From 705284d913642bfce2db8d895eb6a3f90d548b09 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rton=20Boros?= <martonboros@gmail.com>
Date: Tue, 8 Sep 2026 22:40:51 +0300
Subject: [PATCH 1/3] ci: fail nix package builds that exceed glibc 2.31 floor

Guards against binaries silently requiring a newer glibc than customer AMIs ship.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/nix-build.yml |  6 ++++++
 scripts/check-glibc-floor.sh    | 18 ++++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100755 scripts/check-glibc-floor.sh

diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index e286015cca..f379d07a59 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -73,6 +73,9 @@ jobs:
         uses: ./.github/actions/nix-build-retry
         with:
           attr: .#${{ matrix.attr }}
+      - name: Check glibc floor
+        if: ${{ matrix.attr != '' }}
+        run: ./scripts/check-glibc-floor.sh "${{ matrix.attr }}"
 
   nix-build-checks-aarch64-linux:
     name: >-
@@ -192,6 +195,9 @@ jobs:
         uses: ./.github/actions/nix-build-retry
         with:
           attr: .#${{ matrix.attr }}
+      - name: Check glibc floor
+        if: ${{ matrix.attr != '' }}
+        run: ./scripts/check-glibc-floor.sh "${{ matrix.attr }}"
 
   nix-build-checks-x86_64-linux:
     name: >-
diff --git a/scripts/check-glibc-floor.sh b/scripts/check-glibc-floor.sh
new file mode 100755
index 0000000000..6d888a9d50
--- /dev/null
+++ b/scripts/check-glibc-floor.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Fails if any file in ./result requires a glibc symbol version above MAX_ALLOWED.
+set -Eeu -o pipefail
+
+MAX_ALLOWED="2.31"
+
+FLOOR=$(find -L result -type f -exec objdump -T {} \; 2>/dev/null \
+  | grep -oE 'GLIBC_[0-9.]+' | sed 's/GLIBC_//' | sort -V | tail -1)
+
+if [ -z "$FLOOR" ]; then
+  exit 0
+fi
+
+echo "glibc floor: $FLOOR (max allowed: $MAX_ALLOWED)"
+if [ "$(printf '%s\n%s' "$MAX_ALLOWED" "$FLOOR" | sort -V | tail -1)" != "$MAX_ALLOWED" ]; then
+  echo "::error::glibc floor $FLOOR exceeds max allowed $MAX_ALLOWED in ${1:-result}"
+  exit 1
+fi

From e77bbbdd8bdb499bde74dda9fcccf659a2ffb21a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rton=20Boros?= <martonboros@gmail.com>
Date: Tue, 8 Sep 2026 23:03:12 +0300
Subject: [PATCH 2/3] ci: report offending file path in glibc floor check

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 scripts/check-glibc-floor.sh | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/scripts/check-glibc-floor.sh b/scripts/check-glibc-floor.sh
index 6d888a9d50..d3230167ca 100755
--- a/scripts/check-glibc-floor.sh
+++ b/scripts/check-glibc-floor.sh
@@ -4,15 +4,17 @@ set -Eeu -o pipefail
 
 MAX_ALLOWED="2.31"
 
-FLOOR=$(find -L result -type f -exec objdump -T {} \; 2>/dev/null \
-  | grep -oE 'GLIBC_[0-9.]+' | sed 's/GLIBC_//' | sort -V | tail -1)
+HIT=$(find -L result -type f -exec sh -c \
+  'objdump -T "$1" 2>/dev/null | grep -oE "GLIBC_[0-9.]+" | sed -E "s#GLIBC_([0-9.]+)#\1 $1#"' _ {} \; \
+  | sort -V | tail -1)
 
-if [ -z "$FLOOR" ]; then
+if [ -z "$HIT" ]; then
   exit 0
 fi
 
+FLOOR=${HIT%% *}
 echo "glibc floor: $FLOOR (max allowed: $MAX_ALLOWED)"
 if [ "$(printf '%s\n%s' "$MAX_ALLOWED" "$FLOOR" | sort -V | tail -1)" != "$MAX_ALLOWED" ]; then
-  echo "::error::glibc floor $FLOOR exceeds max allowed $MAX_ALLOWED in ${1:-result}"
+  echo "::error::glibc floor $HIT exceeds max allowed $MAX_ALLOWED in ${1:-result}"
   exit 1
 fi

From d4127eaca9d93d1742b345fe33373e8c2fb6d24b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rton=20Boros?= <martonboros@gmail.com>
Date: Tue, 8 Sep 2026 23:17:16 +0300
Subject: [PATCH 3/3] style: shfmt check-glibc-floor.sh

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 scripts/check-glibc-floor.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/scripts/check-glibc-floor.sh b/scripts/check-glibc-floor.sh
index d3230167ca..ce2d178736 100755
--- a/scripts/check-glibc-floor.sh
+++ b/scripts/check-glibc-floor.sh
@@ -5,16 +5,16 @@ set -Eeu -o pipefail
 MAX_ALLOWED="2.31"
 
 HIT=$(find -L result -type f -exec sh -c \
-  'objdump -T "$1" 2>/dev/null | grep -oE "GLIBC_[0-9.]+" | sed -E "s#GLIBC_([0-9.]+)#\1 $1#"' _ {} \; \
-  | sort -V | tail -1)
+	'objdump -T "$1" 2>/dev/null | grep -oE "GLIBC_[0-9.]+" | sed -E "s#GLIBC_([0-9.]+)#\1 $1#"' _ {} \; |
+	sort -V | tail -1)
 
 if [ -z "$HIT" ]; then
-  exit 0
+	exit 0
 fi
 
 FLOOR=${HIT%% *}
 echo "glibc floor: $FLOOR (max allowed: $MAX_ALLOWED)"
 if [ "$(printf '%s\n%s' "$MAX_ALLOWED" "$FLOOR" | sort -V | tail -1)" != "$MAX_ALLOWED" ]; then
-  echo "::error::glibc floor $HIT exceeds max allowed $MAX_ALLOWED in ${1:-result}"
-  exit 1
+	echo "::error::glibc floor $HIT exceeds max allowed $MAX_ALLOWED in ${1:-result}"
+	exit 1
 fi