Skip to content

deps: build pwru from source with the repo Go builder - #2675

Merged
Quang Nguyen (nddq) merged 1 commit into
mainfrom
nddq/pwru-from-source
Aug 21, 2026
Merged

deps: build pwru from source with the repo Go builder#2675
Quang Nguyen (nddq) merged 1 commit into
mainfrom
nddq/pwru-from-source

Conversation

@nddq

@nddq Quang Nguyen (nddq) commented Aug 21, 2026

Copy link
Copy Markdown
Member

Description

The shell image downloads the pwru release binary. Upstream builds each release with a pinned Go image. v1.0.12 carries Go 1.26.5, which 8 stdlib advisories affect. Upstream publishes binaries only on tags, and main already builds with Go 1.27.0, so the fix waits on their release cadence.

This PR builds pwru from source with this repo's golang base image:

  • Toolchain: the binary's standard library now tracks the golang base image. A dependabot digest bump patches pwru with every other shipped binary.
  • Pin: the PWRU_COMMIT build-arg pins the source to the v1.0.12 commit (f1d6cf88). Same pwru version as today, current toolchain.
  • Build: follows the upstream Makefile — vendored static libpcap (gcc, gawk, flex, bison), bpf2go generation (clang, llvm), and a statically linked CGO binary (glibc-static).
  • GOEXPERIMENT=none: the Microsoft Go toolchain enables its OpenSSL crypto backend by default. The backend dlopens libcrypto at startup, which crashes a statically linked binary with SIGFPE. pwru does not need FIPS crypto, so the build disables the backend.
  • Startup check: both stages run pwru --version. If the binary cannot start, the image build fails.

The build stage runs at the target platform. The arm64 image jobs run on native arm64 runners.

Related Issue

N/A — clears the 8 Trivy stdlib findings on retina-shell, the last third-party item from the code-scanning cleanup.

Checklist

  • I have read the contributing documentation.
  • I signed and signed-off the commits (git commit -S -s ...). See this documentation on signing commits.
  • I have correctly attributed the author(s) of the code.
  • I have tested the changes locally.
  • I have followed the project's style guidelines.
  • I have updated the documentation, if necessary.
  • I have added tests, if applicable.

Screenshots (if applicable) or Testing Completed

Built the shell image locally for linux/amd64. The build log shows pwru v1.0.12 from both startup checks. The binary in the image:

$ docker run --rm --entrypoint /usr/local/bin/pwru <image> --version
pwru v1.0.12
$ go version -m pwru
go1.26.7 (microsoft_toolset_version=go1.26.7-1-microsoft)
mod github.com/cilium/pwru v1.0.12

CI builds both architectures on this PR.

Additional Notes

N/A.

@nddq
deps: build pwru from source with the repo Go builder
f061748 
The shell image downloaded the pwru release binary. Upstream builds
releases with a pinned Go image, and v1.0.12 carries Go 1.26.5, which
8 stdlib advisories affect. Upstream publishes binaries only on tags,
so the fix waits on their release cadence.

Build pwru from a pinned source commit with this repo golang base
image instead. The standard library in the binary now tracks the same
image bumps as every other shipped binary, and the commit pin keeps
the build reproducible. The pinned commit is the v1.0.12 tag.

The build follows the upstream Makefile: vendored static libpcap
(gcc, gawk, flex, bison), bpf2go generation (clang, llvm), and a
statically linked CGO binary (glibc-static). GOEXPERIMENT=none
disables the Microsoft Go OpenSSL crypto backend, which dlopens
libcrypto at startup and crashes inside a statically linked binary.
pwru does not need FIPS crypto.

Both stages run pwru --version, so a binary that cannot start fails
the image build instead of shipping.

Signed-off-by: Quang Nguyen <28567936+nddq@users.noreply.github.com>
@nddq
Quang Nguyen (nddq) requested a review from a team as a code owner August 21, 2026 14:33
@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown

Retina Code Coverage Report

Total coverage no change

Decreased diff

Impacted Files Coverage
pkg/controllers/daemon/namespace/namespace_controller.go 78.46% ... 76.24% (-2.22%) ⬇️

@nddq
Quang Nguyen (nddq) added this pull request to the merge queue Aug 21, 2026
Merged via the queue into main with commit 532c5aa Aug 21, 2026
58 of 59 checks passed
@nddq
Quang Nguyen (nddq) deleted the nddq/pwru-from-source branch August 21, 2026 16:25
@nddq Quang Nguyen (nddq) mentioned this pull request Aug 21, 2026
Merged
7 tasks
pull Bot pushed a commit to TheTechOddBug/retina that referenced this pull request Aug 25, 2026
@nddq
fix(build): register current QEMU and compile pwru with clang (micros…
d2b0d23 
…oft#2676)

# Description

The ADO pipeline builds the arm64 shell image on amd64 agents under
QEMU. The pwru source build (microsoft#2675) runs real compilers inside that
stage, and modern aarch64 binaries crash under the old QEMU: gcc `cc1`
died with an internal compiler error, and gawk segfaulted inside the
libpcap configure. Every merge-queue `CI (Build Images)` run failed at
`Build Retina Shell Images arm64`.

Two changes:

- **Current QEMU**: the `qemu-user-static` make target registered
`multiarch/qemu-user-static`, which ships a QEMU from 2022. It now
registers `tonistiigi/binfmt`, which ships a current QEMU.
`docker/setup-qemu-action` uses the same image, so the GitHub Actions
builds never saw these crashes.
- **clang**: the pwru build compiles with clang. clang builds the same
static binary under QEMU, and one compiler serves both architectures.

The org's hosted ADO pool offers no arm64 images, and the OneBranch
arm64 pool rejects pipelines that do not extend the OneBranch governed
template. Native ADO arm64 therefore needs a OneBranch migration, which
stays out of scope.

## Related Issue

N/A.

## Checklist

- [x] I have read the [contributing
documentation](https://retina.sh/docs/Contributing/overview).
- [x] I signed and signed-off the commits (`git commit -S -s ...`). See
[this
documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification)
on signing commits.
- [x] I have correctly attributed the author(s) of the code.
- [x] I have tested the changes locally.
- [x] I have followed the project's style guidelines.
- [ ] I have updated the documentation, if necessary.
- [ ] I have added tests, if applicable.

## Screenshots (if applicable) or Testing Completed

- Local QEMU emulation with current QEMU (`tonistiigi/binfmt`): the
arm64 stage builds, and the startup check prints `pwru v1.0.12` from the
emulated binary. The extracted binary is a static ELF with `go1.26.7`.
- ADO run 124172 isolated the old QEMU as the cause: with clang alone,
gawk still segfaulted under the old QEMU.
- The ADO PR run on this branch passes `Build Retina Shell Images arm64`
with both changes.

## Additional Notes

N/A.

---------

Signed-off-by: Quang Nguyen <28567936+nddq@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ibezrukavyi ibezrukavyi ibezrukavyi approved these changes
@SRodi Simone Rodigari (SRodi) Awaiting requested review from SRodi SRodi is a code owner automatically assigned from microsoft/retina
@carlotaarvela carlotaarvela Awaiting requested review from carlotaarvela carlotaarvela is a code owner automatically assigned from microsoft/retina

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@nddq @ibezrukavyi