Skip to content

Comments

fix(linux): upgrade glibc from 2.28 to 2.34 - support Debian 12+, Ubuntu 22+ and RockyLinux 9+#709

Merged
Manuthor merged 17 commits intodevelopfrom
fix/upgrade-glibc-from-2-27-to-2-40
Feb 12, 2026
Merged

fix(linux): upgrade glibc from 2.28 to 2.34 - support Debian 12+, Ubuntu 22+ and RockyLinux 9+#709
Manuthor merged 17 commits intodevelopfrom
fix/upgrade-glibc-from-2-27-to-2-40

Conversation

@Manuthor
Copy link
Contributor

@Manuthor Manuthor commented Feb 10, 2026

🐛 Bug Fixes

  • Fix Linux packaging smoke tests when the host has /etc/cosmian/kms.toml present by running with an explicit temp config.
  • Make OpenTelemetry export tests resilient under FIPS Nix shells by running curl in a clean environment (avoid inherited OpenSSL/LD overrides).

⚙️ Build

  • Nix builds now target GLIBC ≤ 2.34 (Rocky Linux 9 compatibility) by updating pins and building Linux OpenSSL/server outputs against a glibc 2.34 stdenv; server vendor hash expectations are split by static/dynamic on Linux.
  • SBOM generation improvements:
    • .github/scripts/nix.sh sbom strictly validates --target/--variant/--link, defaults to generating all combinations, and supports generating a specific server subset.
    • SBOM tooling runs in an isolated workdir to avoid stray repo-root artifacts, keeps only final sbom.csv + vulns.csv reports per output directory, and deduplicates CVE rows in-place (via nix/scripts/dedup_cves.py, with optional filtering helper nix/scripts/filter_vulns.py).

@Manuthor Manuthor changed the title fix(linux): upgrade glibc from 2.28 to 2.40 - aligned to stable Debian glibc version fix(linux): upgrade glibc from 2.28 to 2.34 - aligned to stable Debian glibc version Feb 11, 2026
@Manuthor Manuthor changed the title fix(linux): upgrade glibc from 2.28 to 2.34 - aligned to stable Debian glibc version fix(linux): upgrade glibc from 2.28 to 2.34 - support Debian 12+, Ubuntu 22+ and RockyLinux 9+ Feb 12, 2026
@Manuthor Manuthor merged commit 42002c2 into develop Feb 12, 2026
245 of 246 checks passed
@Manuthor Manuthor deleted the fix/upgrade-glibc-from-2-27-to-2-40 branch February 12, 2026 19:56
p0wline pushed a commit that referenced this pull request Feb 17, 2026
…ntu 22+ and RockyLinux 9+ (#709)

* fix: upgrade glibc from 2.27 to 2.40 - stable Debian version

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* fix: split expected vendor hashes in 2 files due to glibc upgrade

* fix: downgrade glibc to 2.34 to support Rocky9, Debian12 and Ubuntu22

* test: adapt Linux distros support

* test: fix pykmip and otel

* chore: update sbom reports

* fix: remove references to glibc 2.40

* chore: update sbom reports

* docs: create changelog entry
Manuthor added a commit that referenced this pull request Feb 22, 2026
* test: add React and WASM tests

* chore: fix Nix expected hashes

* ci: fix React tests

* set up environment

* fix(linux): upgrade glibc from 2.28 to 2.34 - support Debian 12+, Ubuntu 22+ and RockyLinux 9+ (#709)

* fix: upgrade glibc from 2.27 to 2.40 - stable Debian version

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* chore: fix Nix expected hashes

* fix: split expected vendor hashes in 2 files due to glibc upgrade

* fix: downgrade glibc to 2.34 to support Rocky9, Debian12 and Ubuntu22

* test: adapt Linux distros support

* test: fix pykmip and otel

* chore: update sbom reports

* fix: remove references to glibc 2.40

* chore: update sbom reports

* docs: create changelog entry

* docs: update OpenSSL versions (#713)

* feat(ui): clear Cosmian theme and make it post-build-configurable (#704)

* feat(UI): clear Cosmian theme and make it post-build-configurable

* fix: OpenTelemetry metrics collector - nb of active keys being 0

* fix: PR review

* test: review OTEL tests

* ci: fix otel tests

* ci: still fixing OTEL tests

* ci: still fixing OTEL tests

* ci: still fixing OTEL tests

* ci: still fixing OTEL tests

* ci: still fixing OTEL tests

* fix: simplify nix.sh

* fix: still fixing nix.sh

* fix: still fixing nix.sh

* ci: adding test on branding.json update

* chore: fix Nix expected hashes

* chore: sync RPM scripts with DEB scripts

* feat: add KMIP restricting algorithms policy (#700)

* feat: add KMIP policy

* chore: fix Nix expected hashes

* build: release 5.16.0

* chore: update sbom reports

* build: release 5.16.1

* chore: fix Nix expected hashes

* remove useless code

* fix recursive revocation

* chore: fix Nix expected hashes

* ci: fix React tests

* chore: fix Nix expected hashes

* fix branding error in tests

* add integration tests

* increase time waiting for kms server

* update packages and fix eslint error

* update npm packages

* update npm packages

* fix: test wasm

* fix: test wasm

* fix: test wasm

* fix: packaging

* chore: update Nix expected hashes

* fix: audit problem

* test: regenerate package-lock.json

* fix: test wasm

* fix: npm warnings

* fix: non-FIPS deterministic build (#720)

* fix: non-FIPS deterministic build

* chore: fix Nix expected hashes

* fix: merge duplicated Nix expected hashes

* fix: remove dead Nix code

* chore: update Nix expected hash

---------

Co-authored-by: pauline ramon <pauline.hochard@protonmail.com>
Co-authored-by: Pauline <59414053+p0wline@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant