改用 musl 全静态构建，零依赖跨发行版

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-10 12:03:43 +08:00
parent 5430297ff9
commit b44b118be7
8 changed files with 111 additions and 126 deletions
@@ -0,0 +1,66 @@
+# musl fully-static 构建 mond（monerod 换名）：手编 5 个静态库 + patch CMakeLists + static-pie。
+# 为何 musl 而非 glibc：musl 的 getaddrinfo 自包含，全静态可跨发行版运行；glibc 静态会因 NSS
+# 运行时 dlopen 失败（DNS error: resource busy or locked）。详见 CLAUDE.md。
+# 产物为 static-pie（Alpine gcc 默认 PIE），零外部依赖，可在 glibc/musl 任意发行版直接运行。
+
+# ---- Stage 1: 静态依赖库（版本固定 → Docker 层缓存，源码不变不重编）----
+FROM alpine:3.23 AS deps
+RUN apk add --no-cache g++ gcc make cmake git linux-headers autoconf automake libtool \
+    pkgconf perl wget tar xz bzip2 file flex bison boost-static boost-dev rapidjson-dev
+ENV CFLAGS="-fPIC -O2" CXXFLAGS="-fPIC -O2"
+WORKDIR /deps
+
+# OpenSSL 3.0.16（Alpine 仓库只有 .so，须源码编静态）
+RUN wget -q https://github.com/openssl/openssl/releases/download/openssl-3.0.16/openssl-3.0.16.tar.gz && \
+    tar xf openssl-3.0.16.tar.gz && cd openssl-3.0.16 && \
+    if [ "$(uname -m)" = aarch64 ]; then OSSL_T=linux-aarch64; else OSSL_T=linux-x86_64; fi && \
+    ./Configure no-shared no-tests --prefix=/usr --libdir=lib $OSSL_T && \
+    make -j"$(nproc)" && make install_sw && cd / && rm -rf /deps/openssl-3.0.16*
+
+# libsodium 1.0.20
+RUN wget -q https://download.libsodium.org/libsodium/releases/libsodium-1.0.20.tar.gz && \
+    tar xf libsodium-1.0.20.tar.gz && cd libsodium-1.0.20 && \
+    ./configure --enable-static --disable-shared --prefix=/usr && \
+    make -j"$(nproc)" && make install && cd / && rm -rf /deps/libsodium-1.0.20*
+
+# libzmq 4.3.5
+RUN wget -q https://github.com/zeromq/libzmq/releases/download/v4.3.5/zeromq-4.3.5.tar.gz && \
+    tar xf zeromq-4.3.5.tar.gz && cd zeromq-4.3.5 && \
+    ./configure --enable-static --disable-shared --prefix=/usr --without-docs --enable-drafts=no && \
+    make -j"$(nproc)" && make install && cd / && rm -rf /deps/zeromq-4.3.5*
+
+# expat 2.6.4
+RUN wget -q https://github.com/libexpat/libexpat/releases/download/R_2_6_4/expat-2.6.4.tar.bz2 && \
+    tar xf expat-2.6.4.tar.bz2 && cd expat-2.6.4 && \
+    ./configure --enable-static --disable-shared --prefix=/usr && \
+    make -j"$(nproc)" && make install && cd / && rm -rf /deps/expat-2.6.4*
+
+# unbound 1.22.0（DNSSEC；release archive 需 flex/bison 现生成 lexer）
+RUN wget -q https://github.com/NLnetLabs/unbound/archive/refs/tags/release-1.22.0.tar.gz -O unbound.tar.gz && \
+    tar xf unbound.tar.gz && cd unbound-release-1.22.0 && \
+    ./configure --disable-shared --enable-static --prefix=/usr --with-libexpat=/usr --with-ssl=/usr \
+      --with-libevent=no --without-pythonmodule --without-pyunbound --with-libunbound-only --with-pic && \
+    make -j"$(nproc)" && make install && cd / && rm -rf /deps/unbound*
+
+# ---- Stage 2: 换名 + patch + 编译 mond ----
+FROM deps AS build
+ARG MONERO_VERSION
+ARG TARGETARCH
+WORKDIR /src
+RUN git clone --recursive --branch "${MONERO_VERSION}" --depth 1 --shallow-submodules \
+    https://github.com/monero-project/monero.git monero
+WORKDIR /src/monero
+# init.sh：monero→mond 换名 + musl fully-static patch（去 -pie、STATIC_FLAGS 改 -static）
+COPY ./init.sh ./init.sh
+RUN sh ./init.sh
+RUN if [ "$TARGETARCH" = "arm64" ]; then MARCH=armv8-a; MTAG=linux-armv8; \
+    else MARCH=x86-64; MTAG=linux-x64; fi && \
+    cmake -S . -B build/release -DSTATIC=ON -DSTACK_TRACE=OFF -DBUILD_64=ON \
+      -DCMAKE_BUILD_TYPE=Release -DARCH="$MARCH" -DBUILD_TAG="$MTAG" -DUSE_DEVICE_TREZOR=OFF && \
+    make -j"$(nproc)" -C build/release daemon && \
+    mkdir -p /output && cp build/release/bin/mond /output/mond
+
+# ---- Stage 3: 导出（保持 ci.yaml 期望的 linux_<arch>/mond 布局）----
+FROM scratch
+ARG TARGETARCH
+COPY --from=build /output/mond /linux_${TARGETARCH}/mond
@@ -1,70 +0,0 @@
-FROM ubuntu:20.04 AS base
-
-ARG TARGETARCH
-ARG BUILDPLATFORM
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-# 仅安装 Monero depends 系统所需的最小工具链：
-# depends 会自行交叉编译 boost/openssl/zmq/unbound/sodium 等全部第三方库到 contrib/depends/<target>/，
-# 故无需任何系统 -dev 库（装了反而可能被动态链接、破坏纯静态）。
-RUN apt-get update && apt-get install -y \
-    git \
-    wget \
-    curl \
-    ca-certificates \
-    build-essential \
-    cmake \
-    pkg-config \
-    autoconf \
-    automake \
-    libtool \
-    gperf \
-    python3 \
-    bzip2 \
-    xz-utils \
-    patch \
-    && rm -rf /var/lib/apt/lists/*
-
-FROM base AS build
-
-ARG MONERO_VERSION
-ARG TARGETARCH
-ARG BUILDPLATFORM
-ARG TARGETPLATFORM
-
-# 克隆 Monero 项目
-RUN git clone --recursive https://github.com/monero-project/monero.git && \
-    cd monero && \
-    git checkout ${MONERO_VERSION} && \
-    git submodule update --init --force
-
-WORKDIR /monero
-
-# 复制并运行 init.sh 脚本进行修改
-COPY ./init.sh ./init.sh
-
-RUN chmod +x ./init.sh && ./init.sh
-
-# 使用官方 depends 系统构建静态依赖（参考 .source/Dockerfile）
-RUN if [ "$BUILDPLATFORM" != "$TARGETPLATFORM" ]; then \
-        MAKE_JOBS=2; \
-    else \
-        MAKE_JOBS=$(nproc); \
-    fi && \
-    if [ "$TARGETARCH" = "arm64" ]; then \
-        DEPENDS_TARGET="aarch64-linux-gnu"; \
-    else \
-        DEPENDS_TARGET="x86_64-linux-gnu"; \
-    fi && \
-    echo "Building dependencies for $DEPENDS_TARGET with $MAKE_JOBS parallel jobs" && \
-    make -j$MAKE_JOBS depends target=$DEPENDS_TARGET && \
-    mkdir -p /output && \
-    cp build/$DEPENDS_TARGET/release/bin/mond /output/mond
-
-# 最终阶段 - 只复制静态链接的二进制文件
-FROM scratch
-
-ARG TARGETARCH
-
-COPY --from=build /output/mond /linux_${TARGETARCH}/mond