From d7a912d65afa9aec496423ce8640a2eb7fe98ebe Mon Sep 17 00:00:00 2001 From: dhryoo Date: Sun, 26 Jul 2026 10:38:58 +0900 Subject: [PATCH] fix: build release binaries with CGO_ENABLED=0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The published linux binaries are dynamically linked against the release runner's glibc, so they fail to start on distros with an older one: $ onecli version onecli: /lib64/libc.so.6: version `GLIBC_2.34' not found (required by onecli) onecli: /lib64/libc.so.6: version `GLIBC_2.32' not found (required by onecli) $ objdump -T onecli | grep -o 'GLIBC_[0-9.]*' | sort -uV | tail -2 GLIBC_2.32 GLIBC_2.34 This affects every still-supported distro on glibc < 2.32 — RHEL/Rocky/ AlmaLinux 8 (2.28), Debian 10 (2.28), Ubuntu 20.04 (2.31). goreleaser cross-compiles darwin and windows, so those artifacts are already built without cgo; only the native linux build picks up the runner's libc. Setting CGO_ENABLED=0 makes that explicit and uniform. The source imports no cgo — no `import "C"`, no `#cgo` directives, no cgo build tags — and every dependency is pure Go (kong, x/term, x/sys, yaml). internal/auth reaches the OS keychain through an interface that callers may leave nil, not through a cgo binding. Verified all six release targets build clean with CGO_ENABLED=0 (linux, darwin, windows x amd64, arm64) and that the resulting linux binary is statically linked and runs on glibc 2.28: $ file onecli ELF 64-bit LSB executable, x86-64, statically linked, stripped $ ./onecli version {"version": "2.2.5", "server_status": "ok"} `goreleaser check` passes. Co-Authored-By: Claude Opus 5 (1M context) --- .goreleaser.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 806cec6..fa561c4 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -11,6 +11,12 @@ before: builds: - main: ./cmd/onecli binary: onecli + env: + # Without this, the native (linux) build links against the release + # runner's glibc and the published binary refuses to start on any + # distro with an older one. The source imports no cgo, so disabling + # it costs nothing and makes every artifact statically linked. + - CGO_ENABLED=0 ldflags: - -s -w - -X main.version={{.Version}}