Release static binaries only

CMakeLists.txt

@@ -31,10 +31,43 @@ execute_process(
     OUTPUT_STRIP_TRAILING_WHITESPACE
 )
 
+# for distribution purposes, we need fully static builds
+# all of our dependencies are available as static packages on Alpine Linux, which is great!
+# you can use ci/build-in-docker.sh to build release-able AppImages of this tool
+# by default, static builds are off allow for working on this tool on any distribution
+option(BUILD_STATIC OFF)
+
+if(BUILD_STATIC)
+    # since this project does not expose any libraries, we can safely set the linker flag globally
+    set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -static -static-libgcc -no-pie")
+
+    # test if compiling a simple binary works with these flags
+    unset(STATIC_BUILDS_WORKING CACHE)
+    include(CheckCSourceCompiles)
+    check_c_source_compiles("
+        int main() { return 0; }
+    " STATIC_BUILDS_WORKING)
+
+    if(NOT STATIC_BUILDS_WORKING)
+        message(FATAL_ERROR "static builds do not work on this system")
+    endif()
+endif()
+
 # required for appimagetool's signing
 # we're using CMake's pkg-config integration directly, since we want to link those statically
 find_package(PkgConfig REQUIRED)
 
+# note: the following code is a workaround (well, hack) around CMake's limited pkg-config IMPORTED_TARGET support
+# out of the box, CMake does not provide PkgConfig::<target> targets for static build variants of the libraries we use
+# we can either use this workaround, which will
+# see https://gitlab.kitware.com/cmake/cmake/-/issues/21714 for the corresponding feature request and
+# https://gitlab.kitware.com/cmake/cmake/-/issues/21714#note_1074454 for more information on the workaround
+if(BUILD_STATIC)
+    # again, since this project does not expose any libraries, we can safely set this option globally
+    set(CMAKE_FIND_LIBRARY_SUFFIXES .a)
+    list(APPEND PKG_CONFIG_EXECUTABLE "--static")
+endif()
+
 # note: the names of the targets we create with pkg_check_modules should differ from what you pass to `-l`
 # this allows us to catch problems in our own CMake setup
 # otherwise, CMake may just pass `-l<name>` if a corresponding CMake target is not found

ci/build-in-docker.sh

@@ -30,7 +30,9 @@ case "$ARCH" in
         ;;
 esac
 
-image="$image_prefix"/alpine:3.18
+# libassuan-static is supported only from 3.19 onwards
+# TODO: change this to a stable release once Alpine 3.19 was released
+image="$image_prefix"/alpine:edge
 
 repo_root="$(readlink -f "$(dirname "${BASH_SOURCE[0]}")"/..)"
 
@@ -39,10 +41,14 @@ repo_root="$(readlink -f "$(dirname "${BASH_SOURCE[0]}")"/..)"
 #   b) allow the build scripts to "mv" the binaries into the /out directory
 uid="$(id -u)"
 
+# make sure Docker image is up to date
+docker pull "$image"
+
 # mount workspace read-only, trying to make sure the build doesn't ever touch the source code files
 # of course, this only works reliably if you don't run this script from that directory
 # but it's still not the worst idea to do so
-docker run --platform "$platform" \
+docker run \
+    --platform "$platform" \
     --rm \
     -i \
     -e ARCH \
@@ -57,7 +63,12 @@ docker run --platform "$platform" \
 
 set -euxo pipefail
 
-apk add bash git gcc g++ cmake make musl-dev gpgme-dev libgcrypt-dev argp-standalone file desktop-file-utils wget zstd-dev zstd-static
+apk add bash git gcc g++ cmake make file desktop-file-utils wget \
+    gpgme-dev libgcrypt-dev libgcrypt-static argp-standalone zstd-dev zstd-static util-linux-static \
+    glib-static libassuan-static zlib-static libgpg-error-static
+
+# in a Docker container, we can safely disable this check
+git config --global --add safe.directory '*'
 
 bash -euxo pipefail /source/ci/install-static-mksquashfs.sh 4.6.1
 

ci/build.sh

@@ -22,7 +22,7 @@ old_cwd="$(readlink -f "$PWD")"
 
 pushd "$build_dir"
 
-cmake "$repo_root" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_INSTALL_PREFIX=/usr
+cmake "$repo_root" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_INSTALL_PREFIX=/usr -DBUILD_STATIC=ON
 
 if [[ "${GITHUB_ACTIONS:-}" != "" ]]; then
     jobs="$(nproc)"