feat(tmachine): build local RPM artifacts

[elezar]

Summary

Build the CLI and gateway RPMs that tmachine's rpm installer expects from the local checkout, so the Fedora Podman environments can run locally on aarch64 and x86_64 hosts. This is the RPM counterpart of the local DEB build from #4598. It also makes the local musl binaries fully static: on macOS hosts the prover linked libstdc++ dynamically, crashed at startup, and failed the spec's %check.

Related Issue

No issue yet. Opened by a maintainer with write access.

Changes

• Add build-artifacts-rpm. It runs packit build locally with the unchanged openshell.spec in the digest-pinned Fedora 44 image used by build-rpm.yml, for the host's Linux architecture. It packages the binaries staged by build-artifacts-binaries and writes artifacts/packages/rpm/openshell.rpm and artifacts/packages/rpm/openshell-gateway.rpm.
• The build uses a fresh repository holding the checkout's tracked and untracked, non-ignored files, so uncommitted changes are packaged and the checkout is not modified. Named volumes cache cargo and dnf downloads.
• The package version defaults to the development version branch E2E CI computes (release.py get-version --dev). OPENSHELL_RPM_VERSION and OPENSHELL_RPM_RELEASE override it.
• build-artifacts runs the RPM step after the DEB step. It needs a Docker daemon that runs Linux containers for the host architecture, for example Docker Desktop on macOS.
• build-artifacts-binaries sets CXXSTDLIB=static:-bundle=stdc++ for its musl build. z3-sys otherwise emits -Wl,-Bdynamic -lstdc++, and on macOS hosts the musl cross compiler wrapper resolved libstdc++.so. That produced a static openshell-prover with a DT_NEEDED entry for libstdc++.so.6 and no interpreter. The local DEB from feat(tmachine): build local Debian artifacts #4598 ships the same broken prover, but nothing runs it.
  • CXXSTDLIB is read for every target, and Darwin has no libstdc++. So it is set on the musl cargo build rather than in the shared toolchain environment in nix/toolchain/linux.nix. With it set there, the aarch64-apple-darwin prover failed to link with library not found for -lstdc++.
  • The bundled form, static=stdc++, fails because rustc cannot find libstdc++.a on its own search path.
  • The toolchain is unchanged from main; an earlier search-order workaround in this PR was reverted.
• build-artifacts-binaries runs tasks/scripts/verify-static-binary.sh on the musl CLI, sandbox, and prover, as the release does, and fails the build if one is not fully static.
• Document the RPM output and overrides in TESTING.md.

Testing

• nix flake check --no-build --all-systems, nix fmt -- --ci, and the writeShellApplication shellchecks pass.
• Without CXXSTDLIB, verify-static-binary.sh rejects the aarch64 musl prover (DT_NEEDED libstdc++.so.6). With it, nix run .#build-artifacts-binaries passes the check for openshell, openshell-sandbox, and openshell-prover, and the prover runs in a Fedora 44 container.
• On aarch64 macOS (Docker Desktop): nix run .#build-artifacts-rpm produces openshell and openshell-gateway RPMs (0.1.5-0.dev.51.g902ee6571.fc44.aarch64), and the spec's %check passes. Earlier RPMs from this branch installed with dnf in Fedora 44.
• nix run .#tmachine -- test fedora-podman-rootful rpm conformance passed with the earlier, search-order build of these binaries. It was not rerun after the CXXSTDLIB change.
• fedora-podman-rootless rpm conformance not run.
• x86_64 Linux host build not run.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable): not applicable

🤖 Generated with Claude Code

[elezar]

Two suggestions on the libstdc++ fix. The prover is meant to be fully static: the release pipeline runs tasks/scripts/verify-static-binary.sh on the musl prover, and the deb and RPM reuse that artifact. So the fix is right in intent, but it keeps static linking dependent on library search order, which is what broke in the first place.

1. Make the static link explicit. z3-sys 0.13 takes its C++ standard library from CXXSTDLIB (build.rs, link_against_cxx_stdlib) and emits cargo:rustc-link-lib={CXXSTDLIB}. Setting CXXSTDLIB=static=stdc++ for the musl targets in nix/toolchain/linux.nix should replace -Wl,-Bdynamic -lstdc++ with a static link request on every build host, instead of relying on the static-only directory being searched first.

2. Check the musl outputs of build-artifacts-binaries with tasks/scripts/verify-static-binary.sh, as the release does. A local build that produces a non-static prover (or sandbox) then fails immediately. That would have caught this when feat(tmachine): build local Debian artifacts #4598 added the local deb, which ships the same broken prover without running it.

[elezar]

Addressed in 548d181:

1. build-artifacts-binaries now sets CXXSTDLIB=static:-bundle=stdc++ on its musl cargo build, and the search-order change in nix/toolchain/linux.nix is reverted. The toolchain now matches main, so CI and other builds are unchanged. CXXSTDLIB is read for every target, so it can't go into the shared toolchain environment: with it set there, the aarch64-apple-darwin prover failed to link (library not found for -lstdc++). The bundled form, static=stdc++, fails because rustc can't find libstdc++.a on its own search path.
2. build-artifacts-binaries runs tasks/scripts/verify-static-binary.sh on the musl CLI, sandbox and prover, and fails the build if one isn't static. It rejects the old prover (DT_NEEDED libstdc++.so.6) and passes the new one, which runs in a Fedora 44 container. The RPM %check passes again.