchain.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ fetch_bin bpftool
8080
fetch_bin veristat
8181
fetch_bin esbuild
8282
fetch_bin git
83+
fetch_bin gh
8384

8485
# libbpf program headers: arch-independent, one copy per version, beside the
8586
# per-arch tool dirs ($key/include/bpf/*.h).

toolchain/embed/toolchain.mk

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Resolve the static build toolchain (clang, bpftool, veristat, esbuild, git) — included
1+
# Resolve the static build toolchain (clang, bpftool, veristat, esbuild, git, gh) — included
22
# by the project Makefile before build/bpf.mk, so the tools are set before any
33
# rule uses them. A `make CLANG=…` CLI override beats this.
44
#
@@ -11,7 +11,7 @@
1111
# Falls back to host tools on PATH when no lock is present.
1212
#
1313
# The vendored binaries are Linux musl-static, so the cache is only used on
14-
# Linux. On any other host (macOS, BSD) we leave CLANG/BPFTOOL/ESBUILD/GIT
14+
# Linux. On any other host (macOS, BSD) we leave CLANG/BPFTOOL/ESBUILD/GIT/GH
1515
# unset, falling through to host tools on PATH — macOS is an edit-here,
1616
# build-on-Linux host for BPF work.
1717

@@ -36,6 +36,7 @@ ifneq ($(TOOLCHAIN_LOCK),)
3636
VERISTAT ?= $(TOOLCHAIN_DIR)/veristat
3737
ESBUILD ?= $(TOOLCHAIN_DIR)/esbuild
3838
GIT ?= $(TOOLCHAIN_DIR)/git
39+
GH ?= $(TOOLCHAIN_DIR)/gh
3940
# libbpf program headers are arch-independent: one copy per version key,
4041
# beside the per-arch tool dirs.
4142
BPF_SYSINCLUDE ?= $(YEET_CACHE_DIR)/toolchain/$(TOOLCHAIN_KEY)/include
@@ -45,6 +46,7 @@ endif
4546
VERISTAT ?= veristat
4647
ESBUILD ?= esbuild
4748
GIT ?= git
49+
GH ?= gh
4850

4951
# Fill the cache for this arch, downloading any missing tool once. A no-op
5052
# when no lock is present (PATH case).

0 commit comments

Comments
 (0)