fix(release): build host Linux binaries with glibc floor

.github/workflows/branch-checks.yml

@@ -10,7 +10,6 @@ env:
   CARGO_TERM_COLOR: always
   CARGO_INCREMENTAL: "0"
   MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  SCCACHE_GHA_ENABLED: "true"
 
 permissions:
   contents: read
@@ -88,6 +87,7 @@ jobs:
         runner: [linux-amd64-cpu8, linux-arm64-cpu8]
     runs-on: ${{ matrix.runner }}
     env:
+      SCCACHE_GHA_ENABLED: "true"
       SCCACHE_GHA_VERSION: branch-checks-rust-${{ matrix.runner }}
     container:
       image: ghcr.io/nvidia/openshell/ci:latest
@@ -97,12 +97,12 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - name: Install tools
-        run: mise install --locked
-
       - name: Configure GHA sccache backend
         uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
 
+      - name: Install tools
+        run: mise install --locked
+
       - name: Cache Rust target and registry
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
         with:

.github/workflows/driver-vm-linux.yml

@@ -81,11 +81,13 @@ jobs:
           - arch: arm64
             runner: linux-arm64-cpu8
             target: aarch64-unknown-linux-gnu
+            zig_target: aarch64-unknown-linux-gnu.2.31
             platform: linux-aarch64
             guest_arch: aarch64
           - arch: amd64
             runner: linux-amd64-cpu8
             target: x86_64-unknown-linux-gnu
+            zig_target: x86_64-unknown-linux-gnu.2.31
             platform: linux-x86_64
             guest_arch: x86_64
     runs-on: ${{ matrix.runner }}
@@ -163,19 +165,25 @@ jobs:
           set -euo pipefail
           sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${{ inputs['cargo-version'] }}"'"/}' Cargo.toml
 
-      - name: Build openshell-driver-vm
+      - name: Build openshell-driver-vm with glibc 2.31 floor
         run: |
           set -euo pipefail
+          mise x -- rustup target add ${{ matrix.target }}
           OPENSHELL_VM_RUNTIME_COMPRESSED_DIR="${PWD}/target/vm-runtime-compressed" \
-            mise x -- cargo build --release -p openshell-driver-vm
+            mise x -- cargo zigbuild --release --target ${{ matrix.zig_target }} -p openshell-driver-vm --bin openshell-driver-vm
+          mkdir -p artifacts/bin
+          install -m 0755 target/${{ matrix.target }}/release/openshell-driver-vm artifacts/bin/openshell-driver-vm
 
       - name: Verify packaged binary
         run: |
           set -euo pipefail
-          OUTPUT="$(target/release/openshell-driver-vm --version)"
+          OUTPUT="$(artifacts/bin/openshell-driver-vm --version)"
           echo "$OUTPUT"
           grep -q '^openshell-driver-vm ' <<<"$OUTPUT"
 
+      - name: Verify glibc symbol floor
+        run: tasks/scripts/verify-glibc-symbols.sh 2.31 artifacts/bin/openshell-driver-vm
+
       - name: sccache stats
         if: always()
         run: mise x -- sccache --show-stats
@@ -185,7 +193,7 @@ jobs:
           set -euo pipefail
           mkdir -p artifacts
           tar -czf "artifacts/openshell-driver-vm-${{ matrix.target }}.tar.gz" \
-            -C target/release openshell-driver-vm
+            -C artifacts/bin openshell-driver-vm
 
       - name: Upload artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

.github/workflows/release-dev.yml

@@ -376,7 +376,7 @@ jobs:
           retention-days: 5
 
   # ---------------------------------------------------------------------------
-  # Build standalone gateway binaries (Linux GNU — native on each arch)
+  # Build standalone gateway binaries (Linux GNU — glibc 2.31 floor)
   # ---------------------------------------------------------------------------
   build-gateway-binary-linux:
     name: Build Gateway Binary (Linux ${{ matrix.arch }})
@@ -387,9 +387,11 @@ jobs:
           - arch: amd64
             runner: linux-amd64-cpu8
             target: x86_64-unknown-linux-gnu
+            zig_target: x86_64-unknown-linux-gnu.2.31
           - arch: arm64
             runner: linux-arm64-cpu8
             target: aarch64-unknown-linux-gnu
+            zig_target: aarch64-unknown-linux-gnu.2.31
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     container:
@@ -427,20 +429,26 @@ jobs:
           set -euo pipefail
           sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${{ needs.compute-versions.outputs.cargo_version }}"'"/}' Cargo.toml
 
-      - name: Build ${{ matrix.target }}
+      - name: Build ${{ matrix.zig_target }}
         env:
           OPENSHELL_IMAGE_TAG: ${{ github.sha }}
         run: |
           set -euo pipefail
-          mise x -- cargo build --release --target ${{ matrix.target }} -p openshell-server
+          mise x -- rustup target add ${{ matrix.target }}
+          mise x -- cargo zigbuild --release --target ${{ matrix.zig_target }} -p openshell-server --bin openshell-gateway
+          mkdir -p artifacts/bin
+          install -m 0755 target/${{ matrix.target }}/release/openshell-gateway artifacts/bin/openshell-gateway
 
       - name: Verify packaged binary
         run: |
           set -euo pipefail
-          OUTPUT="$(target/${{ matrix.target }}/release/openshell-gateway --version)"
+          OUTPUT="$(artifacts/bin/openshell-gateway --version)"
           echo "$OUTPUT"
           grep -q '^openshell-gateway ' <<<"$OUTPUT"
 
+      - name: Verify glibc symbol floor
+        run: tasks/scripts/verify-glibc-symbols.sh 2.31 artifacts/bin/openshell-gateway
+
       - name: sccache stats
         if: always()
         run: mise x -- sccache --show-stats
@@ -450,7 +458,7 @@ jobs:
           set -euo pipefail
           mkdir -p artifacts
           tar -czf artifacts/openshell-gateway-${{ matrix.target }}.tar.gz \
-            -C target/${{ matrix.target }}/release openshell-gateway
+            -C artifacts/bin openshell-gateway
           ls -lh artifacts/
 
       - name: Upload artifact
@@ -641,7 +649,7 @@ jobs:
 
   build-rpm:
     name: Build RPM Packages
-    needs: [compute-versions]
+    needs: [compute-versions, build-cli-linux, build-gateway-binary-linux]
     uses: ./.github/workflows/rpm-package.yml
     with:
       checkout-ref: ${{ github.sha }}
@@ -650,12 +658,46 @@ jobs:
       cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
     secrets: inherit
 
+  smoke-linux-dev-artifacts:
+    name: Smoke Linux Dev Artifacts (${{ matrix.name }})
+    needs: [build-gateway-binary-linux, build-driver-vm-linux, build-deb]
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: ubuntu-22.04-deb-amd64
+            runner: linux-amd64-cpu8
+            image: ubuntu:22.04
+            artifact_arch: amd64
+          - name: ubuntu-22.04-deb-arm64
+            runner: linux-arm64-cpu8
+            image: ubuntu:22.04
+            artifact_arch: arm64
+    runs-on: ${{ matrix.runner }}
+    container:
+      image: ${{ matrix.image }}
+    steps:
+      - name: Download Debian package artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: deb-linux-${{ matrix.artifact_arch }}
+          path: package-input/
+
+      - name: Smoke Debian package on Ubuntu 22.04
+        run: |
+          set -euo pipefail
+          apt-get update
+          apt-get install -y --no-install-recommends ./package-input/*.deb
+          openshell-gateway --version
+          /usr/libexec/openshell/openshell-driver-vm --version
+
   # ---------------------------------------------------------------------------
   # Create / update the dev GitHub Release with CLI, gateway, driver, and wheels
   # ---------------------------------------------------------------------------
   release-dev:
     name: Release Dev
-    needs: [compute-versions, build-cli-linux, build-cli-macos, build-gateway-binary-linux, build-gateway-binary-macos, build-supervisor-binary-linux, build-python-wheels-linux, build-python-wheel-macos, build-driver-vm-linux, build-driver-vm-macos, build-deb, build-rpm]
+    needs: [compute-versions, build-cli-linux, build-cli-macos, build-gateway-binary-linux, build-gateway-binary-macos, build-supervisor-binary-linux, build-python-wheels-linux, build-python-wheel-macos, build-driver-vm-linux, build-driver-vm-macos, build-deb, build-rpm, smoke-linux-dev-artifacts]
     runs-on: linux-amd64-cpu8
     timeout-minutes: 10
     permissions:

.github/workflows/release-tag.yml

@@ -409,7 +409,7 @@ jobs:
           retention-days: 5
 
   # ---------------------------------------------------------------------------
-  # Build standalone gateway binaries (Linux GNU — native on each arch)
+  # Build standalone gateway binaries (Linux GNU — glibc 2.31 floor)
   # ---------------------------------------------------------------------------
   build-gateway-binary-linux:
     name: Build Gateway Binary (Linux ${{ matrix.arch }})
@@ -420,9 +420,11 @@ jobs:
           - arch: amd64
             runner: linux-amd64-cpu8
             target: x86_64-unknown-linux-gnu
+            zig_target: x86_64-unknown-linux-gnu.2.31
           - arch: arm64
             runner: linux-arm64-cpu8
             target: aarch64-unknown-linux-gnu
+            zig_target: aarch64-unknown-linux-gnu.2.31
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     container:
@@ -461,20 +463,26 @@ jobs:
           set -euo pipefail
           sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${{ needs.compute-versions.outputs.cargo_version }}"'"/}' Cargo.toml
 
-      - name: Build ${{ matrix.target }}
+      - name: Build ${{ matrix.zig_target }}
         env:
           OPENSHELL_IMAGE_TAG: ${{ needs.compute-versions.outputs.source_sha }}
         run: |
           set -euo pipefail
-          mise x -- cargo build --release --target ${{ matrix.target }} -p openshell-server
+          mise x -- rustup target add ${{ matrix.target }}
+          mise x -- cargo zigbuild --release --target ${{ matrix.zig_target }} -p openshell-server --bin openshell-gateway
+          mkdir -p artifacts/bin
+          install -m 0755 target/${{ matrix.target }}/release/openshell-gateway artifacts/bin/openshell-gateway
 
       - name: Verify packaged binary
         run: |
           set -euo pipefail
-          OUTPUT="$(target/${{ matrix.target }}/release/openshell-gateway --version)"
+          OUTPUT="$(artifacts/bin/openshell-gateway --version)"
           echo "$OUTPUT"
           grep -q '^openshell-gateway ' <<<"$OUTPUT"
 
+      - name: Verify glibc symbol floor
+        run: tasks/scripts/verify-glibc-symbols.sh 2.31 artifacts/bin/openshell-gateway
+
       - name: sccache stats
         if: always()
         run: mise x -- sccache --show-stats
@@ -484,7 +492,7 @@ jobs:
           set -euo pipefail
           mkdir -p artifacts
           tar -czf artifacts/openshell-gateway-${{ matrix.target }}.tar.gz \
-            -C target/${{ matrix.target }}/release openshell-gateway
+            -C artifacts/bin openshell-gateway
           ls -lh artifacts/
 
       - name: Upload artifact
@@ -677,7 +685,7 @@ jobs:
 
   build-rpm:
     name: Build RPM Packages
-    needs: [compute-versions]
+    needs: [compute-versions, build-cli-linux, build-gateway-binary-linux]
     uses: ./.github/workflows/rpm-package.yml
     with:
       checkout-ref: ${{ inputs.tag || github.ref }}
@@ -686,12 +694,120 @@ jobs:
       cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
     secrets: inherit
 
