From f24681f4cb9564f9f0dbdcd4f8af32d626f30e19 Mon Sep 17 00:00:00 2001 From: robobun <117481402+robobun@users.noreply.github.com> Date: Thu, 16 Jul 2026 06:20:38 +0000 Subject: [PATCH 1/7] Upgrade LLVM toolchain from 21.1.8 to 22.1.8 --- .github/workflows/build-preview.yml | 2 +- .github/workflows/build-reusable.yml | 8 ++++---- .github/workflows/build.yml | 4 ++-- Dockerfile | 6 +++--- Dockerfile.android | 4 ++-- Dockerfile.freebsd | 2 +- Dockerfile.macos | 8 ++++---- Dockerfile.musl | 16 ++++++++-------- Dockerfile.windows | 26 +++++++++++++------------- build.ts | 4 ++-- mac-release.bash | 4 ++-- 11 files changed, 42 insertions(+), 42 deletions(-) diff --git a/.github/workflows/build-preview.yml b/.github/workflows/build-preview.yml index 08696c1926757..13b1a949e97ff 100644 --- a/.github/workflows/build-preview.yml +++ b/.github/workflows/build-preview.yml @@ -80,7 +80,7 @@ jobs: build_ref: ${{ needs.trigger.outputs.sha }} release_tag: ${{ needs.trigger.outputs.release_tag }} is_prerelease: true - llvm_version: '19' + llvm_version: '22' notify: name: Update PR Comment diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml index 2dbb323f3a0ef..b421b21b83547 100644 --- a/.github/workflows/build-reusable.yml +++ b/.github/workflows/build-reusable.yml @@ -1,7 +1,7 @@ name: Build WebKit (Reusable) env: - LLVM_VERSION: 21 + LLVM_VERSION: 22 on: workflow_call: @@ -21,7 +21,7 @@ on: llvm_version: description: 'LLVM version to use' type: string - default: '19' + default: '22' outputs: release_tag: description: 'The release tag that was created' @@ -266,8 +266,8 @@ jobs: scoop config use_external_7zip true scoop install ninja # Install LLVM ARM64 from official LLVM releases - # Use LLVM 21 for ARM64 - has better Windows ARM64 support and fixes SEH unwind bugs - $llvmVersion = "21.1.8" + # Use LLVM 22 for ARM64 - has better Windows ARM64 support and fixes SEH unwind bugs + $llvmVersion = "22.1.8" $llvmUrl = "https://github.com/llvm/llvm-project/releases/download/llvmorg-$llvmVersion/LLVM-$llvmVersion-woa64.exe" $llvmPath = "C:\LLVM" Invoke-WebRequest -Uri $llvmUrl -OutFile "$env:TEMP\llvm-arm64.exe" diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 97a1721913f36..8a1c358f817e8 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -9,7 +9,7 @@ on: inputs: llvm_version: description: "LLVM version" - default: "19" + default: "22" jobs: build: @@ -22,4 +22,4 @@ jobs: build_ref: ${{ github.sha }} release_tag: autobuild-${{ github.sha }} is_prerelease: false - llvm_version: ${{ inputs.llvm_version || '19' }} + llvm_version: ${{ inputs.llvm_version || '22' }} diff --git a/Dockerfile b/Dockerfile index cef74738100cb..cdfaa3e50f114 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,7 @@ ARG WEBKIT_RELEASE_TYPE=Release ARG CPU=native ARG LTO_FLAG="-flto=thin -fno-split-lto-unit -fwhole-program-vtables -fforce-emit-vtables " ARG RELEASE_FLAGS="-O3 -DNDEBUG=1" -ARG LLVM_VERSION="21" +ARG LLVM_VERSION="22" ARG DEFAULT_CFLAGS="-mno-omit-leaf-frame-pointer -g -fno-omit-frame-pointer -ffunction-sections -fdata-sections -faddrsig -fno-unwind-tables -fno-asynchronous-unwind-tables -DU_STATIC_IMPLEMENTATION=1 " ARG ENABLE_SANITIZERS="" ARG USE_MIMALLOC="OFF" @@ -102,10 +102,10 @@ RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-13 130 \ --slave /usr/bin/gcc-nm gcc-nm /usr/bin/gcc-nm-13 \ --slave /usr/bin/gcc-ranlib gcc-ranlib /usr/bin/gcc-ranlib-13 -# Install LLVM 21 +# Install LLVM 22 RUN wget https://apt.llvm.org/llvm.sh \ && chmod +x llvm.sh \ - && ./llvm.sh 21 all \ + && ./llvm.sh 22 all \ && rm llvm.sh \ && rm -rf /var/lib/apt/lists/* diff --git a/Dockerfile.android b/Dockerfile.android index ab3dc3fbe0275..04914411c19f9 100644 --- a/Dockerfile.android +++ b/Dockerfile.android @@ -1,7 +1,7 @@ ARG MARCH_FLAG="-march=armv8-a+crc -mtune=cortex-a78" ARG WEBKIT_RELEASE_TYPE=Release ARG LTO_FLAG="" -ARG LLVM_VERSION="21" +ARG LLVM_VERSION="22" ARG NDK_VERSION="r27c" ARG NDK_SHA256="59c2f6dc96743b5daf5d1626684640b20a6bd2b1d85b13156b90333741bad5cc" ARG ANDROID_API="28" @@ -28,7 +28,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ # Host clang (same version Bun uses) — we cross-compile via --target/--sysroot, # not via the NDK's bundled clang. apt.llvm.org installs version-suffixed names -# only (ld.lld-21, not ld.lld), so add unversioned links for -fuse-ld=lld. +# only (ld.lld-22, not ld.lld), so add unversioned links for -fuse-ld=lld. RUN wget -qO- https://apt.llvm.org/llvm.sh | bash -s -- ${LLVM_VERSION} && \ for t in clang clang++ ld.lld lld llvm-ar llvm-ranlib; do \ ln -sf /usr/bin/${t}-${LLVM_VERSION} /usr/local/bin/${t}; \ diff --git a/Dockerfile.freebsd b/Dockerfile.freebsd index 4dd208a318f5e..ac456a1b961ad 100644 --- a/Dockerfile.freebsd +++ b/Dockerfile.freebsd @@ -1,7 +1,7 @@ ARG MARCH_FLAG="-march=nehalem" ARG WEBKIT_RELEASE_TYPE=Release ARG LTO_FLAG="" -ARG LLVM_VERSION="21" +ARG LLVM_VERSION="22" ARG FREEBSD_VERSION="14.3" ARG FREEBSD_ARCH="x86_64" ARG DEFAULT_CFLAGS="-mno-omit-leaf-frame-pointer -fno-omit-frame-pointer -ffunction-sections -fdata-sections -faddrsig -fno-unwind-tables -fno-asynchronous-unwind-tables -DU_STATIC_IMPLEMENTATION=1 " diff --git a/Dockerfile.macos b/Dockerfile.macos index dc2499ab9c666..069f1eaed32bd 100644 --- a/Dockerfile.macos +++ b/Dockerfile.macos @@ -29,7 +29,7 @@ ARG BUN_DOWNLOAD_URL="https://pub-5e11e972747a44bf9aaf9394f185a982.r2.dev/releas ARG WEBKIT_RELEASE_TYPE=Release ARG LTO_FLAG="" ARG MARCH_FLAG="-mcpu=apple-m1" -ARG LLVM_VERSION="21" +ARG LLVM_VERSION="22" ARG BOOTSTRAP_CMDS_TAG="bootstrap_cmds-138" # Matches the native macOS lane's CMAKE_C_FLAGS (build-reusable.yml) plus -g # from mac-release.bash. Cross-only additions live in the build stage. @@ -47,8 +47,8 @@ ARG ENABLE_MALLOC_HEAP_BREAKDOWN="OFF" ARG ENABLE_SANITIZERS="" ARG USE_MIMALLOC="OFF" ARG USE_EXTERNAL_MIMALLOC="OFF" -ARG COMPILER_RT_DARWIN_TAG="compiler-rt-darwin-21.1.8" -ARG COMPILER_RT_DARWIN_SHA256="f9bab8191d63873682ec69492d06cfdf0807a7335c4e9b188ef013b3cc3c9dbc" +ARG COMPILER_RT_DARWIN_TAG="compiler-rt-darwin-22.1.8" +ARG COMPILER_RT_DARWIN_SHA256="2a6cb08a41880f20f882205d567ee0676ced7db9aaeccfa2e26643d94eca23b7" FROM ubuntu:24.04 AS base SHELL ["/bin/bash", "-o", "pipefail", "-c"] @@ -113,7 +113,7 @@ ENV MACOS_SDK=/opt/MacOSX${MACOS_SDK_VERSION}.sdk # in Dockerfile). Installed into clang's resource dir where the darwin # driver looks for libclang_rt.*_osx*. ADD --checksum=sha256:${COMPILER_RT_DARWIN_SHA256} \ - https://github.com/oven-sh/WebKit/releases/download/${COMPILER_RT_DARWIN_TAG}/compiler-rt-darwin-21.1.8-arm64.tar.gz /compiler-rt-darwin.tar.gz + https://github.com/oven-sh/WebKit/releases/download/${COMPILER_RT_DARWIN_TAG}/compiler-rt-darwin-22.1.8-arm64.tar.gz /compiler-rt-darwin.tar.gz RUN tar -xzf /compiler-rt-darwin.tar.gz -C /usr/lib/llvm-${LLVM_VERSION}/lib/clang/${LLVM_VERSION}/lib/ && \ rm /compiler-rt-darwin.tar.gz && \ test -f /usr/lib/llvm-${LLVM_VERSION}/lib/clang/${LLVM_VERSION}/lib/darwin/libclang_rt.asan_osx_dynamic.dylib diff --git a/Dockerfile.musl b/Dockerfile.musl index 5b064cb5bfdae..eeeab9a737054 100644 --- a/Dockerfile.musl +++ b/Dockerfile.musl @@ -2,12 +2,12 @@ ARG MARCH_FLAG="" ARG WEBKIT_RELEASE_TYPE=Release ARG CPU=native ARG LTO_FLAG="-flto=thin -fno-split-lto-unit -fwhole-program-vtables -fforce-emit-vtables " -ARG LLVM_VERSION="21" +ARG LLVM_VERSION="22" ARG DEFAULT_CFLAGS="-mno-omit-leaf-frame-pointer -g -fno-omit-frame-pointer -ffunction-sections -fdata-sections -faddrsig -fno-unwind-tables -fno-asynchronous-unwind-tables -DU_STATIC_IMPLEMENTATION=1 " ARG USE_MIMALLOC="OFF" ARG USE_EXTERNAL_MIMALLOC="OFF" -FROM alpine:3.23 as base +FROM alpine:3.24 as base ARG MARCH_FLAG ARG WEBKIT_RELEASE_TYPE @@ -17,13 +17,13 @@ ARG LLVM_VERSION ARG DEFAULT_CFLAGS RUN apk update -RUN apk add --no-cache cmake make clang21 clang21-static clang21-dev llvm21-dev llvm21-static musl-dev git lld libgcc gcc g++ libstdc++ build-base lld-dev llvm21-libs libc-dev xz zlib zlib-dev libxml2 libxml2-dev +RUN apk add --no-cache cmake make clang22 clang22-static clang22-dev llvm22-dev llvm22-static musl-dev git lld libgcc gcc g++ libstdc++ build-base lld-dev llvm22-libs libc-dev xz zlib zlib-dev libxml2 libxml2-dev -ENV CXX=clang++-21 -ENV CC=clang-21 -ENV LDFLAGS='-L/usr/include -L/usr/include/llvm21' -ENV CXXFLAGS="-I/usr/include -I/usr/include/llvm21" -ENV PATH="/usr/bin:/usr/local/bin:/zig/bin:/usr/lib/llvm21/bin:$PATH" +ENV CXX=clang++-22 +ENV CC=clang-22 +ENV LDFLAGS='-L/usr/include -L/usr/include/llvm22' +ENV CXXFLAGS="-I/usr/include -I/usr/include/llvm22" +ENV PATH="/usr/bin:/usr/local/bin:/zig/bin:/usr/lib/llvm22/bin:$PATH" ENV CPU=${CPU} ENV MARCH_FLAG=${MARCH_FLAG} ENV WEBKIT_OUT_DIR=/webkitbuild diff --git a/Dockerfile.windows b/Dockerfile.windows index 8a69622f38f20..7e6a43587874d 100644 --- a/Dockerfile.windows +++ b/Dockerfile.windows @@ -34,7 +34,7 @@ ARG ICU_MARCH_FLAG="-march=nehalem" ARG ENABLE_SANITIZERS="" ARG USE_MIMALLOC="OFF" ARG USE_EXTERNAL_MIMALLOC="OFF" -ARG LLVM_VERSION="21" +ARG LLVM_VERSION="22" ARG XWIN_VERSION="0.9.0" ARG XWIN_SHA256="31e1033f30608ba6b821d17f1461042bd54c23424813c9b4e9ae15b6d32fa4cd" # Pinned MSVC CRT + Windows SDK versions. Bump deliberately; the manifest on @@ -125,10 +125,10 @@ RUN set -e; \ # 2.0 with LLVM exceptions; redistribution is permitted. # OptionsMSVC.cmake's find_library(CLANG_BUILTINS_LIBRARY) searches # WebKitLibraries/windows, which is symlinked to /winsdk in the build stage. -ADD --checksum=sha256:9cff03d2c5218693b1f91efc0074957c710eeddd932d57a681c8f558b81fbe8e \ - https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-21.1.8/clang_rt.builtins-x86_64.lib /winsdk/clang_rt.builtins-x86_64.lib -ADD --checksum=sha256:b1bfec6276dde6166aa038de10c378ec17996779786fe1747c40b833cb826e16 \ - https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-21.1.8/clang_rt.builtins-aarch64.lib /winsdk/clang_rt.builtins-aarch64.lib +ADD --checksum=sha256:22fb8699144ab076d5e331b3deb804e591c43905ec7e0fa5c62ba28f8679d68b \ + https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-22.1.8/clang_rt.builtins-x86_64.lib /winsdk/clang_rt.builtins-x86_64.lib +ADD --checksum=sha256:06a345ec83e1f19b62442ef6b615ea742effd2593581692fd15d38a10847f5bf \ + https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-22.1.8/clang_rt.builtins-aarch64.lib /winsdk/clang_rt.builtins-aarch64.lib # Windows ASAN/UBSan runtime for the -asan variant, mirrored from the same # LLVM release as the builtins above (x64 only: LLVM ships no Windows ARM64 @@ -139,14 +139,14 @@ ADD --checksum=sha256:b1bfec6276dde6166aa038de10c378ec17996779786fe1747c40b833cb # UBSan handlers, so -fsanitize=address,undefined needs no separate # ubsan_standalone libraries. A Linux LLVM install doesn't ship any of these; # WebKitCompilerFlags.cmake locates them via CLANG_LIB_PATH (set below). -ADD --checksum=sha256:3dff47943143ab2c1a786a7c90c88f897bfa34e8b5a4c9382eadf8373fd19ec0 \ - https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-21.1.8/clang_rt.asan_dynamic-x86_64.lib /winsdk/clang_rt.asan_dynamic-x86_64.lib -ADD --checksum=sha256:d4a0398ed7d2e1361674fbb2cfceec4df502052cfe17b51718b061e9fe523719 \ - https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-21.1.8/clang_rt.asan_static_runtime_thunk-x86_64.lib /winsdk/clang_rt.asan_static_runtime_thunk-x86_64.lib -ADD --checksum=sha256:b3c1d6c988792651cc0b0b61b4114cbe513a5e2f6beb067fd54a96b98be9b328 \ - https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-21.1.8/clang_rt.asan_dynamic_runtime_thunk-x86_64.lib /winsdk/clang_rt.asan_dynamic_runtime_thunk-x86_64.lib -ADD --checksum=sha256:14025e779d3c67c53027312d7542aea8f814e5237e59f41cfc6165666189f886 \ - https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-21.1.8/clang_rt.asan_dynamic-x86_64.dll /winsdk/clang_rt.asan_dynamic-x86_64.dll +ADD --checksum=sha256:208ff221af5dff61be90398b1e569d1b2f3b5335066c5c87444454920c3eadb6 \ + https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-22.1.8/clang_rt.asan_dynamic-x86_64.lib /winsdk/clang_rt.asan_dynamic-x86_64.lib +ADD --checksum=sha256:e9571b2c165e1c74475e887858ad344769bb2613547bb91cfe3ada44d378f7bb \ + https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-22.1.8/clang_rt.asan_static_runtime_thunk-x86_64.lib /winsdk/clang_rt.asan_static_runtime_thunk-x86_64.lib +ADD --checksum=sha256:ec97ba766ff24271f7848393601fe5f3eb0c95c3c6cbedfd0913434e425c9096 \ + https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-22.1.8/clang_rt.asan_dynamic_runtime_thunk-x86_64.lib /winsdk/clang_rt.asan_dynamic_runtime_thunk-x86_64.lib +ADD --checksum=sha256:273d06d96cf390f551b2e0ac36de3a82cf2150271ffc1f5f8b13588ee0df7482 \ + https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-22.1.8/clang_rt.asan_dynamic-x86_64.dll /winsdk/clang_rt.asan_dynamic-x86_64.dll # Sanity check: compile + link a PE executable for both arches. RUN for pair in "x86_64 x64" "aarch64 arm64"; do \ diff --git a/build.ts b/build.ts index bea9f80682085..f316b35ce71e4 100755 --- a/build.ts +++ b/build.ts @@ -78,10 +78,10 @@ const HAS_CCACHE = CCACHE !== null; // On Windows, use clang-cl for MSVC compatibility const CC_BASE = IS_WINDOWS ? findExecutable(["clang-cl.exe", "clang-cl"]) || "clang-cl" - : findExecutable(["clang-21", "clang"]) || "clang"; + : findExecutable(["clang-22", "clang"]) || "clang"; const CXX_BASE = IS_WINDOWS ? findExecutable(["clang-cl.exe", "clang-cl"]) || "clang-cl" - : findExecutable(["clang++-21", "clang++"]) || "clang++"; + : findExecutable(["clang++-22", "clang++"]) || "clang++"; const CC = HAS_CCACHE ? CCACHE : CC_BASE; const CXX = HAS_CCACHE ? CCACHE : CXX_BASE; diff --git a/mac-release.bash b/mac-release.bash index e4d0f5998bc81..9821b4880485c 100755 --- a/mac-release.bash +++ b/mac-release.bash @@ -9,8 +9,8 @@ set -euxo pipefail THIS_DIR=$(pwd) # Set default values for environment variables that are not set. -CMAKE_C_COMPILER=${CMAKE_C_COMPILER:-clang-21} -CMAKE_CXX_COMPILER=${CMAKE_CXX_COMPILER:-clang++-21} +CMAKE_C_COMPILER=${CMAKE_C_COMPILER:-clang-22} +CMAKE_CXX_COMPILER=${CMAKE_CXX_COMPILER:-clang++-22} CMAKE_C_FLAGS=${CMAKE_C_FLAGS:-} CMAKE_CXX_FLAGS=${CMAKE_CXX_FLAGS:-} CMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE:-Release} From 418804c0a05d9c9f66b7a3c0ac630253c85d210c Mon Sep 17 00:00:00 2001 From: robobun <117481402+robobun@users.noreply.github.com> Date: Thu, 16 Jul 2026 06:35:36 +0000 Subject: [PATCH 2/7] build-reusable: set fail-fast: false on every matrix One arm64 job's transient ports.ubuntu.com connection failure was cancelling all 12 Linux variants. windows-cross already had this; apply it to linux, linux-musl, macos-cross, freebsd, and linux-android too. --- .github/workflows/build-reusable.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml index b421b21b83547..3f671911c79dc 100644 --- a/.github/workflows/build-reusable.yml +++ b/.github/workflows/build-reusable.yml @@ -32,6 +32,8 @@ jobs: name: Linux runs-on: ${{matrix.os}} strategy: + # One variant's failure shouldn't cancel the others. + fail-fast: false matrix: include: - lto_flag: "" @@ -305,6 +307,8 @@ jobs: name: Linux musl runs-on: ${{matrix.os}} strategy: + # One variant's failure shouldn't cancel the others. + fail-fast: false matrix: include: - lto_flag: "" @@ -390,6 +394,8 @@ jobs: # mac-release.bash remains for building on a real Mac locally. runs-on: linux-x64-gh strategy: + # One variant's failure shouldn't cancel the others. + fail-fast: false matrix: include: - label: bun-webkit-macos-arm64 @@ -484,6 +490,8 @@ jobs: # so all FreeBSD targets build on x64 regardless of target arch. runs-on: linux-x64-gh strategy: + # One variant's failure shouldn't cancel the others. + fail-fast: false matrix: include: - label: bun-webkit-freebsd-amd64 @@ -541,6 +549,8 @@ jobs: # cross-compile from x64 regardless of target arch. runs-on: linux-x64-gh strategy: + # One variant's failure shouldn't cancel the others. + fail-fast: false matrix: include: - label: bun-webkit-linux-arm64-android From f63d3dacc57525fdb7b2faafd094273933371266 Mon Sep 17 00:00:00 2001 From: robobun <117481402+robobun@users.noreply.github.com> Date: Thu, 16 Jul 2026 06:59:53 +0000 Subject: [PATCH 3/7] Dockerfile: retry apt update+install when ports.ubuntu.com drops an index apt-get update exits 0 with only a W: warning when an InRelease fetch fails, so the azure->archive fallback never fired and the subsequent install died with 'no installation candidate'. arm64 (ports.ubuntu.com) hit this on two consecutive runs. Add Acquire::Retries and wrap the update+install in a 3-attempt loop, then verify with dpkg -l. --- Dockerfile | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index cdfaa3e50f114..80dd395779e8b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -33,13 +33,18 @@ ENV DEBIAN_FRONTEND=noninteractive # timed out from inside the GitHub-hosted docker-buildx network at different # times. Prefer Azure (faster on Azure-hosted runners) but fall back to the # canonical mirror if `apt-get update` can't reach it. arm64 uses -# ports.ubuntu.com which has been reachable, so leave it alone. -RUN sed -i 's|http://archive.ubuntu.com/ubuntu|http://azure.archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list +# ports.ubuntu.com (no Azure mirror), so rely on Acquire::Retries there. +RUN sed -i 's|http://archive.ubuntu.com/ubuntu|http://azure.archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list \ + && echo 'Acquire::Retries "5";' > /etc/apt/apt.conf.d/99-retries -# Install basic build dependencies -RUN ( apt-get update || \ - ( sed -i 's|http://azure.archive.ubuntu.com/ubuntu|http://archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list && apt-get update ) \ - ) && apt-get install -y \ +# Install basic build dependencies. `apt-get update` exits 0 on partial index +# fetch failure (only W:, not E:), which then makes the install fail with +# "no installation candidate" — so retry the whole update+install once if the +# install step is what fails. +RUN for attempt in 1 2 3; do \ + ( apt-get update || \ + ( sed -i 's|http://azure.archive.ubuntu.com/ubuntu|http://archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list && apt-get update ) \ + ) && apt-get install -y \ wget \ curl \ git \ @@ -52,6 +57,9 @@ RUN ( apt-get update || \ ca-certificates \ gnupg \ lsb-release \ + && break || { echo "apt attempt $attempt failed, retrying"; sleep 15; }; \ + done \ + && dpkg -l wget curl git python3 ninja-build lsb-release >/dev/null \ && rm -rf /var/lib/apt/lists/* # Install zstd (for icu/compress-data.ts). Pinned: focal's apt has 1.4.4 which From 8c35fe757a34a3f611146deea5dcb6e1356b9373 Mon Sep 17 00:00:00 2001 From: robobun <117481402+robobun@users.noreply.github.com> Date: Thu, 16 Jul 2026 07:29:48 +0000 Subject: [PATCH 4/7] Dockerfile: fall back to an ubuntu-ports mirror when ports.ubuntu.com is down ports.ubuntu.com (the only canonical arm64 archive) went fully dark for 10+ minutes during this PR's CI, defeating the 3-attempt retry loop. On a failed attempt, swap arm64 to mirrors.ocf.berkeley.edu/ubuntu-ports (Launchpad-registered) the same way amd64 already swaps azure->archive. --- Dockerfile | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/Dockerfile b/Dockerfile index 80dd395779e8b..28679352e0fee 100644 --- a/Dockerfile +++ b/Dockerfile @@ -31,20 +31,20 @@ ENV DEBIAN_FRONTEND=noninteractive # Both archive.ubuntu.com and azure.archive.ubuntu.com have intermittently # timed out from inside the GitHub-hosted docker-buildx network at different -# times. Prefer Azure (faster on Azure-hosted runners) but fall back to the -# canonical mirror if `apt-get update` can't reach it. arm64 uses -# ports.ubuntu.com (no Azure mirror), so rely on Acquire::Retries there. +# times, and ports.ubuntu.com (arm64) has gone fully dark for hours at a +# stretch. Prefer Azure on amd64 (faster on Azure-hosted runners). On any +# failed attempt, swap to a fallback mirror before retrying: amd64 falls back +# to the canonical archive, arm64 falls back to a Launchpad-registered +# ubuntu-ports mirror. RUN sed -i 's|http://archive.ubuntu.com/ubuntu|http://azure.archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list \ && echo 'Acquire::Retries "5";' > /etc/apt/apt.conf.d/99-retries # Install basic build dependencies. `apt-get update` exits 0 on partial index # fetch failure (only W:, not E:), which then makes the install fail with -# "no installation candidate" — so retry the whole update+install once if the -# install step is what fails. +# "no installation candidate" — so retry the whole update+install, swapping +# to a fallback mirror after the first failure. RUN for attempt in 1 2 3; do \ - ( apt-get update || \ - ( sed -i 's|http://azure.archive.ubuntu.com/ubuntu|http://archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list && apt-get update ) \ - ) && apt-get install -y \ + apt-get update && apt-get install -y \ wget \ curl \ git \ @@ -57,7 +57,13 @@ RUN for attempt in 1 2 3; do \ ca-certificates \ gnupg \ lsb-release \ - && break || { echo "apt attempt $attempt failed, retrying"; sleep 15; }; \ + && break || { \ + echo "apt attempt $attempt failed, swapping mirrors and retrying"; \ + sed -i -e 's|http://azure.archive.ubuntu.com/ubuntu|http://archive.ubuntu.com/ubuntu|g' \ + -e 's|http://ports.ubuntu.com/ubuntu-ports|http://mirrors.ocf.berkeley.edu/ubuntu-ports|g' \ + /etc/apt/sources.list; \ + sleep 15; \ + }; \ done \ && dpkg -l wget curl git python3 ninja-build lsb-release >/dev/null \ && rm -rf /var/lib/apt/lists/* From 6a95844c17a33510fb10223eccf10294c66f12cb Mon Sep 17 00:00:00 2001 From: robobun <117481402+robobun@users.noreply.github.com> Date: Thu, 16 Jul 2026 08:53:41 +0000 Subject: [PATCH 5/7] Dockerfile: install LLVM 22 arm64 from the bullseye apt.llvm.org repo apt.llvm.org's llvm-toolchain-focal-22 has no arm64 binaries (only the Architecture:all doc/example packages). llvm-toolchain-bullseye-22 has the full arm64 set and is built against glibc 2.31 (same as focal), so the binaries run on ubuntu:20.04. The bullseye clang-22 package declares Depends on Debian's libstdc++-10-dev/libgcc-10-dev/libobjc-10-dev; those are stubbed with equivs since we use gcc-13's libstdc++ via the PPA and set its include paths explicitly. amd64 keeps using llvm.sh against focal unchanged. --- Dockerfile | 35 ++++++++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index 28679352e0fee..f07103d9b9a11 100644 --- a/Dockerfile +++ b/Dockerfile @@ -116,11 +116,36 @@ RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-13 130 \ --slave /usr/bin/gcc-nm gcc-nm /usr/bin/gcc-nm-13 \ --slave /usr/bin/gcc-ranlib gcc-ranlib /usr/bin/gcc-ranlib-13 -# Install LLVM 22 -RUN wget https://apt.llvm.org/llvm.sh \ - && chmod +x llvm.sh \ - && ./llvm.sh 22 all \ - && rm llvm.sh \ +# Install LLVM 22. +# +# apt.llvm.org stopped publishing focal arm64 binaries for the 22 release +# (llvm-toolchain-focal-22/main/binary-arm64 carries only the Architecture:all +# -doc/-examples packages). The bullseye repo still has the full arm64 set and +# is built against glibc 2.31 (same as focal), so on arm64 we pull from there +# instead. The bullseye clang-22 package declares Depends on Debian's +# libstdc++-10-dev/libgcc-10-dev/libobjc-10-dev, which focal doesn't name that +# way (we use gcc-13's libstdc++ via the PPA and set its include paths below), +# so those three are satisfied with equivs dummies before the install. +RUN wget -qO /etc/apt/trusted.gpg.d/apt.llvm.org.asc https://apt.llvm.org/llvm-snapshot.gpg.key \ + && if [ "$TARGETARCH" = "arm64" ]; then \ + echo "deb https://apt.llvm.org/bullseye/ llvm-toolchain-bullseye-22 main" > /etc/apt/sources.list.d/llvm.list \ + && apt-get update \ + && apt-get install -y --no-install-recommends equivs \ + && for p in libstdc++-10-dev libgcc-10-dev libobjc-10-dev; do \ + printf 'Section: misc\nPriority: optional\nStandards-Version: 3.9.2\nPackage: %s\nVersion: 99\nDescription: dummy for bullseye clang-22 dep\n' "$p" > /tmp/$p.ctl \ + && (cd /tmp && equivs-build $p.ctl && dpkg -i ${p}_99_all.deb && rm -f $p.ctl ${p}_99_all.deb); \ + done \ + && apt-get install -y --no-install-recommends \ + clang-22 lld-22 llvm-22 llvm-22-dev llvm-22-tools llvm-22-runtime \ + llvm-22-linker-tools libllvm22 libclang-cpp22 libclang1-22 \ + libclang-common-22-dev libclang-rt-22-dev liblld-22 clangd-22 lldb-22; \ + else \ + wget https://apt.llvm.org/llvm.sh \ + && chmod +x llvm.sh \ + && ./llvm.sh 22 all \ + && rm llvm.sh; \ + fi \ + && clang-22 --version \ && rm -rf /var/lib/apt/lists/* # Configure library paths From 9ca63a2bfc4854dabc02e7c1a637c07813aa16f6 Mon Sep 17 00:00:00 2001 From: Jarred Sumner Date: Thu, 16 Jul 2026 20:46:44 -0700 Subject: [PATCH 6/7] Dockerfile: install bullseye libz3 and drop lldb-22 on arm64 The bullseye clang-22 packages don't install on the focal base: libllvm22 : Depends: libz3-4 (>= 4.8.10) but 4.8.7-4build1 is to be installed lldb-22 : Depends: python3-lldb-22 but it is not going to be installed focal only ships libz3 4.8.7, and llvm-22-dev additionally wants the matching libz3-dev. equivs dummies don't work for z3 the way they do for libstdc++-10-dev: libz3.so.4 is a real DT_NEEDED of libLLVM, so a dummy would leave clang-22 unable to start. Install the two bullseye .debs directly, SHA-256-pinned, instead of adding deb.debian.org as an apt source, so apt can't pull any other Debian package into the image -- in particular a libc6/libstdc++6 that would move the glibc floor. Both only declare libc6 (>= 2.30) / libstdc++6 (>= 9), which focal already satisfies. python3-lldb-22 needs python3 (>= 3.9~) (<< 3.10) and focal ships 3.8, so lldb can't be installed here without pulling in Debian's python3 stack. Nothing in the build uses lldb, so arm64 omits it. Verified on a native arm64 focal container with the real gcc-13 debs: clang-22 22.1.8 installs and runs, libc6 stays at 2.31-0ubuntu9.18, and a clang++-22 -stdlib=libstdc++ binary still tops out at GLIBC_2.17. --- Dockerfile | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index f07103d9b9a11..1c4459968da1f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -126,6 +126,27 @@ RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-13 130 \ # libstdc++-10-dev/libgcc-10-dev/libobjc-10-dev, which focal doesn't name that # way (we use gcc-13's libstdc++ via the PPA and set its include paths below), # so those three are satisfied with equivs dummies before the install. +# +# Two more bullseye-vs-focal gaps have to be closed on arm64: +# +# libz3: bullseye's libllvm22 needs libz3-4 (>= 4.8.10) and llvm-22-dev needs +# the matching libz3-dev; focal only has 4.8.7. equivs can't paper over this +# one -- libz3.so.4 is a real DT_NEEDED of libLLVM, so a dummy would make +# clang-22 fail to start. The two bullseye .debs are installed directly, +# SHA-256-pinned, rather than by adding deb.debian.org as an apt source: it +# keeps apt from pulling any other Debian package into the image, in +# particular a libc6/libstdc++6 that would move the glibc floor. Both only +# declare libc6 (>= 2.30) / libstdc++6 (>= 9), which focal already satisfies, +# so the floor stays where the base image puts it (verified: libc6 stays at +# 2.31 and a clang++-22 -stdlib=libstdc++ binary still tops out at GLIBC_2.17). +# +# lldb-22: pulls python3-lldb-22, which Depends: python3 (>= 3.9~) (<< 3.10). +# focal ships python3.8, so it is not installable here and would need Debian's +# whole python3 stack. Nothing in the build uses lldb, so arm64 omits it; the +# /usr/bin/lldb symlink below is left dangling, which is harmless. +ARG LIBZ3_VERSION=4.8.10-1 +ARG LIBZ3_SHA256_arm64=ae1ea58ecfdd4b5ec53d734e60ac2df37fddb11888b7730a19335f1a9b09f489 +ARG LIBZ3_DEV_SHA256_arm64=4739e62c1f39c35f2382f15347b588245a71bd12c8628a8caa6639fdc1774b6c RUN wget -qO /etc/apt/trusted.gpg.d/apt.llvm.org.asc https://apt.llvm.org/llvm-snapshot.gpg.key \ && if [ "$TARGETARCH" = "arm64" ]; then \ echo "deb https://apt.llvm.org/bullseye/ llvm-toolchain-bullseye-22 main" > /etc/apt/sources.list.d/llvm.list \ @@ -135,10 +156,18 @@ RUN wget -qO /etc/apt/trusted.gpg.d/apt.llvm.org.asc https://apt.llvm.org/llvm-s printf 'Section: misc\nPriority: optional\nStandards-Version: 3.9.2\nPackage: %s\nVersion: 99\nDescription: dummy for bullseye clang-22 dep\n' "$p" > /tmp/$p.ctl \ && (cd /tmp && equivs-build $p.ctl && dpkg -i ${p}_99_all.deb && rm -f $p.ctl ${p}_99_all.deb); \ done \ + && curl -fsSL --retry 5 --retry-connrefused \ + "http://deb.debian.org/debian/pool/main/z/z3/libz3-4_${LIBZ3_VERSION}_arm64.deb" -o /tmp/libz3-4.deb \ + && curl -fsSL --retry 5 --retry-connrefused \ + "http://deb.debian.org/debian/pool/main/z/z3/libz3-dev_${LIBZ3_VERSION}_arm64.deb" -o /tmp/libz3-dev.deb \ + && echo "${LIBZ3_SHA256_arm64} /tmp/libz3-4.deb" | sha256sum -c - \ + && echo "${LIBZ3_DEV_SHA256_arm64} /tmp/libz3-dev.deb" | sha256sum -c - \ + && dpkg -i /tmp/libz3-4.deb /tmp/libz3-dev.deb \ + && rm -f /tmp/libz3-4.deb /tmp/libz3-dev.deb \ && apt-get install -y --no-install-recommends \ clang-22 lld-22 llvm-22 llvm-22-dev llvm-22-tools llvm-22-runtime \ llvm-22-linker-tools libllvm22 libclang-cpp22 libclang1-22 \ - libclang-common-22-dev libclang-rt-22-dev liblld-22 clangd-22 lldb-22; \ + libclang-common-22-dev libclang-rt-22-dev liblld-22 clangd-22; \ else \ wget https://apt.llvm.org/llvm.sh \ && chmod +x llvm.sh \ From 6144f5107a087ba20755866bf0ea2e390afb6a30 Mon Sep 17 00:00:00 2001 From: robobun <117481402+robobun@users.noreply.github.com> Date: Mon, 20 Jul 2026 22:01:41 +0000 Subject: [PATCH 7/7] Dockerfile.musl: pull clang22/llvm22/lld22 from edge to get 22.1.8 alpine 3.24's main repo has clang22/llvm22/lld22 at 22.1.3; edge has 22.1.8. Tag the edge main repo and pull only the LLVM packages from it (musl is 1.2.6-r2 in both, so edge's binaries run on the 3.24 base). Everything else stays on 3.24 stable. --- Dockerfile.musl | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/Dockerfile.musl b/Dockerfile.musl index eeeab9a737054..4eeac1dcd8a1a 100644 --- a/Dockerfile.musl +++ b/Dockerfile.musl @@ -16,8 +16,13 @@ ARG LTO_FLAG ARG LLVM_VERSION ARG DEFAULT_CFLAGS +# alpine 3.24 ships clang22/llvm22/lld22 at 22.1.3; edge has 22.1.8. Tag the +# edge repo so only the llvm packages come from there (musl is the same +# version in both, so edge's binaries run on 3.24). Everything else stays on +# 3.24 stable. +RUN echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/main" >> /etc/apk/repositories RUN apk update -RUN apk add --no-cache cmake make clang22 clang22-static clang22-dev llvm22-dev llvm22-static musl-dev git lld libgcc gcc g++ libstdc++ build-base lld-dev llvm22-libs libc-dev xz zlib zlib-dev libxml2 libxml2-dev +RUN apk add --no-cache cmake make clang22@edge clang22-static@edge clang22-dev@edge llvm22-dev@edge llvm22-static@edge lld22@edge lld22-dev@edge llvm22-libs@edge musl-dev git libgcc gcc g++ libstdc++ build-base libc-dev xz zlib zlib-dev libxml2 libxml2-dev ENV CXX=clang++-22 ENV CC=clang-22