fix: CentOS 7 recipes (x64-glibc-217 & x64-pointer-compression & x86)

bin/_config.sh

@@ -1,6 +1,7 @@
 # All of our build recipes, order matters: recipes run sequentially, so put the
 # most popular/important ones first. Recipes with a should-build.sh that gates
 # them out for a given version are skipped instantly.
+# centos7-toolchain must be listed first as other recipes FROM it.
 recipes=(
   # Active recipes, ordered by likely popularity
   "headers"
@@ -9,12 +10,13 @@ recipes=(
   "riscv64"
   "loong64"
   "riscv64-pointer-compression"
+  "centos7-toolchain" # Shared recipe should be built first
+  "x86"
+  "x64-glibc-217"
+  "x64-pointer-compression"
 
   # Legacy recipes, currently gated out for modern Node.js versions
-  "x86"                     # major < 22
   "armv6l"                  # major < 24
-  "x64-glibc-217"           # major < 24
-  "x64-pointer-compression" # major < 23
   "x64-debug"               # major < 24
   "x64-usdt"                # major <= 18
 )

bin/local_build.sh

@@ -97,6 +97,13 @@ fi
 
 echo "Building ${recipe} recipe and tagging as ${image_tag_pfx}${recipe}..."
 docker build "${__dirname}/../fetch-source/" -t "${image_tag_pfx}fetch-source" --build-arg UID=${USER_ID} --build-arg GID=${GROUP_ID}
+
+# If the recipe depends on the centos7-toolchain base image, build it first
+if grep -q "FROM.*centos7-toolchain" "${recipes_dir}/${recipe}/Dockerfile" 2>/dev/null; then
+  echo "Building centos7-toolchain base image first..."
+  docker build "${recipes_dir}/centos7-toolchain/" -t "${image_tag_pfx}centos7-toolchain" --build-arg UID=${USER_ID} --build-arg GID=${GROUP_ID}
+fi
+
 docker build "${recipes_dir}/${recipe}/" -t "${image_tag_pfx}${recipe}" --build-arg UID=${USER_ID} --build-arg GID=${GROUP_ID}
 
 ## -- DOWNLOAD SOURCE -- ##

fetch-source/run.sh

@@ -32,7 +32,7 @@ cd /home/node
 curl_with_retry "$source_url"
 
 if [[ "$disttype" = "release" ]]; then
-  curl_with_retry https://github.com/nodejs/release-keys/raw/HEAD/gpg-only-active-keys/pubring.kbx
+  curl_with_retry https://github.com/nodejs/release-keys/raw/HEAD/gpg/pubring.kbx
   curl_with_retry "${source_urlbase}/SHASUMS256.txt.asc"
 
   gpgv --keyring="$(pwd)/pubring.kbx" --output - < SHASUMS256.txt.asc \

recipes/centos7-toolchain/Dockerfile

@@ -0,0 +1,21 @@
+FROM --platform=linux/amd64 centos:7
+
+ARG GID=1000
+ARG UID=1000
+
+RUN groupadd --gid $GID node \
+    && adduser --gid $GID --uid $UID node
+
+COPY --chmod=755  files/installPrerequisites  /root/installPrerequisites
+COPY              files/*.repo                /etc/yum.repos.d/
+RUN /root/installPrerequisites
+
+COPY  --chmod=755  files/installFromSourceCode  /root/installFromSourceCode
+COPY  --chmod=755  files/opt__gcc15__enable     /opt/gcc15/enable
+COPY  --chmod=755  files/checksums.sh           /root/checksums.sh
+
+RUN   --mount=type=cache,target=/root/.ccache  --mount=type=tmpfs,target=/usr/src  . /root/checksums.sh  &&  /root/installFromSourceCode  https://www.python.org/ftp/python/3.9.23/Python-3.9.23.tar.xz      "$sha256_python39"  '--prefix=/usr/local/'
+RUN   --mount=type=cache,target=/root/.ccache  --mount=type=tmpfs,target=/usr/src  . /root/checksums.sh  &&  /root/installFromSourceCode  https://www.python.org/ftp/python/3.13.5/Python-3.13.5.tar.xz      "$sha256_python313" '--prefix=/usr/local/'
+RUN   --mount=type=cache,target=/root/.ccache  --mount=type=tmpfs,target=/usr/src  . /root/checksums.sh  &&  /root/installFromSourceCode  https://gcc.gnu.org/pub/gcc/releases/gcc-15.1.0/gcc-15.1.0.tar.xz  "$sha256_gcc15"     '--prefix=/opt/gcc15/  --with-default-libstdcxx-abi=gcc4-compatible  --enable-languages=c,c++  --enable-checking=release  --enable-gnu-indirect-function  --with-linker-hash-style=gnu  --disable-bootstrap  --disable-multilib  --build=x86_64-redhat-linux'
+
+COPY --chmod=755  --chown=node:node  run.sh  /home/node/

recipes/centos7-toolchain/files/checksums.sh

@@ -0,0 +1,4 @@
+# SHA256 checksums for source tarballs
+sha256_python39='61a42919e13d539f7673cf11d1c404380e28e540510860b9d242196e165709c9'
+sha256_python313='93e583f243454e6e9e4588ca2c2662206ad961659863277afcdb96801647d640'
+sha256_gcc15='e2b09ec21660f01fecffb715e0120265216943f038d0e48a9868713e54f06cea'

recipes/centos7-toolchain/files/etc__yum.repos.d__devtoolset.repo

@@ -0,0 +1,4 @@
+[devtoolset-12]
+name=Devtoolset 12
+baseurl=https://buildlogs.centos.org/c7-devtoolset-12.x86_64/
+gpgcheck=0

recipes/centos7-toolchain/files/installFromSourceCode

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+set -e
+set -x
+
+# Args: url expectedSha256 configureArgsStr
+
+url="$1"
+expectedSha256="$2"
+configureArgsStr="$3"
+
+base=$(basename "$url")
+name=${base%.*}
+name=${name%.tar}
+ext=${base:${#name}}
+
+case "$ext" in
+  .tar.xz|.txz)   formatOpt=--xz;;
+  .tar.gz|.tgz)   formatOpt=--gzip;;
+  .tar.bz2|.tbz2) formatOpt=--bzip2;;
+  *)              formatOpt=--auto-compress
+esac
+
+# Download and verify checksum
+tmpFile="/usr/src/${base}"
+curl -fL -o "$tmpFile" "$url"
+
+if [ -n "$expectedSha256" ]; then
+  actualSha256=$(sha256sum "$tmpFile" | awk '{print $1}')
+  if [ "$actualSha256" != "$expectedSha256" ]; then
+    echo "SHA256 mismatch for $base!" >&2
+    echo "  expected: $expectedSha256" >&2
+    echo "  actual:   $actualSha256" >&2
+    exit 1
+  fi
+  echo "SHA256 verified: $base"
+fi
+
+tar --extract --file="$tmpFile" --directory=/usr/src "$formatOpt"
+rm -f "$tmpFile"
+
+source /opt/gcc15/enable
+export CC='ccache gcc'
+export CXX='ccache g++'
+
+cd "/usr/src/$name"
+chmod +x ./contrib/download_prerequisites 2>/dev/null && ./contrib/download_prerequisites
+./configure $configureArgsStr
+make -j $(nproc)
+make install
+
+hash -r
+ccache -s > "/root/ccacheStat_$name.txt"

recipes/centos7-toolchain/files/installPrerequisites

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+set -e
+set -x
+
+sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-*
+sed -i 's|#baseurl=http://mirror.centos.org|baseurl=https://vault.centos.org|g' /etc/yum.repos.d/CentOS-*
+yum install -y epel-release  # Adds extra repos
+yum upgrade -y
+
+yum install -y bzip2         # Required to compile gcc
+yum install -y gcc-c++       # Required to compile Node.js v7-
+yum install -y make          # Allows compilation
+yum install -y ccache        # Allows caching
+yum install -y devtoolset-12 # Includes gcc 12.1.1

recipes/centos7-toolchain/files/opt__gcc15__enable

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -e
+set -x
+
+DIR=/opt/gcc15
+
+source /opt/rh/devtoolset-12/enable
+
+export            PATH="$DIR/bin${PATH:+:${PATH}}"
+export         MANPATH="$DIR/share/man${MANPATH:+:${MANPATH}}"
+export        INFOPATH="$DIR/share/info${INFOPATH:+:${INFOPATH}}"
+export LD_LIBRARY_PATH="$DIR/lib64:$DIR/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
+export PKG_CONFIG_PATH="$DIR/lib64/pkgconfig${PKG_CONFIG_PATH:+:${PKG_CONFIG_PATH}}"
+
+if [ -f "$DIR/bin/gcc" ]; then
+	export LDFLAGS='-static-libstdc++'
+fi

recipes/x64-glibc-217/run.sh → recipes/centos7-toolchain/run.sh

@@ -13,12 +13,13 @@ source_url="$7"
 source_urlbase="$8"
 config_flags=""
 
-cd /home/node
+homeDir=/home/node
+nodeDir="$homeDir/node-$fullversion"
 
-tar -xf node.tar.xz
+tar --directory="$homeDir" -xf "$homeDir/node.tar.xz"
 
 # configuring cares correctly to not use sys/random.h on this target
-cd "node-${fullversion}"/deps/cares
+cd "$nodeDir/deps/cares"
 sed -i 's/define HAVE_SYS_RANDOM_H 1/undef HAVE_SYS_RANDOM_H/g' ./config/linux/ares_config.h
 sed -i 's/define HAVE_GETRANDOM 1/undef HAVE_GETRANDOM/g' ./config/linux/ares_config.h
 
@@ -27,27 +28,38 @@ if [[ "$(grep -o 'ARES_VERSION_STR "[^"]*"' ./include/ares_version.h | awk '{pri
   sed -i 's/MSG_FASTOPEN/TCP_FASTOPEN_CONNECT/g' ./src/lib/ares__socket.c
 fi
 
-cd /home/node
+# Linux implementation of experimental WASM memory control requires Linux 3.17 & glibc 2.27 so disable it
+cd "$nodeDir/deps/v8/src"
+[ -f d8/d8.cc ] && sed -i -e 's/#if V8_TARGET_OS_LINUX/#if false/g' wasm/wasm-objects.cc d8/d8.cc
 
-cd "node-${fullversion}"
+cd "$nodeDir"
 
 export CCACHE_BASEDIR="$PWD"
 export CC="ccache gcc"
 export CXX="ccache g++"
 export MAJOR_VERSION=$(echo ${fullversion} | cut -d . -f 1 | tr --delete v)
 
-. /opt/rh/devtoolset-12/enable
-. /opt/rh/rh-python38/enable
+isNodeVersionGE() {
+	printf "$1\n$fullversion" | sort -VC
+}
+
+source "$homeDir/run_other.sh"
+source "$homeDir/run_versions.sh"
+cd "$nodeDir"
+
+setPython
+setGCC
 
 make -j$(getconf _NPROCESSORS_ONLN) binary V= \
-  DESTCPU="x64" \
-  ARCH="x64" \
-  VARIATION="glibc-217" \
+  DESTCPU="$destCPU" \
+  ARCH="$arch" \
+  VARIATION="$variation" \
   DISTTYPE="$disttype" \
   CUSTOMTAG="$customtag" \
   DATESTRING="$datestring" \
   COMMIT="$commit" \
   RELEASE_URLBASE="$release_urlbase" \
   CONFIG_FLAGS="$config_flags"
 
+"$nodeDir/node" -p process.versions  # Make sure there is no "Segmentation fault" error  (example: node v21.0~v21.2 x64-pointer-compression)
 mv node-*.tar.?z /out/

recipes/centos7-toolchain/should-build.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+# This is a base image used by other recipes, not a build recipe itself.
+# Always skip during the build phase.
+exit 1

recipes/headers/run.sh

@@ -19,7 +19,7 @@ curl -fsSLO --compressed "${source_urlbase}/node-${fullversion}-headers.tar.xz"
 
 if [[ "$disttype" = "release" ]]; then
   pubring=$(mktemp)
-  curl -sSLo "$pubring" https://github.com/nodejs/release-keys/raw/HEAD/gpg-only-active-keys/pubring.kbx
+  curl -sSLo "$pubring" https://github.com/nodejs/release-keys/raw/HEAD/gpg/pubring.kbx
 
   curl -sSL "${source_urlbase}/SHASUMS256.txt.asc" \
   | gpgv --keyring="${pubring}" --output - \

recipes/x64-glibc-217/Dockerfile

@@ -1,39 +1,6 @@
-FROM centos:7
+FROM --platform=linux/amd64 unofficial-build-recipe-centos7-toolchain
 
-ARG GID=1000
-ARG UID=1000
-
-RUN groupadd --gid $GID node \
-    && adduser --gid $GID --uid $UID node
-
-RUN cat <<EOF | tee -a /etc/yum.repos.d/devtoolset-12.repo
-[devtoolset-12]
-name=Devtoolset 12
-baseurl=https://buildlogs.centos.org/c7-devtoolset-12.x86_64/
-enabled=1
-gpgcheck=0
-EOF
-
-RUN ulimit -n 1024 \
-    && sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-* \
-    && sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-* \
-    && yum install -y epel-release \
-    && yum install -y centos-release-scl-rh \
-    && sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-SCLo-scl-rh.repo \
-    && sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-SCLo-scl-rh.repo \
-    && yum upgrade -y \
-    && yum install -y \
-         git \
-         curl \
-         make \
-         python2 \
-         rh-python38 \
-         ccache \
-         xz-utils \
-         devtoolset-12 \
-         glibc-devel
-
-COPY --chown=node:node run.sh /home/node/run.sh
+COPY --chmod=755  --chown=node:node  run_other.sh  run_versions.sh  /home/node/
 
 VOLUME /home/node/.ccache
 VOLUME /out

recipes/x64-glibc-217/run_other.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -e
+set -x
+
+config_flags=
+destCPU=x64
+arch=x64
+variation=glibc-217
+
+# export CFLAGS='-march=skylake'
+# export CXXFLAGS='-march=skylake'

recipes/x64-glibc-217/run_versions.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -e
+set -x
+
+setPython() {
+	if isNodeVersionGE 'v22.3';  then export PYTHON='python3.13';  return;  fi  # Python 3.13: Node.js v22.3  ~ latest (v24.3)
+	if isNodeVersionGE 'v14.14'; then export PYTHON='python3.9';   return;  fi  # Python 3.9:  Node.js v14.14 ~ latest (v24.3)
+	if isNodeVersionGE 'v4.0';   then export PYTHON='python2.7';   return;  fi  # Python 2.7:  Node.js v4.0   ~ v15.14 (latest)
+
+	# Node.js v16.0 is first version not supporting Python 2.7 but supports Python 3.6 ~ 3.9 so Python 3.9 is chosen
+}
+
+setGCC() {
+	if isNodeVersionGE 'v22.3';  then source /opt/gcc15/enable;            return;  fi  # GCC 15.1:  Node.js v22.3 ~ latest (v24.3)
+	if isNodeVersionGE 'v8.0';   then source /opt/rh/devtoolset-12/enable; return;  fi  # GCC 12.1:  Node.js v8.0  ~ v22.1
+	                                                                                    # GCC 4.8.5: Node.js v4.0  ~ v10.14
+}

recipes/x64-glibc-217/should-build.sh

@@ -1,10 +1,20 @@
-#!/bin/bash -xe
+#!/usr/bin/env bash
+
+set -e
+set -x
 
 __dirname=$1
 fullversion=$2
 
-. ${__dirname}/_decode_version.sh
+isNodeVersionGE() {
+	printf "$1\n$fullversion" | sort -VC
+}
+
+isNodeVersionLT() {
+	! printf "$1\n$fullversion" | sort -VC
+}
 
-decode "$fullversion"
+isNodeVersionGE 'v6.2'                                # Node.js v6.1- cannot download required files due to broken links
 
-test "$major" -ge "18" && test "$major" -lt "24"
+isNodeVersionLT 'v17.0'  || isNodeVersionGE 'v18.0'   # Node.js v17   requires GCC version between 4.8.5 and 12.1 which is not installed
+isNodeVersionLT 'v22.2'  || isNodeVersionGE 'v22.3'   # Node.js v22.2 requires GCC version between 12.1  and 15.1 which is not installed

recipes/x64-pointer-compression/Dockerfile

@@ -1,51 +1,6 @@
-FROM centos:7
+FROM --platform=linux/amd64 unofficial-build-recipe-centos7-toolchain
 
-ARG GID=1000
-ARG UID=1000
-
-RUN groupadd --gid $GID node \
-    && adduser --gid $GID --uid $UID node
-
-COPY cloudlinux.repo /etc/yum.repos.d/cloudlinux.repo
-
-# patch repos and install base dependencies
-RUN sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-* \
-    && sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-* \
-    && yum install -y epel-release \
-    && yum upgrade -y \
-    && yum install -y \
-         git \
-         curl \
-         make \
-         python2 \
-         ccache \
-         xz-utils \
-         devtoolset-8 \
-         devtoolset-9 \
-         glibc-devel
-
-# installs c compiler dev tools and builds python >=3.8 from source as it is needed for node >=v22
-ENV PYTHON_VERSION="3.10.15"
-RUN yum groupinstall -y "Development Tools" \
-    && yum install -y \
-        gcc \
-        gcc-c++ \
-        make \
-        zlib-devel \
-        bzip2-devel \
-        openssl-devel \
-        libffi-devel \
-        sqlite-devel \
-        readline-devel \
-    && curl https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz -O \
-    && tar xzf Python-${PYTHON_VERSION}.tgz \
-    && cd Python-${PYTHON_VERSION} \
-    && ./configure --enable-optimizations \
-    && make altinstall \
-    && PYTHON_MAJOR_MINOR_VERSION=$(echo $PYTHON_VERSION | cut -d. -f1,2) \
-    && ln -sf /usr/local/bin/python${PYTHON_MAJOR_MINOR_VERSION} /usr/bin/python3
-
-COPY --chown=node:node run.sh /home/node/run.sh
+COPY --chmod=755  --chown=node:node  run_other.sh  run_versions.sh  /home/node/
 
 VOLUME /home/node/.ccache
 VOLUME /out