+  smoke-linux-release-artifacts:
+    name: Smoke Linux Release Artifacts (${{ matrix.name }})
+    needs: [build-gateway-binary-linux, build-driver-vm-linux, build-deb, build-rpm]
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: ubuntu-20.04-binaries
+            runner: linux-amd64-cpu8
+            image: ubuntu:20.04
+            kind: binary
+            artifact_arch: amd64
+            rpm_arch: x86_64
+            target: x86_64-unknown-linux-gnu
+          - name: ubuntu-20.04-binaries-arm64
+            runner: linux-arm64-cpu8
+            image: ubuntu:20.04
+            kind: binary
+            artifact_arch: arm64
+            rpm_arch: aarch64
+            target: aarch64-unknown-linux-gnu
+          - name: ubuntu-22.04-deb
+            runner: linux-amd64-cpu8
+            image: ubuntu:22.04
+            kind: deb
+            artifact_arch: amd64
+            rpm_arch: x86_64
+            target: x86_64-unknown-linux-gnu
+          - name: ubuntu-22.04-deb-arm64
+            runner: linux-arm64-cpu8
+            image: ubuntu:22.04
+            kind: deb
+            artifact_arch: arm64
+            rpm_arch: aarch64
+            target: aarch64-unknown-linux-gnu
+          - name: rhel9-rpm
+            runner: linux-amd64-cpu8
+            image: rockylinux:9
+            kind: rpm
+            artifact_arch: amd64
+            rpm_arch: x86_64
+            target: x86_64-unknown-linux-gnu
+          - name: rhel9-rpm-aarch64
+            runner: linux-arm64-cpu8
+            image: rockylinux:9
+            kind: rpm
+            artifact_arch: arm64
+            rpm_arch: aarch64
+            target: aarch64-unknown-linux-gnu
+    runs-on: ${{ matrix.runner }}
+    container:
+      image: ${{ matrix.image }}
+    steps:
+      - name: Download gateway binary artifact
+        if: matrix.kind == 'binary'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: gateway-binary-linux-${{ matrix.artifact_arch }}
+          path: smoke-input/
+
+      - name: Download VM driver binary artifact
+        if: matrix.kind == 'binary'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: driver-vm-linux-${{ matrix.artifact_arch }}
+          path: smoke-input/
+
+      - name: Smoke binary artifacts
+        if: matrix.kind == 'binary'
+        run: |
+          set -euo pipefail
+          mkdir -p smoke-bin
+          tar -xzf smoke-input/openshell-gateway-${{ matrix.target }}.tar.gz -C smoke-bin
+          tar -xzf smoke-input/openshell-driver-vm-${{ matrix.target }}.tar.gz -C smoke-bin
+          smoke-bin/openshell-gateway --version
+          smoke-bin/openshell-driver-vm --version
+
+      - name: Download Debian package artifact
+        if: matrix.kind == 'deb'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: deb-linux-${{ matrix.artifact_arch }}
+          path: package-input/
+
+      - name: Smoke Debian package
+        if: matrix.kind == 'deb'
+        run: |
+          set -euo pipefail
+          apt-get update
+          apt-get install -y --no-install-recommends ./package-input/*.deb
+          openshell-gateway --version
+          /usr/libexec/openshell/openshell-driver-vm --version
+
+      - name: Download RPM package artifacts
+        if: matrix.kind == 'rpm'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rpm-linux-${{ matrix.rpm_arch }}
+          path: package-input/
+
+      - name: Smoke RPM packages
+        if: matrix.kind == 'rpm'
+        run: |
+          set -euo pipefail
+          dnf install -y ./package-input/*.rpm
+          openshell-gateway --version
+
   # ---------------------------------------------------------------------------
   # Create a tagged GitHub Release with CLI, gateway, driver, and wheels
   # ---------------------------------------------------------------------------
   release:
     name: Release
-    needs: [compute-versions, build-cli-linux, build-cli-macos, build-gateway-binary-linux, build-gateway-binary-macos, build-supervisor-binary-linux, build-python-wheels-linux, build-python-wheel-macos, tag-ghcr-release, build-driver-vm-linux, build-driver-vm-macos, build-deb, build-rpm]
+    needs: [compute-versions, build-cli-linux, build-cli-macos, build-gateway-binary-linux, build-gateway-binary-macos, build-supervisor-binary-linux, build-python-wheels-linux, build-python-wheel-macos, tag-ghcr-release, build-driver-vm-linux, build-driver-vm-macos, build-deb, build-rpm, smoke-linux-release-artifacts]
     runs-on: linux-amd64-cpu8
     timeout-minutes: 10
     permissions: