改用 musl 全静态构建，零依赖跨发行版

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-10 12:03:43 +08:00
parent 5430297ff9
commit b44b118be7
8 changed files with 111 additions and 126 deletions
@@ -0,0 +1,66 @@
+# musl fully-static 构建 mond（monerod 换名）：手编 5 个静态库 + patch CMakeLists + static-pie。
+# 为何 musl 而非 glibc：musl 的 getaddrinfo 自包含，全静态可跨发行版运行；glibc 静态会因 NSS
+# 运行时 dlopen 失败（DNS error: resource busy or locked）。详见 CLAUDE.md。
+# 产物为 static-pie（Alpine gcc 默认 PIE），零外部依赖，可在 glibc/musl 任意发行版直接运行。
+
+# ---- Stage 1: 静态依赖库（版本固定 → Docker 层缓存，源码不变不重编）----
+FROM alpine:3.23 AS deps
+RUN apk add --no-cache g++ gcc make cmake git linux-headers autoconf automake libtool \
+    pkgconf perl wget tar xz bzip2 file flex bison boost-static boost-dev rapidjson-dev
+ENV CFLAGS="-fPIC -O2" CXXFLAGS="-fPIC -O2"
+WORKDIR /deps
+
+# OpenSSL 3.0.16（Alpine 仓库只有 .so，须源码编静态）
+RUN wget -q https://github.com/openssl/openssl/releases/download/openssl-3.0.16/openssl-3.0.16.tar.gz && \
+    tar xf openssl-3.0.16.tar.gz && cd openssl-3.0.16 && \
+    if [ "$(uname -m)" = aarch64 ]; then OSSL_T=linux-aarch64; else OSSL_T=linux-x86_64; fi && \
+    ./Configure no-shared no-tests --prefix=/usr --libdir=lib $OSSL_T && \
+    make -j"$(nproc)" && make install_sw && cd / && rm -rf /deps/openssl-3.0.16*
+
+# libsodium 1.0.20
+RUN wget -q https://download.libsodium.org/libsodium/releases/libsodium-1.0.20.tar.gz && \
+    tar xf libsodium-1.0.20.tar.gz && cd libsodium-1.0.20 && \
+    ./configure --enable-static --disable-shared --prefix=/usr && \
+    make -j"$(nproc)" && make install && cd / && rm -rf /deps/libsodium-1.0.20*
+
+# libzmq 4.3.5
+RUN wget -q https://github.com/zeromq/libzmq/releases/download/v4.3.5/zeromq-4.3.5.tar.gz && \
+    tar xf zeromq-4.3.5.tar.gz && cd zeromq-4.3.5 && \
+    ./configure --enable-static --disable-shared --prefix=/usr --without-docs --enable-drafts=no && \
+    make -j"$(nproc)" && make install && cd / && rm -rf /deps/zeromq-4.3.5*
+
+# expat 2.6.4
+RUN wget -q https://github.com/libexpat/libexpat/releases/download/R_2_6_4/expat-2.6.4.tar.bz2 && \
+    tar xf expat-2.6.4.tar.bz2 && cd expat-2.6.4 && \
+    ./configure --enable-static --disable-shared --prefix=/usr && \
+    make -j"$(nproc)" && make install && cd / && rm -rf /deps/expat-2.6.4*
+
+# unbound 1.22.0（DNSSEC；release archive 需 flex/bison 现生成 lexer）
+RUN wget -q https://github.com/NLnetLabs/unbound/archive/refs/tags/release-1.22.0.tar.gz -O unbound.tar.gz && \
+    tar xf unbound.tar.gz && cd unbound-release-1.22.0 && \
+    ./configure --disable-shared --enable-static --prefix=/usr --with-libexpat=/usr --with-ssl=/usr \
+      --with-libevent=no --without-pythonmodule --without-pyunbound --with-libunbound-only --with-pic && \
+    make -j"$(nproc)" && make install && cd / && rm -rf /deps/unbound*
+
+# ---- Stage 2: 换名 + patch + 编译 mond ----
+FROM deps AS build
+ARG MONERO_VERSION
+ARG TARGETARCH
+WORKDIR /src
+RUN git clone --recursive --branch "${MONERO_VERSION}" --depth 1 --shallow-submodules \
+    https://github.com/monero-project/monero.git monero
+WORKDIR /src/monero
+# init.sh：monero→mond 换名 + musl fully-static patch（去 -pie、STATIC_FLAGS 改 -static）
+COPY ./init.sh ./init.sh
+RUN sh ./init.sh
+RUN if [ "$TARGETARCH" = "arm64" ]; then MARCH=armv8-a; MTAG=linux-armv8; \
+    else MARCH=x86-64; MTAG=linux-x64; fi && \
+    cmake -S . -B build/release -DSTATIC=ON -DSTACK_TRACE=OFF -DBUILD_64=ON \
+      -DCMAKE_BUILD_TYPE=Release -DARCH="$MARCH" -DBUILD_TAG="$MTAG" -DUSE_DEVICE_TREZOR=OFF && \
+    make -j"$(nproc)" -C build/release daemon && \
+    mkdir -p /output && cp build/release/bin/mond /output/mond
+
+# ---- Stage 3: 导出（保持 ci.yaml 期望的 linux_<arch>/mond 布局）----
+FROM scratch
+ARG TARGETARCH
+COPY --from=build /output/mond /linux_${TARGETARCH}/mond