Check on GLIBC requirements

.github/workflows/commit.yaml

@@ -23,7 +23,7 @@ jobs:
   check:
     name: check
     timeout-minutes: 90 # instead of 360 by default.
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-18.04
     steps:
       - name: Cancel when duplicated
         uses: styfle/[email protected]
@@ -57,7 +57,7 @@ jobs:
       matrix:
         os:
           - "macos-11"
-          - "ubuntu-20.04"
+          - "ubuntu-18.04"
         mode:
           - "default"
           # On CI, by default, we use libc++.
@@ -119,3 +119,10 @@ jobs:
         if: runner.os == 'Linux' && matrix.mode == 'clang'
         run: |
           make requirestatic
+
+      # Upload the binary as an artifact.
+      - uses: actions/upload-artifact@v3
+        if: runner.os == 'Linux' && matrix.mode == 'clang'
+        with:
+          name: auth_server
+          path: bazel-bin/src/main/auth_server.stripped

.github/workflows/release.yaml

@@ -19,7 +19,7 @@ jobs:
       matrix:
         os:
           - "macos-11"
-          - "ubuntu-20.04"
+          - "ubuntu-18.04"
         mode:
           - "default"
           # By default we use libc++.
@@ -102,7 +102,7 @@ jobs:
 
   release:
     name: release
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-18.04
     needs: dist
     timeout-minutes: 90 # instead of 360 by default.
     steps:

Makefile

@@ -202,7 +202,7 @@ endef
 
 # Install clang from https://github.com/llvm/llvm-project. We don't support win32 yet as this script
 # will fail.
-clang-os                          = $(if $(findstring $(goos),darwin),apple-darwin,linux-gnu-ubuntu-20.04)
+clang-os                          = $(if $(findstring $(goos),darwin),apple-darwin,linux-gnu-ubuntu-16.04)
 clang-download-archive-url-prefix = https://$(subst llvmorg/clang+llvm@,releases/download/llvmorg-,$($(notdir $1)@v))
 $(clang):
 	@mkdir -p $(dir $@)

Tools.mk

@@ -1,5 +1,5 @@
 bazelisk@v     := github.com/bazelbuild/[email protected]
-buildifier@v   := github.com/bazelbuild/buildtools/buildifier@4.2.5
+buildifier@v   := github.com/bazelbuild/buildtools/buildifier@5.0.1
 clang@v        := github.com/llvm/llvm-project/llvmorg/[email protected]
 clang-format@v := github.com/angular/[email protected]
 envsubst@v     := github.com/a8m/envsubst/cmd/[email protected]

go.mod

@@ -0,0 +1,5 @@
+module github.com/istio-ecosystem/authservice
+
+go 1.17
+
+require github.com/hashicorp/go-version v1.4.0

go.sum

@@ -0,0 +1,2 @@
+github.com/hashicorp/go-version v1.4.0 h1:aAQzgqIrRKRa7w75CKpbBxYsmUoPjzVm1W59ca1L0J4=
+github.com/hashicorp/go-version v1.4.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=

test/exe/require_glibc.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"log"
+	"os"
+	"os/exec"
+	"strings"
+
+	version "github.com/hashicorp/go-version"
+)
+
+func main() {
+	required, _ := version.NewVersion("2.27")
+	args := os.Args[1:]
+	cmd := exec.Command("objdump", "-T", args[0])
+	var out bytes.Buffer
+	cmd.Stdout = &out
+	err := cmd.Run()
+	if err != nil {
+		log.Fatal("failed to check GLIBC version:", err)
+	}
+	scanner := bufio.NewScanner(strings.NewReader(out.String()))
+	for scanner.Scan() {
+		entry := scanner.Text()
+		if strings.Contains(entry, "GLIBC_") {
+			line := bufio.NewScanner(strings.NewReader(entry[strings.Index(entry, "GLIBC_")+len("GLIBC_"):]))
+			line.Split(bufio.ScanWords)
+			for line.Scan() {
+				v, _ := version.NewVersion(line.Text())
+				if required.LessThan(v) {
+					log.Fatal("linked to a newer GLIBC: ", line.Text())
+				}
+				break
+			}
+		}
+	}
+}

test/exe/require_static.sh

@@ -25,3 +25,5 @@ elif [[ "${DYNLIBS}" =~ libstdc\+\+ || "${DYNLIBS}" =~ libgcc ]]; then
   echo "${DYNLIBS}"
   exit 1
 fi
+
+go run test/exe/require_glibc.go $1