Skip to content

build(libs): publish static libraries as immutable libs-<n> releases #3481

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
datlechin merged 1 commit into from
Oct 17, 2026
Merged

build(libs): publish static libraries as immutable libs-<n> releases #3481

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .claude/rules/libs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,10 @@ paths:
- "Libs/**/*"
- "scripts/download-libs.sh"
- "scripts/publish-libs.sh"
- "scripts/publish-ios-libs.sh"
---

# Static libraries

- **`Libs/` is published only through `scripts/publish-libs.sh <rebuilt libs...>`** (and `scripts/publish-ios-libs.sh` for the iOS xcframeworks), then the updated `checksums.sha256` is committed. Never regenerate a checksum file by hand: a stale `Libs/` silently reverts other libraries.
- **`scripts/download-libs.sh` verifies every archive against the checksums**; `--force` re-downloads.
- **`Libs/` is published only through `scripts/publish-libs.sh <rebuilt .a or .xcframework...>`.** Each run creates the next immutable `libs-<n>` release and writes `Libs/release` and both `checksums.sha256` files, which are committed together. Never edit them by hand: a stale `Libs/` silently reverts other libraries.
- A published `libs-<n>` never changes; a fix is the next `<n>`. `libs-v1` stays frozen for older commits.
- **`scripts/download-libs.sh` fetches the release `Libs/release` names at `HEAD` and verifies every file against the checksums at `HEAD`** on every run; `--force` re-downloads.
1 change: 1 addition & 0 deletions .github/workflows/repo-hygiene.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ jobs:
python3 .github/scripts/test_update_registry.py
bash scripts/ci/test_create_dmg_args.sh
bash scripts/ci/test_draft_release.sh
bash scripts/ci/test_libs_release.sh

# shellcheck cannot tell a library function from a command, so a missing source is exit 127
# at release time (v0.67.1).
Expand Down
2 changes: 1 addition & 1 deletion AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@ Claude Code loads a rule when it reads or edits a file the rule covers. Under Co
| `data-grid.md` | `TablePro/Views/Results`, `TablePro/Core/DataGrid`, `TableProTests/Views/Results` |
| `data-sync-storage.md` | `TablePro/Core/**/*Storage*.swift`, `TablePro/Core/**/*Sync*.swift`, `TablePro/Core/Database`, `TablePro/Core/Plugins/PluginMetadataRegistry*.swift`, `TablePro/Core/Services/Query`, `Packages/TableProCore/Sources/TableProSyncTransport`, `CloudKit` |
| `editor.md` | `Packages/TableProEditor`, `TablePro/Theme`, `TablePro/Views/Editor`, `TablePro/Views/RowInspector` |
| `libs.md` | `Libs`, `scripts/download-libs.sh`, `scripts/publish-libs.sh`, `scripts/publish-ios-libs.sh` |
| `libs.md` | `Libs`, `scripts/download-libs.sh`, `scripts/publish-libs.sh` |
| `mongodb-driver.md` | `Plugins/MongoDBDriverPlugin`, `Plugins/MQLExportPlugin` |
| `mysql-driver.md` | `Plugins/MySQLDriverPlugin`, `Packages/TableProCore/Sources/TableProMySQLCore`, `TableProMobile/**/*MySQL*`, `TableProMobile/**/*MariaDB*` |
| `native-bridges.md` | `Native`, `Plugins/DamengDriverPlugin`, `Plugins/HanaDriverPlugin`, `scripts/build-dameng.sh`, `scripts/build-hana.sh` |
Expand Down
1 change: 1 addition & 0 deletions Libs/release
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
libs-2
6 changes: 2 additions & 4 deletions scripts/build-duckdb-ios.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,9 +197,7 @@ xcodebuild -create-xcframework \
echo
echo "Done: $OUT_DIR/DuckDB.xcframework"
echo
echo "Next steps (these modify the libs-v1 release; run them yourself):"
echo " scripts/publish-ios-libs.sh"
echo " git add Libs/ios/checksums.sha256 && git commit -m 'build: update iOS xcframework checksums'"
echo "Build TableProMobile in Xcode, then publish: scripts/publish-libs.sh DuckDB.xcframework"
echo
echo "Then build TableProMobile in Xcode. Cleaning up $WORK_DIR"
echo "Cleaning up $WORK_DIR"
rm -rf "$WORK_DIR"
11 changes: 4 additions & 7 deletions scripts/build-freetds.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,15 +22,13 @@ IOS_LIBS_DIR="$LIBS_DIR/ios"
FREETDS_VERSION="1.4.22"
FREETDS_SHA256="6acb9086350425f5178e544bbe2d54a001097e8e20277a2b766ad0799a2e7d87"
FREETDS_URL="https://www.freetds.org/files/stable/freetds-${FREETDS_VERSION}.tar.gz"
# A private directory with a cleanup trap. This was a fixed /tmp path, which is world-writable and
# therefore something another local user can own first, and it collided between two concurrent
# runs. The four mktemp dirs below were also never removed, so a run leaked all five.
# Not a fixed /tmp path: another local user could own it first, and two runs would collide.
BUILD_DIR="$(mktemp -d)"
TEMP_DIRS=("$BUILD_DIR")
cleanup_freetds() { rm -rf "${TEMP_DIRS[@]}"; }
trap cleanup_freetds EXIT

