feat: stop dynamic linking (#9)

Author: imos

.github/workflows/release.yml

@@ -90,6 +90,15 @@ jobs:
         run: |
           cargo build --release --locked --target ${{ matrix.target }}
 
+      - name: Verify dynamic dependencies (unix)
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          set -euxo pipefail
+          BIN="target/${{ matrix.target }}/release/sshpod"
+          chmod +x ./scripts/check-dynamic-deps.sh
+          ./scripts/check-dynamic-deps.sh "$BIN"
+
       - name: Package (unix)
         if: runner.os != 'Windows'
         id: package_unix

Cargo.toml

@@ -14,4 +14,4 @@ whoami = "1"
 log = "0.4"
 env_logger = "0.11"
 flate2 = "1"
-xz2 = "0.1"
+xz2 = { version = "0.1", features = ["static"] }

scripts/check-dynamic-deps.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+  echo "usage: $0 <binary>" >&2
+  exit 2
+fi
+
+bin="$1"
+
+if [[ ! -f "$bin" ]]; then
+  echo "binary not found: $bin" >&2
+  exit 2
+fi
+
+case "$(uname -s)" in
+  Darwin)
+    unexpected=0
+    while IFS= read -r dep; do
+      [[ -z "$dep" ]] && continue
+      case "$dep" in
+        /System/Library/*|/usr/lib/*)
+          ;;
+        *)
+          echo "unexpected dynamic dependency: $dep" >&2
+          unexpected=1
+          ;;
+      esac
+    done < <(otool -L "$bin" | tail -n +2 | awk '{print $1}')
+    exit "$unexpected"
+    ;;
+  Linux)
+    unexpected=0
+    while IFS= read -r dep; do
+      [[ -z "$dep" ]] && continue
+      case "$dep" in
+        libc.so.*|libgcc_s.so.*|libm.so.*|libpthread.so.*|librt.so.*|libdl.so.*|libutil.so.*|libresolv.so.*|libanl.so.*|libnsl.so.*|ld-linux-*.so.*|ld64.so.*)
+          ;;
+        *)
+          echo "unexpected dynamic dependency: $dep" >&2
+          unexpected=1
+          ;;
+      esac
+    done < <(readelf -d "$bin" | sed -n 's/.*Shared library: \[\(.*\)\]/\1/p')
+    exit "$unexpected"
+    ;;
+  *)
+    echo "unsupported host OS: $(uname -s)" >&2
+    exit 2
+    ;;
+esac