[zackees]

Implements part 1 of #1629: a PR-time guard for the manylinux_2_17 promise.

Why

ci/publish.py assigns the manylinux tag from a filename map, not by measuring
the artifact, and cargo check never links. So a binary can require a newer
glibc than the wheel claims and nothing notices until the release cross-link —
which is exactly how libc::memfd_create (glibc 2.27+) reached a green PR and
only failed in the release lane (#1629).

What

• ci/check_glibc_floor.py — reads a linked ELF with objdump -T, collects
  every GLIBC_x.y requirement and the symbols that demand it, and exits 1 when
  the maximum exceeds --floor (default 2.17). It names the offending symbols
  so the fix is obvious (memfd_create, statx, copy_file_range, ...).
  Exit 2 is reserved for "could not inspect" (missing file, no objdump, no
  GLIBC_ versions at all) so a broken artifact can never read as a pass.
• ci/test_check_glibc_floor.py — 10 tests: numeric (not lexical) version
  ordering, per-version symbol attribution, at-floor passes, above-floor
  reports only the too-new versions, and three end-to-end CLI runs through a
  fake objdump covering exit 0, 1 and 2.
• .github/workflows/check-ubuntu.yml — new glibc-floor job (existing
  workflow file, no new one). It soldr prepares + cross-links release
  fbuild-cli and fbuild-daemon for x86_64-unknown-linux-gnu and
  aarch64-unknown-linux-gnu, then runs the guard over all four artifacts. Own
  cache-key-suffix: glibc-floor so it neither competes with nor poisons the
  test job's build-cache generation.
• agents/docs/cross-compilation.md — points at the gate, and records that
  a host-native debug binary is not a valid input (it links the host glibc).

Validation

• uv run --no-project ruff format --check ci/check_glibc_floor.py ci/test_check_glibc_floor.py → clean

• uv run --no-project ruff check ci/ → All checks passed!

• python -m unittest ci.test_check_glibc_floor → Ran 10 tests ... OK

• python -m unittest ci.test_fractional_workflows ci.test_workflow_concurrency ci.test_no_legacy_cross → Ran 36 tests ... OK

• ci/check_python_complexity.py → passed; ci/find_direct_subprocess.py --fail → 0 unallowlisted; ci/check_usb_vidpid_literals.py → passed; ci/check_test_layout.py → ok

• Guard run against a real ELF (objdump -T, host-native debug fbuild) →
  correctly reports max GLIBC_2.39 TOO NEW, exit 1, naming
  pidfd_getpid/pidfd_spawnp (2.39), statx (2.28), getrandom (2.25), etc.

• Real artifact validation on this branch, cross-linked exactly as the new
  CI job does (soldr prepare + soldr build --release --target <t> -p fbuild-daemon), then measured with the guard:

  target	result	max GLIBC
  aarch64-unknown-linux-gnu	OK, exit 0	GLIBC_2.17
  x86_64-unknown-linux-gnu	OK, exit 0	GLIBC_2.16

  That reproduces glibc 2.17 (manylinux_2_17) floor is only enforced at release link time; add a PR guard and decide on multi-manylinux wheels #1629's measured table (2.17 / 2.16) and proves the guard
  reads a real soldr-sysroot artifact rather than only fixtures.

Not included

• Part 3 (publish manylinux_2_28 alongside 2_17) needs a maintainer
  decision on wheel tagging; left open.
• The paired guards in zccache/kernal-api/running-process are separate repos.

Closes part 1 of #1629.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: FastLED/fbuild
• Branch: agent/glibc-floor-guard
• File: .coderabbit.yaml
• Commit: 01cb22b
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1bd61343-5849-4673-8e32-a9a0c9c030f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}