# Keeps the downloaded tarballs across runs, which the fixed build root used to provide for free.
# Outside BUILD_DIR so the downloaded tarballs survive across runs.
CACHE_DIR="${TMPDIR:-/tmp}/tablepro-freetds-cache"
mkdir -p "$CACHE_DIR"
SOURCE_DIR="$BUILD_DIR/freetds-${FREETDS_VERSION}"
Expand Down Expand Up @@ -265,6 +263,5 @@ find "$XCFRAMEWORK_OUT" -mindepth 1 -maxdepth 1 ! -name Info.plist -exec basenam
echo ""
echo "NEXT STEPS:"
echo " 1. Inspect: xcodebuild -checkFirstLaunchStatus; file ${XCFRAMEWORK_OUT}/*/libsybdb.a"
echo " 2. Publish the iOS libs and refresh their integrity baseline:"
echo " scripts/publish-ios-libs.sh"
echo " git add Libs/ios/checksums.sha256 && git commit -m 'build: update iOS xcframework checksums'"
echo " 2. Publish:"
echo " scripts/publish-libs.sh libsybdb_arm64.a libsybdb_x86_64.a libsybdb_universal.a libsybdb.a FreeTDS.xcframework"
6 changes: 1 addition & 5 deletions scripts/build-mariadb.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,16 +4,13 @@ set -eo pipefail
# Build static MariaDB Connector/C for macOS (arm64 + x86_64 + universal).
#
# Includes the mysql_clear_password client plugin (STATIC), required for AWS RDS
# IAM authentication. The previous Libs/libmariadb*.a were built without it, so
# IAM connections failed with "Plugin mysql_clear_password could not be loaded".
# IAM authentication.
#
# Output (overwrites, since Libs/*.a are not in git):
# Libs/libmariadb_arm64.a Libs/libmariadb_x86_64.a
# Libs/libmariadb_universal.a Libs/libmariadb.a (= universal)
#
# Requires: cmake, OpenSSL 3 (defaults to Homebrew openssl@3; override OPENSSL_ROOT).
# After running: regenerate Libs/checksums.sha256 and re-upload to the libs-v1
# release (see CLAUDE.md "Updating Static Libraries").
#
# Usage: ./scripts/build-mariadb.sh

Expand Down Expand Up @@ -111,4 +108,3 @@ echo ""
echo "Done. Libs/libmariadb*.a rebuilt with the cleartext plugin."
echo "Next: rebuild the app and test MySQL IAM. When confirmed working, publish the libs:"
echo " scripts/publish-libs.sh libmariadb_arm64.a libmariadb_x86_64.a libmariadb_universal.a libmariadb.a"
echo " git add Libs/checksums.sha256 && git commit -m 'build: update static library checksums'"
Loading
Loading