Re: Statically linked build of 0install

On Sun, 28 Oct 2018 at 13:28, Bastian Eicher <[email protected]> wrote:
>
> Hi all,
>
> I've recently been experimenting with running 0install in Docker containers
> based on various Linux distributions. Since I wanted to use the latest
> version I downloaded the pre-built binaries listed here:
> http://0install.net/tools/0install.xml
>
> On Debian Stable and Ubuntu 18.04 I simply had to run "apt-get install
> libcurl3", download and extract the 0install archive and was good to go.
> However, on Debian Testing and Ubuntu 18.10 libcurl3 has been replaced with
> libcurl4. After installing this 0install fails to launch with:
> "/lib/x86_64-linux-gnu/libcurl.so.4: version `CURL_OPENSSL_3' not found"
> Installing a libcurl3 package intended for an older distro also isn't a good
> option, since libcurl3 and libcurl4 both attempt to install the same file
> and therefore cannot co-exist on the same system. Forcibly downgrading
> libcurl also breaks the curl command on the system.
> Running the binaries on Alpine is of course even trickier, since that distro
> does not use glibc.
>
> This got me thinking: Would it be practical to create completely statically
> linked builds of 0install? A quick Google search turned up a blog article
> titled "Creating Static Linux Binaries in OCaml"
> (http://rgrinberg.com/posts/static-binaries-tutorial/). Since I have no
> experience with OCaml yet, I'm not sure if this is applicable to 0install.
> @Thomas: Could you perhaps take a quick look?

Static linking libcurl itself probably isn't difficult (or we could
replace it with cohttp if we dropped FTP support; I guess no-one is
using FTP now anyway).

But curl depends on openssl, which I think has even more API problems.
And I guess that depends on the files in ca-certificates, which I seem
to recall each distribution puts in a slightly different location. So
it's quite likely that a static binary using openssl wouldn't work
properly on other distributions.

Technically, assuming the C stuff is set up, building a static binary
should just be a case of passing -static as a linker option, e.g. edit
ocaml/Makefile to use

OCAMLBUILD=ocamlbuild -lflag -ccopt -lflag -static ...

However, it appears that Alpine doesn't provide a static version of
libssl, so the link fails when using the Alpine Docker image, as
suggested in the blog post.

If we had a reliable way to find the distribution's CA certificates,
we could even replace openssl with ocaml-tls and avoid all these C
problems entirely.

Another option is to drop support for older Linux versions and just
build against libcurl4 now.


-- 
talex5 (GitHub/Twitter)        http://roscidus.com/blog/
GPG: 5DD5 8D70 899C 454A 966D  6A51 7513 3C8F 94F6 E0CC