Skip to content

Release an ARM Linux build so the installer and thirdshift update work on aarch64 Linux #1663

Closed

Description

@JacobStephens2

This was generated by AI during triage.

What happens

On an ARM Linux host, the shell installer stops before installing anything:

$ curl -LsSf https://github.com/JacobStephens2/thirdshift/releases/latest/download/thirdshift-installer.sh | sh
ERROR: there isn't a download for your platform aarch64-unknown-linux-gnu

Seen on 2026-10-30 with v0.18.7, in an Ubuntu 24.04 aarch64 VM on Apple Silicon (Lima, vz). That kind of VM is the natural way to get Linux user namespaces, bwrap and systemd scopes on a Mac, for the full Security review sandbox. The only way in is a source build (cargo install --path .) or cargo install thirdshift. Neither writes an install receipt, so thirdshift update refuses ("this thirdshift has no install receipt"). Each update then means a toolchain, a checkout and a rebuild.

Why

dist-workspace.toml builds only x86_64-unknown-linux-musl and aarch64-apple-darwin. ADR 0003 (docs/adr/0003-static-binaries-through-github-releases.md) records it as a consequence: "ARM Linux, Intel macOS and native Windows have no binary."

Proposal

Add aarch64-unknown-linux-musl to targets, built on GitHub's ubuntu-24.04-arm runner. It's statically linked like the x86_64 build, so one binary covers any glibc. HTTPS is already rustls (ADR 0003), so there's no OpenSSL to cross-link.

Changes:

  • dist-workspace.toml:
    • add the target;
    • add its runner under [dist.github-custom-runners].
  • .github/workflows/release.yml: regenerate with python3 scripts/generate-release.py, never by hand (ADR 0003).
  • A release smoke check: run the ARM binary's thirdshift version on the ARM runner before the Release is published, as the Rocky and WSL checks do for x86_64.
  • ADR 0003: amend its build list and the "no binary" consequence.
  • Docs that list platforms:
    • the README's "Supported" line;
    • docs/guide.md "Supported platforms";
    • site/index.html "Requirements and platforms" (hand-written, and kept in agreement with the README);
    • then regenerate site/docs/ with npm run docs --prefix site.

Decision needed

What "supported" means for ARM Linux. Today a supported platform also has CI coverage: ci.yml runs the test suite on ubuntu-24.04 and macos-26. The options:

On 2026-10-29 a source build in that VM passed the sandbox, security_sandbox and scope tests. That's evidence for the platform, but not ongoing coverage.

Recommendation

enhancement, needs-triage until the decision above is made. After that it's agent-sized.

Activity

  1. JacobStephens2 commented on Oct 30, 2026

    @JacobStephens2
    OwnerAuthor

    This was generated by AI during triage.

    Agent Brief

    Category: enhancement
    Summary: Publish a statically linked ARM Linux binary with every release, and run the full test suite on ARM Linux on main pushes and nightly.

    Decision (maintainer, 2026-10-30): option (b). ARM Linux is supported with CI test coverage, not just a smoke test. Rocky and WSL2 keep their smoke checks with no test suite: a Rocky container can't reproduce a Rocky host's kernel, SELinux or systemd, and the maintainer runs thirdshift daily on a real Rocky 9.8 host. The docs say which platforms get which.

    The time cost was checked against today's successful main runs. A full CI run takes 18–21 minutes, set by the macOS shards (13–18 minutes each); the x86_64 test job takes 15–21 minutes. ubuntu-24.04-arm has the same 4 vCPUs, so an ARM suite run in parallel should add little or no time. GitHub's standard runners, ARM included, are free for this public repository.

    For comparison, Rocky Linux and WSL2 get smoke checks only (a static-link check plus thirdshift version). x86_64 Ubuntu and macOS get the test suite.

    Current behavior:

    • Releases build only x86_64-unknown-linux-musl and aarch64-apple-darwin.
    • On aarch64 Linux the shell installer stops with "there isn't a download for your platform aarch64-unknown-linux-gnu".
    • A source or crates.io install has no install receipt, so thirdshift update refuses there.
    • ADR 0003 records "ARM Linux … have no binary".

    Desired behavior:

    • Release.

      • Each release also publishes an aarch64-unknown-linux-musl binary. It's statically linked like the x86_64 one, built on GitHub's ubuntu-24.04-arm runner, and covered by the same shell installer, so thirdshift update works on ARM Linux.
      • Before the GitHub Release is published, a smoke job on ubuntu-24.04-arm checks the ARM binary is statically linked and that thirdshift version prints the release's version. It follows the existing release smoke pattern: always on tag pushes, and on pull requests only when the existing gate would run.
      • If that check fails, nothing is published, as with the Rocky and WSL checks.
    • CI.

      • The full test suite, with the same clippy and nextest invocation as x86_64 Linux, runs on ubuntu-24.04-arm on main pushes and the nightly schedule.
      • It doesn't run on ordinary pull requests, like the full macOS suite. Mirror that split, including a way to run it on a PR on demand if the macOS label mechanism generalizes cheaply.
      • It reports under one stable check name.
      • Shard it if one ARM job would take noticeably longer than the existing longest job.
    • Docs. The platform lists name ARM Linux:

      • ADR 0003's build list and its "no binary" consequence (amend the ADR; don't add a new one);
      • the README's "Supported:" line;
      • the user manual's Supported platforms section, then regenerate the generated manual;
      • the hand-written site home page's "Requirements and platforms" list, which says it agrees with the README.
    • Wording. Every platform list states what each platform is checked with, so "supported" doesn't imply equal coverage:

      • test suite in CI: Ubuntu 24.04 x86_64, macOS on Apple Silicon, and Ubuntu 24.04 aarch64;
      • release smoke check only: Rocky Linux 9 and WSL2, each confirmed to start the static x86_64 binary and print its version. Rocky's check runs in a rockylinux:9 container on an Ubuntu runner, so it doesn't exercise a Rocky host's kernel, SELinux or systemd.

      Make no claim that Rocky or WSL run on ARM.

    Key interfaces:

    • dist-workspace.toml [dist] targets, and [dist.github-custom-runners], which maps each target to a pinned runner image.
    • The release workflow is generated. Change the dist config or the generator, then regenerate it with the repository's generator script. Never hand-edit the generated workflow. The repository's CI check for the generator must still pass.
    • The release smoke workflow (workflow_call with a plan input) currently hard-codes the x86_64 archive and artifact names. ARM needs its own job or a parameterized one, read from the dist plan.
    • thirdshift update relies on the installer's receipt matching the running executable. No change is expected there, but verify it on ARM.

    Acceptance criteria:

    • On a dry release or pull request run that the smoke gate covers, the plan lists aarch64-unknown-linux-musl, its build job succeeds on ubuntu-24.04-arm, and the ARM smoke job passes (file reports a static binary, and thirdshift version prints the expected version).
    • A failing ARM smoke check blocks the GitHub Release, verified by reading the generated workflow's job dependencies.
    • A main push and the nightly schedule run the full ARM Linux suite and it passes. An ordinary pull request doesn't run it, and its CI time is unchanged.
    • The installer, run on aarch64 Linux against a release that includes the target, installs to ~/.local/bin and writes a receipt. thirdshift update there then reports it's up to date instead of "no install receipt". If no release exists yet, check the installer's platform table in the generated script.
    • ADR 0003, the README, the user manual (with the generated manual regenerated, and its check passing) and the site home page all list the ARM Linux build, and each platform's coverage (test suite or smoke check only), consistently.
    • scripts/affected-tests main passes.

    Out of scope:

  2. added
    ready-for-agentFully specified, ready for an AFK agent
    in-progressA Claim: thirdshift has taken this issue
    and removed
    needs-triageMaintainer needs to evaluate this issue
    ready-for-agentFully specified, ready for an AFK agent
    on Oct 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions