fix(ci): build Linux glibc binary against an older glibc

[dubadub]

Fixes #420.

The bug

Cross.toml pinned the x86_64-unknown-linux-gnu target to the cross edge image. edge tracks cross's main branch, which is now Ubuntu 24.04 / glibc 2.39, so the released binary picked up four symbols no older distro provides:

symbol	version	source
__isoc23_strtol, __isoc23_sscanf	2.38	C deps (SQLite, aws-lc, ring) compiled by gcc 13
pidfd_spawnp, pidfd_getpid	2.39	Rust std process spawning

Debian 12 ships glibc 2.36 and is supported until 2028, so cook stopped starting there entirely:

cook: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.38' not found (required by cook)
cook: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.39' not found (required by cook)

The edge pin came from bc6f054 (Sep 2025) as a blanket change across all targets. It's harmless for the musl targets — they're statically linked — but for glibc it silently raised the runtime floor to Ubuntu 24.04, and only bit users once the upstream image drifted. This was never a deliberate decision to drop older distros.

The fix

Pin that one target to the released 0.2.5 image (Ubuntu 16.04 / glibc 2.23) and add a comment explaining why it must not follow edge. musl and freebsd are left on edge.

Verification

Ran the real cross build --release --locked --target x86_64-unknown-linux-gnu against the 0.2.5 image locally on an Intel host (clean target dir, 11m49s). Despite the image's gcc 5.4, aws-lc-sys, libsqlite3-sys and ring all compile fine.

The binary's glibc floor drops from 2.39 to 2.18. Smoke-tested cook --version in containers:

distro	glibc	result
debian:12	2.36	ok — the reported failure
debian:11	2.31	ok
ubuntu:20.04	2.31	ok
ubuntu:22.04	2.35	ok
rockylinux:9	2.34	ok

For contrast, the shipped v0.33.0 asset reproduces the report exactly on debian:12.

cargo fmt --check, cargo clippy --all-targets and cargo test all pass clean.

Notes

• This only takes effect on the next release; v0.33.0's GNU asset stays broken. Affected users can use cook-x86_64-unknown-linux-musl.tar.gz in the meantime — it's static and runs on Debian 12 today.
• cook update needs no code change, but src/update.rs:118-123 routes every non-musl Linux to the GNU asset, so affected users can't self-update out of this — they need one manual re-download once a fixed release ships.
• Worth following up with a CI guard that checks the built GNU binary's .gnu.version_r against a chosen floor, so this can't regress silently again. Not included here.

[claude]

Review

Small, well-scoped CI fix — looks good to merge.

Code quality

• The added comment block in Cross.toml is genuinely useful: it explains why this one target must not track edge, which is exactly the kind of non-obvious constraint that justifies a comment (a future contributor bumping images across the board would otherwise silently reintroduce this bug).
• Change is minimal and targeted — only the one glibc target is repinned; the musl and freebsd targets correctly stay on edge since they're statically linked and unaffected.
• Confirmed against .github/workflows/release.yaml: x86_64-unknown-linux-gnu is the only glibc (non-musl) Linux target actually built for release, so this fix covers the full affected surface — there's no aarch64-unknown-linux-gnu target left on edge that would need the same treatment.

Potential issues

• None found. This is a config-only change (image pin + comment), so there's no code-level risk of regressions elsewhere.
• One thing worth double-checking before merge: pinning to 0.2.5 freezes that image in time — if cross-rs stops publishing/maintaining the 0.2.5 tag, this could become a supply-chain/availability risk down the line. Not a blocker, just worth a mental note for future maintenance (maybe tracked alongside the CI-guard follow-up mentioned in the PR description).

Testing

• The PR description shows solid manual verification: a real cross build against the pinned image, plus smoke tests of cook --version across Debian 11/12, Ubuntu 20.04/22.04, and RockyLinux 9, confirming the glibc floor dropped from 2.39 to 2.18 and the original Debian 12 failure is fixed.
• cargo fmt --check, cargo clippy --all-targets, and cargo test are reported as passing, consistent with this repo's pre-PR checklist.
• Since this only affects the release pipeline (not exercised by cargo test), the manual container smoke-testing described is the right verification approach here — nice level of rigor for a CI-only change.

Notes

• Good call flagging in the description that v0.33.0's already-shipped asset stays broken and that cook update can't self-heal affected users (routes to the same broken GNU asset until a new release ships). Worth making sure that's communicated in the release notes for the next version.
• The suggested follow-up (CI guard checking .gnu.version_r against a floor) is a good idea to prevent silent regression — not required for this fix, but worth opening a tracking issue if one doesn't exist yet.

🤖 Generated with Claude Code