Dockerfile.rhel

ARG ALMA_VERSION=10
FROM almalinux:${ALMA_VERSION}

ARG ALMA_VERSION=10
ARG TARGETARCH
ARG RPM_ARCH
ARG UID=1000
ARG GID=1000

SHELL ["/bin/bash", "-c"]

RUN if [ -z "${RPM_ARCH}" ]; then \
        case "${TARGETARCH:-$(uname -m)}" in \
            arm64|aarch64) echo aarch64 > /tmp/rpm_arch ;; \
            *) echo x86_64 > /tmp/rpm_arch ;; \
        esac; \
    else echo "${RPM_ARCH}" > /tmp/rpm_arch; fi

ENV PATH=/opt/gcc/bin:${PATH}

RUN dnf -y install epel-release dnf-plugins-core && \
    if [[ "${ALMA_VERSION}" == "8" ]]; then \
        dnf config-manager --set-enabled powertools; \
    else \
        dnf config-manager --set-enabled crb; \
    fi && \
    dnf -y --allowerasing install \
        perl make rpm-build rpm-sign rpmdevtools \
        openssh rsync createrepo_c gpg \
        git jq gzip which sudo xz tar zstd curl \
        python3 python3-requests \
        bison flex autoconf automake gettext-devel libtool pkgconfig \
        gcc gcc-c++ glibc-devel zlib-devel nasm gperf

RUN if [[ "${ALMA_VERSION}" == "8" || "${ALMA_VERSION}" == "9" ]]; then \
        dnf -y install '@ruby:3.3' rubygems ruby-devel; \
    else \
        dnf -y install ruby rubygems ruby-devel; \
    fi && \
    gem install --no-document fpm

RUN if [[ "${ALMA_VERSION}" == "9" || "${ALMA_VERSION}" == "10" ]]; then \
        dnf -y install re2c; \
    else \
        dnf -y install python39 && \
        curl -L https://github.com/skvadrik/re2c/releases/download/4.3/re2c-4.3.tar.xz | tar xJ && \
        cd re2c-4.3 && ./configure && make -j"$(nproc)" && make install && cd .. && rm -rf re2c-4.3; \
    fi

RUN curl -o cmake.tar.gz -fsSL "https://github.com/Kitware/CMake/releases/download/v3.31.4/cmake-3.31.4-linux-$(uname -m).tar.gz" && \
    tar -xzf cmake.tar.gz -C /usr/local --strip-components=1 && \
    rm cmake.tar.gz

RUN --mount=type=secret,id=github_token \
    GITHUB_TOKEN="$(cat /run/secrets/github_token 2>/dev/null || true)" && \
    RPM_ARCH=$(cat /tmp/rpm_arch) && \
    curl -L "https://files.henderkes.com/${RPM_ARCH}-linux/php" -o /usr/local/bin/php && \
    chmod +x /usr/local/bin/php && \
    COMPOSER_INSTALLER_SHA=f3108f64b4e1c1ce6eb462b159956461592b3e3e && \
    if [ -n "${GITHUB_TOKEN}" ]; then \
        curl -sS -H "Authorization: Bearer ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.raw" \
            "https://api.github.com/repos/composer/getcomposer.org/contents/web/installer?ref=${COMPOSER_INSTALLER_SHA}" | php -- --quiet; \
    else \
        curl -sS "https://raw.githubusercontent.com/composer/getcomposer.org/${COMPOSER_INSTALLER_SHA}/web/installer" | php -- --quiet; \
    fi && \
    mv composer.phar /usr/bin/composer

RUN U=$(id -un 1000 2>/dev/null || echo "") && \
    if [ -z "$U" ]; then \
        groupadd -g 1000 builder && useradd -m -u 1000 -g 1000 -s /bin/bash builder && U=builder; \
    fi && \
    echo "$U ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/builder

# GCC 16 toolchain, vanilla source build into /opt/gcc against the system glibc.
# Built on el8 (oldest supported glibc), usable on all Alma versions: gcc's own binaries
# only need glibc <= 2.28, while everything it compiles links against the host distro's
# headers/crt/libc as with any native toolchain. By default a prebuilt blob is fetched
# from the toolchain release; .github/workflows/build-toolchain.yml publishes the blobs
# by passing TOOLCHAIN_URL= (empty) to force this source path.
ARG GCC_VERSION=16.2.0
# binutils is bundled into /opt/gcc and gcc is pinned to it (--with-as/--with-ld). The el8
# system assembler is 2.30, which predates the aarch64 armv9 extensions (bf16, sve2-aes,
# …) gcc 16 emits for per-target SIMD dispatch (e.g. highway in libjxl) — assembling that
# fails with "unknown architectural extension". Carrying our own binutils keeps the
# toolchain self-contained across every Alma version and arch (a gcc-toolset path can't be
# hardcoded: Alma 10 lays it out differently). Bump alongside GCC_VERSION as needed.
ARG BINUTILS_VERSION=2.44
ARG TOOLCHAIN_URL=https://github.com/static-php/packages/releases/download/toolchain-gcc-${GCC_VERSION}/gcc-${GCC_VERSION}-rhel-%ARCH%.tar.zst
RUN if [ -n "${TOOLCHAIN_URL}" ]; then \
        curl -fsSL --retry 5 "$(echo "${TOOLCHAIN_URL}" | sed "s/%ARCH%/$(uname -m)/")" | zstd -dc | tar -xf - -C /; \
    else \
        curl -fsSL --retry 5 https://ftp.gnu.org/gnu/binutils/binutils-${BINUTILS_VERSION}.tar.xz | tar -xJ -C /tmp && \
        cd /tmp/binutils-${BINUTILS_VERSION} && mkdir build && cd build && \
        ../configure --prefix=/opt/gcc --disable-multilib --disable-nls --with-system-zlib \
            --enable-plugins --enable-ld=default --disable-gprofng && \
        make -j"$(nproc)" && make install-strip && \
        cd / && rm -rf /tmp/binutils-${BINUTILS_VERSION} && \
        curl -fsSL --retry 5 https://ftp.gnu.org/gnu/gcc/gcc-${GCC_VERSION}/gcc-${GCC_VERSION}.tar.xz | tar -xJ -C /tmp && \
        cd /tmp/gcc-${GCC_VERSION} && \
        contrib/download_prerequisites && \
        mkdir build && cd build && \
        ../configure --prefix=/opt/gcc --disable-multilib --disable-bootstrap --disable-nls \
            --enable-checking=release --enable-languages=c,c++ --with-system-zlib \
            --with-as=/opt/gcc/bin/as --with-ld=/opt/gcc/bin/ld \
            --enable-default-pie --with-pkgversion="static-php GCC" && \
        make -j"$(nproc)" && \
        make install-strip && \
        cd / && rm -rf /tmp/gcc-${GCC_VERSION}; \
    fi

# libstdc++.so dev-symlink becomes a linker script INPUT(libstdc++.a) so -lstdc++ links
# gcc 16's C++ runtime statically: shipped artifacts then depend only on the system
# glibc/libgcc_s (built on the oldest glibc, so no too-new symbol versions can leak in).
# The assertions fail the image build if the toolchain regresses.
RUN for d in /opt/gcc/lib64 /opt/gcc/lib; do \
        if [ -e "$d/libstdc++.a" ]; then \
            rm -f "$d/libstdc++.so" && \
            printf 'INPUT(libstdc++.a)\n' > "$d/libstdc++.so"; \
        fi; \
    done && \
    ln -sf gcc /opt/gcc/bin/cc && \
    echo 'export PATH=/opt/gcc/bin:$PATH' > /etc/profile.d/gcc16.sh && \
    command -v gcc | grep -q /opt/gcc && \
    gcc -dumpfullversion | tee /dev/stderr | grep -qx "${GCC_VERSION}" && \
    { gcc -print-prog-name=as | grep -qx /opt/gcc/bin/as || echo "WARN: gcc not using bundled /opt/gcc/bin/as — toolchain blob predates binutils bundling; republish via build-toolchain.yml (aarch64 needs it for gcc16 SVE2/bf16)"; } && \
    echo 'int main(){return 0;}' > /tmp/cc-check.c && \
    gcc /tmp/cc-check.c -o /tmp/cc-check && /tmp/cc-check && \
    ! readelf -ld /tmp/cc-check | grep -qE 'linuxbrew|/opt/gcc' && \
    printf '#include <string>\nint main(){ return std::string("x").size() != 1; }\n' > /tmp/cxx-check.cpp && \
    g++ /tmp/cxx-check.cpp -o /tmp/cxx-check && /tmp/cxx-check && \
    ! readelf -ld /tmp/cxx-check | grep -qE 'linuxbrew|/opt/gcc|libstdc\+\+' && \
    rm -f /tmp/cc-check* /tmp/cxx-check*

# Pre-install SPC's go-xcaddy package so workflows don't redownload it.
ENV PKG_ROOT_PATH=/opt/spc-pkgroot
COPY composer.json composer.lock /tmp/spc-bootstrap/
RUN --mount=type=secret,id=github_token \
    cd /tmp/spc-bootstrap && \
    export GITHUB_TOKEN="$(cat /run/secrets/github_token 2>/dev/null || true)" && \
    export SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt && \
    mkdir -p src && \
    composer install --no-interaction --prefer-dist --no-progress --no-scripts && \
    php vendor/bin/spc install-pkg go-xcaddy && \
    SPC_TOOLCHAIN='StaticPHP\Toolchain\GccNativeToolchain' SPC_LIBC=glibc php vendor/bin/spc doctor --auto-fix --debug && \
    cp /tmp/spc-bootstrap/downloads/.cache.json "$PKG_ROOT_PATH/.cache.json" && \
    rm -rf /tmp/spc-bootstrap /root/.composer /root/.cache && \
    chown -R ${UID}:${GID} "$PKG_ROOT_PATH"

WORKDIR /build