Build linux executables that link to glibc 2.17 (#1352)

Fixes an unintentional breakage in 0.30.1 that bumped the required glibc to 2.34.

.github/index.pkl

@@ -196,3 +196,27 @@ release {
       }
     } |> toWorkflowJobs
 }
+
+output {
+  files {
+    [[true]] {
+      renderer {
+        converters {
+          ["jobs"] = (it: Mapping<String, Workflow.Job>) ->
+            it
+              .toMap()
+              .mapValues((name, job) ->
+                if (name.contains("linux") && !name.contains("alpine"))
+                  job
+                    .toMap()
+                    .put("container", new Dynamic {
+                      image = "redhat/ubi8:8.10"
+                    })
+                else
+                  job
+              )
+        }
+      }
+    }
+  }
+}

.github/jobs/BuildNativeJob.pkl

@@ -19,6 +19,15 @@ extraGradleArgs {
   }
 }
 
+preSteps {
+  when (os == "linux" && !musl) {
+    new {
+      name = "Install deps"
+      run = "dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en"
+    }
+  }
+}
+
 steps {
   when (musl) {
     new {
@@ -26,6 +35,14 @@ steps {
       run = read("../scripts/install_musl.sh").text
     }
   }
+  // workaround for https://github.com/actions/checkout/issues/1048
+  when (os == "linux" && !musl) {
+    new {
+      name = "Fix git ownership"
+      // language=bash
+      run = "git status || git config --system --add safe.directory $GITHUB_WORKSPACE"
+    }
+  }
   new {
     name = "gradle buildNative"
     shell = "bash"

.github/jobs/GradleJob.pkl

@@ -23,6 +23,8 @@ extraGradleArgs: Listing<String>
 
 steps: Listing<*Workflow.Step | Workflow.TypedStep>
 
+preSteps: Listing<*Workflow.Step | Workflow.TypedStep>
+
 /// The fetch depth to use when doing a git checkout.
 fetchDepth: Int?
 
@@ -69,6 +71,7 @@ fixed job {
         }
       }
   steps {
+    ...preSteps
     // full checkout (needed for spotless)
     new Common.Checkout {
       when (fetchDepth != null) {

.github/workflows/build.yml

@@ -198,6 +198,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -205,6 +207,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -226,6 +230,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-macOS-aarch64-snapshot:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -267,6 +273,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -274,6 +282,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -295,6 +305,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
@@ -476,6 +488,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -483,6 +497,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -504,6 +520,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-macOS-aarch64-snapshot:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -545,6 +563,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -552,6 +572,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -573,6 +595,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:

.github/workflows/main.yml

@@ -197,6 +197,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -204,6 +206,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -225,6 +229,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-macOS-aarch64-snapshot:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -266,6 +272,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -273,6 +281,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -294,6 +304,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
@@ -475,6 +487,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -482,6 +496,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -503,6 +519,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-macOS-aarch64-snapshot:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -544,6 +562,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -551,6 +571,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -572,6 +594,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:

.github/workflows/prb.yml

@@ -117,6 +117,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -124,6 +126,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -146,6 +150,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-macOS-aarch64-snapshot:
     if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-aarch64]')) && github.repository_owner == 'apple'
     runs-on:
@@ -189,6 +195,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -196,6 +204,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -218,6 +228,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-alpine-linux-amd64-snapshot:
     if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-alpine-linux-amd64]')
     runs-on: ubuntu-latest
@@ -405,6 +417,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -412,6 +426,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -434,6 +450,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-macOS-aarch64-snapshot:
     if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-aarch64]')) && github.repository_owner == 'apple'
     runs-on:
@@ -477,6 +495,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -484,6 +504,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -506,6 +528,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-alpine-linux-amd64-snapshot:
     if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-alpine-linux-amd64]')
     runs-on: ubuntu-latest

.github/workflows/release-branch.yml

@@ -197,6 +197,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -204,6 +206,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -225,6 +229,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-macOS-aarch64-snapshot:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -266,6 +272,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -273,6 +281,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -294,6 +304,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
@@ -475,6 +487,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -482,6 +496,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -503,6 +519,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-macOS-aarch64-snapshot:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -544,6 +562,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -551,6 +571,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -572,6 +594,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:

.github/workflows/release.yml

@@ -197,6 +197,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -204,6 +206,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
@@ -225,6 +229,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-amd64-release
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-macOS-aarch64-release:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -266,6 +272,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -273,6 +281,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
@@ -294,6 +304,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-aarch64-release
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-alpine-linux-amd64-release:
     runs-on: ubuntu-latest
     env:
@@ -475,6 +487,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -482,6 +496,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
@@ -503,6 +519,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-amd64-release
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-macOS-aarch64-release:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -544,6 +562,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -551,6 +571,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
@@ -572,6 +594,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-aarch64-release
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-alpine-linux-amd64-release:
     runs-on: ubuntu-latest
     env:

buildSrc/src/main/kotlin/pklNativeExecutable.gradle.kts

@@ -13,6 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import java.lang.Runtime.Version
 import kotlin.io.path.createDirectories
 import kotlin.io.path.writeText
 import org.gradle.accessors.dm.LibrariesForLibs
@@ -135,7 +136,6 @@ val windowsExecutableAmd64 by
     mainClass = executableSpec.mainClass
     amd64()
     setClasspath()
-    extraNativeImageArgs.add("-Dfile.encoding=UTF-8")
   }
 
 val assembleNative by tasks.existing
@@ -167,13 +167,46 @@ val testStartNativeExecutable by
     }
   }
 
+val requiredGlibcVersion: Version = Version.parse("2.17")
+
+val checkGlibc by
+  tasks.registering {
+    enabled = buildInfo.os.isLinux && !buildInfo.musl
+    dependsOn(assembleNative)
+    doLast {
+      val exec =
+        providers.exec {
+          commandLine("objdump", "-T", assembleNative.get().outputs.files.singleFile)
+        }
+      val output = exec.standardOutput.asText.get()
+      val minimumGlibcVersion =
+        output
+          .split("\n")
+          .mapNotNull { line ->
+            val match = Regex("GLIBC_([.0-9]*)").find(line)
+            match?.groups[1]?.let { Version.parse(it.value) }
+          }
+          .maxOrNull()
+      if (minimumGlibcVersion == null) {
+        throw GradleException(
+          "Could not determine glibc version from executable. objdump output: $output"
+        )
+      }
+      if (minimumGlibcVersion > requiredGlibcVersion) {
+        throw GradleException(
+          "Incorrect glibc version. Found: $minimumGlibcVersion, required: $requiredGlibcVersion"
+        )
+      }
+    }
+  }
+
 // Expose underlying task's outputs
 private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
   dependsOn(other)
   outputs.files(other)
 }
 
-val testNative by tasks.existing { dependsOn(testStartNativeExecutable) }
+val testNative by tasks.existing { dependsOn(testStartNativeExecutable, checkGlibc) }
 
 val assembleNativeMacOsAarch64 by tasks.existing { wraps(macExecutableAarch64) }