Repository navigation
Description
This was generated by AI during triage.
What happens
On an ARM Linux host, the shell installer stops before installing anything:
$ curl -LsSf https://github.com/JacobStephens2/thirdshift/releases/latest/download/thirdshift-installer.sh | sh
ERROR: there isn't a download for your platform aarch64-unknown-linux-gnu
Seen on 2026-10-30 with v0.18.7, in an Ubuntu 24.04 aarch64 VM on Apple Silicon (Lima, vz). That kind of VM is the natural way to get Linux user namespaces, bwrap and systemd scopes on a Mac, for the full Security review sandbox. The only way in is a source build (cargo install --path .) or cargo install thirdshift. Neither writes an install receipt, so thirdshift update refuses ("this thirdshift has no install receipt"). Each update then means a toolchain, a checkout and a rebuild.
Why
dist-workspace.toml builds only x86_64-unknown-linux-musl and aarch64-apple-darwin. ADR 0003 (docs/adr/0003-static-binaries-through-github-releases.md) records it as a consequence: "ARM Linux, Intel macOS and native Windows have no binary."
Proposal
Add aarch64-unknown-linux-musl to targets, built on GitHub's ubuntu-24.04-arm runner. It's statically linked like the x86_64 build, so one binary covers any glibc. HTTPS is already rustls (ADR 0003), so there's no OpenSSL to cross-link.
Changes:
dist-workspace.toml:- add the target;
- add its runner under
[dist.github-custom-runners].
.github/workflows/release.yml: regenerate withpython3 scripts/generate-release.py, never by hand (ADR 0003).- A release smoke check: run the ARM binary's
thirdshift versionon the ARM runner before the Release is published, as the Rocky and WSL checks do for x86_64. - ADR 0003: amend its build list and the "no binary" consequence.
- Docs that list platforms:
- the README's "Supported" line;
docs/guide.md"Supported platforms";site/index.html"Requirements and platforms" (hand-written, and kept in agreement with the README);- then regenerate
site/docs/withnpm run docs --prefix site.
Decision needed
What "supported" means for ARM Linux. Today a supported platform also has CI coverage: ci.yml runs the test suite on ubuntu-24.04 and macos-26. The options:
- (a) Build and smoke only. List it as, for example, "Ubuntu 24.04 and later, aarch64 (smoke-tested)". This is cheap: one build job and one smoke job per release.
- (b) Also run the test suite on
ubuntu-24.04-armin CI, on main pushes or nightly, like the macOS split in Run the full macOS suite on main and nightly, with a one-job macOS gate on PRs into main #893. It costs more CI time, but the support claim matches the x86_64 one.
On 2026-10-29 a source build in that VM passed the sandbox, security_sandbox and scope tests. That's evidence for the platform, but not ongoing coverage.
Recommendation
enhancement, needs-triage until the decision above is made. After that it's agent-sized.
Activity
JacobStephens2 commentedon Oct 30, 2026
Agent Brief
Category: enhancement
Summary: Publish a statically linked ARM Linux binary with every release, and run the full test suite on ARM Linux on
mainpushes and nightly.Decision (maintainer, 2026-10-30): option (b). ARM Linux is supported with CI test coverage, not just a smoke test. Rocky and WSL2 keep their smoke checks with no test suite: a Rocky container can't reproduce a Rocky host's kernel, SELinux or systemd, and the maintainer runs thirdshift daily on a real Rocky 9.8 host. The docs say which platforms get which.
The time cost was checked against today's successful
mainruns. A full CI run takes 18–21 minutes, set by the macOS shards (13–18 minutes each); the x86_64testjob takes 15–21 minutes.ubuntu-24.04-armhas the same 4 vCPUs, so an ARM suite run in parallel should add little or no time. GitHub's standard runners, ARM included, are free for this public repository.For comparison, Rocky Linux and WSL2 get smoke checks only (a static-link check plus
thirdshift version). x86_64 Ubuntu and macOS get the test suite.Current behavior:
x86_64-unknown-linux-muslandaarch64-apple-darwin.thirdshift updaterefuses there.Desired behavior:
Release.
aarch64-unknown-linux-muslbinary. It's statically linked like the x86_64 one, built on GitHub'subuntu-24.04-armrunner, and covered by the same shell installer, sothirdshift updateworks on ARM Linux.ubuntu-24.04-armchecks the ARM binary is statically linked and thatthirdshift versionprints the release's version. It follows the existing release smoke pattern: always on tag pushes, and on pull requests only when the existing gate would run.CI.
ubuntu-24.04-armonmainpushes and the nightly schedule.Docs. The platform lists name ARM Linux:
Wording. Every platform list states what each platform is checked with, so "supported" doesn't imply equal coverage:
rockylinux:9container on an Ubuntu runner, so it doesn't exercise a Rocky host's kernel, SELinux or systemd.Make no claim that Rocky or WSL run on ARM.
Key interfaces:
dist-workspace.toml[dist]targets, and[dist.github-custom-runners], which maps each target to a pinned runner image.workflow_callwith aplaninput) currently hard-codes the x86_64 archive and artifact names. ARM needs its own job or a parameterized one, read from the dist plan.thirdshift updaterelies on the installer's receipt matching the running executable. No change is expected there, but verify it on ARM.Acceptance criteria:
aarch64-unknown-linux-musl, its build job succeeds onubuntu-24.04-arm, and the ARM smoke job passes (filereports a static binary, andthirdshift versionprints the expected version).mainpush and the nightly schedule run the full ARM Linux suite and it passes. An ordinary pull request doesn't run it, and its CI time is unchanged.~/.local/binand writes a receipt.thirdshift updatethere then reports it's up to date instead of "no install receipt". If no release exists yet, check the installer's platform table in the generated script.scripts/affected-tests mainpasses.Out of scope: